Stupid security

There's an awful lot of it, and sometimes security that tries to be smart ends up being dumb. From Ars Technica:

Follow-up questions revealed that the students seemed to find any dialog box a distraction from their assigned task; nearly half said that all they cared about was getting rid of these dialogs. The results suggest that a familiarity with Windows dialogs have bred a degree of contempt and that users simply don't care what the boxes say anymore.

Well, yeah. Especially when they get security popups like this:

"The instruction at '0x77f41d24 referenced memory at '0x595c2a4c.' The memory could not be 'read.' Click OK to terminate program."

What the heck does this mean? So what folks think is "I remember that time I clicked 'No' and my browser wouldn't run any more. I think I'll click 'Yes'". Even the article, written by security geeks for security geeks, recognizes this. They have a popup that might be an improvement:


This is actually not a bad idea, although it does way too much hand-waving on "Malware is BAD, mkay?" An improvement is to capture information about what an expert would do, sort of like this:

"The instruction at '0x77f41d24 referenced memory at '0x595c2a4c.' The memory could not be 'read.' Ted at Borepatch thinks that this is no big deal. Do you want to do what he did, or something else?"

Actually, if you replace "Ted at Borepatch" with "Best Buy's Geek Squad", this might work pretty well, as long as you don't overwhelm the user with security popups, like Vista:



Slashdot has a really misleading title ("Popup Study Confirms Most Users Are Idiots"), but the comments in the post thrash the headline within an inch of its life. Good to see the big tech egos at Slashdot not throwing typical users under the security bus.