Slashdot Mirror
Safe Computing For the Elderly?
wingspan asks: "My 80-year old mother is insisting on using this new fangled thing called the Internet for banking and brokerage. I researched ways for her to perform those activities safely. The typical suggestions, from organizations such as BITS [pdf], include installing anti-virus, anti-spyware, anti-spam, anti-adware, browser toolbar, and a personal firewall. The suggestions also include not clicking on links, verifying security certificates (If it has a cert, it must be a good site!), making sure the address begins with 'https://' regularly updating the security software and patching all other software, and regularly changing passwords. Personally, I think the technical suggestions are too Windows-centric, too costly, and leave too much of an attack surface. The non-technical suggestions are simply too much to ask of the elderly. What do you think? Is it possible for an elderly person to safely perform Internet banking and brokerage? If so, what system should they have, how should it be configured and maintained, and how much of the security should depend with the elderly user?"
Since she isnt gonna install applications but only browse the Internet, she doesnt need to understand how her OS works. So i would say go for a Ubuntu with icons to the few programs she will use on the desktop (Browser, Mail client, Text editor). Once this is done, you re safe from every threat except phising. As someone else said before you will have to teach her about the danger of links in e-mail, and that they shouldn t trust their email.
> A rather elitist and patronizing view of the elderly.
> Author needs to be whacked with a cane.
As you get older you lose your mental faculties. That's not patronizing - it's what happens. Eventually - if you live long enough - you'll start to make bad decisions. It doesn't happen, or we shouldn't talk about it?
Getting back on topic, I guess you could provide a shortcut to a browser with no address bar, pointing to a homepage which is a local html file with links to the banking (etc) sites so that there's no ability to be phished into typing the wrong address. Email could be set up with a whitelist of friends - all other email being dumped. Email filters could additionally dump emails containing any URL/some pretty broad set of words ("banking", "log in", "logon" etc). You could subscribe to a service, such as Gmail, that does anti-phishing by default.
I actually think there is some sense in introducing someone who hasn't used a computer before to Linux. With Windows, especially on an OEM machine full of crapware, the user is constantly bombarded with popups and warnings. This was too much for my girlfriend's elderly grandma to handle. She had no clue what these things meant and didn't know how to react to them. On the command line, on the other hand, nothing happens unless you type something and hit return. It might be cryptic, but you're in control, and you are forced to pro-actively learn what you are doing, instead of simply reacting to the stuff the computer throws at you. If your mind is not used to GUIs then the command line is simple: type a command and the computer does something.
The perfect sig is a lot like silence, only louder
"As you get older you lose your mental faculties. That's not patronizing - it's what happens."
Sometimes true, however I once had opportunity over several weeks to play a Monk in his late eighties at chess, a game at which I have some talent. I've never been so completelly destroyed in chess so many times in a row, his abilities were fearsome.
Yet he seemed absent minded, it was all very puzzling.
Chess skill is largely a basis of pattern recognition and experience, prodigies aside. One can be brilliant at chess by sheer dint of having played thousands and thousands of games and be mediocre at everything else in life. Adrian de Groot famously [in the chess world, at least] found that Grandmasters are far better than amateurs at memorizing real gameplay positions on a board, but are just as poor as amateurs with nonsense positions [three white bishops all on black squares, kings adjacent, general random piece placement]. This has led heavily to the adoption of the 'pattern recognition' mode of thought.
Your monk, then, may have just been very, very, experienced, in spite of his old age, and thus fearsome. Hell, look at Viktor Kortchnoi.
That said, though, I absolutely believe there are some very, very, sharp elderly men and women out there. As well as some very, very, strong ones, to dispel another myth. The key is using what you have -- intelligence, strength -- and never giving it a chance to slip into senility.
Perhaps life really is full of possibilities.
interesting stuff.
The Monk in question had been left at the monestary as a baby and raised there. Chess was, and remains, a major entertainment in that monestary. We're probably talking over 70 years of constant chess playing.
What struck me as odd at the time was that I didn't seem to be able to come up with a single long term strategy that he didn't block several moves before I got to a checkmate. I got a few checks, but usually before I realised something horrible was happening elsewhere on the board.
They're not children. It's new (but not necessary), they've a life time of perspective on the merits of caution, and the perils of reckless ignorance. My grandparents got a computer for Christmas a few years back, I do the tech support. You know what the majority of my calls were? "No, really it's ok. It's nearly impossible for you to screw it up so bad I can't fix it easily." Now there more of a focused nature about doing specific tasks. They're almost 80, grandpa installed his own ram upgrade (without me in attendence). Maintains his own virus protection, and updates. He's also the only person who reads the EULAs who's not writing articles on them. Grandma saves her geneology to a thumbdrive, and burns CD slideshows of grandkid pictures. They were terrified that they'd break it and then they'd have a broken computer. It took a while to overcome the inertia. But all it really took is patiently outlining what they should expect in the throws of a given problem, letting them ask for clarification, and not making them feel guilty about it when the did. For me it was a joy, but I like my grandparents. The only problem they ever had was when one of my uncles talked them into having a PC shop monkey upgrade them to XP, which he promptly fucked up. It offten takes someone who imagines they know better to make a true mess of a situation.
As for the person who asked the question. If it's a gift and you're doing the support, go with what you're comfortable supporting and which meets their needs. Their needs at this stage of the game being pretty modest in all likelyhood. Between making a homepage with all the links they need, properly installed configured antivirus suits, setup firewalls, and user accounts. (Including them in the decision making process, of course.) A little bit of hands on tutoring with some follow up coaching is all it will take. I'm convinced my faith in their good sense and expecation that this would be something they could both do and enjoy added years to my grandfather's life. It's clear as his time draws to a close; having something to do, new experiences, and learning opportunities was part of what kept them both (but him in particular) going as all their friends and peers began to die. When I got them that computer I thought I was just getting them a toy, or a luxury item to amuse and entertain. In reality I was buying them time, time which I got to spend better knowing them. One of the smartest fucking things I ever did.
Here's some advice form someone who's just finished building a new internet banking security system for the bank I work for:
DONT USE WINDOWS
Simple really.
Seriously, for someone who wasn't weaned on Windows, using a modern Linux desktop is a very viable proposition. The only trojan attack vectors we've seen are from Windows boxes. A recent survey stated that 50% of all trojanned machines run Windows XP SP2, so there's no safety there. Most are simple key-loggers which are bad enough, but there's a new wave of targetted banking site trojans designed to crack various protection schemes.
Install Linux, Mandriva is a good newbies distro. Get broadband with a hardware router/firwall. Put big icons on the panel for e-mail, browser and OpenOffice. Put a signle Bookmark for teh Banking site on the browser toolbar. Lock down the KDE desktop using Kiosk. Install Spamassasin to cut down on the phishing e-mails. Sign them up with a bank that supports Firefox (there's plenty, we do) and has a form of 2nd Factor Authentication. A smaller bank will be less of a target, but they need to be big enough to have proper security in place.
Most importantly, patiently explain to them WHY they must only ever use the bookmark to access thier banking, never reply to e-mails or follow links on other sites. Don't assume they won't understand the background, just issuing blanket orders to not do something is guaranteed to confuse and be forgotten/ignored. Explain it to them in simple, non-technical language and use analogies to things tehy do understand. If they understand the why, they will be better prepared when they do see an attack vector you haven't explicitally told them about.
John.
P.S. And yes, I've done this for my parents...