Ask Slashdot: What To Tell Non-Tech Savvy Family About Malware?

First time accepted submitter veganboyjosh writes "I got an instant message from an uncle the other day, asking me what was in the link I sent him. I hadn't sent him a link so I figured that his account had been hacked and he'd received a malicious link from some bot address with my name in the 'From' box. This was confirmed when he told me the address the link had come from. When I tried explaining what the link was, that his account had been hacked, and that he should change the password to his @aol.com email account, his response was 'No, I think your account was hacked, since the email came from you.' I went over it again, with a real-life analog of someone calling him on the phone and pretending to be me, but I'm not sure if that sunk in or not. This uncle is far from tech savvy. He's in his 60s, and uses Facebook several times a week. He knows I'm online much more and kind of know my way around. After his initial response, I didn't have it in me to get into the whole 'Never click a link from an unfamiliar email address' bit; to him, this wasn't an unfamiliar email address, it was mine. How do I explain this to him, and what else should I feel responsible for telling him?"

Comments

i think your uncle is right

[notgm]

you've been compromised, and now you're spamming /.

Re:i think your uncle is right

[mattkrea]

Yeah.. pretty sure this is the more likely scenario..

Re:i think your uncle is right

[Anonymous Coward]

Not sure why parent was modded funny as that is actually the most likely scenario.

Re:i think your uncle is right

[Anonymous Coward]

Yeah, he's spot on.

Uncle hacked hypothesis:
- malware resides in uncle's PC
- malware looks through uncle's address book
- malware sends email not to the people from the address book (otherwise the summary would've told us), but to the owner of the machine it already infected pretending to be someone he knows... what for?

veganboyjosh hacked hypothesis:
- malware resides in veganboyjosh's PC
- malware looks through veganboyjosh's address book
- malware, with the objective to infect more machines, emails veganboyjosh contacts pretending to be him

Which one makes more sense?

Re:i think your uncle is right

[Billly Gates]

He couldn't be.

He is middle aged and knows better. He doesn't click on shit or go to weird sites. He also doesn't use IE. THerefore a AV scanner is not needed especially if you have a firewall. AV software is for wusses according to these folks and I am sure his 3 year old version of flash and 5 year old unpatched Java on his machine are no match to the mighty security of running firefox!

Don't believe me? Just ask any slashdotter who has not used Windows in 12 years. They know what they are talking about when it comes to Windows security as they post this all the time.

Re:i think your uncle is right

[Anonymous Coward]

I get stuff from my address book but weird email addresses frequently now. I suspect somewhere my shared addressbook 'leaked' or got harvested. But the bot only has the names, not the addresses. Several people on an email listserv I manage have been hacked in that the account sent stuff to the associated address book which included the listserv address. Those people got removed from the list until they fixed their accounts. It's usually AOL, Hotmail, Yahoo, or sometimes Earthlink addresses. But I suspect your Uncle had the address book leak thing.

Re:i think your uncle is right

[Anonymous Coward]

Yeah, he's spot on.

Uncle hacked hypothesis:
- malware resides in uncle's PC
- malware looks through uncle's address book
- malware sends email not to the people from the address book (otherwise the summary would've told us), but to the owner of the machine it already infected pretending to be someone he knows... what for?

veganboyjosh hacked hypothesis:
- malware resides in veganboyjosh's PC
- malware looks through veganboyjosh's address book
- malware, with the objective to infect more machines, emails veganboyjosh contacts pretending to be him

Which one makes more sense?

That was my first thought as well.

Re:i think your uncle is right

[Anonymous Coward]

Using an email address from the compromised machine's address book makes it much more likely that the compromised user will trust the email. This has been a well-known exploit for a long time.

Re:i think your uncle is right

[Anonymous Coward]

If that is the level of reasoning among "tech savvy" people, then we're screwed.

veganboyjosh's computer wasn't hacked, and his uncle's computer wasn't hacked until the link in the email was clicked. Someone else, who had both of them in the address book, was hacked and, after grabbing the address information from that third person's computer, a Facebook account, an uploaded Android contacts list, etc., the botnet sent the malicious email "from" someone in the address book to someone else in the address book, because that's how you make fake emails look legit and apparently it's also how you dumbfound enough geeks.

Re:i think your uncle is right

[Anonymous Coward]

I'm glad it's not just me then. When I get email from people which they clearly didn't send, I email them and tell them. Not one of them has been amusing enough to say, "No, *you've* been hacked". Because, like you say, the first thing a compromised machine will do is send email to itself.

Of course the most likely scenario is that no one has been "hacked", but just that a spammer has got the address somewhere and used it to fake a From: line.

Re:i think your uncle is right

[Anonymous Coward]

If the malware was on veganboy's computer, why didn't it just just his email account? Why would it use some other email address with just veganboy's name as the From field?

Re:i think your uncle is right

[TFAFalcon]

There is a third option - Uncle's account hacked.

- malware has access to the uncle's address book stored on a remote server
- malware sends the uncle an email based on information gathered from his account
- uncle clicks the links and installs the malware on his own machine

Re:i think your uncle is right

[Anonymous Coward]

And a fourth vaganboyjosh hotmail/msn/facebook/yahoo account compromised.

Re:i think your uncle is right

[loufoque]

It used veganboy's email address. You can send an email from any address, there is no need to get access to any account for this.

The only way to guarantee that someone sending an email is really who he claims to be is digital signing, and for some reason no one uses it.

Re:i think your uncle is right

[loufoque]

It's true. Anti-virus software is useless.

Re:i think your uncle is right

[Anonymous Coward]

There are some defenses against that, though. The email server can reject mail that does not come from the domain it claims in the From field, for example.

Re:i think your uncle is right

[wiredlogic]

The uncle is right. I received spam a few times from a friend who didn't exercise good password security and used the same password for all her online accounts.

Generally, when a hacker group manages to dump the account info from a website they try to use the passwords against any email addresses linked to that account. All the success cases have the inbox scanned for useful information like bank account data and more online account info. Some subset of these hackers will use the accounts to send spam with malware links to the people in the hacked account's address list.

The lesson from this is to always maintain a unique password for your e-mail accounts.

Re:i think your uncle is right

[danomac]

Just here to point out something...

Malware has generally moved to sending mail to one contact appearing like mail from another contact in the same address book. Been seeing this for years. It's very possible veganboyjosh's computer is not infected at all. It could be anyone who has both veganboyjosh and his uncle in their contacts, which could limit it to another family member that isn't even aware they've been infected.

Re:i think your uncle is right

[cbiltcliffe]

What's the point of sending an email link to a computer that's already compromised?
The attacker doesn't need to social engineer the user into trusting the email. Their computer is already owned by the attacker. Just tell your malware program to download and run whatever you want. No user involved.

Re:i think your uncle is right

[Anonymous Coward]

digital signing authenticates computers, not people.

Re:i think your uncle is right

[Billly Gates]

Riight.

It only detects 96% of them.

Re:i think your uncle is right

[loufoque]

Getting virii implies running binary code that you do not trust.
If you don't run arbitrary binary code, then you don't need any sort of anti-virus.

Re:i think your uncle is right

[jedidiah]

I've had a "deleted" yahoo account get hacked and used for spam/malware. It was "deleted" the first time the account got hacked and was used for spam/malware. It had been in disuse for years before it was hacked the first time and afterwards. After the 2nd time the account was hacked, I deleted each one of my accounts as well as "deleting" the account itself.

I'm waiting for the day that that account comes back from the dead again.

Re:i think your uncle is right

[uglyduckling]

At risk of stating the obvious... an online bot crawls well-known webmail interfaces trying obvious names and passwords. When it gets a hit, it pulls a few names from the address book, and sends an email to that account appearing to come _from_ that email address. That mail contains a link to download malware that then infects the PC. All of this effort is to bypass the now well-known advice not to click a link in a message when you know the sender.

Re:i think your uncle is right

[Billly Gates]

Sigh

Your post shows exactly why I wrote that piece. Google buffer overflows, stack smashing, out of bounds exceptions and so on? You do not have to click anything to get infected. All it takes is a an infected ad to exploit one of the techniques above and you are 0wned. Slashdot had one last year. If you came to slashdot last spring you got owned if you ran Windows without an AV.

Your knowledge is from the 1990s. There are so many ways to get code to run on outdated software it is not funny. Google drive by downloads?

Re:i think your uncle is right

[readnotpost]

Dude, this is Slashdot. It's one great big echo-chamber for the ignorant. There's no point in trying to educate them since they'll just hear the same incomplete information from other like-minded (but incorrect) individuals, and it ends up reinforcing their ignorance.

I think hairyfeet is close to a mental collapse trying to deal with these idiots sometimes. They WANT to believe incorrect information because it means they don't have to be challenged to deal with not really knowing much about the state of modern Windows, for example.

Re:i think your uncle is right

[Billly Gates]

Hairyfeet is one of my favorite posters. He is direct and pisses people off but funny because he is right. I do not know how he does not get -1 when I try to say the same things I am considered a troll.

Re:i think your uncle is right

[loufoque]

modern Windows

"lol" is all that comes to mind.

Re:i think your uncle is right

[readnotpost]

It's actually surprising how often he does get modded to 4 and 5 though. Heck he posted in this very thread (http://yro.slashdot.org/comments.pl?sid=3319169&cid=42306651) and right now it's Score:5, Informative, which tells me that there are definitely people on Slashdot who are also tired of ignorant shit and like to see some legitimate information posted about Windows from time to time. If he's pissing anyone off it's because his posts challenge their narrow-mindedness.

It's not like I'm even a Microsoft fan, or even a Windows fan. I'm just sick of incessant FUD and the encouragement of not wanting to know much about the operating system the majority of the world uses. As an Engineer, it pisses me off to see fellow geeks enjoy their ignorance.

Re:i think your uncle is right

[Anonymous Coward]

Is this serious? Really, Slashdot? It's a simple "FROM" header forgery. Most of the time, there'll be a barrage of emails from "different" people that ultimately spread the same attack.

OP, use a different example: "Uncle, imagine someone wants to send you a bomb. They make a bomb, put it in a box, put your address on "TO" and for the return address... well, they put whatever they want. For example, they could put "FROM: Your nephew, OP". They send it in the mail, the post office catches it in time to to keep it from you, and in time to read the addresses. Now, if the post office told you "a bomb was sent to you and it had your nephew's return address" are you going to think "who would do this that has both of our addresses?" or are you going to think "oh my god, my nephew is trying to kill me... poorly". One is less crazy than the other. Your address book is part of your account. They can look through what you've received. That's how they got my address. The "from" from an email can be anything, there's no way to fact-check it, and only laziness keeps everyone from doing it. Now please change your password to minimize the damage. You will keep getting junk. Because they already have the addresses.

At the same time, congratulate him on good security practice for 1) not checking every random link, and 2) verifying through an alternate channel.

Re:i think your uncle is right

[Anonymous Coward]

it's like leaving the computer screen unlocked while you are gone for quick meeting... of course you will get an email from yourself and be wondering how that happened...

it's like passing out with your shoes on and I am nearby with a black marker...

it's still like that

Re:i think your uncle is right

[andy.ruddock]

It could, but that would be wrong.

There's nothing in the standards that says the sending server has to be in the same domain as the mail client.
I can use a gmail server to send mail from a hotmail address, or my ISP's smtp server to send mail from my domain, which may not be big enough to justify it's own infrastructure.

Re:i think your uncle is right

[dotHectate]

In response to the "what for?" in the "Uncle hacked hypothesis" a reasonable scenario exists where this would be of benefit to the malware authors. Specifically, having malware alone on a computer doesn't necessarily generate revenue for them, for that they need to use it to obtain something with a more liquid monetary value - such as user/pass credentials for the users bank, etc. In fact, the ideal scenario from a malware author's point of view is that he wants to 1. Infect a computer, 2. Use the infection for gain, and 3. Spread the infection so that #2 can be repeated elsewhere.

Re:i think your uncle is right

[jhughe90]

OP didn't provide a lot of details for me to determine if what his uncle received is similar to below: Here's a third hypothesis based on e-mails that I've been seeing in the past month: Contact lists are being hacked hypothesis: - I have a secondary user@mydomain.net e-mail that I have not shared with any family members. It is in my Yahoo contact list. - Been receiving malware link e-mails at this e-mail address from junk domains, but the sender's name is some random family member - The only location of those family members' names is in my Yahoo contact list. Have not even added most to my Gmail. Malware link spammers are getting ahold of Yahoo contact lists and cross-sending e-mails to people on those lists using the contact names. Yahoo is filtering those e-mails as spam, but for those messages that go to other providers, their spam filters may not be trashing them such as the mydomain.net address.

Re:i think your uncle is right

[Anonymous Coward]

The above is happening constantly. Messages with no text other than the link. Yeah, I email my mom that way all the time......not.

The above conclusion is correct also.

Re:i think your uncle is right

[Anonymous Coward]

Not used Windows? If your running windows in a VM or Dual Booting, your still running Windows to do the things Linux or MAC can't do, which is alot... Most Linux and MAC users I know and here on Slashdot still go over to the Dark Side as some say, but I think it's idiotic to bounce between OS's to do certain things, When you can have one OS that will do all of it... Oh wait that would be Windows...

Re:i think your uncle is right

[Anonymous Coward]

New phishing scam right now is distastefully using the tradegy in Conneticut yesterday disquised as a news link to president Obama's speech, which everyones emails are swarming with...

Re:i think your uncle is right

[cbiltcliffe]

If you read a few posts back in this thread, you'll see the context is that some theoretical malware is on the target's PC, which then sends the email to the target, attempting to get the target to infect their own PC.
That's what I was responding to.

Having said that, with your explanation, I haven't yet seen a webmail interface that allows you to change the From: header. You'd have to have access to an SMTP server somewhere, hacked or otherwise, to send the actual email from.

Fake one yourself.

[jx100]

Log into AOL's SMTP server with telnet and make an email that looks like it's coming from your uncle. Show him how easy it is to fake, and that the "to" field is actually incredibly untrustworthy.

Re:Fake one yourself.

[Megahard]

Send a fake email from your uncle to your aunt. The more chaos you can cause, the better the lesson will sink in.

Re:Fake one yourself.

[toygeek]

I did this once to prove the point to my wife. I made up some ridiculous email and then called her and asked her if she got it. She had. When I told her it was from ME, she finally got the point. The email was telling her she was a winner of free tickets to a concert for an artist that hasn't performed in a VERY long time. And I didn't have to telnet into a server to do it. I just set up my mail program.

Re:Fake one yourself.

[johnsnails]

set up a free smsglobal (or similar) account and show how u can also send an sms to his grandchildren from "Mum or "Mom" as the case might be saying meet me in the dark van next to the shops after school. And then use up the rest of ur credits messing with ur mates.

Re:Fake one yourself.

[Anonymous Coward]

Let's get this out of the way first - I'm not an expert. Now, let's reply to this post mentioning how I'm stating the obvious. Are we done? Good. Now on to my inquisitive statement -

I assume that the AOL SMTP servers require login, and that they modify the "sender" address label to match that who logged in similar to how Google does (ie, "granpajo@aol.com on behalf of rustyshackelford@red-hot-tubgirl-grits.cn")?

Re:Fake one yourself.

[toygeek]

Actually, jackass, she is a very intelligent woman, and in many ways smarter than I am. The point is that abstract concepts often need demonstration before they are well understood.

Re:Fake one yourself.

[toygeek]

If the mail server is set up well, yes. But many aren't, and not everyone is on gmail or the like. When I did it, I was the mail server admin so I could do whatever I wanted, to be honest. This is why spammers go after breaking into legit accounts.

Re:Fake one yourself.

[Anonymous Coward]

Log into AOL's SMTP server with telnet and make an email that looks like it's coming from your uncle. Show him how easy it is to fake, and that the "to" field is actually incredibly untrustworthy.

Pick up an envelope. Write your uncle's address on it. In the "return" section, write "President of the United States of America". Place a piece of paper inside which says "Don't worry about paying any income taxes this year, buddy, I've got yo' back!".
Now, ask your uncle if he would believe that was sent from the Pres. It does say it's from him, right? Ok then, we've learned a little lesson today.

Re:Fake one yourself.

[Anonymous Coward]

Definitely this. Unless AOL has SMTP Auth enabled, this should work.

Re:Fake one yourself.

[Rockoon]

If your wife needed you to do that before she was able to understand it, then she's severely lacking in intelligence. Of course, your wife lacking intelligence works in your favor; she wouldn't have married you otherwise.

obligatory If you are traveling 80 miles per hour, how long does it take you to go 80 miles?

Re:Fake one yourself.

[Anonymous Coward]

I take it none of you have done this in a few years?

most modern "legitimate" email providers won't deliver without SPF and a few other niceties set up, assuming your father's (presumably consumer) ISP would even allow you to make an outbound connection to port 25 -- that is, if any modern email provider would accept SMTP without STARTTLS. more likely you'd be using openssl s_client, but you still need appropriate DNS records.

see also: Bennett Hasselton's post from a few days ago -- those are tales of woe suffered by someone sending *with* all the prerequisites in place.

Re:Fake one yourself.

[fa2k]

I assume that the AOL SMTP servers require login, and that they modify the "sender" address label to match that who logged in similar to how Google does (ie, "granpajo@aol.com on behalf of rustyshackelford@red-hot-tubgirl-grits.cn")?

The GP was probably talking about sending *to* an AOL account. There would be no intermediate SMTP server, just the computer delivering a message directly to the AOL incoming SMTP server. The only problem would be that AOL probably blacklists a lot of IP addresses for home users for incoming messages.

Re:Fake one yourself.

[Anonymous Coward]

Better still send him a fake email from obama@whitehouse.com telling him if he questions your authority again the CIA will be all over his ass.

Re:Fake one yourself.

[Anonymous Coward]

Smart women have smart babies, something dumb women will almost never do. When you want to fuck a ridiculously hot 19 year old, you definitely don't want any smarts involved. See the difference? Different folks for different strokes.

Re:Fake one yourself.

[ArsenneLupin]

most modern "legitimate" email providers won't deliver without SPF

Apparently, the uncle's provider does... which allowed the fraudulent e-mail to get through in the first place. So that would be the first piece of advice: get a provider who knows his stuff. Because, without SPF checking, anybody can just put whatever he wants into the envelope From field.

Re:Fake one yourself.

[cbiltcliffe]

What? Obama works the porn site, now?!

Re:Fake one yourself.

[ultranova]

Or he could just say that the email was forged. It's not like that's a new concept that didn't exist before computers. And it's not like people have trouble understanding the concept of forgery even if they're not familiar with the particular skills and techniques a forgerer uses.

The only real difference a computer makes is letting the whole forgery process be entirely automated right down to finding out your friends and relatives names, so the forgerer can send mass-produced yet personalized forged emails to millions of victims rather than carefully crafting them one at a time.

Re:Fake one yourself.

[rioki]

Fun story, my English teacher (German school) wanted to go the the white house's website. Yea was fun experience when he typed in whitehouse.com... You should have seen the look on his face.

Why the white house has not failed a dispute claim for whitehouse.com at the IANA I don't know...

Tell your family what Mike tells his...

[Anonymous Coward]

...that'll a man will jump out of their screen and yell, "WHERE'S YOUR DAUGHTER?!" http://www.youtube.com/watch?v=U0wY4wIB5_4

Think up a meatspace analogy

[The MAZZTer]

In this case, let's say your uncle mails his letters by leaving them in his mailbox (I think some places let you do this) for the mailman to pick up. Now let's say a shady guy comes along and copies the names of people your uncle is mailing letters to, including yours, then sends him a letter purportedly from you asking him to loan you money by wiring it to a specific bank account or whatever.

Your NAME was involved but you had nothing to do with it, and the scammer found out your name from him.

Re:Think up a meatspace analogy

[aitikin]

That's actually probably one of the best analogies for this purpose I've ever heard/read. Consider it stolen.

Re:Think up a meatspace analogy

[marty23571113]

(I think some places let you do this) Yeah several million places

Re:Think up a meatspace analogy

[houghi]

With email, I also always use the snail-mail analogy.
Everybody can send your name on an envelope.
Everybody can write my name on the back.
There is no way of telling where it was then send from, except the country where the person put it in the mailbox.

That will help most of the time (some people just don't WANT to understand), yet I can go further:
Email is like a postcard, everybody can read it. If you encrypt it, it is like an envelope.

An email has two parts. The part before the @ and the part after it.
The last part is the address. Street, and city/country. The part before it is your mailbox. It can have your name, but can also be a mailbox or anything that you put on the mailbox.

Your email program puts it in the mailbox. That is emptied by the post people. Then it si put in trucks to the postal dispatch. That will sort it and send it with a lot of others to another dispatch, where it will be sorted again and given to the postman. He will put it then in your mailbox.
So it is not like a fax where the machine speaks directly to another machine. It takes a lot of steps and on all those steps there can be a delay. That is the reason your email might not arrive in the 7 seconds you have been waiting for.

Re:Think up a meatspace analogy

[Anonymous Coward]

It's good, but to that add the fact that the letters are postcards, the contents of which anybody can read if they have access to the mailbox.

Re:Think up a meatspace analogy

[EvilJoker]

Your email program puts it in the mailbox. That is emptied by the post people. Then it si put in trucks to the postal dispatch.

The Internet is not a big truck! It's a series of tubes

Uhm... No, it's just spam.

[Anonymous Coward]

I don't see why you think his account has been hacked.

Someone simply sent him email with your address as the "From" address. Doing that is trivial, and spammers do it all the time.

Post your uncle's email address and your email address, and thousands of us here will send you email with your uncle's email address as the origin.

Go ahead, post both addresses. You can trust me. I'm "Anonymous Coward", and you've seen millions of articles from me which show my wide variety of expertise.

Re:Uhm... No, it's just spam.

[Anonymous Coward]

There's no reason whatever to think the uncle's account was hacked. None. A little knowledge is a dangerous thing.

Re:Uhm... No, it's just spam.

[Anonymous Coward]

I'm "Anonymous Coward"

No you aren't, you liar! You hacked my account! How dare you!

Re:Uhm... No, it's just spam.

[BronsCon]

There's no reason to think it was not hacked. There's, likewise, just as much reason not to change the password. Standard practice in the security community is to assume that everything has been compromised and act accordingly; this is because a good hack will be all but undetectable.

Re:Uhm... No, it's just spam.

[reybo]

When you think about, there's a far better chance the miscreant behind that email invaded, not the uncle's email account, but the nephew's PC with a worm or trojan that spams his email address list.

Re:Uhm... No, it's just spam.

[Anonymous Coward]

if they have access to the names of people that he has emailed then they have some sort of access to the account.

Re:Uhm... No, it's just spam.

[hidden]

When the from and to names are people who genuinely know each other, it generally means that one or the other of them's address book has been stolen. Less frequenty, it may mean that a third party (that they both know) had their address book stolen. Subby doesn't think his address book has been stolen, so that leaves the relative as the most likely victim.

Who we think the most likely victim is maybe be another story, but his logic seems fairly sound to me, if we accept the initial assumptions...

Re:Uhm... No, it's just spam.

[Anonymous Coward]

This is 50% funny and 50% true. I get spam mails from *myself* all the time.

Re:Uhm... No, it's just spam.

[Frankie70]

I get spam mails from *myself* all the time.

I think you have accidentally hacked your own account.

Re:Uhm... No, it's just spam.

[matunos]

That doesn't explain how the spambots knew to send an email purpotedly from him to his uncle.

It's possible one or both of their Facebook privacy settings are overly lax, allowing anyone to see their email addresses and friendship.

Re:Uhm... No, it's just spam.

[martin-boundary]

You're been living under a rock maybe? TFA said the uncle uses Facebook, and I presume so does the submitter. The spammers only need to figure out who's a friend of whom on Facebook, and they can send targeted mails purporting to be from from one to the other. Private address books are so 90s, Facebook is the modern, single common address book for the whole world.

Re:Uhm... No, it's just spam.

[Anonymous Coward]

infinite recursion in 5 .. 4 ... 3 .....2 ......1

Re:Uhm... No, it's just spam.

[Anonymous Coward]

No, I'm "Anonymous Coward". And so's my wife.

Re:Uhm... No, it's just spam.

[Anonymous Coward]

Hi Uncle is using Windows. What more proof do you need?

Re:Uhm... No, it's just spam.

[Anonymous Coward]

I think you should report yourself to Spamcop and Spamhaus. That will fix the problem for sure.

Re:Uhm... No, it's just spam.

[Anonymous Coward]

Right let's go for the more complicated answer when 99% of this kind of crap simply forges FROM:

Where is that razor?

Re:Uhm... No, it's just spam.

[hidden]

I'm sure there's some stuff like what you're talking about out there but most of phishing and scam crap I've seen seems to stay separate.

Facebook attacks stay in the facebook realm, spreading through sketchy timeline posts and using FB connect, and email attacks stay in email realm, attacking via addressbooks and sketchy email links.

this is just from my personal exerience though. milage may vary

Re:Uhm... No, it's just spam.

[Anonymous Coward]

He's not the Anonymous Coward; he's a very naughty boy!

Re:Uhm... No, it's just spam.

[dacarr]

Header check, maybe? The best way to confirm it is to look at the headers and find out where it came from - most people on the 'net these days who know their stuff can read that.

Re:Uhm... No, it's just spam.

[Anonymous Coward]

But why would you need to send suspicious links to the uncle if his computer is already compromised?

Re:Uhm... No, it's just spam.

[Anonymous Coward]

Don't know if this is still the case, but in the hotmail web interface a mail from yourself would load images, regardless of preferences. We all know how much spammers love it when the images get loaded.

Re:Uhm... No, it's just spam.

[Anonymous Coward]

When the From and To addresses are people with the same last name, it means the spambot is hoping the similar email addresses will confuse people in just this way.

Re:Uhm... No, it's just spam.

[safetyinnumbers]

I don't see why you think his account has been hacked.

I wondered about that, but I took it to mean that the uncle clicked a link and entered his account details before asking what the link was about, and so was 'hacked' in that sense, not that hacking was needed to fake the From: header.

There's the question of how the email associated the recipient and sender names, but that just suggests that a mutual friend's machine was harvested for addresses.

Re:Uhm... No, it's just spam.

[Anonymous Coward]

I'm "Anonymous Coward"

No you aren't, you liar! You hacked my account! How dare you!

No! I am Spartacus! (Oh, I'm sorry ... carried away there)

Re:Uhm... No, it's just spam.

[JoeCommodore]

Yep happened to me at work once or twice, maybe some computer in a CC tree got compromised and the list got out. Now this third party is using addresses on the list both the sender and recipient fields.

Not much to do about it except what your uncle did, verify you sent it and what it is. Seems he's got a better grasp of the situation.

Re:Uhm... No, it's just spam.

[lennier]

You can trust me. I'm "Anonymous Coward", and you've seen millions of articles from me which show my wide variety of expertise.

Noel? Is that you? I thought you were better known for your plays.

are you sure

[PieceOfShitAndroid]

Are you sure it was your uncle who sent you the instant message?

Just make shit up

[Anonymous Coward]

Seriously. Show him a segment in the e-mail header and say that's proof his shit was hacked. He won't know the difference anyway.

Re:Just make shit up

[MrL0G1C]

Or look at said header and determine who has actually been compromised.

Re:Just make shit up

[Anonymous Coward]

Worst. Advice. Ever.

Way to mislead and belittle him, destroy your personal integrity and undermine his trust in you, all in one move. If you do this, you're a freakin' psychopath.

Re:Just make shit up

[Anonymous Coward]

That's your approach for relating technical details to simple folk, eh?

No wonder you're using AC...

To drive home the point, however ironic, I am also using AC. So there. It's because the sky pancakes are blue and positively not furry.

Good luck

[Anonymous Coward]

Explaining email issues can be very tricky, since there can be problems with authenticity at both ends of a one directional communication. For instance, perhaps your email host is owned, they can send messages as you. Alternately, the recipient's email host is poorly configured, and it's accepting mail with spoofed sources. It gets even more layered, when it you look at whether or not the sending MX is authoritative for the domain the message originates from, which is where SPF comes into play. Everyone who has a domain, whether it's used for sending email or not, should specify an SPF record (or TXT with appropriate content) specifying which servers can send mail, if any. Every mail server, besides not being configured to be a relay, needs to avoid accepting mail from senders using addresses only it should be authoritive for.

Just feel superior

[Anonymous Coward]

Tell him nothing else, just feel superior that you don't get malware. OR
You could point him to a website that has a simple explanation of how it is that you know for certain it is you know his machine is infected, instead of someone else's who has both your and his email addresses in it.

Did the message spoof your email address

[Anonymous Coward]

Or did it just spoof your name, and attach some made-up email address. In either case, tough to blame your uncle for "lack of sophistication". Anyone might have followed a link to "take a look at this hilarious clip" or whatever, under the circumstances, unless they were unusually observant and/or paranoid.

Re:Did the message spoof your email address

[Ritchie70]

I consider myself pretty savvy, but I've been fooled a couple times by "fake" emails harvesting login credentials when I was tired and not thinking.

Both times I realized within minutes that I'd been had and went and changed the passwords immediately, but it's really easy to be fooled if you aren't paying attention.

Re:Did the message spoof your email address

[Anonymous Coward]

You might still be "savvy" if you fell for it once, but the second time you were just plain careless. Sorry...

Re:Did the message spoof your email address

[maxwell demon]

It's very hard to get fooled if you always think by default "it's a fake" and only revise that opinion after having convinced yourself that the mail is legit. Then the worst thing you might do when tired is to not react on a legitimate mail.

Re:Did the message spoof your email address

[veganboyjosh]

It was just my name, with the "from" address being some other address I didn't recognize. He assumed it was me because it was my real name.

Re:Did the message spoof your email address

[Anonymous Coward]

Maybe you should have included that information in the summary, dumbass.

Re:Nothing

[Grishnakh]

This used to be good advice, because Macs were such a small share of the market that the malware authors didn't bother with them. This isn't quite so true any more.

If you want to get them a platform that won't be targeted by malware authors for quite some time, install Linux Mint on their PC. As a bonus, it won't cost anything extra (unless they have some shitty printer that has no Linux support, but a new Linux-compatible printer is much cheaper than a new Mac). As an extra bonus, you can install the KDE version of Linux Mint and assuming they're coming from XP or Win7, they won't even have to learn a whole new GUI paradigm.

If he doesn't believe you

[Anonymous Coward]

Why is he asking you for help? Just say "If you trust me enough to ask, trust me enough to accept my explanation."

Re:If he doesn't believe you

[DarwinSurvivor]

He didn't ask for help, he asked why he sent him then link. If you can't even be bothered to read the summary, don't bother trying to answer the question in the title.

Re:If he doesn't believe you

[Anonymous Coward]

You must be new here.

Re:If he doesn't believe you

[jafiwam]

He didn't ask for help, he asked why he sent him then link. If you can't even be bothered to read the summary, don't bother trying to answer the question in the title.

The answer is still valid.

Helpee: "help me"

Helper: "ok, do X"

Helpee: "no, I think it's y"

Helper: "Fuck off, figure it out yourself."

Perfectly reasonable response. There are plenty of other people in the world that will graciously accept help with computers to deal with twatwaffles that won't.

Re:If he doesn't believe you

[Anonymous Coward]

Do you approach all of your negotiations with such a blind assurance of authority?

The true mark of a false leader is anyone that relies on authority for obedience.

The false mark of a true leader is the impression that people follow authority; they don't.

People follow wisdom, compassion and most of all, good storytellers. What's your story?

Re:If he doesn't believe you

[DarwinSurvivor]

And you apparently didn't read the first 5 words of my post. He didn't ask for help! He just asked why his nephew sent him a link, his nephew then "thurst help upon him", help which he eventually declined after disagreeing about the source of the link.

Create a non-admin account for them

[Beeftopia]

Creating a non-administrator/root account for them should prevent the installation of most malware. DON'T give them the password.

And tell them that the Internet is like Mos Eisley: "It is a wretched hive of scum and villainy. We must be cautious."

Keep an up-to-date firewall and virus scanner like Norton. Turn on automatic updating for the operating system. And for the security software.

Hope for the best.

Re:Create a non-admin account for them

[therufus]

Norton? LOL.

From the fact that he's completely illiterate about computers automatically implies he already has Norton installed. That AND the fact he's on AOL.

It seems OP is pretty savvy, why not register a domain name for him and set up an SMTP account you can remotely administer. It doesn't mean he'll never have his email hacked, but he'd be less of a target.

Re:Create a non-admin account for them

[maugle]

Probably because the OP does not have anywhere near enough time to spare setting up and maintaining a custom domain name and SMTP account for every relative.

Re:Create a non-admin account for them

[antdude]

Ditto, and OP would have to support them which is a pain in the butt. :(

Re:Create a non-admin account for them

[ArsenneLupin]

Probably because the OP does not have anywhere near enough time to spare setting up and maintaining a custom domain name and SMTP account for every relative.

Why not set up one domain name and SMTP server for all of them?

Tagged as funny, but makes a point.

[mark-t]

Really, I can't think oi a good reason to presume that either account was actually hacked. What's evidently happened, however, is that both parties have had their email addresses harvested, using one (falsely) as a sender and the other as recipient.

Re:Tagged as funny, but makes a point.

[FatLittleMonkey]

This was my first thought.

Specifically, harvested from a third party who has both the poster and his uncle's email address.

In other words, the poster, veganboyjosh, should be looking into his other relatives. His aunt, his nan & pop, his mum & dad, etc. First to see if they are receiving spam from each others' addresses, and to try to narrow down who has been compromised. Start with the oldest relative and work your way down.

Re:Tagged as funny, but makes a point.

[Anonymous Coward]

That's the problem today. Too many people think just because they can navigate the internet or run automated programs that they can act as a reliable expert. All it does is propagate faulty information even farther until it's repeated as if it were a meme, to the point where the lazy just accept it as fact without question.

If anyone reading really wants to be helpful, do yourself on those you are trying to help a favor and perform at least a few minutes of research before jumping to a conclusion. Doing this single step would have lead the poster to hundreds of videos on youtube demonstrating how to falsify the "sender" of an email using freely available programs.

The first step of problem solving begins with identifying the problem.

never talk to strangers

[metalmaster]

Explain how to expand the e-mail header to show the senders full address ie. Josh

Then simply explain the whole "never talk to strangers" bit and make comparisons to tech where possible.

Re:never talk to strangers

[metalmaster]

ie. josh [ 766567616e626f796a6f7368@shadymail.net ]

Re:Nothing

[Anonymous Coward]

Yes, because that would totally prevent his AOL account from being hacked...

Holy shit you Apple people are fucking stupid.

maybe the problem is on your end

[Anonymous Coward]

I mean, when you're mailing from maximizeyoursize@maleenhancement.com there are just predictably going to be misunderstandings.

Re:maybe the problem is on your end

[Opportunist]

You joke, but some people actually run into big problems with such things.

Like a friend of mine who happens to live in the small Austrian village "Fucking" (despite the name the link is safe for work). I'm dead serious, a google picture search will provide the proof that this town exists.

Do you think he can order ANYTHING online? He doesn't even make it past the spam filter.

Re:maybe the problem is on your end

[anagama]

Obvious sister city candidate:

http://en.wikipedia.org/wiki/Intercourse,_Pennsylvania

Re:maybe the problem is on your end

[Anonymous Coward]

Dildo, Newfoundland
https://maps.google.ca/maps?q=Dildo,+Newfoundland&hl=en&sll=47.569114,-53.547363&sspn=5.737726,7.064209&hnear=Dildo,+Division+No.+1,+Newfoundland+and+Labrador&t=m&z=14

Re:maybe the problem is on your end

[climb_no_fear]

Alternatively, since they are so far apart, this may result in

"Blue Balls"

Re:maybe the problem is on your end

[AkkarAnadyr]

Neither can the folks in Scunthorpe.

Re:Nothing

[Nerdfest]

Most 'exploits' that get people these days are emails, etc, with fake notifications that get people to enter their login details for FaceBook, Gmail, etc. A Mac will not help for the majority of what gets people these days.

Neither one hacked

[Anonymous Coward]

I think this is mentioned, but nothing mentioned indicates either party was hacked. The from part of an email can be forged as easily as the from address on a piece of stationary. That email could have come from anywhere in the world and anyone. The only thing we can gather is that the spammer somehow connected the submitter's name with that of his uncle. It could have been either side, or a public mention of both addresses, or a third relative getting hacked that has both of you in their contact list. The raw headers *might* be able to tell you if it came from an aol email server but that still doesn't itself tell you who sent it.

Re:Neither one hacked

[Opportunist]

Not targeted enough. The chance that you get two identical emails from different sources and notice something's amiss is way too high. Plus too many people who know a thing about security would receive it and maybe warn their friends and relatives.

A much better way would be to set up some kind of service where someone has to enter his own and some other email address. First, you know who to target: The one stupid enough to use such a service. And you know exactly whose mail they would open. Make it some sort of personal service to increase the chances that the mark will open the mail, thinking it is from someone he likes/loves and trusts.

The current season with its greeting card craziness is perfect for that purpose.

Re:Neither one hacked

[Rob the Bold]

I think this is mentioned, but nothing mentioned indicates either party was hacked. The from part of an email can be forged as easily as the from address on a piece of stationary. That email could have come from anywhere in the world and anyone. The only thing we can gather is that the spammer somehow connected the submitter's name with that of his uncle. It could have been either side, or a public mention of both addresses, or a third relative getting hacked that has both of you in their contact list. The raw headers *might* be able to tell you if it came from an aol email server but that still doesn't itself tell you who sent it.

"Once is happenstance. Twice is coincidence. Three times, it's enemy action."

If someone's got your email address and the address of someone you correspond with, and sends bogus emails to the correspondent with your return address, someone's been compromised.

Re:Neither one hacked

[Anonymous Coward]

The raw headers *might* be able to tell you if it came from an aol email server but that still doesn't itself tell you who sent it.

You misspelled "open mail relay."

Re:Neither one hacked

[deimtee]

Not targeted enough. The chance that you get two identical emails from different sources and notice something's amiss is way too high.

Not if they all know each other. At one place I used to work, people would forward emails all over the place, to both internal and external contacts.
If something was really funny or very relevent to the work, the popular people would see multiple copies as everyone sent it to them.
Funniest thing was that there was a poorly enforced policy about spamming, so nobody forwarded them to IT. If it was malware it usually got everybody before IT even knew about it.

Re:Neither one hacked

[Opportunist]

I guess your CISO would love to hear that story. After all it's his job to make sure crap like that doesn't run rampart in your company.

My solution as CISO would probably have been to tell them to include IT in their "funny" mailing list as a mandatory recipient. If I cannot enforce a policy, if you cannot fight them, I have to work with them.

Actually, it would be a very good reason to hand in the 2 weeks. If I don't get backing from "above" for my policies, there's no sense in defining them.

Re:Neither one hacked

[jafiwam]

I think this is mentioned, but nothing mentioned indicates either party was hacked. The from part of an email can be forged as easily as the from address on a piece of stationary. That email could have come from anywhere in the world and anyone. The only thing we can gather is that the spammer somehow connected the submitter's name with that of his uncle. It could have been either side, or a public mention of both addresses, or a third relative getting hacked that has both of you in their contact list. The raw headers *might* be able to tell you if it came from an aol email server but that still doesn't itself tell you who sent it.

Or malware that collects those "forward to everyone you know!!!!112" emails and harvests emails from them. Where do you think the "millions of verified emails on CD!" lists come from?

You're not responsible for his security. He is.

[Anonymous Coward]

I have similar problems with my family (usually my mid-60's parents). Funny thing is, they're not dumb. But about a year ago when I was explaining to my mom for the 40th time what a URL is and how to copy and paste it in your browser, when she (a 10+ year computer user) asked me what a "browser" is, I gave up. They spent their money on that machine and if they can't figure out how to use it properly, it's their own fault.

Re:You're not responsible for his security. He is.

[thereitis]

They're not alone. I sent a family member an email with a link and they said the link didn't work. I tried it again myself and it did, in fact, work. Turns out the email client they were using didn't hilight the URL as a clickable link. You think people would know how to copy/paste that sort of thing these days but that's not the case.

If he asks and doesn't take your advice

[Rob the Bold]

A person can ask for advice. They can act on it as they see fit. If your adult uncle ignores your advice, you are off the hook. Maybe you know what's best for him, but if he's asked you and doesn't believe you, there's nothing you can do. I know you wish you could help, but you can't. We sell computers to people who aren't IT admins with the implication that they don't need to be one in order to operate them. Sadly this isn't true, but it's beyond your duties as a nephew to try to disabuse him of this notion.

This answer is probably less than satisfactory, but the world is an imperfect place and our ability to change that is very limited.

Perhaps other Slashdotters have some Jedi mind tricks for you to try, but I'm not optimistic, based on personal experience.

Re:If he asks and doesn't take your advice

[Nemyst]

The problem is that usually, in such a scenario, the relative/friend then screws up and asks you to fix it. Not wanting to fix it, after you've shown that you are well capable of it, will end up causing issues for you with said person.

If you could wash your hands of the whole matter, it wouldn't be an issue, but I've just about never seen a situation where this is the case.

Re:If he asks and doesn't take your advice

[Anonymous Coward]

We sell computers to people who aren't IT admins with the implication that they don't need to be one in order to operate them. Sadly this isn't true...

Isn't that like saying you must be a mechanic to drive a car? How many in this crowd seek professional help when their vehicle breaks down?

Re:If he asks and doesn't take your advice

[Anonymous Coward]

Took me years to learn, the hard way, what Rob describes.
Several rebuilds of his PC, a McAfee subscription he is probably paying over the odds for and a car that lasted less than a year.
I just gave up as I _really_ didn't want to end up with an ulcer.
Some people you just can't help.

Re:If he asks and doesn't take your advice

[Psyborgue]

I had a client like this. Refused to take my advice. So I let everything blow up in his face. Then he started listening. Sometimes you gotta let people learn for themselves that they're wrong.

Re:If he asks and doesn't take your advice

[olddoc]

I agree completely. I have an elderly family member that can screw up a fresh OS install in a week. He will install 3 or 4 antivirus programs, 3 or 4 "registry cleaners", 5 or 6 toolbars, 2 or 3 download optimizers and every free trial nagware that promises to optimize his computer. He WILL NOT LEARN. I got tired of trying to fix his computer which merely consisted of uninstalling crap so I did the best thing I could think of: I cloned his HDD over to an SSD and now his PC will boot in 2 minutes instead of 10. I tell him over and over but he sees a pitch about something that promises to make his PC better or get him free coupons and he installs it. It is some kind of mental disease and I know of no Jedi mind tricks to change him...

MOD PARENT UP

[kumanopuusan]

You can never be too sure, especially since the submitter thinks his uncle has been compromised.

Re:MOD PARENT UP

[Frankie70]

kumanopuusan, I think PieceOfShitAndroid has hacked your slashdot account and is using it to ask people to mod his posts up.

Re:MOD PARENT UP

[kumanopuusan]

How can you be sure it was PieceOfShitAndroid posting in the first place?

Re:MOD PARENT UP

[Austerity Empowers]

There is no spoon.

Re:MOD PARENT UP

[MisterSquid]

You don't fool me. You're just another of PieceOfShitAndroid's sockpuppets. Just like I am... er... wait.

"From" is like the upper left of an envelope.

[theedgeofoblivious]

Tell him that the "from" that shows up in emails is like the upper left corner of an envelope.

I could write a letter, address it, and in the upper left corner write

PRESIDENT BARACK HUSSEIN OBAMA
1600 PENNSYLVANIA AVE. NW
WASHINGTON, DC 20500-0003

And you could mail the letter. And the letter might even be delivered. But that doesn't mean that the President really sent that letter. It just means that whoever sent it claimed to be someone else when they were sending it.

Re:"From" is like the upper left of an envelope.

[Anonymous Coward]

Another interesting feature is that it works like a return address too. If the recipient address is no good, then the white house will get that letter. Similarly, just about everyone I know who uses one ISP in this area (which has a webmail system that gives different errors for "email doesn't exist" and "email exists but bad password") has received a bounce back for an email they didn't send.

Re:"From" is like the upper left of an envelope.

[Culture20]

Yeah, that was a popular spam method back in 2000-ish. Spam filters would give bounces a low "spamminess" value, so they'd slip into inboxes.

Re:"From" is like the upper left of an envelope.

[Anonymous Coward]

Send him a letter from Thomas Jefferson at the above address. That way it is clear from the start that it has been faked and that you were not trying to commit fraud.

Re:"From" is like the upper left of an envelope.

[Anonymous Coward]

I used to teach UNIX & Linux system administration. I showed my students how to telnet to port 25 and send a mail to myself as "Bill.Gates@whitehouse.gov", stating that as president of the USA he had no time anymore to lead Microsoft and would therefor hand the company over to me. One guy was still sceptical, so I sent him a mail as himself - that was years ago, I hope he has recovered from the shock by now.

Nothing

[Andy Prough]

Get them a Chromebook and save $1200+ off the price of the Mac and be done with it.

Your uncle's right

[Anonymous Coward]

You were more likely the one who was hacked. After all, if you were a hacker, and you had compromised someone's email, which would you do: send one email to the account you hacked, or send a bunch of emails to everyone in that account's contact list? Of course, neither of you have necessarily been hacked, but there has to be some way the hacker knew to claim it was from you. So the hacked account could belong to someone you both know. That would be a sneakier way of avoiding detection for a bit.

Re:Your uncle's right

[Opportunist]

(...) there has to be some way the hacker knew to claim it was from you.

His uncle's address book, maybe? Sending emails from one address in the address book to another address doesn't make sense, though. How should the hacker decide which people actually have any kind of business with each other?

But here's a good scenario, and a quite valid one: His uncle used some sort of stupid "online holiday greetings card" service, one of those that need your email address and the one belonging to the recipient. Judging from the described level of knowledge his uncle has I wouldn't deem it too far fetched that he actually uses some kind of service of that kind.

And, bluntly, people who use such a "service" are prime candidates for malware mails. Because they surely are not the most educated when it comes to online security. Else they wouldn't touch such "services".

Re:Your uncle's right

[Anonymous Coward]

Sending emails from one address in the address book to another address doesn't make sense, though. How should the hacker decide which people actually have any kind of business with each other?

Why would the hacker care? It's the shotgun approach, so nothing that misses matters, only the ones that happen to hit.

Re:Your uncle's right

[theedgeofoblivious]

Have you ever heard of backscatter spam?

Spammers use bots to browse the internet and scoop up email addresses. Then they send messages with one of those addresses in the "From" header and one in the "To" header. If the messages go through, one person receives spam. If they don't go through, the other person receives spam. Either way, someone gets spam.

None of this requires much technical knowledge. I can make backscatter spam by filling in a registration form on any website. I just put your address in the "email address" field, and the site sends you a confirmation email, typically from a no-reply@whatever.com email address. So it's basically impossible to stop.

Backscatter spam works because it looks like it came from someone it didn't. It's why web sites shouldn't provide alerts for messages that weren't delivered and why "out of office" messages or messages to confirm addresses are bad. Because any bot (or any person, too) can fill in a form and turn your website into a backscatter machine.

Re:Your uncle's right

[Opportunist]

Because the very last thing you want is that your new and improved trojan hits the AV industry before it has some impact. Think of it as firing your shotgun into a crowd where a few policemen stand around and you're done for if you hit one of them instead of a target.

Shotgun is so yesterday, today, they choose their targets rather carefully. The goal is to infect as many machines as possible before the AV makers get a sample and neutralize you. It's a race, if you're first, you can infect and lock them out of unseating you. If you're second, the AV kit will prevent your trojan's execution.

Re:Your uncle's right

[bingoUV]

Yes, but the spam filter is the policeman here instead of the AV. This particular security problem is likely to be entirely based in the "cloud".

Re:Your uncle's right

[Opportunist]

How many people actually HAVE a spam filter? The target isn't companies here, it's private users. Private users without too much of a clue, to be precise.

And yes, you're technically right. The spam filter will "notice" that it was shot and inform its "office" about the incident. So yes, an AV company is more like the SWAT team that comes after you shot the policeman, but that's nitpicking, don't you think?

Re:Your uncle's right

[bingoUV]

How many people actually HAVE a spam filter?

Everyone I know enough to know this aspect of their lives who uses email (at least 300 people who use email). They haven't configured it themselves , they use the spam filter of gmail, yahoo, and even hotmail (is it "live" these days?). They don't have to make a decision to use the spam filter as webmail comes preconfigured with spam filter, and good ones at that.

So yes, an AV company is more like the SWAT team that comes after you shot the policeman, but that's nitpicking

No, an AV is just not involved at all. If an AV is dealing with this kind of problem at all, such an AV comes bundled with a spam filter and the spam filter part of the AV is dealing with this problem rather than the core AV part. And this spam filter part of the AV doesn't work on webmail, which an overwhelming majority of email users are using these days.

Is it nitpicking? No. Saying an AV is involved in this kind of problem is simply wrong. And it gives undue credit to popular AV companies, which I consider to be parasites on the computing world. Webmail is fighting all the spam out there, not some stupid AV.

Keep it simple.

[jonadab]

Just tell him email is very easy to forge. That's it.

You don't have to explain the technical details of exactly how it is forged, what headers are, how SMTP works, how malware mines personal data, or any of that. If he cared about the technical details, he'd read up on them, and then he wouldn't need you.

Keep it simple: "email is very easy to forge."

Re:Keep it simple.

[Anonymous Coward]

Just tell him email is very easy to forge. That's it.

You don't have to explain the technical details of exactly how it is forged, what headers are, how SMTP works, how malware mines personal data, or any of that. If he cared about the technical details, he'd read up on them, and then he wouldn't need you.

Keep it simple: "email is very easy to forge."

Translation: "You are too stupid to use email if you fell for that shit."

(to some extent, this is true)

Re: Keep it simple.

[dropadrop]

This.

You don't want to give any technical details or use any terms like "smtp" or "headers". You don't want to try to fet them to understand the technical reasons, just the concept of how the sender address is just whatever is configured in the email client and no more a guarantee then what's written as sender on a traditional email.

I found the fastest way to get somebody to understand was by walking through configuring their email to send from a bogus address, it opens up their eyes faster then an explanation.

You're done.

[Blinkin1200]

You did what you needed to do, you let them know they had a problem.

You are done.

It is not just non-tech savvy people that have this problem. My brother is, or so I thought, knowledgeable in the area of malware. One day I get a spam message sent from him, actually from his previous email address. I recognized that the message was also sent to quite a few people in his address book. After receiving a few more, I did a reply all to one of the messages, copied to his current email address and included a message that I hope you are not doing any banking or on-line shopping with that computer. His response was to send out a message to his entire address book asking people to set up their spam filters to ignore any messages from his old address.

I tried, I'm done.

The good news is that I now know of some juicy stocks that are going to really run up in price and three or four places where I can order some V1agra. Also, I was able to do all of my holiday shopping an a really great Russian sex toy shop. They even gift wrap! Everyone is going to be so surprised this year!

Again, you are done, move on.

Re:You're done.

[Anonymous Coward]

Ahhh V1agra. You know it must be better because it has a "1" in it!

Re:You're done.

[Anonymous Coward]

This was along my thoughts. After they refused to believe me, I'd just say "Aight, well you seem to know what you're doing. Give me a shout when you want to take me seriously.

Forget it

[Opportunist]

You can tell a kid a hundred times that the stove is hot, he won't believe you until he burned his hand.

Tell him, if he chooses to ignore you, don't press on. You offered help, he declined, everything's fine. Sorry, but if ignorant people choose to reject the information they get from people who know more than them about the matter, you have to let the kid burn his hand.

Re:Forget it

[c0lo]

Tell him, if he chooses to ignore you, don't press on. You offered help, he declined, everything's fine.

On the same line, you can tell him stories on the bees and flowers and crane birds and whatnot. There'll be a time when he'll learn the truth.

Re:Forget it

[Anonymous Coward]

There's this phase you go through called youth where you start to take such advice after the stage called "kid". Then you realise much of the advice is lies and bullshit designed to give you the "opportunity" to miss out on everything worthwhile in life. And so you become a grown up and start checking things for yourself again. I don't know yet what happens after that.

Re:Forget it

[Opportunist]

Yup. Well, if you really insist in your kid not trusting you, go ahead and tell him fairy tales as if they were true. My dad tried. I don't believe him anything he says anymore. At times this is to my disadvantage, but usually it's the right thing to do.

AOLOL

[epp_b]

Really, you could have just said, "my uncle uses AOL," and that would have explained everything.

Joking aside, why did you use the telephone analogy? It's email, a postal mail analogy would have been perfect: it's as if someone sent him a nasty letter and printed your address in the top-left corner of the envelope.

As for what to do with his PC ... well, if he's just the typical "Facebook and email" user, install Debian or something and rename the desktop icons ("Internet", "Email", etc.). I put Ubuntu on my mom's netbook and she pesters me no more often than she does about her Windows PC.

Re:AOLOL

[flyingfsck]

You should have use Xubuntu, then she would not have pestered you at all.

Now imagine the software swears at you, too.

[Impy the Impiuos Imp]

"What's malware?"

"You know how government officials tell you sweet things they'll do for you, so you vote for them, and suddenly you see your walled draining rapidly and all kinds of shit clogging up everything you do, and even after installing their 'fix', things keep running slower and slower and slower? Same thing but just on your computer."

This isn't "Malware". This isn't "Hacking".

[BaldingByMicrosoft]

This isn't "Malware". This isn't "Hacking". It's just Phishing.

Read this: http://www.securingthehuman.org/newsletters/ouch/issues/OUCH-201112_en.pdf

Explain that email was invented in the mid-70s and hasn't really changed that much. Security wasn't a factor back then, and its easy to write an email that appears to come from anyone.

I don't get it

[Anonymous Coward]

If your uncle had been hacked, why would the attacker send him a malicious link?

Re:I don't get it

[Anonymous Coward]

If your uncle had been hacked, why would the attacker send him a malicious link?

You're right: you don't get it.

The supposition is that the uncles AOL account has been hacked, not his computer. A malicious link is then sent claiming to be from a presumably trusted sender chosen from the Uncle's hacked account's address book. This contains the malicious link which will allow the Uncle's computer to be hacked.

It's a feasible scenario, but hardly the only way two such email addresses could have been associated.

Letters

[Todd Knarr]

My analogy is a letter with my name and address written in the return-address space. Does that guarantee that the letter's from me? Of course not, anybody could write that in if they knew my address, and all it takes to find my address is to look me up in the phone book.

You can't save em all Hasselhoff...

[SuperCharlie]

As plain and obvious it seems to us tech nerds.. some people will just never get some of the tricks the spammers use like forged from addresses and no, you're not infected, don't click that link to install superantispyware 2013. If possible, take the PC/Laptop for an evening to "speed things up" put good anti-malware and antivirus on it, maybe make a clean image and a non-admin account if you can and expect the calls for when he screws it up again if you are his dedicated tech nerd.

Re:Nothing

[Anonymous Coward]

What I'm getting at is that non tech-savvy people will not remember/act on the advice you give them. Better to get them something -usable-, with a low chance of infection. You could give them a *nix install if you prefer, but I don't want to be a support contact for my family's systems unless there is a dire need (eg. hardware). Also, you described a phishing attack, which I don't classify as 'malware'.

Re:This isn't "Malware". This isn't "Hacking".

[Anonymous Coward]

And then, go one better, and explain to him that by using PGP authentication, you CAN ensure that emails are from who they say they are, assuming you've verified the key. Show him how easy this is to do with Enigmail. And then join the ranks of us who've been frustrated by the glazed eye look that comes upon doing so.

Having to explain tech to the tech-clueless is definitely among the activities in some of the lower circles of Hell. Sorry, there's no magic solution here.

Check his login history

[Anonymous Coward]

This happened to a guy I know recently. I was suprised to learn that Yahoo! and Google have a place you can check your login history at. I was able to show this guy evidence that my theory was correct, after which he became much more cooperative about changing his password. FYI on Gmail and other services with oauth you should also clear all those sessions I would think. I dunno if AOL has this history feature, but it's more common than I would have thought. If he's connecting from ARIN block IPs and you find some unexplained APNIC IP in the history it's a pretty good indicator of a problem..

Not your responsibility

[Anonymous Coward]

Most of the non tech savvy will end up hacked. This will be the perpetual state of any Windows box which doesn't have full time support of a corporate IT department or a tech savvy user between the chair and keyboard 100% of the time.

AOL is a problem as well. You shouldn't be trying to support AOL users. Refer them to the AOL tech support number.

If your uncle isn't asking you for help it's none of your business. Why should people rally against infections which don't affect them?

My Windows partition contains a copy of Borderlands 2 and nothing else. Antivirus and Windows updates can't protect you from zero day exploits, which means they are useless and should be turned off. Boot to another OS to browse the Internet.

Advice

[Frankie70]

I think the first thing to tell your uncle is that he should get his tech advice from a more tech savvy relative who doesn't automatically assume that a forged email is done by hacking someone's account.

Re:Nothing

[hendridm]

This used to be good advice, because Macs were such a small share of the market that the malware authors didn't bother with them. This isn't quite so true any more.

It is true that Macs are not (relatively) free from threats anymore, but damn, they sure have a lot fewer to deal with. No?

Re:Nothing

[Concerned Onlooker]

That's pretty much true. You should only get a Mac if you're trying to do real work. For web surfing and email a Chromebook would be better for most non-savvy users.

Re:Nothing

[Austerity Empowers]

What he's getting at is that any OS on any computer is vulnerable to this sort of attack. Any OS at all that has a web browser: Windows, OSX, Linux, Android, iOS, *BSD, Solaris, whatever.

Once you click that link and enter your credentials, you are hacked. No resident virus required that has to hook your system via known attack vectors. Of course once you are hacked, it is much easier to get to that next step, if that's important to the attacker. But usually it's not, they're perfectly happy with your accounts.

What to tell your non-tech family about malware

[PopeRatzo]

It's bad, m'kay.

Re:What to tell your non-tech family about malware

[flyingfsck]

You know, that is a perfect answer. You'll never get any tech support questions. In fact, I doubt anyone will ever again ask you anything again, except maybe whether you can spare them a doobie. I usually tell people that I don't do Windows, but for some obscure reason that tends to piss them off.

Re:Nothing

[Anonymous Coward]

Hacks always go after the widest distribution and so naturally Windows XP/Vista/7 are affected much more than Mac's since they are still a much larger percentage of the online systems today.

By that logic, I would recommend they use Windows 8. Nobody uses it! Not for long anyway...

Re:Nothing

[lucm]

This used to be good advice, because Macs were such a small share of the market that the malware authors didn't bother with them. This isn't quite so true any more.

It is true that Macs are not (relatively) free from threats anymore, but damn, they sure have a lot fewer to deal with. No?

Not anymore. Remember that story posted not so long ago?
http://thenextweb.com/microsoft/2012/11/02/microsofts-security-team-is-killing-it-not-one-product-on-kasperskys-top-10-vulnerabilities-list/

Apple is on that list twice (QuickTime and iTunes). Adobe is there a lot. No Microsoft products.

Feel free to bring the conspiracy/fraudulent research theories but really it's time people move on with old stuff.

Re:Nothing

[Anonymous Coward]

What he's getting at is that any OS on any computer is vulnerable to this sort of attack. Any OS at all that has a web browser: Windows, OSX, Linux, Android, iOS, *BSD, Solaris, whatever...

Which is the main reason you teach someone how to avoid this shit one time. Maybe twice. After that, they're on their own, and it fucking needs to be that way. Only way malware is going to ever become less of a problem is through education, not technology. This example clearly proves that.

Too cruel? Here, how about a car analogy then.

How many times are you going to help replace your friends flat tire because they keep driving over nails before you finally say, "fuck it, you're on your own."

Get Rid of Windows and Install Linux

[RudyHartmann]

My dad got infected by some malware a while back. He had WinXP Pro. My brothers tried to help him to no avail. He doesn't do well with keeping his antivrus and malware stuff updated. The old guy also does stuff I've told him not to do too. So he got this malware infection that told him that the FBI had locked his computer and to send $200 to a site to unlock it. He freaked out. So I installed Linux Mint 13 KDE 32-bit on his computer. He hasn't had to worry since. He likes it because its also faster. My family thinks I'm free tech support and I was getting real tired of fixing their installations. Now my brothers and uncle have installed Mint also. Life is much simpler for me now. :-)

Re:Get Rid of Windows and Install Linux

[sribe]

My dad got infected by some malware a while back. He had WinXP Pro. My brothers tried to help him to no avail. He doesn't do well with keeping his antivrus and malware stuff updated. The old guy also does stuff I've told him not to do too. So he got this malware infection that told him that the FBI had locked his computer and to send $200 to a site to unlock it. He freaked out. So I installed Linux Mint 13 KDE 32-bit on his computer. He hasn't had to worry since. He likes it because its also faster. My family thinks I'm free tech support and I was getting real tired of fixing their installations. Now my brothers and uncle have installed Mint also. Life is much simpler for me now. :-)

All these people say "get him a Mac" or "get him Linux". Bah humbug! I get the good stuff for myself (I prefer Mac), and then I can give people like that a blank stare and say "I don't know nothin' about that there Windows stuff" ;-)

Re:Get Rid of Windows and Install Linux

[RudyHartmann]

All these people say "get him a Mac" or "get him Linux". Bah humbug! I get the good stuff for myself (I prefer Mac), and then I can give people like that a blank stare and say "I don't know nothin' about that there Windows stuff" ;-)

Dad is a retired 85 year old dude on a fixed budget. He can't afford the luxury of Apple products. Regardless of what he was running, he is still my dad. I would help him no matter what. I just want my life to be simpler, so this is why I did this. Now my brothers......That's another story. But they are teachable. ;-)

Re:This isn't "Malware". This isn't "Hacking".

[Anonymous Coward]

...Having to explain tech to the tech-clueless is definitely among the activities in some of the lower circles of Hell. Sorry, there's no magic solution here.

Sure there is. Stop teaching.

Absolutely shocking to me that the one solution that is the most obvious (a user actually educating themselves about the tool they rely on) is the one that has somehow now been deemed "magical" due to mass ignorance.

I say fuck 'em. They'll learn one way or another, or they'll give up trying and stop using computers. Either way, it's a win for the educated and/or self-inclined.

And no, I don't feel I'm asking a user to program Java when learning the basic 101 rules of online communication. It is that simple. Learn it.

Re:Nothing

[matunos]

Yep, that way instead of having to explain email to his uncle, he gets to explain Unix, and Open Office, etc.

Porn

[asmkm22]

I just tell them to stop watching porn, stop downloading movies, and stop clicking on links inside email. For most people, that probably equates to "don't use the internet" which is fine as far as I'm concerned.. If you want to use a tool without getting hurt, invest a little time and effort into learning how. If not, just accept the fact that you will magically have problems crop up here and there, sort of like a car that never gets its fluids checked.

The problem is, most people simply don't want to learn new things past the age of about 16, so trying to elaborate any more than that is pointless.

Re:Nothing

[Runaway1956]

Browser hijacks and browser vulnerabilities are exactly that, and have little to do with which operating systems they are being run on. Phishing attempts work on any operating system. My own operating system has been one flavor or another of Linux for many years now, and I have to be cautious. Mac, Windows, Unix, Solaris, Linux, DRDOS, MSDOS 6.22, - it doesn't matter which you are using if the exploit is aimed at the browser.

Re:Nothing

[jamesh]

This used to be good advice, because Macs were such a small share of the market that the malware authors didn't bother with them. This isn't quite so true any more.

If you want to get them a platform that won't be targeted by malware authors for quite some time, install Linux Mint on their PC. As a bonus, it won't cost anything extra (unless they have some shitty printer that has no Linux support, but a new Linux-compatible printer is much cheaper than a new Mac). As an extra bonus, you can install the KDE version of Linux Mint and assuming they're coming from XP or Win7, they won't even have to learn a whole new GUI paradigm.

We have detected a suspicious transaction in your bank account. Please go to http://www.sitethatlookslikeyourbankbutisnt.com.ru/ and enter your username and password to confirm the transaction and also enter a brief description about why you think the OS you are running makes a difference here.

ouch...

[Anonymous Coward]

If he is in his 60's and using Facebook and AOL, abandon all hope. As others have said, if his "tech support" presumes that phishing is "malware", then his "tech support" needs tech support just like many lawyers need other lawyers... look it up.

I long ago ceased to help any family members with their online/computer problems if they run anything other than Linux/BSD, or if they think they should be providing massive amounts of personal info to the world via facebook or some stupid "family tree" site. People who insist on being dumb and reckless do not deserve help avoiding the consequences.

Re:Nothing

[Anonymous Coward]

Apple is twice on that list, with Windows software. If you dig down all the way to the original reports, you'll find "Available for: Windows 7, Vista, XP SP2 or later". Windows is still a more vulnerable platform. I'm not saying that OSX is invulnerable - just that the top threats are still for Windows.

I recently didn't get a job at a job interview

[GoodNewsJimDotCom]

The company was a security firm for phishing. They said they sent phishing emails to clients to see if the employees fell for it.

I said,"That's a great way to find business. Spam the world with phishing emails, and people who fall for it, you tell them they need your product.". He laughed and said,"That's like if we did mechanic work and went out and wrecked into people's cars and told them.we could fix it". I think it is different. I think it is more like finding people susceptible to an illness and offering inoculations.

Re:Nothing

[Anonymous Coward]

The problem is: everybody knows driving over nails is a bad idea. Nobody is so fucking stupid that they'll intentionally drive over nails. Now malware links are a whole other world. People can't see that the links are bad, and will intentionally click them. Over and over again. Even when you explain it to them, most of them are too dumb to understand it. They'll keep clicking them. Even if you teach them the mantra of 'never click a link to login, always go to the website yourself', because they're lazy or stupid or whatever. And then they'll tell you to fix their PC because it's broken, or you fucked up because the virusscanner didn't protect them from their account being "hacked" by some asshole.

Re:Nothing

[Grishnakh]

Phishing != "Malware".

Re:Nothing

[Grishnakh]

That's funny, I never had to explain those things to my wife when I set her up with Linux. LibreOffice looks just like pre-ribbon versions of MS Office (or close enough that you can figure it out from the menus), KDE works much like Windows, and you don't need to know jack about UNIX filesystems or other innards to use a web browser and LibreOffice.

try malwarebytes

[Anonymous Coward]

I have only read 3 replies and can't be bothered to read the rest in true tradition so will simply offer up malwarebytes http://downloads.malwarebytes.org/mbam-download.php as one option. I find the free frisk will get rid of most (95.764% for the made up stats crew) crapware. TBH, the OP was a tad too long and I only got half way through.

Re:Nothing

[Grishnakh]

My point is that, while Windows is probably still more vulnerable, Macs are growing in vulnerability because their popularity is growing, so having a Mac is no longer a good defense against malware, and it's only going to get worse.

Candy and strangers

[Anonymous Coward]

How about, as in life, and on the internet, don't take candy from strangers?

To veganboyjosh

[Anonymous Coward]

YOU were hacked.

malware's bad ok?

[goffster]

Mom, pop, don't do malware. It's the opposite of goodware. So just say no.

Re:Nothing

[matunos]

Is your wife a baby-boomer who can't understand how forged email works?

I'm SO tired of this age crap

[hyades1]

My buddy's dad is in his late 80's. Because the computer gave him tools he wanted to use (communication with a family out west, moving a whole lifetime of photographs, slides, 8mm and Super-8 movies going back over a hundred years into digital format, finding in mere seconds information that would have involved a trip to the library when he was a kid), my friend's dad learned how to operate a computer. And because he's the kind of man who does things properly, he took the trouble to learn how to stay safe on-line. His son, ironically, sounds a lot like your uncle. Put together a short PowerPoint presentation illustrating some of the bad stuff, teach him how to behave, and tell him to either get a brain or get off-line.

We live in a digital age. Uncle Dinosaur should learn to swim in it or leave his on-line business to people who are competent.

Re:Nothing

[MartinSchou]

And where, exactly, do you get paid money to buy a Chromebook?

MacBook Air starts at $999 for the 11" version, so in order to save 1200 bucks, you'd have to be given $201 when getting the Chromebook.

Sounds like a really bad deal for the manufacturer to be honest.

Re:Nothing

[issicus]

OSX runs on many PCs now, you might look into that. it would be a bit more user friendly then Linux. If you can get it to work that is.

It's a psych problem actually...

[Nyder]

It has nothing to do with being tech savvy, smart, or old. This is the sort of news that people do NOT like hearing. You tell them their computer is infected and they get defensive because they don't want to hear they did something wrong. Even though we know it's very easy to get infected if you aren't paying attention and there are a lot of traps out there to get you, but most people do not know that.

And when you tell someone something they don't want to hear, what do they usually do? Yes, lash out at you in anger. Not unlike what the article person did, tried to turn it around and blame their friend.

Back in the early 90's, there was this local person that I did a bit a computer business with, so we knew each other decently. This one time I got a disk from him, and it was infected with the Stoned virus https://en.wikipedia.org/wiki/Stoned_(computer_virus). Well, it took me a bit to figure out what was going on, and that i infected a few other of my boot disks in the process (it was my first virus, how we never forget out first!). When i figured it all out and told him that I got a virus from him, he wigged out and swore that he never gave me a virus and blah blah blah. I was just warning him so he could check his disks, i wasn't blaming him for anything, yet his first reaction is to deny it happened.

You find this happens for most everything when there is a chance someone did something wrong.

If he can 'Facebook' - he can browse & read.

[Anonymous Coward]

Tell him to go look it up if he doesn't believe you - there's a wide scope of places/users with info similar enough to convince anyone. It's Never too Late to Educate. (I'm 62 & my only edge over him is 'computing' since 1985 - sure I know a lot more, but that's exposure to the digital world over a quarter-century plus. Even if he only started recently, it ain't age - it's NEWBIE. It's the Holiday Season - be kind to a newbie.)

Re:Nothing

[ThePeices]

And where, exactly, do you get paid money to buy a Chromebook?

MacBook Air starts at $999 for the 11" version, so in order to save 1200 bucks, you'd have to be given $201 when getting the Chromebook.

Sounds like a really bad deal for the manufacturer to be honest.

Hi there, you must be very pedantic and love to point out how utterly moronic everybody else is compared to you.

Welcome to Slashdot!
You will fit in quite nicely here.

Your Uncle Could Be Correct

[Orphaze]

Your logic seems a bit off here.

The usual scenario for hacked account spamming is as follows: Spammer takes control of account (either via phishing, malware, or more rarely social engineering) then sends spam message out to everyone on the account's contact list. It's a great way to spam since a) the people you are sending to are usually real people and b) they will be more likely to click through since the message is coming from someone they know.

What I have not seen before is a spammer gaining control an account, getting its contact list, then sending a *single* message to that very same account from someone on that contact list. What could possibly be the point when you can do the usual trick above? Spam is a numbers game for the most part, and what you're proposing has happened seems to be one of the worst possible ways to reach as many people as possible.

I'm not saying you're wrong, but just that it doesn't quite add up.

Re:Your Uncle Could Be Correct

[Todd Knarr]

What I've seen done is a spammer gets an address book from one compromised account, and then proceeds to spam people in that address list forging the names of other people in the list on the assumption that if they know the holder of the compromised account they likely know each other too. The idea is to minimize the number of malicious e-mails appearing to come from any given source, so as to avoid getting noticed. And if you've received a malicious e-mail and clicked on a link in it, you have to assume your computer and your account are compromised too.

Re:Your Uncle Could Be Correct

[Inda]

Just an coinsidental Joe Job?

Yea...

[Anonymous Coward]

Yea, change your email password.

Re:Nothing

[Anonymous Coward]

Get them a mac and be done with it.

How is this insightful? Macs are prone to malware such as trojans, and malicious links are the prime attack vector.

Having said that, it irritates me to no end that email programs still insist on showing the reported sender's address instead of displaying the actual source address like they ought to. Tell your aged uncle that it's like sending regular mail- the sender can write whatever they want for the return address, doesn't mean it came from them.

Re:Nothing

[Anonymous Coward]

Phishing != "Malware".

To the geezer this article is talking about, they may as well be the same thing. You can sit around and whine about the semantics of "malware" and "viruses" and "social engineering", or you can just admit that most of the common attempts at fucking with you are OS-independent and that the response of "get a mac" isn't going to do anything to help this guy out.

Re:Nothing

[Anonymous Coward]

phishing is more like malware that works on the wetware.

Re:Nothing

[stenvar]

In my experience, switching people from Windows to Linux is a lot less work than switching them from Windows to Mac: pretty as it is, the Mac has just too many annoying differences and annoying little usability problems. My parents could never get used to global menus on the Mac, for example. And remote system management on the Mac is also harder (the best you can do is try and set up remote desktop access). And, of course, there is the obvious advantage that people using Linux can continue to use the hardware they are already used to.

(Besides, you seem to be off your Apple marketing script: I thought the party line among Mac folks was that Mac is UNIX but Linux is not.)

Re:Nothing

[Anonymous Coward]

Oh, you don't seriously think that they walk into the Apple store and leave just having bought a naked MBA. They'll get talked into buying the extended maintenance ("since it's such a valuable laptop"), sleeves, maybe an extra charger, USB sticks, and god knows what else, all crap you don't need with a Chromebook.

Regarding email and the need to update

[Fencepost]

For email, it's actually really simple. What he sees in email headers (From, Subject, etc.) is the equivalent of the return address written in the top left corner of an envelope. There's absolutely nothing keeping you from putting false information there, and if he doesn't believe you ask him when's the last time he had to present identification to send a letter. What you're showing him instead is kind of like inspecting the cancellation mark on the stamp to determine that while the return address may say the White House, the letter was actually mailed from Portland, Oregon.

To give him an impression of the need to update, there are a few things to point out, and hopefully at least one will get through.
  * First, among the most dangerous sites on the web these days are church websites - they're created as a volunteer effort by someone who may not even still be with the church (or who graduated HS and moved on in life). They're unmaintained. If they're infected, it may be a long time before someone even notices. In contrast, the "skeevy" sites like porn have a financial incentive to make sure their sites are safe.
  * Second, once upon a time malware was written by spotty-faced geeks competing with each other for reputation. Those days are gone and have been gone for 20 years. These days malware is written by professional virus authors who do it for a living.
  * Finally, show him the picture from http://www.deependresearch.org/2012/11/common-exploit-kits-2012-poster.html which shows a bunch of *commercially available* malware kits used to create new viruses and some of the security holes they target.

The no longer call me and complain.

[mrmeval]

I told them my hourly rate and when they complained I sent them to http://www.geekinpink.com/

The women adore them and if it all works out the uncle will go to jail.

Facebook Spam

[dcollins]

I'm surprised that no one's brought it up yet, but -- One of the most common spam email profiles that I get these days has the name of a Facebook friend in "From", my name in "Subject", and the body being just a single hyperlink. Pretty clearly, something is scooping up names of friends from Facebook (and recall email address is required there), so there's no need for any personal computer involved to be hacked. And I'm getting these things with the names of some friends I've never had any contact with except through Facebook, so it's easy to deduce that's the source. I would think.

Re:Nothing

[disambiguated]

Even when you explain it to them, most of them are too dumb to understand it.

If you are a programmer, you are part of the problem. The user isn't dumb, s/he just has better things to do than become a Software Engineer just to use what has become an everyday appliance. The problem here is bad design, period. Accept that and maybe we can move on.

Re:Nothing

[flyingfsck]

My wife is a baby boomer accountant who speaks 5 languages, has no idea how computers and anything technical works and only ever used Windows. While she had endless trouble with Vista, she had absolutely no trouble at all with Linux and I never explained anything to her. I just gave her, her username and password on a sticky note on top of a new laptop computer. Problem solved.

Re:Nothing

[disambiguated]

You make it sound like it's some display problem in the email client. It's not. The entire email protocol is broken by design and always has been. The technical solution is easy, but it breaks compatibility with an enormous amount of deployed software. Things have to get pretty bad before people are willing to break that compatibility. Actually, "pretty bad" happened a long time ago, I should have said "horrendously fucked". Err, wait, never mind, It'll never happen.

Most people assume that email is like using SMS

[MichaelSmith]

But in fact you can put anything you like in the From: field. Most people don't know that.

Re:Most people assume that email is like using SMS

[Anonymous Coward]

You can put anything as the sending number (even names) on SMS too

Uncle is *not* "far from tech savvy"

[Anonymous Coward]

"I got an instant message from an uncle the other day, asking me what was in the link I sent him."

So he knew not to click the link, even though it was apparently from you. Uncle: 1

"I hadn't sent him a link so I figured that his account had been hacked and he'd received a malicious link from some bot address with my name in the 'From' box."

Massive assumption with no basis in fact. Nephew: -1

"This was confirmed when he told me the address the link had come from."

Confirmation bias. Nephew: -1

"When I tried explaining what the link was, that his account had been hacked, and that he should change the password to his @aol.com email account, his response was 'No, I think your account was hacked, since the email came from you.'"

A fair response. Uncle: 1

"I went over it again, with a real-life analog of someone calling him on the phone and pretending to be me, but I'm not sure if that sunk in or not."

If someone calls him on the phone and pretends to be you, that doesn't mean his phone has been "hacked". Nephew: -1

"This uncle is far from tech savvy."

So far we have Uncle: 2 Nephew: -3

"He's in his 60s, and uses Facebook several times a week."

That means he can't be tech savvy? Ageism: Nephew -1. Able to use Facebook: Uncle 1

"He knows I'm online much more and kind of know my way around."

Apparently not, though.

"After his initial response, I didn't have it in me to get into the whole 'Never click a link from an unfamiliar email address' bit; to him"

He didn't click the link.

"How do I explain this to him, and what else should I feel responsible for telling him?"

Call him, tell him he's doing fine and he's more tech savvy than his Nephew.

Re:Uncle is *not* "far from tech savvy"

[Anonymous Coward]

hahahahahahahahahahaha pwnt.

its sometimes hard for us to see these perspectives. your comment is one of my alltime fav slashdot posts after 12 years on /.

Re:Uncle is *not* "far from tech savvy"

[tooyoung]

It is a crime that you didn't get modded up.

Re:Uncle is *not* "far from tech savvy"

[Anonymous Coward]

Truly! Who is more dangerous; the older people that try their best to do the right thing or the younger people who are too quick to assume that they're doing the right thing to notice that they're missing the naked and obvious facts?

Listen to your uncle, dammit.

Re:Nothing

[matunos]

I use Linux daily and personally love it, and I wasn't the one suggesting for the uncle to get a Mac; but nice try.

Re:This isn't "Malware". This isn't "Hacking".

[Anonymous Coward]

The problem with that attitude is that their lack of knowledge harms you too. They may share a network with you, which now has a compromised computer on it due to their ineptitude. They may have your personal information in their address books, and your data ends up in spammers' and scammers' databases. Their computers may end up DDoSing the web sites you like, or your favorite game server. Letting malware run rampant makes the internet an unsafe place, for anything, not just for doing business. Countries which are overrun by crime are not nice places, not even for those who can protect themselves. If we don't help protect the people who can't protect themselves, we're handing over our world to criminals.

Easy Solution

[Anonymous Coward]

Try these two solutions:

(1) Tell your Uncle to imagine that this is 1950 and you both live there at the same age and that you send him typed letters -- using a typewriter of course -- and suddenly he gets a letter that is typed and has your forged signature on it. He gets conned, thinking it's you. Tell him, that's what happened. Then introduce him to software that makes this harder to do e.g. EMSIsoft.

(2) If that doesn't work, he's probably hopeless and you can tell him that evil spirits are in his PC but a software program fights the evil spirits and introduce him to antivirus software or tell him to stop using his PC.

You might also get some software that returns that PC to the state it was in before you restart it and tell him to restart the PC every night and the damage will not be so bad.

Re:This isn't "Malware". This isn't "Hacking".

[Anonymous Coward]

Absolutely shocking to me that the one solution that is the most obvious (a user actually educating themselves about the tool they rely on) is the one that has somehow now been deemed "magical" due to mass ignorance.

It's easy to see how that happened. Information processing is abstract, you don't see any moving parts that make it obvious what's going on. Add the endless versatility and power of computers to that and computers are arguably amongst the most difficult devices to interact with. But to make personal computers (including the mobile computers we don't call PC's) popular and accessible the software industry has put such a strong focus on user friendliness and intuitive interfaces that the expectation has become that you don't need to learn or know anything to use a computer, it is expected to magically work. This push towards knowledge-free computing has helped to put computers in nearly every home, and I certainly see that as a positive effect. Unfortunately it has also resulted in a large majority of computer users who, apart from some operational knowledge, have no idea at all what a computer actually is and leaves them completely helpless when something goes wrong. Abstractions are far from perfect, and I keep having this nagging feeling that we would have fewer helpless users, *and* fewer problems with malware and phishing etc., if the OS builders had made interfaces that helped people to understand computers instead of trying to camouflage what they actually are. I suspect that quite a few people who do have the intellectual capability to understand what a computer is are kept in the dark because it's abstracted away too much. That doesn't mean I want everybody to use a Linux CLI or something like that, and I don't know what UIs would have been like if keeping the computer visible and transparent had been a goal as well as making it easy to use, but I do think the attempts to camouflage what's going probably confuse people more than they help in the long run.

I say fuck 'em.

No, fuck the corporations that misinform people about what they're buying and leave it to their friends and family to clean up the mess.

Re:Nothing

[bgarcia]

It's very easy to spend $1500 and up on a MacBook Air.

This is the dumbest argument I've seen on slashdot. Congratulations!

Is anybodies account hacked at all?

[Anonymous Coward]

Why are you telling him his account is hacked. In the phone analogy his phone isn't hacked, somebody just called him in the normal way.

Unless you can find any evidence that actions were taken using authority given to you or to him just ignore the email.

Re:Nothing

[Runaway1956]

Funny - my wife had little problem migrating to Linux, either.

She resisted initially. But, I talked her into trying it out. I explained that I didn't want to spend yet more money on a license to install an operating system, when I could install a free system on her existing hardware. So, she went along, and tried it out.

There were some questions over the first few days. Fewer questions as the first weeks went by. Almost no questions over the next several months.

Today, I find her doing stuff that I NEVER told her about. Believe me, she is NOT a techy. She has little idea how any of the components in her machine work. She is NOT the person you want to choose new hardware. But, she has learned her way around Linux pretty well, with little pain. Occasionally, I even see a terminal open on her desktop. Do I pry? No way. Let the old girl do whatever pleases her - just like I do on my own computer!

Of course, most of what pleases her is Pogo games and watching soap operas. Silly waste of resource, if you ask me, LMAO

Same as postal mail

[Monoman]

I can send you a letter and write anyone's name and address in the upper left corner of the envelope (From field). The only legitimate marking on an envelope is the post mark and with email it is most of the IP addresses in the headers.

Re:Nothing

[stenvar]

Gosh, maybe you should express yourself more clearly then!

Kiddie porn - ultimate scare

[Anonymous Coward]

Tell them bad people can use their computer to store and distribute kiddie porn. If that doesn't scare them then you might have a bigger problem.

Nothing

[DaveGod]

what else should I feel responsible for telling him?

Nothing.

Tech enthusiasts often get satisfaction from helping others in this way. But you should always understand that you are not responsible for doing so, and they should understand that too. If they are difficult or unappreciative, well it's not your problem. If they don't follow your advice, it's not your problem. Your goal in doing it is because it's a nice and helpful i.e. good thing to do; when it stops feeling like that then you're not achieving the goal, it's not really nice and helpful no matter what your intentions, how right you may be or how much safer they might be for following it.

If your uncle knew a lot about cars and you were going to buy one, would you consider that he was obliged to find you a good runner and teach you how to drive? Would he even go into lots of detail or just give a handful of key general points? Would you definitely follow his advice to the letter or would you take it on board and do what you want to do?

The best advice I've given is that if there's any kind of account then you do not use links in emails, go to the site normally. Seeing as he went about asking you what the link was, perhaps that might already have sunk in.

FYI an email with your address in the "from" and his in the "to" field doesn't offer any clue which has been compromised, or if anyone has. One possibility would be if anyone has sent one of those stupid "forward 1000 times and Bill Gates donates $1b to charity" with both of your email addresses.

Give up the fight.

[Anonymous Coward]

Get an ipad.

Explain but don't start a blame-game

[Qbertino]

Give him a new mail account. And tell him not to trust anything, even if you sent it. And tell him that mails are basically electronic postcards that can be easyly searched, scanned and manipulated, even the sender and the reciever. If he's still with you, tell him a bit about mailheaders and look at them with him. ... Although I personally wouldn't bother going to much into the details of email, they are insane anyway, in my opinion. (The Type A email security incident you describe pretty much proves my point).

Clean his system, give him a fresh thunderbird install with a new account and - if he fell like doing this - set up an encrypted mail communication between you and him. Explain which part of that makes it a sufficiently secure means of communication and which part can still be compromised (his, your's or anybody elses system).

If he's a person who's usage patterns are covered by Ubuntu, offer to move his system to that. ... I got my daughter an ubuntu netbook for her birthday. The amount of hassle-freeness is refreshing. It does suck that sound and mic are causing trouble on Ubuntu 12LTS, but that's a minor tradeoff for the lack of headaches I've gotten in return.

Good luck.

Re:Nothing

[hairyfeet]

Unless he is willing to be full time 24/7 tech support that would be a BAD idea. Just look at the serious guttings that have happened to Linux in just the last 5 years, ALSA for Pulse, Gnome 2 for GnomeShell then this funky ass hybrid of the 2, KDE 3 to KDE 4 (which was frankly shoved out in alpha quality at best by ALL the "user friendly" distros) and finally the changes in the wireless networking that has made USB wireless hit or miss, usually miss.

Frankly if you know what you are doing you can set up an "idiot proof" Windows that short of the old guy clicking "Why yes, I DO want to get infected, STFU and let me get infected!" then nothing is gonna happen. With this system I've had customers that picked up more bugs than a Bangkok whore on coupon day and they are squeaky clean. Everybody ready? Here we go..

You start by doing the most obvious thing, that is making sure all their software is up to date. Once that is finished you get their ass OFF IE onto something that doesn't have a giant bullseye on it, personally I prefer Comodo Dragon as not only does it have low rights mode like Chrome, but it also has Privalert, which will block all the tracking crap (you can of course whitelist any page with a single click, even grandma could do it) and you have the option of Comodo DNS which in this case i would say YES, use it, as it blocks many malware pages from loading. Once its installed go ahead and add ABP, in less he likes ads bugging the shit out of him, and I usually install ForecastFox as its nice to have the 5 day forecast and the radar right there.

Next you install Paragon Backup and Recovery Free as this will let you not only make a hidden backup capsule (think OEM restore partition, only custom made by you and up to date) but you can set it to any kind of schedule you like, including differential, daily, weekly, whatever. I used to use Comodo Time Machine as it allows you to restore even if they hosed the boot image but its not supported on Windows 8. if you are running 7 might want to check it out. Next you install FileHippo Update Checker and tell it to ignore beta releases. the reason you do this is to keep the old guy for falling for the "you need the latest flash, just download "Iz_Not_Bug_Iz_Flash.exe" right now!". you tell him if the little Hippo don't say there is an update there is NO update, period.

Finally you have the AV, here you can use either Avast free or Comodo IS, I prefer the latter as its not as "chatty" and has built in sandboxing by default but some folks like chatty, both are VERY good at stop malware pages before load and Comodo IS sandboxing means if the old guy does try to run something nasty it'll minimize the risk.

so there you have it, it looks more complex than it actually is, takes about an hour all told depending on how out of date the software on the system is. Once its done that's it, just leave them be, they'll be safe as houses. The browser is sandboxed and in low rights mode, you have the AV scanning every page before load, the browser is blocking ads (one of the biggest attack vectors) and tracking crap, and to top it all off the OS has a hidden encrypted partition with a backup image so if they by some miracle ever do figure out how to break something you can have it back up in under 30 minutes, no problem.

Re:Nothing

[Anonymous Coward]

Soap operas? Meh, Now soap operas with *vampires*...

Part of the problem...

[Anonymous Coward]

He also might benefit from not using AOL. Their security is not very good, unlike Yahoo! Mail or Gmail.

Re:Part of the problem...

[Anonymous Coward]

http://theoatmeal.com/comics/email_address

There you go.

demonstrate your point to your uncle

[Anonymous Coward]

Send him an email from BarrackObama, thanking him for his service or something,with a link to click on for an invitation to a whitehouse reception.

(or pick some other political social organization...)

This should demonstrate how easy it is to hack someone.

Re:Nothing

[dgatwood]

My parents could never get used to global menus on the Mac, for example.

I would have said the reverse. The menu bar being at the top creates modality that makes it easy to discover which windows belonging to a given application. In the Windows/X11 world, trying to figure out which application a particular window came from can be a usability nightmare... except for apps that are designed so that all of your windows are subwindows of one big window, which makes your second monitor useless.

And remote system management on the Mac is also harder (the best you can do is try and set up remote desktop access).

Or SSH or iChat/Messages screen sharing. The latter makes more sense for home use, IMO.

And, of course, there is the obvious advantage that people using Linux can continue to use the hardware they are already used to.

Unless it is ancient hardware with a PS/2 mouse and keyboard, you can usually just plug their existing hardware into a Mac and use it. People aren't used to the box on their desk; they're used to the peripherals and the OS, and you're changing the OS either way.

Re:Nothing

[loufoque]

People like you are the real problem.

Computers are working tools, and manipulating a tool is something that must be learned.
Many people seem to be strongly opposed to trying to understand how a computer works to use it, but sorry, that's just the way things work. People not trained in the use of machine tools are not allowed to use them, it should arguably be the same thing for computers.

That's when you charge money

[Anonymous Coward]

I've done that to relatives plenty of times. They'll ask me what's wrong then disregard my advice. They dig themselves a deeper hole and come crying back to me. I tell them I'm kind of busy but if there's money involved I can clear a spot for them.

Just let the remtards fail

[gelfling]

I get this kind of thing all the time. Endless demands for tech support and then when I do something they scream at me that I broke something and they know better. So from now on screw them, they're on their own.

The Most Common Scenario

[Anonymous Coward]

Random relative or friend hacked hypothesis:
- malware resides in random person's PC (This person has been a participant/recipient in one of the family and friends chain letter/joke emails that have 50 recipient in teh To: field and Fwd:Fwd:Fwd:Fwd:Fwd:Fwd in the Subjectline.
- malware looks through random relative's address book
- malware, with the objective to infect more machines, emails Uncle and others in random relatives address book pretending to be him(chosen at random from the same address book.

If you're like me, you can't tell them to stop sending the FUCKING chain letters and fake virus warnings without alienating yourself from the family. 'Thanks Grandma, since it's my job I really do know about these things a few months before Ethyl tells you about it.' Teach your friends and family how to use BCC: it's the only hope.

Call it a "virus"

[gatkinso]

Don't click on just any old link. Don't open shit in spam emails. Becareful on porn sites. Update you antivirus weekly. Automatic scans. Then be done with it.

Wisdom of Mr. Mackey

[retroworks]

Just say "It's bad, m'kay? It's not good, it's bad." Works as well as jargon.

the perfect analogy is snail mail

[sribe]

Anyone in the word can write your return address on an envelope and mail it to him. So explain to him that email is the exact same way.

Re:Nothing

[mcgrew]

None of the ten in your list are holes in operating systems; Oracle features prominently. The question is, how many trojans and viruses are there in the wild for the various OSes?

I'll believe MS is concerned with user security when they stop hiding extensions and stop mixing data and code.

Re:Nothing

[Anonymous Coward]

And even dumber try an convince that Chromebook and a max'd out MacBook Air are comparable and a valid comparison.

Re:Nothing

[cjjjer]

his response was 'No, I think your account was hacked, since the email came from you.'

With this quote you want the OP to install Linux for him? LOL good luck with that...

60yo? Facebook? AOL?

[Anonymous Coward]

In his 60s? A regular on Facebook? Still uses AOL? Believes he's in no danger?

Just cut him loose, man. He's a dinosaur on a path to total self-destruction.

Re:Nothing

[Walter White]

You start by doing the most obvious thing, that is making sure all their software is up to date.

That's a little problematic on Windows, no? You have to open each app ever installed and figure out how to check for updates. Definitely a non-trivial issue. (One of the benefits of Linux package management is there is a single spot to update all S/W installed within the package management framework.)

Next you install FileHippo Update Checker and tell it to ignore beta releases.

Does this solve the problem for all installed software on Windows?

Re:Nothing

[mcgrew]

Yep, that way instead of having to explain email to his uncle, he gets to explain DOS

See how stupid that sounds when you turn it around? From the end-user's prospective there is no more "learning Unix" in any modern distro than there is learning DOS commands to use Windows.

As to Open Office, anyone who knows MS office will have no trouble migrating to Oo, especially if they've suffered from an MS Office upgrade.

Needlessly complex tools

[sjbe]

People like you are the real problem.

You mean people who recognize that others have better things to do than waste their time learning a needlessly complex device? People like you are the reason Apple and Google are worth billions and you aren't because they understand design and you pretty clearly do not.

Computers are working tools, and manipulating a tool is something that must be learned.

So we should make tools intentionally difficult to use? I should have to learn a programming language to adjust the temperature on my thermostat? If someone cannot be trained to do a simple task quickly with a tool then the tool is badly designed. That is 100% the fault of the designer. While there is a learning curve to everything, it is a question of degrees. A tool that is unnecessarily hard to learn just because the designer could not be bothered to make it simpler is a bad tool. (and the designer of that tool is bad at design) Just because you can figure it out with sufficient effort doesn't mean it is a useful application of time and effort to do so.

Many people seem to be strongly opposed to trying to understand how a computer works to use it, but sorry, that's just the way things work.

So you know everything about how how an airplane works? You know enough to do all your own home repairs, no matter how complex? You know everything about engine repair and never need a mechanic? Of course you don't. Computers are tools and you can get useful work out of a tool without knowing all the details about how it works. In fact it would be a HUGE waste of money, brains and time for you to try to learn all of that.

People not trained in the use of machine tools are not allowed to use them, it should arguably be the same thing for computers.

I run a manufacturing company that uses machine tools. Very few of our employees know how to use even most of the features of them and yet they are able to do their jobs and do them well. They are trained on the bits that apply to their job and we try to keep those as simple as possible. They don't care about all the arcane details of the tools and they don't need to. If someone cannot be trained to do a simple task quickly with a tool then the tool is badly designed. Computers are no exception.

Re:Needlessly complex tools

[loufoque]

So you know everything about how how an airplane works?

I'm not the one driving the plane, but I certainly expect that the pilot and his team certainly know how it works, yes.

You know enough to do all your own home repairs, no matter how complex? You know everything about engine repair and never need a mechanic?

I like work to be well done, so either I spend a lot of time studying the problem domain and attempt to do it myself once I'm confident that I can execute the proper procedures, or I contract a professional to do it for me.
I advise other people to do the same.

Computers are tools and you can get useful work out of a tool without knowing all the details about how it works. In fact it would be a HUGE waste of money, brains and time for you to try to learn all of that.

Actually, studies clearly demonstrate that investing time to be more familiar with the tools you use daily make you significantly more productive than any productivity-enhancing methodology.

If someone cannot be trained to do a simple task quickly with a tool then the tool is badly designed. Computers are no exception.

So you agree a minimum of training is required. Most people using computers have no training at all.
Programming a computer is a basic skill, and should be taught in school along with mathematics and physics (especially since it's essentially the same thing).

Re:Needlessly complex tools

[jedidiah]

> You mean people who recognize that others have better things to do than waste their time learning a needlessly complex device?

THEN DON'T USE ONE AT ALL.

It would be considered an obvious conclusion if we were talking about any other device but it seems to be a total taboo if we're talking about computing.

People like you are why cars kill more children than guns.

Digital signatures are too complex an idea

[sjbe]

The only way to guarantee that someone sending an email is really who he claims to be is digital signing, and for some reason no one uses it.

No one uses digital signatures because hardly anyone understands digital signatures. Seriously, I can count one one hand the number of people among my family and close friends that understand what a digital signature is, why they should care about them and are able to figure out how to use one. Even if I sent one, virtually no one I email would have the slightest idea what I was doing. And 99.9999% of the time a digital signature would be of no value even if I did use it because it's quite rare that someone tries to spoof my email. I'm not even convinced the tools CAN be made simple enough to bother, though I recognize the potential value of digital signatures. Maybe they can be made easy enough to use but certainly no one has accomplished that feat yet.

Re:Digital signatures are too complex an idea

[loufoque]

The way I see it, the main problem with digital signing is that you need to manually retrieve the signature of someone (which involves him publishing it on a website, which for added security needs to have proper security certificates) and add it to a database so that you can indeed check that the signature at the end of his emails matches his/her signature as it was published on a trusted source.

I believe that if governments provided a trusted online database with the signatures of all citizens it would make things significantly easier to use. This could even be used as proof of identity in official cases.

Re:Digital signatures are too complex an idea

[sjbe]

The way I see it, the main problem with digital signing is that you need to manually retrieve the signature of someone...

The problems are more basic than that. First off, very few people even know what a digital signature is. The name is misleading because they aren't signing anything in a sense that resembles what they consider a signature. Even if you show them one, to them it's just a bunch of random characters (which is almost correct) that bears no resemblance to anything in their actual life that they can wrap their head around. Then if you get over that hurdle (big if), they have to know how to create a digital signature, properly publish the keys, include it in their email, and revoke/maintain keys when necessary. Not one piece of that is particularly easy. They basically have to become a expert in a basic form of public/private key cryptography. Worse, for any of this to be of any use the recipient has to understand all of that just as well as the sender. Every single step in this process currently fails the so called Mom Test. (could you explain this to your technologically illiterate mother?)

What is telling is that even the geeks who hang out here on slashdot almost never use digital signatures in spite of their calls for their use. They're too much of a pain to use even for the people who are capable of understanding all the stuff I outlined above.

I believe that if governments provided a trusted online database with the signatures of all citizens it would make things significantly easier to use.

As soon as you involve a third party, you have all kinds of potential trust problems. I don't really regard the government as any more trustworthy than a private enterprise and in some ways I find government less trustworthy. Digital signatures work precisely because they don't really require a trusted third party.

Re:Digital signatures are too complex an idea

[loufoque]

The government is already handing out ID cards and passports, which are essentially the same thing except they can't be used in the digital world.

Re:Digital signatures are too complex an idea

[andy.ruddock]

Use OpenPGP, there's the Enigmail plugin for Thunderbird, and a plugin for Outlook. Pretty sure there'll be something for Mac.
Certainly Enigmail can be configured to automatically fetch other peoples public keys.

Re:Digital signatures are too complex an idea

[sjbe]

The government is already handing out ID cards and passports, which are essentially the same thing except they can't be used in the digital world.

A signature is very different from an ID. Signatures are evidential marks indicating the identity and will of someone one a document. However they cannot confirm identity by themselves which is why you typically are required to provide some form of identification in addition to authenticate the signature. A digital signature is very similar to a traditional signature with some advantages (harder to forge if done properly) and some disadvantages (complicated to use) but it cannot by itself serve as a form of identification.

An ID is a document used to prove that the person standing right in front of you holding that document is indeed who they say they are. This gives two of the three things you need for authentication (something you have which is reasonably likely to be unique and something you are). Signatures provide a weak form of a third confirmation (something you know), but is not something you have nor is it something you are and thus needs corroboration to be useful for authentication - for instance in the form of a notary or a witness.

Furthermore the only reason I have a driver's license or a passport or a social security card is because I legally need them to travel and work. I did not get them because I regard the government as a trusted third party but rather because there was no realistic alternative. In fact I'm old enough that my social security card actually says "not to be used as a form of ID" right on the card even though that totally gets ignored because it was convenient to do so. No one has those documents aside from me (unless they have forged a copy) and almost every use of them requires my physical presence. A signature is a convention by which we indicate that we have seen and possibly agreed to the contents of some document. The confirmation of my identity is made separately in most cases.

Even if we trust the government as a third party, it doesn't really solve the other problems with digital signatures. People still have to understand how to create them, distribute them, revoke them, how to know when they are compromised and how to actually use them. I don't see an easy solution to those problems.

Re:Digital signatures are too complex an idea

[loufoque]

The private key is the equivalent of the physical card that only you own.
The public key is the facade of the card as you show it to people.

Even if we trust the government as a third party, it doesn't really solve the other problems with digital signatures. People still have to understand how to create them, distribute them, revoke them, how to know when they are compromised and how to actually use them. I don't see an easy solution to those problems.

I'm afraid I don't see your problem.
The governments clearly take care of all the points above, just like they take care of creating passports, distributing them, revoking them, and knowing when they're compromised.

Just tell them

[Virtucon]

It's Malware.. MMMkay and it's bad MMMkay

Geebus what a ridiculous question. Non Techies? Really? Look just give them an analogy that malware is like an STD. If you sleep around without protecting yourself, you'll get one and then your penis will fall off.

Mom was hacked 4 yrs ago. Happily running Linux si

[Anonymous Coward]

My Mom was hacked by a relevant email with a link that made sense to her. The email FROM was a granddaughter's address and about pregnancy. The granddaughter WAS actually pregnant, so this fit.

Mom clicked the link using her Windows PC. She knew immediately that was bad based on what followed, but wasn't smart enough to unplug the box. She tried to close windows and shutdown - because I'd been so careful to make sure that she knew that was the "proper way" a decade earlier.

Her PC was a Pentium4 with 1GB of RAM.

She didn't tell anyone there was an issue. She just started re-using the PC the following day for surfing and emails. It became slower and slower over time. I tried to remote in to fix it and couldn't. I told her not to use it for anything that wasn't trivial. No airline stuff, no stock market anything, and definitely ZERO banking or email. 2 months later, I finally made a trip there - she's 4 states away - and I loaded Lubuntu on the box. She's still running Lubuntu and in a few weeks I'll migrate her from 10.04 to 12.04 LTS release.

She like Lubuntu. It is easy, simple, relatively secure and I can remote in easily. I've added weekly patching of her box to my normal weekly patching server list, so it isn't any extra effort for me at all. I'd already had Mom using Firefox and Thunderbird on Windows, so migrating to using them on Linux was nothing extra.

I even got Quicken running through WINE in 2009.

This summer, that P4 motherboard died. I haven't be for a visit, but I was able to talk a PC knowledgeable person through swapping the HDD out for a new computer. Inside the new PC, everything was exactly as before. All her data, programs, settings. Only the /etc/udev/rules.d/70-persistent-net.rules had to be deleted so the static IP would be put back so ssh port forwarding from the router would keep working. NOTHING ELSE WAS CHANGED. 100% working. No license crap to deal with. The new machine is a Core i7 monster, but Mom just thinks it is a little quicker, not 200x faster, thanks to the highly efficient Lubuntu OS and GUI.

With the new Core i7 w/ 8GB of RAM, I could setup VirtualBox and give her a WindowsXP VM for Quicken, TurboTax and a few other Microsoft-Windows-only programs. Nah ... don't want to open that Pandora's box again.

She's better off and happier with Lubuntu. Definitely do not inflict Unity on anyone. Keeping the interface as much like WniXP has been good for her.

THE INNERNET!

[Jeremiah Cornelius]

IS FER PWN3'n N00BZ!

DRDOS? MSDOS?

[Anonymous Coward]

DOS is an operating system? The only DOS that I know of is denial of service attack.

I remember Solaris. George Clooney, Natascha McElhone and Viola Davis where in that movie.

Tell him you don't know what you are talking about

[Anonymous Coward]

because he received the mail and didn't click the link. Yet. He was smart enough to call you and verify if you were the sender before clicking on it. Since you declined he is safe, and doesn't need to do anything else.

Tell him his computer is broken...

[John Hasler]

...and that he should take it to PC Doctor and have it fixed. There is really nothing else you can do as there is no hope of convincing him to stop using Windows.

Re:Nothing

[SCHecklerX]

http://www.zdnet.com/blog/security/safarimacbook-first-to-fall-at-pwn2own-2011/8358

Malware is an end user problem. Computers exist to, yup, run software. When you aren't careful about what you are running, you run bad things. No technology is ever going to stop that without making general use computing pretty useless. The problem is that most computer users are not educated, and worse, are overly trusting of their 'security' software and the ads they see on tv to 'make your computer faster'.

The solution is education:
- only install software from trusted sources, that you explicitly install (this is where that whole unix permissions thing works better than the alternative)
- keep the software you do have installed patched and up to date (much easier these days, has been easy in linux longer than in windows or mac worlds)
- install adblock, and maybe even noscript for your browser and use them.
- don't click on random links from unknown sources in email. Not even from friends, if the link seems 'out of character' for them.
- do not run unnecessary software or services on your computer
- don't use software that provides easy vectors for malware. Unfortunately, microsoft office and even libre and openoffice fall into this category. But not opening these types of files from unknown sources somewhat mitigates this. Again, *THINK*.
- use a hardware firewall at home (this probably isn't an issue these days, as that is the way things come by default now)
- use a software firewall on laptops (even windoze does this by default now, but it will still merrily broadcast all kinds of SMB nonsense. Most home users don't have a need to run client and printer sharing at all, however, so it should simply be disabled anyway)
- have a good backup strategy, USE IT, and TEST IT. Re-installing an operating system isn't that big a deal. Losing your digital life's history could very well be.
- don't aggregate your 'cloud' stuff between facebook, google, dropbox, whatever. As far as storing things in the cloud? Probably not a great idea, despite the convenience. Better to spend a little money on a home NAS.

And, for those of you who make a career out of keeping your co-workers and families safe
- Transparent dansguardian proxy
- Sendmail + Mimedefang + Spamassassin + ClamAV

But, again, it's a behavior problem. The above solution are more to cut through the cruft. Ultimately, end users need to understand safe computing.

Re:Nothing

[stenvar]

I would have said the reverse. The menu bar being at the top creates modality that makes it easy to discover which windows belonging to a given application. In the Windows/X11 world, trying to figure out which application a particular window came from can be a usability nightmare

People don't usually care what "application" a window belongs to; the fact that you care on the Mac is a holdover from the Mac's single tasking heritage (where the entire menu bar paradigm originated). What people do care about is that the menu entry they select operates on the document they are working on, and people get confused about that relationship on the Mac.

Or SSH or iChat/Messages screen sharing. The latter makes more sense for home use, IMO.

SSH isn't a good option because OSX command line administration is extremely obscure. iChat is mac specific.That points out another problem with switching to Mac: if you switch your parents, you really have to buy another Mac for yourself and set up Apple-related accounts and infrastructure everywhere. You can't maintain a Mac if you don't use one yourself, it is just too different.

I went down that road; bought a Mac for my parents and a MacBook and desktop for myself. It was a lot of work. In the end, the small benefits of OS X over Windows just didn't justify the big expense and work. A couple of machine generations later, my parents are on Linux, I'm back on Windows and Linux, and we're all a lot happier.

Re: Nothing

[Urza9814]

My mother is your stereotypical baby boomer who can't figure out tech...can't figure out how to connect a new monitor to a desktop; asks me every time I'm home what the difference is between an app and a mobile site....and she's been using Ubuntu for a few years now. Of course, even though the menu is at the top, all the icons are different, all the names are different...she still can't understand that is not Windows.

Thing is, people like that see computers as an appliance where they've been trained on certain tasks. Replicate those tasks and you're good to go. In her case, she uses thunderbird instead of outlook express, open office, and still has Firefox. And that's all she uses. And now I don't have to worry about making sure antivirus or a firewall is running and up to date (she'll never get that, and it's amazing how she can somehow end up with those disabled every time.) So she can't go buy any random software and install it. Doesn't matter. She wouldn't be able to do that on Windows either, and she'd need me to even know that she wanted to in the first place.

When she used Windows I was fixing the pc every time I came home. With Linux, I haven't touched the thing since I set it up a couple years ago. For people like that (and their family geeks,) it actually is a better choice.

THIS GUIDE

[Anonymous Coward]

To "immunize" a Windows system, I effectively use the principles in "layered security" possibles!

http://www.bing.com/search?q=%22HOW+TO+SECURE+Windows+2000%2FXP%22&go=&form=QBRE

I.E./E.G.-> I have done so since 1997-1998 with the most viewed, highly rated guide online for Windows security there really is which came from the fact I also created the 1st guide for securing Windows, highly rated @ NEOWIN (as far back as 1998-2001) here:

http://www.neowin.net/news/apk-a-to-z-internet-speedup--security-text

& from as far back as 1997 -> http://web.archive.org/web/20020205091023/www.ntcompatible.com/article1.shtml which Neowin above picked up on & rated very highly.

That has evolved more currently, into the MOST viewed & highly rated one there is for years now since 2008 online in the 1st URL link above...

Which has well over 500,000++ views online (actually MORE, but 1 site with 75,000 views of it went offline/out-of-business) & it's been made either:

---

1.) An Essential Guide
2.) 5-5 star rated
3.) A "sticky-pinned" thread
4.) Most viewed in the category it's in (usually security)
5.) Got me PAID by winning a contest @ PCPitStop (quite unexpectedly - I was only posting it for the good of all, & yes, "the Lord works in mysterious ways", it even got me PAID -> http://techtalk.pcpitstop.com/2007/09/04/pc-pitstop-winners/ (see January 2008))

---

Across 15-20 or so sites I posted it on back in 2008... & here is the IMPORTANT part, in some sample testimonials to the "layered security" methodology efficacy:

---

SOME QUOTED TESTIMONIALS TO THE EFFECTIVENESS OF SAID LAYERED SECURITY GUIDE I AUTHORED:

http://www.xtremepccentral.com/forums/showthread.php?s=672ebdf47af75a0c5b0d9e7278be305f&t=28430&page=2

"I recently, months ago when you finally got this guide done, had authorization to try this on simple work station for kids. My client, who paid me an ungodly amount of money to do this, has been PROBLEM FREE FOR MONTHS! I haven't even had a follow up call which is unusual." - THRONKA, user of my guide @ XTremePcCentral

AND

"APK, thanks for such a great guide. This would, and should, be an inspiration to such security measures. Also, the pc that has "tweaks": IS STILL GOING! NO PROBLEMS!" - THRONKA, user of my guide @ XTremePcCentral

AND

http://www.xtremepccentral.com/forums/showthread.php?s=672ebdf47af75a0c5b0d9e7278be305f&t=28430&page=3

"Its 2009 - still trouble free! I was told last week by a co worker who does active directory administration, and he said I was doing overkill. I told him yes, but I just eliminated the half life in windows that you usually get. He said good point. So from 2008 till 2009. No speed decreases, its been to a lan party, moved around in a move, and it still NEVER has had the OS reinstalled besides the fact I imaged the drive over in 2008. Great stuff! My client STILL Hasn't called me back in regards to that one machine to get it locked down for the kid. I am glad it worked and I am sure her wallet is appreciated too now that it works. Speaking of which, I need to call her to see if I can get some leads. APK - I will say it again, the guide is FANTASTIC! Its made my PC experience much easier. Sandboxing was great. Getti

Re:Nothing

[Anonymous Coward]

Oh hey, did you know you were on Penny Arcade? You were featured as "last commenter in panel 2". http://penny-arcade.com/comic/2011/05/16

Re:Nothing

[Anonymous Coward]

If you want to get them a platform that won't be targeted by malware authors for quite some time, install Linux Mint on their PC.

Just out of curiosity:

Sometimes I've heard people claim that Linux's design makes it next to impossible to get infected via a web page (or e-mail URL).

Is there any basis for this claim?

Re:Nothing

[sudon't]

That's what I tell all my friends and relatives - get a Mac next time. Way easier for them to figure out and use, and everyone who's taken that advice has been grateful, and thanked me. Think of that! After that, the only thing you need to tell them is to use a non-admin account, make one good password, then setup, and show them how to use Keychain. I'd like to get them to use the email app, but ok, if you like webmail, fine. Plus, when I have to work on it for them, which is rare, it has a shell. No more "hacked" accounts, no more virus paranoia, and no more obscure problems every f^^ckin week. OTOH, they all stop calling me after a while, and I start to feel like the Maytag repairman.

Re:Nothing

[Omestes]

Does this solve the problem for all installed software on Windows?

No. But it works on enough. Remember that this isn't about you or me, or us nerds, this is about an older guy who isn't big on computers. He probably doesn't have a/several TB HDDs full of stuff. My Biweekly update fest is annoying, but I have it down rather well. FileHippo gets around 50% of my installed software, another bunch is old and doesn't update (or has built in updating), leaving around 6 or seven programs I have to manually update. If he is using popular software, he probably won't have to update much of anything by hand. Windows takes care of all MS apps, Filehippo takes care of most popular software, and everything else takes care of itself.

If he is anything like my own father, his biggest problem is relatives installing crap, and teaching him basic security (don't install crap from sources that seem dubious, don't click on links that seem dubious, treat installing software like answering your door). I've been trying this for around 10 years now, and I admit I haven't had any success. Especially the former, of late. Every single kid/stepchild/grandchild who comes over now treats his computer like their own, which basically means that even if I trained my dad, I have to deal with the bad habits of everyone else. It is worse since he now runs a rather lucrative business, and keeps tons of information on his computer, or in places where his computer has quick access. Sure, I could talk him through accounts and security, but it would be about as useful as trying to teach him to macrame, in Klingon.

Hell, one of the kids (ex-husband of his wife's daughter) decided to fix some internet problems by opening up their wifi, no password, no nothing. He used to work for Cox, so obviously he is more trusted than me, whose only been working on computers for 30 years, and only set up their whole network, and all their systems. Not that I can't understand where he was coming from, my dad has a completely different password for EVERYTHING, but all of them are variations of the same four things (dog name, his birthday, his wife's birthday, and their anniversary) (try poopsie3445, no? try 4534poopsie, no? try 121792poopsie? try p00psie1217344592, no?).

Ditch Windows - Get Ubuntu

[Anonymous Coward]

Windows security is so hopelessly broken that only experts can properly secure it. Just imagine what can go wrong when you want to install Skype.

Muha

[Anonymous Coward]

or just take a Ubuntu or Mint CD, install in 20 minutes and be done with it. No "special" browsers and virus scanners required whatsoever. It comes with firefox, open office and gimp. No need to twist your mind around the Ribbon.

And all software+updates from a defined, dependable and secure source.

Re:Muha

[hairyfeet]

And you don't even have the balls to make an account so why should anybody listen to you? Oh and here is How to write a Linux virus in 5 easy steps but you hang onto that "magical thinking" because it sure did protect all those Apple users from the non existent MacDefender and MacGuardian...oh wait. Well it at least protected all those android users because of the excellent Linux kernel protecting them...oh wait.

NEWS FLASH: there is NO SUCH THING as an OS that doesn't have bugs and vulnerabilities, which is why you airgap sensitive systems. All your "solution" does is use security by obscruity alongside a truly shitastic ecosystem where a billion devs "do their own thing" and make changes for the sake of change, make things incompatible for no damned reason other than they can, and where the kernel on up is like the shifting sand with ZERO QA or QC so the driver that works now probably won't work when the 6 month upgrade deathmarch comes. Hell even one of the Red Hat Devs says the current desktop is shit, and you wanna hoist it off on somebody who is barely able to use a PC? Yeah maybe if he hates his dad's guts and wants to see him suffer maybe. After all a broken machine is 100% virus proof as well, not gonna be very useful though.

Ubuntu 10 LTS Sound

[Anonymous Coward]

..is very good. Skype works as expected.

WRONG

[Anonymous Coward]

Just install Mint Linux and claim it is the "latest, much more secure version of Windows".

Yeah !

[Anonymous Coward]

First, shell out serious money for an insecure operating system.

Then shell out more money to attempt to secure that OS.

Finally, take away the user's right to administer the system.

Or, get Mint Linux for free and be done with the security nightmares.

Re:Nothing

[Sfing_ter]

I did this too for my daughter in her second year of college. After bringing the Winxp laptop home fully infested with spyware. At the time I was using mepis. Quickly showed her around and sent her back to school. She had a few issues, but her school's computers had OpenOffice on them so no issues there. She was virus free for 3 years, playing her mp3s and sharing photos etc. and the techs at the school loved it that someone other than they used linux. Her senior year she got a mac - so instead of saying "I have a Linux Box", where she would get looked at by others saying "WTF???", she could now say "I have a mac", and they would give her a sympathetic look and pat her on the head and say "We understand".

The point is she understood what she wanted to do and figuring out how to do it whether or not it is Windowsx, Linux or MacOS is not that difficult anymore.

Re:Nothing

[K. S. Kyosuke]

it irritates me to no end that email programs still insist on showing the reported sender's address instead of displaying the actual source address like they ought to

Pray tell, what is "the actual source address"? Perhaps my dynamically-assigned IP with a nonsensical reverse lookup domain name? I don't think so.

Share in his guilt

[Anonymous Coward]

"Looks like they might have hacked both of our accounts, just to be safe I think we should both change our passwords."

Re:Nothing

[Cinder6]

Oh, you don't seriously think that they walk into the Apple store and leave just having bought a naked MBA. They'll get talked into buying the extended maintenance ("since it's such a valuable laptop"), sleeves, maybe an extra charger, USB sticks, and god knows what else, all crap you don't need with a Chromebook.

And you don't think the salesguy would try to upsell you on that stuff if you bought a Chromebook? Hell, retail stores try to sell you extended warranties on $60 video games; of course they will try to sell you one for a $200 computer.

Get a Mac

[Anonymous Coward]

Those commercials helped people understand this stuff more than any tech article

Re:Nothing

[hairyfeet]

My dad was the same way, here is how you solve that. You set up Win 7 (or whichever one he's on) to time out to the screensaver after 20 minutes and have it require a password, since everybody knows his regular password (and this is strictly for local access) I'd suggest using his social. You then set up a limited user in Win 7 that doesn't require a password and ONLY has the software you pre-approve of. In the case of my dad's PC it has only Comodo Dragon with ABP, no IE links anywhere, no file explorer, and the Windows Games, that's it, that's all the can run. If they don't like it? Go fucking home and hose your own system, thanks a bunch.

Now if my idiot cousin or my dumbass uncle come over they can still check their mail, hell my cousin can even shop on amazon for parts for that damned vette he is putting together, but they can NOT install shit, modify shit, or mess shit up. Works like a charm friend, I used to have to deal with my dad's system all the time, now with this in combination to the little "idiot proofing" I posted earlier? Haven't had to mess with it for over a year now, and even when I did have to mess with it it was simply to load a new USB HDD and set the backup schedule as his old one finally bought the farm.

A little knowledge is a dangerous thing

[Zero__Kelvin]

" it doesn't matter which you are using if the exploit is aimed at the browser."

Of course it matters. If you are a newbie running many versions of Windows, the browser is running with Administrator privileges unless you go out of your way to lock it down. If you are running Ubuntu Linux , then they can just sudo to gain the same level of OS access. If you are running a real OS, then they might explout the browser, but they still can't own the OS. Also, plenty of "browser exploits" use the browser as an attack vector, but the flaw exploited is in an OS library, which will not have the same vulnerability on a different OS.

Your best bet ...

[Zero__Kelvin]

". When I tried explaining what the link was, that his account had been hacked, and that he should change the password to his @aol.com email account, his response was 'No, I think your account was hacked, since the email came from you."

Your best bet is to stop trying to explain things to him until you understand them yourself. Nobody's account was cracked. Neither your e-mail, nor your Uncle's, has to be cracked for someone to forge an e-mail. Any script kiddie can send an e-mail to anyone else that claims to be from whomever they want. All that is needed is an open SMTP port. RFC 822 See also RFC 822

Re:Nothing

[Grishnakh]

Oh please, you're living 10 years in the past.

Grab the latest Linux Mint KDE and install it on fairly recent hardware: it "just works", as long as you have decent hardware (the more Intel parts, the better). I've never had any problems with PulseAudio, and you can avoid the whole GNOME mess by using KDE, which works just fine now. The KDE4 alpha-quality debacle was 4 years ago. Get over it.

Re:Nothing

[Grishnakh]

Don't be stupid. Even the biggest moron knows that buying a reliable car (versus an unreliable car) isn't going to protect you from a speeding dump truck or other road hazards, but that it's still smart to pick a reliable car so you don't have to deal with too many mechanical failures. It's the same way here.

Re:Nothing

[Grishnakh]

Probably not; a serious browser vulnerability could still lead to some sort of malware infection, in theory. However, since the user almost never runs the browser as root on Linux, the malware could only affect that user's account (barring a second, privilege-escalation vulnerability that the malware knows about and can take advantage of) rather than the whole system, but for a single-user system that's probably cold comfort. But more importantly, with the underlying OS being different than the other two OSes which have much greater marketshare and popularity, and also possibly some of the system-dependent code in the browser being different OS-to-OS, a vulnerability in Browser X on Windows, exploited by Malware A, probably isn't going to be a problem on Linux, and the malware authors are unlikely to bother making a Linux version since so many more people use Windows and Mac. Of course, with mobile OSes becoming so popular, both iOS and Android are probably going to be targeted by malware too, but even in the case of Android, the system is very different from Linux (aside from the kernel, which is nearly identical), so Android vulnerabilities are unlikely to affect Linux.

Re:Nothing

[jedidiah]

...which does fuckall for forged headers or any other subtle form of phishing that depends on stupid people being complacent.

      If you're a Mac user kidding yourself in this manner, then you are the proverbial old geezer that has no social defense mechanisms against telemarketers.

Re:Nothing

[jedidiah]

AOL and Yahoo accounts tend to get hacked. It's best just to avoid those services entirely. You also have to acknowledge the possibility that yes it is YOUR email service that got hacked rather than the victims.

I thought it rather insightful of the "n00b" that the originating account could have been hacked. I also found the dismissiveness of the "expert" to be unwarranted.

Welcome to my Life

[thewolfkin]

There is a level of technological savvy that's vastly underestimated. There are TONs of people out there using AOL and Hotmail and stuff and these are your family. You can't just let them hang. Do your best to migrate them. Gmail will have a lot more security and it will let you import AOL. Heck lie, tell him you got mail from him so it's both of your accounts are hacked. Whatever it takes. I'm not trying to go full on Machiavellian but there's some validity to the thought: Ends justify the means. Shame it's an online problem or you could just install teamviewer and clean it out yourself. I find sometimes chicanery is the most efficient way to deal with these types of situations. Sorry.

Re:Nothing

[jedidiah]

It all depends on the requirements.

Apple fanboys like to gloss over that part: the actual end user requirements.

They may be far less than what is warranted for an overpriced token of conspicuous consumption. They could also be far more interesting than what can be done with something that's crippled in the name of ease of use.

What's the user going to do with it? That's the most important question.

Re:Nothing

[dgatwood]

The user isn't dumb, s/he just has better things to do than become a Software Engineer just to use what has become an everyday appliance. The problem here is bad design, period. Accept that and maybe we can move on.

And that attitude is precisely why we have the security problems that we do. Viruses and trojan horses are design problems. Phishing is not, unless you consider the fact that anyone can create a website without "adult supervision" to be a design problem. Short of removing the ability for arbitrary people to create websites without audits, you're never going to prevent phishing, because there will always be someone clueless enough to believe that a2342730872983.ru is really Chase Bank's website.

When it comes to phishing and other social engineering attacks, unless you did something really, really obviously wrong in your design, the core problem behind phishing is always lack of proper security consciousness on the part of the person who got attacked. Don't get me wrong, bad UI can make things worse by hiding critical information or making it too easy for people to hose themselves even when they do know what they are doing, but for the most part, modern software is way beyond that point already.

Sure, there are some UI design decisions and software design practices that can make it so that people don't have to understand as much, but the problem is that the farther you go down that path, the more your users treat the device as an appliance, and the more you need to protect them. (Ironically, the very ease of use that makes computers so great at transforming society also leads to the false confidence that makes phishing attacks possible, and thus makes computers seem harder to use.) At some point, protecting users from their own lack of skills becomes a vicious cycle that can only end in locked-down devices with no ability to tinker and no ability to access the Internet except through specific websites that are specifically designed to have no outgoing links—basically shutting off the Internet and going back to the world of curated BBS companies like AOL. I mean, if a Netflix viewer is what you want, that's fine, but it isn't a computer anymore at that point.

As long as arbitrary people can create arbitrary content without bounds, naïve users are not safe. Period. Heck, as long as users can add apps without each one going through a meticulous code review to look for backdoors, easter eggs, etc., there is at least some possibility that users are not fully safe (even if they are not naïve). The only way to completely and reliably prevent phishing and social engineering is to educate the users so that they are not naïve and do not make the mistakes that lead to their digital lives becoming compromised. Either that or make computers so hard to use that you need years of training to be able to use them, but that's probably not a change of direction that anyone wants to see.

Re:Nothing

[dgatwood]

People don't usually care what "application" a window belongs to; the fact that you care on the Mac is a holdover from the Mac's single tasking heritage (where the entire menu bar paradigm originated). What people do care about is that the menu entry they select operates on the document they are working on, and people get confused about that relationship on the Mac.

I think you have things backwards. I find myself having that problem in X11 every time I try to use it. On the Mac, there is exactly one non-pallette-style window that has focus at any time (bugs notwithstanding), and the visual style of the window's title bar makes it blindingly obvious which window you're working with. Therefore, when you pull down a menu, you can instantly see what window will be the target of that action. With floating palettes in X11, you have basically no idea what's going to happen when you click on it.

As for not caring what application a window belongs to, that's only true for very simple, document-based apps. As soon as you get into complex apps that involve multiple windows for a single task—multitrack audio apps, for example—it really helps to know that your menu bar is always going to be in one place and cannot ever be hidden, no matter how many windows you have littering the screen. The only good alternative is to waste space in every window with a redundant menu bar, and that's just bad UI.

Re:Nothing

[Anonymous Coward]

*shrug* I've been using Kubuntu on several machines for the past ~2.5 years, and have been using KDE 4.x (on Gentoo) since the 4.0 days. Kubuntu is perfectly fine for even the most non-technical computer user. (If we want to cherry-pick operations that suck ass in a given platform, let's talk about a) associating an A2DP headset with a Win7 machine, then b) routing existing (or, hell, even new) audio streams to the newly associated device.)

Re:Nothing

[stenvar]

and the visual style of the window's title bar makes it blindingly obvious which window you're working with. Therefore, when you pull down a menu, you can instantly see what window will be the target of that action

With Mac-style menus, when you're looking at the menu bar, you're not looking at the title bar, and that's exactly the problem. You can rationalize as much as you like, my parents really did get confused by this (and I tripped over it too when I was still using a Mac).

As for not caring what application a window belongs to, that's only true for very simple, document-based apps.

Yes, like the kind parents tend to run.

Re:Nothing

[disambiguated]

Viruses and trojan horses are design problems.

Agreed.

Phishing is not.

No, phishing is also a design problem, here's why:

Web authentication is fundamentally broken. We've known this since forever. The whole idea of typing your credentials into a web page is a poorly thought out idea. Authentication/authorization should be done out-of-band, in a way that cannot be plausibly emulated by the content of a web page.

There's a reason why phishing attacks don't work against your local computer account password. You get an email saying "your computer has been compromised, please go to this website and enter your user name and password" and you immediately know something is wrong, even if you have no idea how any of this works. Why? Because you're never asked to go to a website to do anything related to administering your local computer.

Actually, even without phishing attacks (which took a surprisingly (in retrospect) long time to become common) web authentication would still be horrible design, just from a usability standpoint.

This is what I do.

[xyourfacekillerx]

"Weird, I got an email just like that. I opened and the same thing happened! So I think it's a virus." No blame, no shame.

I dont' worry about it anymore

[Anonymous Coward]

After making the Nth four hour round trip drive to "fix" my parents PC, I ultimately got tired of it and wiped Windows from the machine and replaced it with Ubuntu. Has been running for quite some time now problem free. ( Ubuntu 10.10 ) Couldn't be happier.

If I had to do it today, it would likely be Linux Mint since the Ubuntu folks have obviously lost their damn minds.

Re:Nothing

[Muros]

That points out another problem with switching to Mac: if you switch your parents, you really have to buy another Mac for yourself and set up Apple-related accounts and infrastructure everywhere. You can't maintain a Mac if you don't use one yourself, it is just too different.

Just switch your parents for ones using Linux then. Duh.

Re:Nothing

[Anonymous Coward]

You seem to confuse "most vulnerable" with "most targeted". Just how hard was it for those OSX exploits to run rampant? If OSX was targeted more, then the "top threats" would be there and not in Windows.

It's like saying Israel is more vulnerable because they have the most rockets fired at them... Israel is one of the most secure nations in the Middle East, brother.

Now let's pick ourselves up, dust ourselves off and forget this fanboy slap-fight ever happened.

I promise I'm not crazy

[Anonymous Coward]

Ever heard of that "here, let me google that for you" website known as lmgtfy.com ? Well, someone had sent me a link to that with "f**k you" as the search phrase. And of course I had left that window's search results open. Mother of 7 kids living across the street asks me for help dis-infecting her malware and spyware infested computer, and in discussion, I offered to look up something online for her real quick about her particular problem. We go back to my screen, I enter my password to unlock it, and lo and behold is that search page still open with the F-bomb on it. I tried to reassure her that it was a friend who had sent me a link to that page, but it was no use; she thinks I sit around googling swear words.

Hacked ThirdParty + Address Forgery FTW

[billstewart]

Not sure why Anon. Coward got marked "Funny"? It's the most likely explanation, because it's in fact a common trick. If your machine is compromised, or even better if an email you sent to a bunch of people is received/stolen, it's fairly likely that many of the recipients know each other. And it's more effective to forge mail from one of the recipients than from the account that got compromised, because that leads to "You must have gotten hacked" "No, not me, must have been you" conversations between you and your uncle, instead of "Did you get hacked?" "Oh, yes, better fix that!" between your uncle and your cousin Alice who really did get infected.

it's like telling someone about the birds and bees

[Anonymous Coward]

just tell him to always wear protection. he will figure out the rest.

Re:Nothing

[hairyfeet]

All the stuff that is on a good 90%+ of PCs. You can tell it custom paths if you want it to check software it doesn't normally check but all the stuff most people have that isn't done by Windows Update, your Java and Flash, your third party browsers (although Dragon autoupdates so you don't need the Hippo for that) and most of the mundane everyday software like VLC or messenger, I'd say a good 90% of my customers FileHippo covers all the software they install and use.

BTW you want to save even more time you can use Ninite to not only do first installs but to also update the systems. just tell 'em to check the boxes on the stuff they use and hit run, that's it. No toolbars or other crap, no getting a bunch of dumb questions asked, its a fully automated install and that page covers most of the software your average user is running, from iTunes to .NET.