Email scam this morning. Not the usual.

[dickthegrouch]

1. Financial organizations are quite good at disseminating advice for non-experts

My bank has a whole Security Learning Center which is quite good
https://www.bmo.com/en-us/main/personal/security-center/learning-center/
(curiously it won't even display unless I deactivate my VPN, but they're trying).

Of course, like everything else, it requires people to have an attention span of more than 30 seconds, and understand the language.

Many people don't even know they are using a browser, far less what "mousing over an email address to read the domain name" means.

Even when I tell people explicitly what I want them to do as I diagnose some issue, they don't pay attention and do something different. The classic on this was many years ago when I told a customer (on the phone) to type "shutdown", he actually typed "reset" and then claimed the problem was still manifesting. I had him type "shutdown" again, and this time I only heard 5 characters being typed. I asked "What did you type" he said "reset". I had him actually type "shutdown" and the problem 'miraculously' disappeared. Then of course I tried to explain the technical difference between the two, but he wasn't interested.

Getting back to today's cybersecurity - I have always maintained that it's far better to have the computer do things humans have trouble with (repetitive, or complicated procedures), the Cybersecurity community IMHO has signally failed to enforce that in the programming so far.

It's actually quite disgusting that the un-trained user still has to perform so much of their own protection. For 40 years cars have had seat belts. Computers are equally ubiquitous and have barely any inherent protections for those untrained users, even after 40 years of destructive and dangerous experiences.