Conversation

Notices

1. BrBr.Prime (bryanbrake@mastodon.social)'s status on Friday, 14-Apr-2023 22:45:37 JST BrBr.Prime

   • Kevin Karhan :verified:

   @kkarhan sounds good, but would fail... Same reason I don't use WhatsApp, signal, etc... People won't use it, and the second you don't get an important email from a customer or time sensitive email, they'll go elsewhere for email or have an email for 'unencrypted' comms, and you already lost.

   I used hushmail for years because it allowed for encryption of emails... Except I paid for a service no one uses..

   Encrypt the attachment if you need to, send the password in another way, like SMS

   • BrBr.Prime (bryanbrake@mastodon.social)'s status on Friday, 14-Apr-2023 22:45:33 JST BrBr.Prime

     in reply to

     • Kevin Karhan :verified:
     • DocRekd

     @docRekd @kkarhan

     I'd imagine y'all are on the same team as 'everyone should have a password manager', even the 'tech illiterate '

     Who do you propose speak to the 'tech illiterate ' about password managers? We cannot deal in absolutes in #infosec, or you're going to lose the 'tech illiterate '

     Do you blame the person or the tech for phishes?

   • DocRekd (docrekd@hachyderm.io)'s status on Friday, 14-Apr-2023 22:45:33 JST DocRekd

     in reply to

     • Kevin Karhan :verified:

     @bryanbrake @kkarhan
     I am of the opinion that a physical notebook you write password on is better than a KeePassXC account that is not used.

     Still modern browsers have an integrated password manager that is quite easy to explain and use.

   • DocRekd (docrekd@hachyderm.io)'s status on Friday, 14-Apr-2023 22:45:34 JST DocRekd

     in reply to

     • Kevin Karhan :verified:

     @bryanbrake @kkarhan
     That's because people *in general* have great difficulties reasoning about threat models, especially if in the middle of doing something, and attackers are known to use it to their advantage.

     And no tech literacy is *not* the answer

   • BrBr.Prime (bryanbrake@mastodon.social)'s status on Friday, 14-Apr-2023 22:45:36 JST BrBr.Prime

     in reply to

     • Kevin Karhan :verified:

     @kkarhan because 'security' people treat everyone like shit if they don't do everything EXACTLY as 'they' say...

     There's use cases where it's a hard requirement to send information with the highest possible encryption, then there's the 'hey honey, did I leave my socks in the dryer?' does that need the highest possible "Security"? If you say yes, then you're the problem...

     #security
     #informationsecurity
     #cybersecurity
     #email

   • Kevin Karhan :verified: (kkarhan@mstdn.social)'s status on Friday, 14-Apr-2023 22:45:37 JST Kevin Karhan :verified:

     in reply to

     @bryanbrake Personally, I'm just fed-up with excuses by ignorant & #TechIlliterates on why they don't encrypt their shit.

     It's not rocket science:
     Most eMail clients can do S/MIME and more than ever PGP/MIME out of the box.

     Also I'd see this as a beneficial feature as even if a provider has been hacked or otherwise taken over, the data is useless for anyone...

     Consider it an "additional Layer" for #ComSec & #InfoSec...