<![CDATA[they have a solid point, y'know.]]>they have a solid point, y'know.

users don't have meaningful agency here, but businesses sure the fuck do, and the way tech has treated users is creating perverse incentives and frustrations.

]]>https://board.circlewithadot.net/topic/4e87e436-1abb-4e97-8962-0e58dd9cdec5/they-have-a-solid-point-y-know.RSS for NodeMon, 25 May 2026 06:24:26 GMTSat, 16 May 2026 22:23:38 GMT60<![CDATA[Reply to they have a solid point, y'know. on Sun, 17 May 2026 18:35:11 GMT]]>@phessler

Each individual user may not consider a given credential as worth needing MFA, but since most users reuse passwords, it's arguably better move for the ecosystem and site operators to require some kind of MFA. Otherwise, if one site gets popped, a wave of user accounts could be abused in bulk and require operator intervention. Whether or not mass lockout/reset is inconvenient enough for the individual user to think MFA is a good trade-off may vary.

@munin

]]>https://board.circlewithadot.net/post/https://infosec.exchange/users/tychotithonus/statuses/116591356263901188https://board.circlewithadot.net/post/https://infosec.exchange/users/tychotithonus/statuses/116591356263901188Sun, 17 May 2026 18:35:11 GMT<![CDATA[Reply to they have a solid point, y'know. on Sun, 17 May 2026 01:52:07 GMT]]>@munin I just posted about an attack on/using agentic finance bots that cost someone $200k. https://oldbytes.space/@arclight/116587393934910011

I still can't stop laughing at a Trojan NFT.

]]>https://board.circlewithadot.net/post/https://oldbytes.space/users/arclight/statuses/116587412016459881https://board.circlewithadot.net/post/https://oldbytes.space/users/arclight/statuses/116587412016459881Sun, 17 May 2026 01:52:07 GMT<![CDATA[Reply to they have a solid point, y'know. on Sat, 16 May 2026 22:58:09 GMT]]>@munin
I can never use online banking, and my bank may still allow my account to be compromised.

I can never fill out a form online with my address, but my address is still online because “public record”

I can never buy anything online, never use a credit card, but the combination of ALPR and security cameras means my shopping habits are still known when I shop in-person using cash.

Yeah, consumers are not the problem here.

]]>https://board.circlewithadot.net/post/https://infosec.exchange/users/TindrasGrove/statuses/116586727961618862https://board.circlewithadot.net/post/https://infosec.exchange/users/TindrasGrove/statuses/116586727961618862Sat, 16 May 2026 22:58:09 GMT<![CDATA[Reply to they have a solid point, y'know. on Sat, 16 May 2026 22:24:37 GMT]]>if you want users to take security seriously?

gotta give them some reason to think it will matter.

]]>https://board.circlewithadot.net/post/https://infosec.exchange/users/munin/statuses/116586596131887110https://board.circlewithadot.net/post/https://infosec.exchange/users/munin/statuses/116586596131887110Sat, 16 May 2026 22:24:37 GMT