Low Tech, Low Security

You don't have to be a l33t hacksaw to obtain personal details, & until joe average starts thinking about security in the real world how can we expect them to take it seriously in the virtual world.

How can I make this statement, well, as it happens I have witnessed various people (smart & dumb) happily hand over all their personal details along with credit card details, write them down, hand them over, without any paperwork being given to the "custerom". Now I'm a defender, not an attacker, so I was dumb struck with how easy it was to attack. So how did this happen?

A personal friend hosted a "tupperware" party, so posters are put up, a sales person comes to your house & everyone comes & buys stuff.. easy.. this particual party was not tupperware, so what happened next may not be the norm, as people placed their order on a paper form they filled out all vital information. The sales person took all the forms & left, goods were delivered to the host of the party, with a copy of all the forms, card details etc. goods were handed to customers, everyones happy & the personal friend ends up with a whole bunch of credit card & personal details. hmmm how can people take on bored concepts of man in the middle in the computer world when they don't even get it in real life...

I've never blogged / published / anythings else.. so forgive the pants writing, but this "story" really bought it home to me that we really can not rely on user education to combat issues around personal information leakage & credit card fraud, be that real or virtual, we need to tackle the underlying attitude of trust that seems to be in built to most humans... I suggest we all smoke pot..