Hacker News new | past | comments | ask | show | jobs | submit login

I mean, the nigerian prince scam is almost a meme these days…



Interesting example. How does denying root to the user mitigate this attack?


Much harder to install a key logger or other such shenanigans.


Install a key logger, when they already have someone on the end of the line willing to install and run whatever software they request? Why?

I think the marginal security value of denying root on the computer when you have already wangled root on the human is small.


Prior to modern AI, one could be done at scale, now I suppose both can which may change my calculus on this one. I hadn't thought about that until your comment. Thanks!


This scam is much older than the Internet or even computers. It was called a Spanish Prisoner scam in the 19th century but I would be surprised if it wasn't happening in the ancient world via cuneiform tablets.


A meme is not a statistic. Exactly how many people have fallen for the scam, out of all computer users.

And how exactly does device vendor lockdown stop this particular scam?


> Exactly how many people have fallen for the scam, out of all computer users

Who the fuck knows ? And how is that even remotely a useful question to ask - it's not answerable, those who commit the scam are the only people with the figures, and there's no "register of fuckers who scam other people" where they have to tell you how well they do.

> how exactly does device vendor lockdown stop this particular scam

Premise 1: All (for a suitable definition of "all") computer users are clueless when it comes to internet security

Premise 2: You are not trying to help any given individual's security, because some of them violate premise #1. You are trying to raise the bar for the clueless hurting themselves.

Premise 3: It is not about "personal freedom". It is about preventing the clueless (by no fault of their own, this shit is complicated) becoming drones and mules for attacks on others. It is an attempt to increase the greater good at the expense of placing restrictions on what any individual can do on their own phone. Those restrictions can be mitigated mainly by coughing up $100/year, which is a sufficient bar to prevent bad guys from doing it en-masse, but not so high as to prevent the people who want to do stuff from doing it.

Stopping people doing stupid stuff because they don't know any better is the goal, and that inevitably gets more and more restrictive as time progresses, because an arms race is instituted between the truly evil arseholes who prey on the clueless, and the manufacturers who don't want their produces seen as vehicles leading the clueless to the slaughter.

Personally I don't give a crap. The iPhone is fine for me as-is, I can install my own software on my own phone, and sure it costs $100/year. That's not a big deal IMHO, in terms of outgoings it barely registers above the noise floor. YMMV.


> Who the fuck knows ? And how is that even remotely a useful question to ask - it's not answerable, those who commit the scam are the only people with the figures, and there's no "register of fuckers who scam other people" where they have to tell you how well they do.

Um, why do crime statistics have to come from the perpetrators rather than from the victims? The victims report the crimes, duh.

Anyway, you spent a lot of words avoiding my question, which is how exactly does vendor lockdown stop the Nigerian prince scam? You're arguing that vendor lockdown is supposed to protect consumers, but you can't seem to explain how or how often.


> Um, why do crime statistics have to come from the perpetrators rather than from the victims? The victims report the crimes, duh.

You asked for (quoting) "Exactly how many people have fallen for the scam, out of all computer users". Not every crime is reported, duh.

> Anyway, you spent a lot of words avoiding my question

Nope. I can't answer the question because it's non-answerable. If you believe that nobody has ever fallen for phishing, Nigerian-prince, etc. etc. scams, well, I don't know what colour the sky is on your world, but it's not the same as on mine...

If you further believe that allowing everyone root access to devices that are also linked directly to their bank accounts, social security numbers, driving licenses, etc. etc. Then again, sky colour becomes an issue.

You seem technically savvy. I do not believe you are typical of the average phone user. I think the restrictions in place are a necessary tragedy of the commons, to prevent the destruction of trust in the system as a whole.

As I said, YMMV, and I'm not saying I particularly like the situation, just that I think it's necessary, and opening up everything to everyone is a foolish, idealistic, and hopelessly naive idea.


> You asked for (quoting) "Exactly how many people have fallen for the scam, out of all computer users". Not every crime is reported, duh.

Not every crime is reported, but it's indisputable that a lot of crimes are reported. So give me a statistic, any reported statistic.

> If you believe that nobody has ever fallen for phishing, Nigerian-prince, etc. etc. scams, well, I don't know what colour the sky is on your world, but it's not the same as on mine...

How do you know this, except from reports by victims? That's what I'm asking for.

And once again, you haven't explained the mechanism by which vendor lockdown prevents this scam. However many or few victims there are of the scam, precisely zero of them are helped by vendor lockdown. I'm not going to stop asking how to explain how vendor lockdown is event relevant here.

> If you further believe that allowing everyone root access to devices that are also linked directly to their bank accounts, social security numbers, driving licenses, etc. etc.

This is hand waving, and it's not clear how root access by the owner of the device somehow exposes userland data to criminals. Moreover, all of this data is on desktop computers, and it's mostly fine.


[sigh] fine. You believe whatever you want.

As I said, I don't care about the current OS situation, I think it's actually pretty well reasoned out. I'm not spending my time tracking down statistics for you to "prove" some point to some other person on the internet.

I don't care enough to argue. Have a nice life.


> I'm not spending my time tracking down statistics for you to "prove" some point to some other person on the internet.

A simple Google search would do: "Nigerian prince’ email scams still rake in over $700,000 a year" https://www.cnbc.com/2019/04/18/nigerian-prince-scams-still-...

$700k a year as an excuse to lock down over a billion smartphones? Not to mention that once again, this is an email scam, and thus vendor lockdown is irrelevant and doesn't prevent it.

It appears that you're the one believing whatever you want to believe, despite the empirical facts. The problem is that proponents of vendor lockdown always make gross exaggerations to defend it, pure fearmongering.




Join us for AI Startup School this June 16-17 in San Francisco!

Guidelines | FAQ | Lists | API | Security | Legal | Apply to YC | Contact

Search: