Forgot your password?
typodupeerror
Microsoft OS X Security Software Windows IT

Adobe Hopes Pop-up Warnings Will Stop Office-Borne Flash Attacks 125

Posted by timothy
from the ms-bob-is-on-the-case dept.
tsamsoniw writes "In the wake of the most recent zero-day attacks exploiting Flash Player, Adobe claims that it's worked hard to make Player secure — and that most SWF exploits stem from users opening infected Office docs attached to emails. The company has a solution, though: A forthcoming version of Flash Player will detect when it's being launched from Office and will present users with a dialog box with vague warnings of a potential threat."
This discussion has been archived. No new comments can be posted.

Adobe Hopes Pop-up Warnings Will Stop Office-Borne Flash Attacks

Comments Filter:
  • by Gothmolly (148874) on Friday February 08, 2013 @11:59PM (#42840799)

    This is why your data should not be executable.

    • by Darinbob (1142669) on Saturday February 09, 2013 @12:12AM (#42840857)

      People want convenience. And convenience is the mortal enemy of security.

      • by davester666 (731373) on Saturday February 09, 2013 @12:41AM (#42841027) Journal

        WTF is so convenient about having Word being able to display Flash content?

        Do a significant/noticeable number of people embed Flash content in their Word documents?

        How about Flash just preventing itself from running in non-browsers [and maybe their standalone Flash app]?

        • by rudy_wayne (414635) on Saturday February 09, 2013 @01:28AM (#42841249)

          WTF is so convenient about having Word being able to display Flash content?

          Do a significant/noticeable number of people embed Flash content in their Word documents?

          The number of people actually doing this for legitimate reasons is probably very small. The problem is, companies like Microsoft and Adobe must constantly release new versions of their software in order to keep a constant revenue stream. And that means constantly adding new "features" of questionable value.

          • by thegarbz (1787294) on Saturday February 09, 2013 @02:19AM (#42841455)

            While that may be true for flash specifically, the number of people who embed complex programming scripts into word documents is incredibly large. I've never worked for a company which didn't have some bizarre use for it.

            A small Pizza joint used a complicated array of javascript to automate their ledgers which were kept in an excel file rather than an accounting program.
            A biscuit factory I worked for actually managed to turn a very large collection of excel files into a rudimentary database with an insanely complicated set of scripts embedded in each file. This surprisingly worked, though you pushed a button and it would open many files in excel at once and the computer ground to a halt while computing the necessary ingredients for the next batch.
            Now I work for a large fortune 500 company and every word document is embedded with complicated scripting to automagically update footers and synchronise with a 3rd party document management system.

            While I haven't seen flash specifically it is not at fault here security wise, embedding programming languages into content files is, and that is incredibly common.

            • by ewanm89 (1052822)

              Excel technically is an accounting program, spreadsheets were first created to do double entry book keeping.

              It's better than most the other uses I've seen for it, like excel based databases.

            • by Titus Groan (2834723) on Saturday February 09, 2013 @08:07AM (#42842459)
              just because the software is flexible enough to do the job doesn't make it the right tool for that job. this system can indeed be built in house by those who don't have a full understanding of programming but do have a better insight in to the data that's being manipulated. it's going to be poorly documented and when it breaks or goes wrong very few people are going to be able to fix it for you. Do the job properly from the outset - hire a programmer and have custom software written to your spec. The false economy of using off the shelf products has led to many companies downfall.
              • by Shavano (2541114)

                I could not disagree more. An off-the-shelf program is very often a perfectly adequate tool for the job and has all the features you want. Most small businesses need the same things to do their accounting and only need slight customization within the range of what standard programs can be easily configured to do.

                It's easy to find somebody to explain how to use it or set up your custom installation. And your data will all be in a standard format. If later on you decide that LitteWare Accounting doesn't f

          • by DNS-and-BIND (461968) on Saturday February 09, 2013 @05:18AM (#42842015) Homepage
            I've noticed this in reverse: app reviewers on Google Play complain if the app hasn't been updated in a while - even if it is complete and stable. To the modern user, updating frequently doesn't mean "broken-ass program with lazy programmers", it means "normal".
          • this is why they're moving to software as a service. they've realised that the feature bloat is not sustainable.
        • Re: (Score:2, Insightful)

          by symbolset (646467) *
          Why fix on flash? Word can be Pwned by an image, an embedded spreadsheet, a document template, one of a hundred forgotten media formats - or even a font. It's a beautiful gateway to being pwned that requires no user interaction. You don't even have to open a document: it installs pwnable services to facilitate remote management by random strangers.
          • by cellocgw (617879)

            Word can be Pwned by an image, an embedded spreadsheet, a document template...

            Exactly. Add to that the fact that any jackass who's learned to click on "Developer" can create a macro. I recall one horrible Word macro provided to our company from a customer (this is in the DoD world, where all sorts of 'mandatory forms' are passed around). The concept was stupid enough: when this document template was opened, an autorun macro created an extra Menu item (back in the heavenly days before the cursed Ribbon) full of special macro-backed commands we had to use to fill the Word doc with h

      • by Nyder (754090)

        People want convenience. And convenience is the mortal enemy of security.

        I thought being cheaper was the mortal enemy of convenience.

        For example, "convenience" stores are only convenient because they are closer, not because they sell stuff at twice the price of grocery stores.

        But then I can see your point, because the convenience store doesn't hire a security guard, while the grocery store usually has 1 or 2.

        So yes, I guess your correct.

    • This is why your data should not be executable.

      I'm trying to figure out what possible reason to have Flash embeddable inside an Office document someone might have. Maybe you could argue that it's worth being able to embed in a PowerPoint slide, but even that is reaching.

      A forthcoming version of Flash Player will detect when it's being launched from Office and will present users with a dialog box with vague warnings of a potential threat.

      I think a better solution is to disable Flash entirely* when run from an Office document and instead display a message that says:

      "Flash has been disabled. To enable Flash content, contact your system administrator and he will come back there and hit you on the head with a tack hammer 'cause you are a retard [youtube.com]."

      * of course with the obligatory registry-key-bypass for corporate users

      • by symbolset (646467) * on Saturday February 09, 2013 @04:53AM (#42841963) Journal
        What does it matter? Office may as well be considered a remote access terminal server backend with system privileges for a metasploit frontend remote desktop client. The document preparation features are optional and in most cases redundant.
    • by hedwards (940851)

      And, this is why Adobe should have removed the ability of Flash to expand randomly to trick the user into clicking on something they clearly didn't want to click on in the first place.

      Well, not Adobe, that's why Macromedia should have done it and why webmasters shouldn't be doing it.

    • I hate to tell you this but code is data. Specifically it is the data about what you want the machine to do. There are methods to separate operators from operands, but none of them deliver the utility we demand.
  • Clever move (Score:4, Insightful)

    by physlord (1790264) on Saturday February 09, 2013 @12:03AM (#42840811) Homepage

    Yeah!. Since the average user totally understands the situation, that "vague warnings of a potential threat" will, obviously, solve the problem. Pure genius.

    • Re: (Score:2, Informative)

      by PNutts (199112)

      The "vague" warning on Office 2008 or earlier is below. The default is do not allow content to play. It's inline with other generic warnings so let's try to keep the FUD to a minimum.

      Also, Office 2010 has a Protected Mode sandbox. If it's from the Internet or Untrusted Zone the Protected View feature prevents it from running by default.

      "This document contains embedded content that may be harmful to your computer.
      Choose from one of the following options:
      - Do not allow content to play (Recommended).
      - I recogn

      • Which gets blindly clicked thru since they see that pop up dozens of times a day.

        I am a fan of microsoft up until after win xp, but UAC and the effing annoyance it causes with legit apps was definitely not the way to go to improve security.

      • by symbolset (646467) *
        It's from my boss. It must be OK. Even if it isn't, I don't dare not read it.
    • Of course it solves the problem...for Adobe. Just like ActiveX warnings solved the problem for MS or UAC solved the problem for MS. Instead of fundamentally fixing a broken system by removing or mitigating all the attack issues, the onus is put on the user to make the correct choice up front by giving very vague information on just precisely might happen without any possibility to mitigate or revert what actually happens. Hence not even a genius could make the correct choice because there's often too lit

  • by decora (1710862) on Saturday February 09, 2013 @12:08AM (#42840837) Journal

    Warning: Adobe has detected this file may be infected. Click here to report this to Corporate IT security and secure your workstation.

    • by Shavano (2541114)

      Warning: Adobe has detected this file may be infected. Click here to report this to Corporate IT security and secure your workstation.

      Does it uninstall Flash, then?

  • by v1 (525388) on Saturday February 09, 2013 @12:09AM (#42840843) Homepage Journal

    "So what's wrong with it?"

    "You have the latest flash virus. Have you opened any Word documents lately?"

    "Of course! I use Word all day."

    (scans hdd, finds the one in email that started it)

    "Did you open this?"

    "Of course I did. It's the weekly report."

    "Didn't it WARN you there may be a virus?"

    "Yes it opened up a box I hadn't seen before. But I needed to see the report, so I clicked the Open Anyway button."

    "Didn't you get the memo last week about not clicking Open Anyway?"

    "Of course I read the memo. But I need to read that report. I had to open it."

    aaaand this is why this doesn't work anywhere near as well as Adobe says it will. No matter how many times you tell them to call you and NOT open it anyway, they still will. And you'll be at her desk again. Maybe later today even. Because she opened it anyway, because she "had to". (speaking from experience here)

    The only reasonably effective way to implement this is with a policy that is system-wide, that allows administrators to disable the Open Anyway button for the users that can't be trusted with it. (which will be most of them)

    • by Darinbob (1142669) on Saturday February 09, 2013 @12:22AM (#42840927)

      People sometimes don't realize that people they know may be sending malware (not on purpose), or that someone may be pretending to be people they know. Just because the email is from the head of your church committee doesn't mean it's safe to open the "look at these kitties!" file.

      Some people also just click yes to everything. I was helping my mother figure out some new problem on Firefox, which involves telling her the names of a particular menu to choose and the like. And I couldn't figure out why she wasn't find the menus or buttons I was talking about. Then I realized she had updated her Firefox whenever it popped up and said "hey, please update me!", and now she had a UI she was unfamiliar with. This also means she occasionally ends up with google bars or yahoo bars or something else stupid that I have to uninstall every time I visit.

      It's not just mothers that do this, I see professionals in the office doing the same thing.

      • by v1 (525388)

        Sometimes you get people who only care about getting their job done. I had to deal with a couple that flat out told me they didn't care if it had a virus in it or not, they needed to open it, and come hell or high water, they were going to open it. Sort of a "reports are my job, dealing with viruses is your job" kind of attitude.

        And then the virus traffic detection tags the machine and tells the switch to turn off her port and we get lots of waaaaah.

        • by decora (1710862) on Saturday February 09, 2013 @01:15AM (#42841197) Journal

          welcome to corporate america, you are responsible for shit you have no way to control or to fix.

          just like everyone else.

          those people who have to open those reports are in the same boat as you. if they dont open the report, then xyz doesnt get done, then a shit storm rolls down the hill and destroys the entire department.

        • by symbolset (646467) *
          Usually you get people - quite intelligent, technical, well educated and experience people - who still can't understand why you don't click on the "Stop sending this spam" link in spam, or why they can't have the "Yahoo toolbar" browser add-on installed by some app they downloaded from a some random download portal on the Internet with uncertain provenance, or the prancing horse mouse cursor. But then you have C level executives who don't understand reply-all either also.
          • by drinkypoo (153816)

            Usually you get people - quite intelligent, technical, well educated and experience people - who still can't understand why you don't click on the "Stop sending this spam" link in spam,

            No, those are not intelligent people (or you aren't.) Forget all the other adjectives. If someone cannot comprehend that clicking a link in an email can provide information to a spammer after your explanation then there's something wrong with one of you.

            or why they can't have the "Yahoo toolbar" browser add-on installed by some app they downloaded from a some random download portal on the Internet with uncertain provenance

            Again, either they're stupid or your explanation is poor.

            But then you have C level executives who don't understand reply-all either also.

            They just don't care enough to understand. And frankly I've run into that with a lot of people who are supposedly intelligent. They have decided that something isn't their job and therefore they should

      • Enable Remote Desktop on your mom's PC. It's not as insecure as people claim, if you do it right.

      • It's not just mothers that do this, I see professionals in the office doing the same thing.

        It's sad you have to point it out before people can see it as sexist. The geek community here didn't used to be quite like that. There were trolls of course, but lately it's become prevalent even in otherwise perfectly good comments... :(

    • by Anonymous Coward

      that is system-wide, that allows administrators to disable the Open Anyway button for the users that can't be trusted with it. (which will be most of them)

      Sure. Activate this. 10seconds to the first call of a user "ordering" you to reactivate it, because he/she need's it, 30seconds until your boss get's a call from him/her cause you refused it, 60seconds 'til the department head get's a call from his/her boss, ordering your boss to order you to reenable it.

      • that is system-wide, that allows administrators to disable the Open Anyway button for the users that can't be trusted with it. (which will be most of them)

        Sure. Activate this.
        10 seconds to the first call of a user "ordering" you to reactivate it, because he/she need's it,
        30 seconds until your boss get's a call from him/her cause you refused it,
        60 seconds 'til the department head get's a call from his/her boss, ordering your boss to order you to reenable it.

        You're exactly right, and that's because of the real problem: Word cannot tell if something in a document is malicious or not, so it will display the warning message for all content of that particular type, even if it is perfectly legitimate. And so you are left with an all or nothing choice --

        (1) Let people open the documents and take your chances
        or
        (2) Don't allow users to open ANY document which contains that particular type of content (are you ABSOLUTELY SURE that NOBODY in your company is producing doc

    • Which is why these applications need administrator-level permissions that let you prevent those warning and instead show an error message (without an "ok" button).

      Better yet, corporations could wake up and start demanding their software and infrastructure stop requiring the use of flash player to access their services.

    • by rabtech (223758) on Saturday February 09, 2013 @01:32AM (#42841275) Homepage

      Here's the real version of that conversation:

      "So what's wrong with it?"

      "You have the latest flash virus. Have you opened any Word documents lately?"

      "Of course! I use Word all day."

      (scans hdd, finds the one in email that started it)

      "Did you open this?"

      "Of course I did. It's the weekly report."

      "Didn't it WARN you there may be a virus?"

      "No"

      "I'm pretty sure it popped up and warned you about the security implications of opening documents containing flash applets from untrusted sources"

      "What does that mean?"

      "It means it warned you about a possible virus"

      "Oh, well stuff pops up all the time and I just click OK so the computer will work. Sometimes it pops up again so I click Cancel"

      Users are bombarded with dialog boxes, permission boxes, info bars, tray notifications, software update notifications, and so forth all day long. They don't read them, they just click YES/OK. If it pops up again, they try CANCEL (even if the text is different - remember they don't read it!)

      That's why IE's ActiveX scheme was a massive failure - it relied on users to know what ActiveX was, know what digital certificates were, then make an informed security decision for each and every control that wanted to install. Even if the native code execution wasn't a huge hole all by itself the whole scheme is a massive failure because most users don't know what ActiveX is, wouldn't know how to verify a certificate if they wanted to, and can't control what the control does after it's installed.

      This is also why Android is a huge security fail. It relies on the user to understand what the permissions mean and what the consequences are at the time of install. Even if you understood exactly what those 18 permissions were (including scrolling down to expand the list and finding identically named permissions but with slightly different detail text under them)... you can't enable-disable them if you decide the app shouldn't have some of them. Should App X be able to modify or delete USB storage? maybe... depends on what it wants to do! Should it be able to make phone calls or send text messages? Maybe... too bad you won't be asked about it when it signs you up for $9.99/mo SMS services. What about manage accounts? Maybe the app wants to legitimately manage accounts... or maybe it will delete your entire google account. Who knows, but you sure won't be prompted about it.

      Any system that relies on the user to make potentially dangerous security decisions is an automatic failure; doubly so if the decision is irreversible and persistent for all time (which covers the vast majority of security systems in use today).

      I'm almost certain that in the future we'll grant permissions to different apps and websites by answering at the time the app wants access to the resource, not forever. Further I think the system will want to keep a history (think git, but for the entire filesystem), allowing you to effectively "roll back" a bad security decision. That probably means browsers and apps all run isolated in their own OS-provided VM/sandbox and all sharing or filesystem access routes through the version control system.

      • by 0123456 (636235)

        I'm almost certain that in the future we'll grant permissions to different apps and websites by answering at the time the app wants access to the resource, not forever.

        Like UAC's wonderfully helpful popups, you mean?

        'Application Hello Kitty Screensaver wants to: Access Hard Disk. Allow/Deny?'

        Yeah, that's going to make life much easier for Joe Know-Nothing to avoid malware. They'll click yes to everything, then disable it after ten minutes because it's popping up all the time.

        The only way it can work is to sandbox every app so it can't infect any files but its own. Even then, it also needs a network sandbox so it can't connect to arbitrary network services.

      • by tlhIngan (30335)

        Users are bombarded with dialog boxes, permission boxes, info bars, tray notifications, software update notifications, and so forth all day long. They don't read them, they just click YES/OK. If it pops up again, they try CANCEL (even if the text is different - remember they don't read it!)

        The technical term for it is dancing pigs [wikipedia.org] (or Dancing Rabbits).

        The premise is that any security that relies on getting in the user's way of a task will be promptly bypassed. The user will always choose dancing rabbits/pig

        • This is exactly what I was going to post, I searched to see if anyone had posted the dancing rabbits problem yet and there it is.

          If you leave it up to the user to decide whether or or not to bypass the security protocols, then you have no security protocol. It's like getting the most secure door installed on your house but allowing your 4 year old to open the door to strangers.

    • by _Ludwig (86077)

      "And now you need to be out of commission for at least an hour so we can fix your computer that you broke. I'm sure your manager will understand."

    • You need to send these people this... http://www2.b3ta.com/top-10-cutest-kittens/ [b3ta.com]
    • by DaveGod (703167)

      Did it occur to you that maybe she did actually need to open the weekly reports and that the policy was not fit for purpose? The story seems intended to imply the ignorance of the user but I'm left questioning the ignorance of the IT guy.

  • by chronokitsune3233 (2170390) on Saturday February 09, 2013 @12:35AM (#42840991)

    "This document contains macros which may harm your computer. Do you wish to allow them to run?" (Clicks "Yes" blindly.)

    Some (or maybe all...IDK) Word documents that were actually templates contained macros in the absence of an actual wizard. This meant that in versions of Office that recognized the security hazard, you got a pop-up before the document actually opened. I personally clicked "Yes" or "Open Anyway" or "Allow" or whatever it said without even bothering to read it because I usually got the document from a trusted source (as in someone I trust, not someone a company/corporation trusts using an actual whitelist/blacklist). I presume many got tired of seeing the message as I did, and they did the same thing. Similar events will probably happen with this Flash issue. Your aunt sent you an e-card for your birthday from her virus-infested computer? Sweet! Allowed!

    And before people ask, yes I was speaking in the past tense. I no longer use Microsoft Office, in favor of Google Drive's Office-like features that started out as "Google Docs & Spreadsheets". It may not be as full-featured, but I don't need it to be either.

    • by v1 (525388) on Saturday February 09, 2013 @12:53AM (#42841089) Homepage Journal

      Macro viruses were annoying also. For awhile Word/Excel gave you only one check box in security prefs, to pop a dialog when a document contained macros. (you could not disable them, only turn on the dialog)

      Then when the user opened a doc with a macro (or more often, a virus) it would pop and give just TWO options... (A) open and run macros, or (B) do not open.

      Gotta love microsoft for that one. Took them insane ages to add the (C) Open with macros disabled. Until then we had to deal with the "but I HAD to open it" people. But then I could continue to bash on them for not having a "flush macros" button anywhere, and the ability to create a "hidden" macro, and every macro virus creator's all-time-favorites, the "run on open" and "copy macro to other closed document" options. But that's drifting somewhat OT.

  • Stop allowing Flash to be embedded in things like Word documents and PDF files.
    I have yet to see a single valid use of Flash in PDF or other document formats that couldn't be done as a web page instead.

    • Stop allowing Flash to be embedded in things like Word documents and PDF files. .

      This is the correct answer. Yes, Adobe needs to get their shit together and stop producing software with new security flaws being discovered almost daily. But what about Microsoft's responsibility? Flash embedded in a Word document? What.The.Fuck

      • by hedwards (940851)

        Well, didn't MS pretty much invent documents as an attack vector. Perhaps my memory isn't so good, but the first cases I remember of that were for Word.

      • by cellocgw (617879)

        But what about Microsoft's responsibility? Flash embedded in a Word document?

        Yeah, not to mention the idiotic capability to embed entire Office documents inside other Office docs. I knew people who thought this was far better than, say, a nice zip archive. I used to get even by doing helpful things like converting a Word doc to PDF (try opening that embedded spreadsheet NOW, Dr. Doom!), or embedding a PowerPoint doc in a Word doc., embedding that Word doc in an Exel workbook, etc. in an EmbeddedTurtles Allthe Way Down sequence, and giving that back to them.

  • Meanwhile Gnash (Score:4, Interesting)

    by Ceriel Nosforit (682174) on Saturday February 09, 2013 @12:45AM (#42841053)

    Meanwhile Gnash supports Youtube just fine, which remains Flash's sole legitimate use.

    It even supports audio out of the box.

    • by jfengel (409917)

      Is it demonstrably more secure? Or is it just too obscure for anybody to target?

      • I don't have an authoritative answer, but Chromium keeps telling me Adobe Flash is out of date with its bright yellow Load Anyway dialogue. I see that bar on a lot of sites which should not have any reason to use SWF, even though adblock removes the worst offenders.

        • by tlambert (566799)

          I don't have an authoritative answer, but Chromium keeps telling me Adobe Flash is out of date with its bright yellow Load Anyway dialogue. I see that bar on a lot of sites which should not have any reason to use SWF, even though adblock removes the worst offenders.

          Flash is often embedded in web pages with no UI in order to implement "super cookies" (LSO's or Local Shared Objects) in order to be able to track you even if you have cookies disabled, since people want to be able to see their videos. So they leave Flash enabled.

          The workaround for the user is to install something like "ClickToFlash", but that can get annoying pretty fast, especially on sites like abc.com or cbs.com, which have very short timeouts on reading the data back out, and so claim you have flash d

      • by WD (96061)

        It's definitely the latter. It's pretty easy to find bugs in Gnash. However due to the obscurity of Gnash itself combined with the diversity of the platforms that Gnash runs on, Flash is a much more interesting target for attackers.

    • by tepples (727027)

      Youtube [...] remains Flash's sole legitimate use.

      Is there a reason that you feel that showing web animations (such as Homestar Runner or animutations) without converting to MP4 and thereby bloating the download size by a factor of 10 is not "legitimate"

      • Are you saying that you'll play those legitimate animations written in ActionScript (a flavor of ECMAScript) in a Flash format outside of a web browser that already supports JavaScript (a flavor of ECMAScript) and Vector Graphics? Adobe hates Flash. They make money making tools that create flash content, and they would MUCH rather simply sell the same tools and generate HTML5 content with them instead. Same revenue, no cost to maintain the "player" becuase it's in the damn browser. You can even embed J

        • by tepples (727027)

          Are you saying that you'll play those legitimate animations written in ActionScript (a flavor of ECMAScript) in a Flash format outside of a web browser that already supports JavaScript (a flavor of ECMAScript) and Vector Graphics?

          Solve these three issues and I'll consider joining you in bashing Flash:

          • ActionScript comes with a tweening library. JavaScript does not.
          • Not all deployed web browsers support vector graphics. An outdated version of Internet Explorer is especially common on the kinds of computers most likely to have PowerPoint installed. All computers running Windows XP, for example, run a version of Internet Explorer that lacks SVG. I'm under the impression that corporate IT departments are far more likely to authorize dep
    • Even better, join the youtube html5 trial, no flash needed (I don't think though it works for all the videos yet): http://www.youtube.com/html5 [youtube.com]

  • to the problem of liability.

  • by Anonymous Coward

    http://flavio.tordini.org/minitube [tordini.org]

    Linux, Mac OS X, Windows

    "Light on your computer. By consuming less CPU, Minitube preserves battery life and keeps your laptop cool. That's because Minitube does not use the Flash Player.

    High Definition. Minitube plays HD videos up to 1080p. Go full-screen and watch them play smoothly.

    1-Click Downloads. Download your favorite clips to your computer and put them on your portable device. Downloaded files are in MPEG4 format which is compatible with most devices, including Appl

    • by Skapare (16644)

      Where are the 64 bit binaries? But more importantly, where is the source code?

      • Re: (Score:2, Informative)

        by Anonymous Coward

        for Linux - it should be posted on their site.

        Even more importantly, where is the source code for Adobe Flash?

  • by chopthechops (979273) on Saturday February 09, 2013 @01:56AM (#42841373)
    After 18 years or so of increasingly frequent popup messages appearing in popular software you would think everyone realises by now how useless they are. Normal users don't read popups, and those who do read them don't know or care what they mean, and/or they just choose to ignore them. Actually I think software vendors know exactly how useless they are, and in the case of security-related popups it's just the vendor saying "security is the end user's problem, not ours". Kinda like the warnings you get on cigarette packets.
    • "Warning: Smoking Adobe/Microsoft/Apple/etc products has been shown that it may increase the chances of cancer and hallucinations about said software being good."

      Sounds about right.

  • "To protect users of Office 2008 and earlier"

    Refer to Office 2008 then post a Windows screenshot? Par for the course I suppose.
  • by Ralph Spoilsport (673134) on Saturday February 09, 2013 @02:27AM (#42841491) Journal
    will protect all the unicorns.
  • by Chas (5144) on Saturday February 09, 2013 @02:56AM (#42841611) Homepage Journal

    Sorry.

    It doesn't happen that way.

    It just doesn't.

    They tried this with browsers. It was egregiously cumbersome and conditioned people to auto-click YES to everything.

    They tried this with Windows. It's still egregiously cumbersome and is still just conditioning people to blindly auto-click YES to everything.

    So...NOW...they're adding MORE crap to click YES automatically to?

    Third time's the charm?

    FUCK NO!

    Three strikes and you're out fuckers!

    Warning popups prevent a small amount of infestations up front.
    HOWEVER, down the road, as people get conditioned to the popups, they just click past without looking. Because the popups ARE IN THEIR WAY.

    Adding a stupid popup is basically an admission that they're too goddamn stupid or lazy (or both) to secure their software properly. Or that their software is, inherently not secure or not able to BE secured.

    At which point, it's crap that needs to be replaced with a better solution. Even if it means giving up the convenience of "Well this works right now".

  • by drolli (522659) on Saturday February 09, 2013 @09:46AM (#42842767) Journal

    I use noscript.

    A site has to be really important to me for me to activate plugins on it. If newspapers cant put in a static image but reduce all news reports to 5 lines of non-descriptive generic text and a link to a video they bought from somwhere, i dont need that.

  • This is an idea I had just now, could be completely useless, impossible to get users to adapt to, and would just shift the problem from one domain to another, but here goes anyway: How about we do away with e-mail attachments? Adapt a policy that forbids any e-mail attachments from being downloaded, period (sorry, people who feel the need to include a fancy e-mail signature image, guess you'll just to have to use boring text). Obligate employees, etc. to retrieve files from another source outside of e-mail.

    • Your Security policy allows you to put work files into 3rd party "cloud" services? That's soooo nice for you. I'd love to get rid of email attachments, but i cant see it happening, unless there is something else that allows drag and drop easy file transfers (not FTP because port 21 is always blocked already) and stays within our network.
      • Mine doesn't allow 3rd party services, but that was just a potential example. We have an internal network that everyone has access to (it's divided up so you don't have access to ~every~ folder, but you can still setup easy sharing between any number of individuals). For your scenario, why not use a network? Open it up just like a folder on your computer, drop the file(s) there, done and done.
  • I wonder is there are really useful usages of SWF in MS Office. I would be happy if I had the opportunity to make flash installation visible only to the browser. Anyone has a trick for that? Moving DLL to a place where only Firefox looks for them?

Philogyny recapitulates erogeny; erogeny recapitulates philogyny.

Working...