Security quotes of the week

Security quotes of the week

A system that relies on users not entering their credit card number unless they intend to spend money is not doomed - people are trained that they shouldn't give you access to their cards unless they want you to spend money.

What dooms card-based age verification systems (beyond the practicalities of the card networks not wanting to get involved) is that to make them work, you have to train people to give access to their cards without any intention of spending money. Once you've established that giving out your card number is a requirement for access, not just payment, you've trained people to be phished.