The Blanket
We got ourselfs a nice big blanket for picnics and such. A big one. Waterproof and everything. Now, unfolding it and doing picnic things is great fun and all. But the time will come when you have to fold that thing together and carry it home. This blanket comes with a strip of velcro and it doesn't just hang on anywhere on the blanket but on a similar sized counterpart. Have fun folding that thing in just the right way, so these two strips find each other.
I don't regularly fold things in specific ways, so they make sense. But in this instance I got the job done and it made me realize something that matters for my dayjob.
See the blanket is not just a blanket. Besides the typical rectangle, there is an extra piece sowed on with a handle and the just mentioned velcro strip. From the layout of that handle piece (width and position) it is fairly clear that this blanket wants to be folded four times. Looking at the two remaining sides also obviously wanted me to fold that long strip at least two times in the same direction (not zigzag), so that the velcro fit. No, that didn't really fit. But three times the same direction. Close the velcro, grab the handle, be on your merry way.
And that's why attackers will always find a way to convince people to unwittingly help in their nefarious endavours. Ok, that's a stretch. Let's warm up first.
On Solving Problems
The philosopher Karl Popper said:
All Life is Problem Solving
And while life coaches pick your pockets with promises to provide you with Better Problems™, we still end up with e. g. solving the problem of folding that blanket fittingly. However, we are not being left alone in this situation because of Engineers and Designers, yay! Because someone spent some time on figuring out how to make this blanket:
big enough for a familiy of about three
somewhat resistant against wet grounds
portable
kept from unfolding uncontrollably
But they also thought about where to put that extra piece with the handle and the velcro strip so that experiencing users like me were enabled to figure out how to fold that thing in a way so that one could carry it in one hand. Now, this is not solving world peace but it is some fancy thinking. Someone solved a minor problem of helping me solving a tiny problem.
The thing is: We are used to experiencing things, products, services that someone spent some varying amount of time on to make it make sense to us. We are used to intentional design instead of accidental composition.
Many products we put our hands on, we can fairly easily look at and gain a basic understanding on how it works. We are used to those products. We are that used to it, that we make fun of the instances, where it is not so. The internet is full of stories of people who encountered a product or service, where they expected, due to appearance or habit, a certain function and where disappointed in said expectation.
Next thing in this development is that things change. Yet, we also kind of are used to that. Features come and go, wordmarks change, a new version comes with a new handle, the button is on the other side, programs are now called apps. But we adapt. We look for hints and signals on how this new iteration of product works and we figure it out and we get used to it.
The Big Problem
It is becoming a considerable problem to tell the difference between intentional design and accidental composition. And even worse: maliciously intentional design.
A little anecdote from me: I do know some things in IT. Many, I don't. I do use 2FA, duh. But when I started diving into infosec topics I set up Aegis for my 6 digit TOTP and never really used another method apart from the occasional email 2FA, when nothing else was available. That process I know. But then I had a meeting with a client and they had to login to their Azure tenant, for the first time I saw the Microsoft Authenticator Push Notification 2FA with the two digit code on the screen. That did put me off for a moment. And then something interesting happened. I immediately was hit with internal shame, because under no circumstances could I, the guy who had to tell that client something about cybersecurity, not know of this security implementation. Maybe it is very common and just I don't know it? This would put my credibility at risk.
This is nonsense, but it is a usual response people have to such experiences. But the consequence is that people may not ask, when they are hit with something they don't recognize.
I definately do not know all the common authentication flows, even that are fairly common. And like that, there might just have been moments, where I wouldn't have been sufficiently alarmed by a ClickFix-style attack. Because it might just be that the ne reCAPTCHA uses some weird new way of determining my humanity. Because I am used to such processes to change and I am also used to look for clues on how things work or can be resolved.
Sure, that might just be a flaw of mine and I chose the wrong profession. But that's probably not the case here. ClickFix made a sharp career in the last 2 ½ years for a reason.
The Solution
How do we tackle this issue? We will probably not make all the things worse, just to make people more reluctant to change. We also won't require everyone to get a license for using every single solution.
What we can do, though, is to give people a break. Most people really don't want to wrap their head around dem 'puters. They are busy with caring for themselfs and their family, not being replaced by AI and not breaking down due to the state of the world right now.
Love might just be little too much, but let's try support, shall we? How can we support people in recognising the right intentional design?
Easiest way first of all is making it normal, mundane even, and desirable to ask questions. Create an approachable channel to address their fear, uncertainty and doubt #TheGoodFUD. Communicate the central authentication and work-flows so that the default is known and to close the gap for ambiguity. Communicate also the changes and plan for the users to have some time of their working hours to address those topics.
And on the ClickFix specifically. In my opinion, this really is something where awareness really can make a difference, since the method is fairly recognizable and can be differentiated against valid processes. Just don't reduce it to "don't run copy pasted code from the browser". Most don't even recognize, that this is what they are doing by following the instructions, so please try to speak their language. The marker Win+R and the reminder what Ctrl+V does is easlily understood and enough for the basic variations.