Daniel J. Summers ~ East TN, USA on Nostr: I guess this is the distinction. I completely agree with "highly spoofable" - I'd ...

I guess this is the distinction. I completely agree with "highly spoofable" - I'd even go so far as to call it eminently spoofable. But, if risk = vulnerability * (threat / likelihood - as a decimal number no greater than 1) - any number times 0 is 0.

SMS spoofing/cloning are non-zero risk, even for folks who celebrated a holiday yesterday - but, how do we communicate that to the average user in a way that gets their attention, but isn't so catastrophic that it fades into the background noise of "everything is going to get you eventually"?

This is a genuine question I've had, as a security-conscious developer, for several years. The vulnerabilities are real - security professionals can provide chapter-and-verse for that. Communicating the threat, though, is where the industry comes up short. "This is like bathroom graffiti!" doesn't land with most folks. IOW - if the given is "these ignorant users believe their data is not at risk" - do you have ideas of how we can convince them that they're wrong?

What I've done, up to this point in my career, is make my stuff as secure as possible. I'd love an out-of-the-box take, though, that breaks through the tech-bubble noise and convinces people not to panic, but to actually consider their risk and adjust their behavior. :)