Hacker News Reader

The overwhelming evidence is that this isn't true for the majority of users.

You’re saying the majority of users have fallen for phishing attacks? That seems like selection bias. Since you only see reports about successful phishing attacks and don’t see any reports about all the people who log in safely and successfully every day, you assume a “majority of users” must fall victim to this.

It's actually the other way around - everyone likes to read about clever APT attacks, or zero day exploits, or impressive supply chain attacks. But despite what you may read, phishing attacks are the most important.

Consider: most (over 50%) of company compromises starts with phishing (or with reuse of compromised passwords, which are also usually sourced from phishing). It's even higher for ransomware attacks specifically btw. This means that if we were able to stop phishing and credential theft, we would cut number of cyberattacks by half! That's not something you can downplay.

Sure. It's still nowhere near the case that a "majority of users" fall for phishing attacks.

Reply on news.ycombinator.com