cross-posted from: https://lemmy.ml/post/47972724
i encountered this for the first time today while attempting to read something on archive.today.
i confirmed that decoding the qrcode using a computer and following the URL it contains is insufficient; the error it gave directed me here which is what the linked screenshot is of.
the old type of captcha remains available too, for now:
Sorry, my faith in users is basically zero. These dummies will go to websites that tell them to copy code and run it with win+r. They’re morons and will do anything if a website promises them something.
Unfortunately true for a lot of people, but what’s the solution?
At work? Crowdstrike is kind of the training wheels for people who don’t want to use application whitelisting or group policy that disables users running various terminals.
Training isn’t the answer, because training is basically an industry propped up by knowbe4 from convincing cybersecurity insurance that it’s the right thing. We do training where I work and everyone falls for the same old shit, raise information, pay information, promotion information and performance review content. Doesn’t matter how many indicators of compromise are hidden in the message, but they’ll gladly just keep clicking along or running code that is prompted because the desire sensor overrides the training.
Anywho, nowadays not giving users admin rights is simply not enough. The script creating people often know how to use privilege escalation exploits without issue to gain control even when a user can’t. Really need a tool that can detect behavior and block it, or lock the system down somehow.