Sounds kinda serious!

 	David Houston
 	University of Vermont
 	Phone: (802) 656 2013
 	**
         "You are nestled in our hearts forever"
         **

---------- Forwarded message ----------
Date: Wed, 31 May 2006 15:19:11 -0700
Subject: CAF: chronic authentication fatigue

On May 31, 2006, at 2:08 PM, John C. Welch wrote:
> On 5/31/06 15:54, "Chris Adams" <[log in to unmask]> wrote:
> 
>>> No, because proper user training and education is a critical,
>>> possibly *the*
>>> critical component of any security plan. If you try to implement
>>> any form of
>>> security without user training, you're doomed to failure.

CAF, or chronic authentication fatigue, is an increasingly widespread 
affliction that's causing alarm among the sysadmin community.  The problem 
is expected to worsen as soon as four billion Vista users are forced 
(forced!) to enter their username/password for everything (everything!).

CAF attacks the autonomic nerve system; the afflicted have their reflexes 
confused to the point they hit "OK" without reading on-screen messages and 
dialogue boxes. As if controlled by some strange virus, they click the 
throbbing blue "OK" button without fail, each and every time it appears. 
Nothing can slow them down; they neither pause nor reflect. Their username 
and password is entered -- for the tenth time since lunch -- without fail, 
whenever asked.

One early symptom of CAF is the refusal to read "Terms of Agreement" and 
"User License and Warranty" messages. Here, the individual agrees to 
anything, all the time, every time. They believe they have developed 
prescient knowledge. When asked what they just agreed to, they declare, "I 
already know what it says. Just hit the OK button."

When asked about this new condition, Kathi, a representative from the 
Admissions Office, said, "Look, every day, I get nagged about some 
Microsoft Office update, so I entered my username and password just to 
shut the damn thing up. So then it put some log file here in my hard drive 
icon. See? So when I went to go delete it, I had to enter my username and 
password. Again. Then the next thing you know, I opened a Word document 
and it gave me some message about whether I wanted to open Word. Well, 
duh. Of course I do. So I hit the OK button. I mean, what am I supposed to 
do?"

Janice from Purchasing adds, "It's kinda like wack-a-mole. Every time I 
want to do something, it says, 'are you sure? are you sure?' -- and I keep 
hitting 'OK' a billion times. I have to enter my username and password 
here at the university, it must be, fifty times a day. Seriously. So I 
just do it, because otherwise, I can't get any work done."

"Clearly, this is a case of CAF." says the systems administrator. "We gave 
them handouts. I'm not sure what the problem is. We posted our security 
policy on our intranet. I even sent out an e-mail. Mark, over in the 
Windows group, put some Dilbert cartoons near the coffee maker to lighten 
the mood, but to, you know, spread the word. He put them up there to 
remind users not to blindly hit "OK" every time they're asked. They're 
kind of funny. The cartoons, I mean."

Security experts are stumped. "We're not sure what to do, other than just 
keep on warning people with these dialogue boxes and making people enter 
their username and passwords. We're baffled. But I mean, heck, I don't 
even read those terms of agreements, even the ones that make me scroll all 
the way down, like as if I read it or something."