←back to thread

Cyber Scarecrow

(www.cyberscarecrow.com)
606 points toby_tw | 1 comments | 18 Jun 24 08:08 UTC | HN request time: 0.216s | source
Show context
scosman ◴[18 Jun 24 08:25 UTC] No.40715334[source]▶
Fun concept.

If the creators read this, I suggest some ways of building trust. There’s no “about us”, no GitHub link, etc. It’s a random webpage that wants my personal details, and sends me a “exe”. The overlap of people who understand what this tool does, and people who would run that “exe” is pretty small.

replies(7): >>40715364 #>>40715425 #>>40715446 #>>40715473 #>>40716059 #>>40716538 #>>40723731 #
CyberScarecrow ◴[18 Jun 24 08:55 UTC] No.40715473[source]▶
Author of cyber scarecrow here. Thank you for your feedback, and you are 100% right. We also dont have a code signing certificate yet either, they are expensive for windows. Smartscreen also triggers when you install it. Id be weary of installing it myself as well, especially considering it runs as admin, to be able to create the fake indicators.

I have just added a bit of info about us on the website. I'm not sure what else we can do really. Its a trust thing, same with any software and AV vendors.

replies(18): >>40715568 #>>40715665 #>>40715733 #>>40716043 #>>40716134 #>>40716229 #>>40716260 #>>40716317 #>>40716684 #>>40716889 #>>40719030 #>>40719198 #>>40719439 #>>40720186 #>>40720416 #>>40720493 #>>40723898 #>>40727328 #
1. peter_l_downs ◴[18 Jun 24 18:04 UTC] No.40720493[source]▶
One more thing you could do is put the real name of any human being with any track record of professionalism, anywhere on the website. Currently you're:

- commenting under a pseudonymous profile

- asking for emails by saying "please email me. contact at cyberscarecrow.com"

- describing yourself in your FAQ entry for "Who are you?" by writing "We are cyber security researchers, living in the UK. We built cyber scarecrow to run on our own computers and decided to share it for others to use it too."

I frequently use pseudonymous profiles for various things but they are NOT a good way to establish trust.