Embed Notice

I have heard this opinion that infosec should pay attention to web 3.0 applications like NFTs and cryptocurrency, and it's something we do have to talk about.

First of all, the tenor of the argument is that the infosec community owes web 3.0 applications expertise by default, I guess, by virtue of the fact that people will use it and deserve to be protected when they use it. This argument might make sense elsewhere, but there are limitations to this.

My argument is, we have no responsibility to secure obvious scams just because there are users who will engage in scams.

For example, imagine if Bernie Madoff was using an insecure chat app to communicate with the victims of his ponzi scheme. Is the infosec industry expected to rush in and tell Bernie he should be using an encrypted and community audited chat app for his operations? I would argue, no.

When the overall operation is rife with fraud, securing the operations of that fraud is not an obligation. Feel free to disagree with me.