Background: I’m an amateur programmer, make both desktop and mobile applications with a moderately deep background in computer science (from my experience and undergraduate studies).
A lot of friends of mine don’t pay attention to (or even worse, have no intention to know anything about) information security. The following are some examples of their beliefs:
Connecting public Wi-Fi (indeed, without any VPN connection) is perfectly fine, because a lot of people are doing so.
Reusing password(s) is fine, and no one is going to steal them (reusing passwords even on plain http sites).
Writing down passwords in plaintext is fine, and obscured versions of plaintext password records are safe (for example, inserting a lot of newlines in a text file and append the passwords at the end).
Ignoring potential signals, for example, advertisements/toolbars in browsers, startup applications etc. One of them has taken no security measure even though a series of transactions (although stopped by bank technicians) were made by her credit card.
Ignoring security measures built into systems, for example, blindly turning off anti-virus programs/accepting programs as false positives, entering admin passwords in arbitrary authentication dialogs, turning off full-disk encryption (even though its effects on disk speed is small), and granting privileges even to pirated software.
I often have conflicts with them, especially when their actions may harm my security measures:
They treat me as a paranoid. They think that concerns are unnecessarily and create inconvenience.
They usually make illogical counter-arguments. For example, once I mentioned that programs coming from arbitrary sources should not be opened. The next time I wrote a game (it’s open-source so everyone can have a check on it) and shared it on GitHub. One of them challenged me that my game should not be opened because it may be malicious. He even challenged whether GitHub is a safe site to visit.
They think that because almost everyone doesn’t follow my security practices (again, like reusing passwords), if my security claims are true, a lot of people are under security threats, and because they don’t observe any, they aren’t going to bother about information security.
Sometimes they may “coerce” me into situations which may harm my device’s security. For example, some of them may use my accessories without asking me in advance, and because I have to use them afterwards I have to worry about the potential spread of malicious contents.
Some of them even have very bad attitude when they think their beliefs are correct (and hence treating me in a very impolite manner). For example, when I say that others can’t use my accessories (at least can’t without my prior approval), they usually say something like “there’s no virus on my device” (perhaps even in a worse tone) and ignore the issues about information security.
As a programmer, information security is something that I can’t compromise. I do need to cope with the above situations and handle arguments which others don’t except (even though some of them are standard practices). Any help is appreciated.