4 ms·

I've respected Moxie Marlinspike ever since he made sslstrip, a simple illustration of the fundamental insecurity of browser-based HTTPS. However I do question

by abalone 10y ago

I've respected Moxie Marlinspike ever since he made sslstrip, a simple illustration of the fundamental insecurity of browser-based HTTPS. However I do question his premise that criminals already have the wherewithal to opt in to "clunky" strong encryption before engaging in criminal activity. In fact there are many scenarios where criminals simply go with the default security configuration in consumer devices, either because they (a) did not plan the crime in advance or (b) aren't as smart about opsec as you might expect. There are many good arguments to make strong encryption the default for consumer devices, but here I feel he was attempting to take an easy way out by pretending it's orthogonal to investigating crimes. In fact it is a tradeoff, granting us security from cybercriminals and bad state actors (if there's even a difference), while making it harder for law enforcement in some scenarios.

EdHominem 10y ago
Right, not all criminals can choose secure defaults. But those who can't are unlikely to be all that secure in other ways either meaning that it won't change the threat landscape much. Besides, it wouldn't kill our LEOs to work for their supper. This reliance on dragnet tactics means that'll soon be all they're able to do.
cJ0th 10y ago
or (c) they don't have to care about it. "security by obscurity" might proves as being good enough. I could write you a text message: "Hey abalone, do you fancy helping me planting a tree over at my garden?" and it seems perfectly innocent until you consider that planting a tree could be a code for all sort of things. As long as you don't "plant trees" every week and talk about all kind of things in your text messages you are not attracting attention. One could argue that truly innocent/law abiding people require strong encryption the most because of all the criminals out there.

by abalone 10y ago

EdHominem 10y ago

Right, not all criminals can choose secure defaults. But those who can't are unlikely to be all that secure in other ways either meaning that it won't change the threat landscape much. Besides, it wouldn't kill our LEOs to work for their supper. This reliance on dragnet tactics means that'll soon be all they're able to do.

cJ0th 10y ago

or (c) they don't have to care about it. "security by obscurity" might proves as being good enough. I could write you a text message: "Hey abalone, do you fancy helping me planting a tree over at my garden?" and it seems perfectly innocent until you consider that planting a tree could be a code for all sort of things. As long as you don't "plant trees" every week and talk about all kind of things in your text messages you are not attracting attention. One could argue that truly innocent/law abiding people require strong encryption the most because of all the criminals out there.