3 ms·

I admit your front door deadbolt analogy is a very persuasive argument, however this is being marketed as a technically perfect nuclear material / army weapons

by VLM 10y ago

I admit your front door deadbolt analogy is a very persuasive argument, however this is being marketed as a technically perfect nuclear material / army weapons locker grade bank vault door that solves all security problems when installed and used. Which might be correct. However, I will extend your admittedly excellent analogy with unfortunately this probably high quality piece of security hardware is installed in a garden shed that has easily breakable windows with no curtains and at least a couple unlocked back doors and an unknown number of (old fashioned electronic) bugs installed in the shed and the news is full, every day, of stories of garden sheds being broken into and peoples secrets on the front page, or at least the front page of wikileaks. Yet the marketing spiel is something like "once you install this really nice door, that's all you need to be completely secure and can feel comfy doing anything that needs to be private or is illegal" "There's no reason people should be confined to only discussing those topics with people in physical proximity" Pragmatically, sure there is, its because they don't want it made public. Extremely optimistically, all you need to do is install this really top quality bank vault door on your garden shed, then ...

SomeStupidPoint 10y ago
I don't disagree that security talk could be better about threat models, total evaluation, etc. But in this case, we also have to imagine that the bank-grade vault door to the shed costs about the same as a regular door. While I agree the marketing is nonsense (you need lots of other secure features too!), there's absolutely no reason people shouldn't a) start locking their doors, since most current "robberies" are walking in the front door without challenge and b) use the high security door, because the cost is the same as a regular one while the benefits are strictly greater. I agree that Signal needs to tone down the complete security language, but I think too many security professionals scare people out of making improvements by talking about how there are still compromises. There are lots of middle-ground social goals, like reaching a level of security that makes bulk collection untennable, but leaves targetted attacks open. It's the digital equivalent of closing your blinds in a locked house -- government can still get in to see if they have reason, but they can't see when just wandering by on the street. And they can't pretend their intent wasn't to violate your privacy by entering, since the low technical barriers still require active bypass. The vault door may not keep your shed from being robbed, afterall there's a ton of easy-to-kick-in windows, but forcing it to be B&E instead of a walk in is meaningful. The law might be ambiguous about walk-ins, but is clear about B&E. (Id argue the other "unlocked" doors are really just getting keys from the landlord, which is a separate problem.)
- VLM 10y ago
  "we also have to imagine that the bank-grade vault door to the shed costs about the same as a regular door." I admit defeat. Two extremely strong back to back arguments, both very persuasive and well written. I see we have common ground on the toning down the security language. That specific aspect of the issue triggered me a bit into a general, eventually proven somewhat wrong, rant. Have a pleasant day!

by VLM 10y ago

SomeStupidPoint 10y ago

I don't disagree that security talk could be better about threat models, total evaluation, etc. But in this case, we also have to imagine that the bank-grade vault door to the shed costs about the same as a regular door. While I agree the marketing is nonsense (you need lots of other secure features too!), there's absolutely no reason people shouldn't a) start locking their doors, since most current "robberies" are walking in the front door without challenge and b) use the high security door, because the cost is the same as a regular one while the benefits are strictly greater. I agree that Signal needs to tone down the complete security language, but I think too many security professionals scare people out of making improvements by talking about how there are still compromises. There are lots of middle-ground social goals, like reaching a level of security that makes bulk collection untennable, but leaves targetted attacks open. It's the digital equivalent of closing your blinds in a locked house -- government can still get in to see if they have reason, but they can't see when just wandering by on the street. And they can't pretend their intent wasn't to violate your privacy by entering, since the low technical barriers still require active bypass. The vault door may not keep your shed from being robbed, afterall there's a ton of easy-to-kick-in windows, but forcing it to be B&E instead of a walk in is meaningful. The law might be ambiguous about walk-ins, but is clear about B&E. (Id argue the other "unlocked" doors are really just getting keys from the landlord, which is a separate problem.)

VLM 10y ago
"we also have to imagine that the bank-grade vault door to the shed costs about the same as a regular door." I admit defeat. Two extremely strong back to back arguments, both very persuasive and well written. I see we have common ground on the toning down the security language. That specific aspect of the issue triggered me a bit into a general, eventually proven somewhat wrong, rant. Have a pleasant day!