3 ms·
I don't disagree that security talk could be better about threat models, total evaluation, etc. But in this case, we also have to imagine that the bank-grade v
by SomeStupidPoint 10y ago
I don't disagree that security talk could be better about threat models, total evaluation, etc.
But in this case, we also have to imagine that the bank-grade vault door to the shed costs about the same as a regular door.
While I agree the marketing is nonsense (you need lots of other secure features too!), there's absolutely no reason people shouldn't a) start locking their doors, since most current "robberies" are walking in the front door without challenge and b) use the high security door, because the cost is the same as a regular one while the benefits are strictly greater.
I agree that Signal needs to tone down the complete security language, but I think too many security professionals scare people out of making improvements by talking about how there are still compromises. There are lots of middle-ground social goals, like reaching a level of security that makes bulk collection untennable, but leaves targetted attacks open. It's the digital equivalent of closing your blinds in a locked house -- government can still get in to see if they have reason, but they can't see when just wandering by on the street. And they can't pretend their intent wasn't to violate your privacy by entering, since the low technical barriers still require active bypass.
The vault door may not keep your shed from being robbed, afterall there's a ton of easy-to-kick-in windows, but forcing it to be B&E instead of a walk in is meaningful. The law might be ambiguous about walk-ins, but is clear about B&E. (Id argue the other "unlocked" doors are really just getting keys from the landlord, which is a separate problem.)
- VLM 10y ago"we also have to imagine that the bank-grade vault door to the shed costs about the same as a regular door." I admit defeat. Two extremely strong back to back arguments, both very persuasive and well written. I see we have common ground on the toning down the security language. That specific aspect of the issue triggered me a bit into a general, eventually proven somewhat wrong, rant. Have a pleasant day!