3 ms·

A secure communication technology that is understandable (after reading some mans) and verifiable by an average user, without being infosec expert. For now, th

A secure communication technology that is understandable (after reading some mans) and verifiable by an average user, without being infosec expert. For now, there are so many unknowns in the equation, that users have no choice but to rely on vendor's authority, which means centralization. Don't tell me it's theoretically impossible because it's possible in almost every other area.

sp332 10y ago
How verifiable? You've seen the Underhanded C code competition? http://underhanded-c.org/ http://underhanded-c.org/
- ComodoHacker 10y ago
  I'm not talking about code bugs and backdoors, which can always exist. I'm talking about protocols, encryption schemes and architectures. We need "comprehensible security", as opposed to incomprehensible, "NP-hard" and (soon) even "quantum-hard" security, accessible to only 0.1% of engineers, let alone users. We still don't have digital signing technology that is verifiable as easily as paper signature and works peer-to peer, without some big corp/govt involved.
  - khedoros1 10y ago
    The challenge here is that it's super-easy to design protocols that the average person would consider 100% secure, even after reading some documentation. It's the same problem where anyone can create a lock/encryption that they don't know how to break, but there's always someone smarter or better versed in breaking it. Subtle bugs don't look like problems until someone figures out an exploit against them.
adrianN 10y ago
How could the average user possibly verify any kind of modern technology? Programming VCRs is too hard for almost everybody, do you really expect these people to understand even the most basic explanation of how their privacy is protected?
- ComodoHacker 10y ago
  You don't have to know how VCR works in every detail to use it and be sure it does what it should. You just look at the recording and see its quality. On the other hand, using some security product, you can't tell if it's secure or it's snake oil, even if source code is open.
  - adrianN 10y ago
    There aren't any adversaries trying their best to sneak a different X-Files episode on your recording, so you can reasonably assume that checking the quality of the recording is enough to verify that the show you wanted ended up on the tape. With security software, the threat model is completely different.
UweSchmidt 10y ago
The One Time Pad is secure and each step can in its operation can be validated by a layperson with pen+paper.

sp332 10y ago

How verifiable? You've seen the Underhanded C code competition? http://underhanded-c.org/ http://underhanded-c.org/

ComodoHacker 10y ago
I'm not talking about code bugs and backdoors, which can always exist. I'm talking about protocols, encryption schemes and architectures. We need "comprehensible security", as opposed to incomprehensible, "NP-hard" and (soon) even "quantum-hard" security, accessible to only 0.1% of engineers, let alone users. We still don't have digital signing technology that is verifiable as easily as paper signature and works peer-to peer, without some big corp/govt involved.
- khedoros1 10y ago
  The challenge here is that it's super-easy to design protocols that the average person would consider 100% secure, even after reading some documentation. It's the same problem where anyone can create a lock/encryption that they don't know how to break, but there's always someone smarter or better versed in breaking it. Subtle bugs don't look like problems until someone figures out an exploit against them.

adrianN 10y ago

How could the average user possibly verify any kind of modern technology? Programming VCRs is too hard for almost everybody, do you really expect these people to understand even the most basic explanation of how their privacy is protected?

ComodoHacker 10y ago
You don't have to know how VCR works in every detail to use it and be sure it does what it should. You just look at the recording and see its quality. On the other hand, using some security product, you can't tell if it's secure or it's snake oil, even if source code is open.
- adrianN 10y ago
  There aren't any adversaries trying their best to sneak a different X-Files episode on your recording, so you can reasonably assume that checking the quality of the recording is enough to verify that the show you wanted ended up on the tape. With security software, the threat model is completely different.

UweSchmidt 10y ago

The One Time Pad is secure and each step can in its operation can be validated by a layperson with pen+paper.