3 ms·

I can't believe how all these security experts are suggesting the Guardian retract a factually correct article because stupid users might switch from Whats App

I can't believe how all these security experts are suggesting the Guardian retract a factually correct article because stupid users might switch from Whats App to SMS. Do you really think the average user is that stupid? Maybe the Guardian article prompted thousands of people to learn more about cryptography? This is probably the first time many people have learned that a security protocol can have flaws. To me it sounds like a bunch of security experts are angry that they weren't quoted in the most prominent security story of the year.

tptacek 10y ago
Maybe if you can't believe it, there's something about the situation that you haven't grasped. Consider the possibility that practically every expert in the field isn't wrong about this, and that you haven't come to some surprising new insight in the time you've given to thinking about that.
tprynn 10y ago
The average user does not know anything about encryption! But they have heard about hacking, so they know that if a popular paper is reporting something as insecure, they shouldn't use it. What will they use instead? Whatever is available, and the next most available messenger is SMS. There are users who could literally (yes, literally) have their lives saved by using whatsapp rather than SMS. But because of this article, they won't. You don't have to take my word for that. Zeynep works with those people, and will tell you the same thing.
- baby 10y ago
  > Whatever is available, and the next most available messenger is SMS I would argue that at this point it is either Messenger (facebook) or Snapchat.
Analemma_ 10y ago
> can't believe how all these security experts are suggesting the Guardian retract a factually correct article because stupid users might switch from Whats App to SMS. Do you really think the average user is that stupid? The security experts you're complaining about are citing empirical evidence that people mostly switch back to SMS if they stop using WhatsApp. They are right, and you are wrong. > Maybe the Guardian article prompted thousands of people to learn more about cryptography? This is probably the first time many people have learned that a security protocol can have flaws. Everyone in this discussion agrees that there is no 100% correct answer here, and that this is all a question of tradeoffs. The security community wants the option that minimizes harm to the most people, and the Guardian's reporting is doing the opposite of that. Yes, a few people may have been more informed about cryptography. The overwhelming evidence is that many more people instead are switching to a less-secure alternative because they didn't understand what they were reading. > To me it sounds like a bunch of security experts are angry that they weren't quoted in the most prominent security story of the year. I don't know where to begin with this. You just told us not to assume the worst of ordinary people but seem happy to do that with domain experts.
- jakobegger 10y ago
  Did you actually read the open letter? There is no actual empirical evidence presented in the letter, just a paragraph with anecdotal evidence that people are unsure what to do, and assertions that the author's years of experience show that the Guardian's article has bad effects. The letter complains that the journalist did not ask any established security researchers, and discredits the source as a 'single well meaning graduate student'. I honestly don't understand why all these domain experts are getting so riled up over a single story; instead of welcoming the attention it brings, they are asking a paper to retract a factually correct article, because the presented flaw should be described as a sensible tradeoff, instead of as a back door.

tptacek 10y ago

Maybe if you can't believe it, there's something about the situation that you haven't grasped. Consider the possibility that practically every expert in the field isn't wrong about this, and that you haven't come to some surprising new insight in the time you've given to thinking about that.

tprynn 10y ago

The average user does not know anything about encryption! But they have heard about hacking, so they know that if a popular paper is reporting something as insecure, they shouldn't use it. What will they use instead? Whatever is available, and the next most available messenger is SMS. There are users who could literally (yes, literally) have their lives saved by using whatsapp rather than SMS. But because of this article, they won't. You don't have to take my word for that. Zeynep works with those people, and will tell you the same thing.

baby 10y ago
> Whatever is available, and the next most available messenger is SMS I would argue that at this point it is either Messenger (facebook) or Snapchat.

Analemma_ 10y ago

> can't believe how all these security experts are suggesting the Guardian retract a factually correct article because stupid users might switch from Whats App to SMS. Do you really think the average user is that stupid? The security experts you're complaining about are citing empirical evidence that people mostly switch back to SMS if they stop using WhatsApp. They are right, and you are wrong. > Maybe the Guardian article prompted thousands of people to learn more about cryptography? This is probably the first time many people have learned that a security protocol can have flaws. Everyone in this discussion agrees that there is no 100% correct answer here, and that this is all a question of tradeoffs. The security community wants the option that minimizes harm to the most people, and the Guardian's reporting is doing the opposite of that. Yes, a few people may have been more informed about cryptography. The overwhelming evidence is that many more people instead are switching to a less-secure alternative because they didn't understand what they were reading. > To me it sounds like a bunch of security experts are angry that they weren't quoted in the most prominent security story of the year. I don't know where to begin with this. You just told us not to assume the worst of ordinary people but seem happy to do that with domain experts.

jakobegger 10y ago
Did you actually read the open letter? There is no actual empirical evidence presented in the letter, just a paragraph with anecdotal evidence that people are unsure what to do, and assertions that the author's years of experience show that the Guardian's article has bad effects. The letter complains that the journalist did not ask any established security researchers, and discredits the source as a 'single well meaning graduate student'. I honestly don't understand why all these domain experts are getting so riled up over a single story; instead of welcoming the attention it brings, they are asking a paper to retract a factually correct article, because the presented flaw should be described as a sensible tradeoff, instead of as a back door.