4 ms·

All the stuff about private and public keys was a bit of a haze to me until I invested a few hours in reading up on cryptography and specifically the Diffie-Hel

by Tycho 16y ago

All the stuff about private and public keys was a bit of a haze to me until I invested a few hours in reading up on cryptography and specifically the Diffie-Hellman Key Exchange. I postulate that the problem here is (was?) one of terminology and/or education, rather than interface design. Incidentally I thought the article was going to be about why amateurs can't/shouldn't write encryption algorithms (having inquired about this myself on Stack Overflow and been royally shouted down).

zppx 16y ago
I still remember that some years ago I did not knew what exactly was a "secure channel" that some texts talked about when I was learning about PKIs. The terminology is really confusing if people do not get the concepts.
wmf 16y ago
These days in the security field "user education" is viewed as an excuse by developers who abdicate responsibility. Phishing shows that users can't/won't be educated, so some other solution has to be found.
- derefr 16y ago
  It's only been a few decades since users (outside of DARPA) were first required to understand anything about computer security. Cultures take time to change, though when they do, it can seem like a sudden burst. I think Western culture might be just about to start caring about computer privacy, due to the thorough percolation of media reports about it; computer security might have its day as well, soon enough. We all learned to brush our teeth, do our taxes and drive (through various mechanisms)—we'll eventually learn to sign/authenticate and encrypt/decrypt information as well, if it's that important.
ganjianwei 16y ago
I agree with the terminology being a problem. Regarding private key public key encryption, I think the public key should be called the "lock" since people use it to lock data they want to send you, while the private key should be called the "key" because you use it to "unlock"(decrypt) the data. But this messes up when you use the same terms for other uses of public/private keys such as authentication. Still, the terms could provide a better mental model for people new to it to understand.
- dalore 16y ago
  That breaks down when you use your private key [aka the "key"] to encrypt/sign something when you send it out. It proves it came from you because your public key [aka the "lock"] can decrypt it.

by Tycho 16y ago

zppx 16y ago

I still remember that some years ago I did not knew what exactly was a "secure channel" that some texts talked about when I was learning about PKIs. The terminology is really confusing if people do not get the concepts.

wmf 16y ago

These days in the security field "user education" is viewed as an excuse by developers who abdicate responsibility. Phishing shows that users can't/won't be educated, so some other solution has to be found.

derefr 16y ago
It's only been a few decades since users (outside of DARPA) were first required to understand anything about computer security. Cultures take time to change, though when they do, it can seem like a sudden burst. I think Western culture might be just about to start caring about computer privacy, due to the thorough percolation of media reports about it; computer security might have its day as well, soon enough. We all learned to brush our teeth, do our taxes and drive (through various mechanisms)—we'll eventually learn to sign/authenticate and encrypt/decrypt information as well, if it's that important.

ganjianwei 16y ago

I agree with the terminology being a problem. Regarding private key public key encryption, I think the public key should be called the "lock" since people use it to lock data they want to send you, while the private key should be called the "key" because you use it to "unlock"(decrypt) the data. But this messes up when you use the same terms for other uses of public/private keys such as authentication. Still, the terms could provide a better mental model for people new to it to understand.

dalore 16y ago
That breaks down when you use your private key [aka the "key"] to encrypt/sign something when you send it out. It proves it came from you because your public key [aka the "lock"] can decrypt it.