4 ms·

> along with healthy security habits like proper secret generation and frequent rotation. While having the populace in general be security aware would be a gre

> along with healthy security habits like proper secret generation and frequent rotation. While having the populace in general be security aware would be a great thing, it's barely possible to get them to do even basic shit like not putting credit card numbers and other secret information into an email and sending it to anyone who asks nicely. Educating people on why 'healthy security habits' and 'key rotation' doesn't mean locking the front door and hanging their housekeys differently is pretty much a non-starter.

tylersmith 9y ago
As people continue to get their money stolen they'll slowly come around to utilizing good security.
- groby_b 9y ago
  No, they won't. They'll stop using tech as much as they can. That's basic UX. If you make the experience shitty, people will avoid it. No amount of experts waving their hands wildly will help that. If you can't wrap up your healthy habits and your key rotation in a simple device/card/whatnot that people can carry around and use just like a key, your security measures have already failed. "Because I said so" doesn't work on kids, it sure as heck doesn't work on adults.
  - tylersmith 9y ago
    > No, they won't. They'll stop using tech as much as they can. That's doubtful, especially as technology becomes increasingly ubiquitous. For systems like SS force users to use it so opting out isn't currently even an option. > If you can't wrap up your healthy habits and your key rotation in a simple device/card/whatnot that people can carry around and use just like a key, your security measures have already failed. Who said we won't? Seat belts were also avoided for a long time but eventually people have realized they're a good idea.
    - groby_b 9y ago
      > Seat belts were also avoided for a long time but eventually people have realized they're a good idea. I take it, then, you were not around in the 80s :) People did not "realize" seatbelts are a good idea. We made people wear seatbelts, using quite draconian laws and relentless PR. > Who said we won't? [... wrap security habits into a handy device] You'll have to explain to me how that jives with your idea of decentralizing data and access control. A key/security device will need to be manufactured - and there are only a few commercial entitites that can and/or will do that. And if you think they won't centralize key management, I admire your optimism.
      - tylersmith 9y ago
        Firstly, thanks for the discussion. I enjoy it. I was not around in the 80s, but I know that campaigns to support seat belts and the potential outcomes of not doing so had eventually gotten people to be much more careful. Regarding devices, things like the Ledger or Trezor Bitcoin wallets could easily be adapted to allow users to control their own data securely and simply. There's no reason end users need to understand what's going on in the background. They just know you have a secure usb device you use to authenticate yourself.
        will_hughes 9y ago
        "could easily be adapted to allow users to control their own data securely and simply" If you can solve the UX problems associated with those, you'll win a lot of praise. To be clear, even something as simple as contactless payment/transit cards are still too difficult for many people to manage. I had to physically take a wireless payment terminal out of a taxi driver's hands when he insisted on trying to do a contactless payment by taking the card in one hand, the reader in the other, and then as if he were playing a game of 'slap', slapping the credit card against the terminal and then immedidately pulling it back up and away. He repeated this several times, cursing each time the terminal displayed the message 'Read Error'. I've repeatedly seen people of all ages: try to press contactless cards against screens, wave cards back and forth at varying distances from the reader, and all manner of other behaviors. And we're talking with basic cards that have no option for input here. Key rotation that requires installing software, using a computer, etc - it's all going to be far too complex for many to understand.

tylersmith 9y ago

As people continue to get their money stolen they'll slowly come around to utilizing good security.

groby_b 9y ago
No, they won't. They'll stop using tech as much as they can. That's basic UX. If you make the experience shitty, people will avoid it. No amount of experts waving their hands wildly will help that. If you can't wrap up your healthy habits and your key rotation in a simple device/card/whatnot that people can carry around and use just like a key, your security measures have already failed. "Because I said so" doesn't work on kids, it sure as heck doesn't work on adults.
- tylersmith 9y ago
  > No, they won't. They'll stop using tech as much as they can. That's doubtful, especially as technology becomes increasingly ubiquitous. For systems like SS force users to use it so opting out isn't currently even an option. > If you can't wrap up your healthy habits and your key rotation in a simple device/card/whatnot that people can carry around and use just like a key, your security measures have already failed. Who said we won't? Seat belts were also avoided for a long time but eventually people have realized they're a good idea.
  - groby_b 9y ago
    > Seat belts were also avoided for a long time but eventually people have realized they're a good idea. I take it, then, you were not around in the 80s :) People did not "realize" seatbelts are a good idea. We made people wear seatbelts, using quite draconian laws and relentless PR. > Who said we won't? [... wrap security habits into a handy device] You'll have to explain to me how that jives with your idea of decentralizing data and access control. A key/security device will need to be manufactured - and there are only a few commercial entitites that can and/or will do that. And if you think they won't centralize key management, I admire your optimism.
    - tylersmith 9y ago
      Firstly, thanks for the discussion. I enjoy it. I was not around in the 80s, but I know that campaigns to support seat belts and the potential outcomes of not doing so had eventually gotten people to be much more careful. Regarding devices, things like the Ledger or Trezor Bitcoin wallets could easily be adapted to allow users to control their own data securely and simply. There's no reason end users need to understand what's going on in the background. They just know you have a secure usb device you use to authenticate yourself.
      - will_hughes 9y ago
        "could easily be adapted to allow users to control their own data securely and simply" If you can solve the UX problems associated with those, you'll win a lot of praise. To be clear, even something as simple as contactless payment/transit cards are still too difficult for many people to manage. I had to physically take a wireless payment terminal out of a taxi driver's hands when he insisted on trying to do a contactless payment by taking the card in one hand, the reader in the other, and then as if he were playing a game of 'slap', slapping the credit card against the terminal and then immedidately pulling it back up and away. He repeated this several times, cursing each time the terminal displayed the message 'Read Error'. I've repeatedly seen people of all ages: try to press contactless cards against screens, wave cards back and forth at varying distances from the reader, and all manner of other behaviors. And we're talking with basic cards that have no option for input here. Key rotation that requires installing software, using a computer, etc - it's all going to be far too complex for many to understand.