3 ms·

> No, they won't. They'll stop using tech as much as they can. That's doubtful, especially as technology becomes increasingly ubiquitous. For systems like SS f

> No, they won't. They'll stop using tech as much as they can. That's doubtful, especially as technology becomes increasingly ubiquitous. For systems like SS force users to use it so opting out isn't currently even an option. > If you can't wrap up your healthy habits and your key rotation in a simple device/card/whatnot that people can carry around and use just like a key, your security measures have already failed. Who said we won't? Seat belts were also avoided for a long time but eventually people have realized they're a good idea.

groby_b 9y ago
> Seat belts were also avoided for a long time but eventually people have realized they're a good idea. I take it, then, you were not around in the 80s :) People did not "realize" seatbelts are a good idea. We made people wear seatbelts, using quite draconian laws and relentless PR. > Who said we won't? [... wrap security habits into a handy device] You'll have to explain to me how that jives with your idea of decentralizing data and access control. A key/security device will need to be manufactured - and there are only a few commercial entitites that can and/or will do that. And if you think they won't centralize key management, I admire your optimism.
- tylersmith 9y ago
  Firstly, thanks for the discussion. I enjoy it. I was not around in the 80s, but I know that campaigns to support seat belts and the potential outcomes of not doing so had eventually gotten people to be much more careful. Regarding devices, things like the Ledger or Trezor Bitcoin wallets could easily be adapted to allow users to control their own data securely and simply. There's no reason end users need to understand what's going on in the background. They just know you have a secure usb device you use to authenticate yourself.
  - will_hughes 9y ago
    "could easily be adapted to allow users to control their own data securely and simply" If you can solve the UX problems associated with those, you'll win a lot of praise. To be clear, even something as simple as contactless payment/transit cards are still too difficult for many people to manage. I had to physically take a wireless payment terminal out of a taxi driver's hands when he insisted on trying to do a contactless payment by taking the card in one hand, the reader in the other, and then as if he were playing a game of 'slap', slapping the credit card against the terminal and then immedidately pulling it back up and away. He repeated this several times, cursing each time the terminal displayed the message 'Read Error'. I've repeatedly seen people of all ages: try to press contactless cards against screens, wave cards back and forth at varying distances from the reader, and all manner of other behaviors. And we're talking with basic cards that have no option for input here. Key rotation that requires installing software, using a computer, etc - it's all going to be far too complex for many to understand.
    - tylersmith 9y ago
      I am neither a UX nor hardware expert so that's all taken with what you called "optimism". Key rotation doesn't need to be so complex if the afore mentioned hardware devices are built correctly. Overall I hope security-absolutists like me can work with more socially in-touch people like you to build solutions that can become mainstream.
      - will_hughes 9y ago
        I'm hardly socially in-touch. I just observe people's interaction with technology both at my job (Devops), and in the wider world. If you want to have some idea of the challenges - read reddit's Tales from Tech Support[1] subreddit. For a non-IT focus, the Just Rolled Into the Shop[2] subreddit has a similar theme - that people refuse to read instructions, educate themselves, or even listen to basic instructions on things. Better still - do a 'ride along' with someone who does hands-on IT support for a few weeks. I suspect the only way we will get it if Apple decides to make an ID platform that integrates with the iPhone. [1] https://www.reddit.com/r/talesfromtechsupport https://www.reddit.com/r/talesfromtechsupport [2] https://www.reddit.com/r/Justrolledintotheshop/ https://www.reddit.com/r/Justrolledintotheshop/
        tylersmith 9y ago
        I've done a fair amount of tech support in my career. The divide in our thoughts seems to be that I'm not thinking of a system that will be quickly popular and adopted, but rather one that is secure and eventually wins over users. Users may be reluctant but as they continue to suffer from data loss they'll slowly learn to use proper security regardless of the UX hurdles.
        dsfyu404ed 9y ago
        [2] is basically an enthusiast sub and filled likewise filled with unrealistic expectations of normal people. The mechanical equivalent of "what kind of neanderthal doesn't run no-script?" [1] is better because it's real stories.
  - conanbatt 9y ago
    Milton friedman talks quite a bit about the seatbelt debacle which he was contemporary for. A report-book was written by Ralph Nader called Unsafe at any speed, talking about motor accidents which prompted some outcry and political action that ended with the seatbelt legislation and other safety features. Some time after the book was published, it was shown to have inaccuracies and wrong statistics. https://www.nytimes.com/2015/11/27/automobiles/50-years-ago-unsafe-at-any-speed-shook-the-auto-world.html?mcubz=1 https://www.nytimes.com/2015/11/27/automobiles/50-years-ago-... MF on it: https://www.youtube.com/watch?v=-M90XvQD8eE https://www.youtube.com/watch?v=-M90XvQD8eE
- addHocker 9y ago
  Outlier anecdata: I know a guy who survived a accident, that would have pulped him, by beeing flung out of the car window. Which just proofs that you can find data for every case- and the disappearance of the glasses-haematoma from ERs is great!

groby_b 9y ago

> Seat belts were also avoided for a long time but eventually people have realized they're a good idea. I take it, then, you were not around in the 80s :) People did not "realize" seatbelts are a good idea. We made people wear seatbelts, using quite draconian laws and relentless PR. > Who said we won't? [... wrap security habits into a handy device] You'll have to explain to me how that jives with your idea of decentralizing data and access control. A key/security device will need to be manufactured - and there are only a few commercial entitites that can and/or will do that. And if you think they won't centralize key management, I admire your optimism.

tylersmith 9y ago
Firstly, thanks for the discussion. I enjoy it. I was not around in the 80s, but I know that campaigns to support seat belts and the potential outcomes of not doing so had eventually gotten people to be much more careful. Regarding devices, things like the Ledger or Trezor Bitcoin wallets could easily be adapted to allow users to control their own data securely and simply. There's no reason end users need to understand what's going on in the background. They just know you have a secure usb device you use to authenticate yourself.
- will_hughes 9y ago
  "could easily be adapted to allow users to control their own data securely and simply" If you can solve the UX problems associated with those, you'll win a lot of praise. To be clear, even something as simple as contactless payment/transit cards are still too difficult for many people to manage. I had to physically take a wireless payment terminal out of a taxi driver's hands when he insisted on trying to do a contactless payment by taking the card in one hand, the reader in the other, and then as if he were playing a game of 'slap', slapping the credit card against the terminal and then immedidately pulling it back up and away. He repeated this several times, cursing each time the terminal displayed the message 'Read Error'. I've repeatedly seen people of all ages: try to press contactless cards against screens, wave cards back and forth at varying distances from the reader, and all manner of other behaviors. And we're talking with basic cards that have no option for input here. Key rotation that requires installing software, using a computer, etc - it's all going to be far too complex for many to understand.
  - tylersmith 9y ago
    I am neither a UX nor hardware expert so that's all taken with what you called "optimism". Key rotation doesn't need to be so complex if the afore mentioned hardware devices are built correctly. Overall I hope security-absolutists like me can work with more socially in-touch people like you to build solutions that can become mainstream.
    - will_hughes 9y ago
      I'm hardly socially in-touch. I just observe people's interaction with technology both at my job (Devops), and in the wider world. If you want to have some idea of the challenges - read reddit's Tales from Tech Support[1] subreddit. For a non-IT focus, the Just Rolled Into the Shop[2] subreddit has a similar theme - that people refuse to read instructions, educate themselves, or even listen to basic instructions on things. Better still - do a 'ride along' with someone who does hands-on IT support for a few weeks. I suspect the only way we will get it if Apple decides to make an ID platform that integrates with the iPhone. [1] https://www.reddit.com/r/talesfromtechsupport https://www.reddit.com/r/talesfromtechsupport [2] https://www.reddit.com/r/Justrolledintotheshop/ https://www.reddit.com/r/Justrolledintotheshop/
      - tylersmith 9y ago
        I've done a fair amount of tech support in my career. The divide in our thoughts seems to be that I'm not thinking of a system that will be quickly popular and adopted, but rather one that is secure and eventually wins over users. Users may be reluctant but as they continue to suffer from data loss they'll slowly learn to use proper security regardless of the UX hurdles.
      - dsfyu404ed 9y ago
        [2] is basically an enthusiast sub and filled likewise filled with unrealistic expectations of normal people. The mechanical equivalent of "what kind of neanderthal doesn't run no-script?" [1] is better because it's real stories.
- conanbatt 9y ago
  Milton friedman talks quite a bit about the seatbelt debacle which he was contemporary for. A report-book was written by Ralph Nader called Unsafe at any speed, talking about motor accidents which prompted some outcry and political action that ended with the seatbelt legislation and other safety features. Some time after the book was published, it was shown to have inaccuracies and wrong statistics. https://www.nytimes.com/2015/11/27/automobiles/50-years-ago-unsafe-at-any-speed-shook-the-auto-world.html?mcubz=1 https://www.nytimes.com/2015/11/27/automobiles/50-years-ago-... MF on it: https://www.youtube.com/watch?v=-M90XvQD8eE https://www.youtube.com/watch?v=-M90XvQD8eE
addHocker 9y ago
Outlier anecdata: I know a guy who survived a accident, that would have pulped him, by beeing flung out of the car window. Which just proofs that you can find data for every case- and the disappearance of the glasses-haematoma from ERs is great!