3 ms·
Very good questions, and something I believe we as a society AND as a profession are only starting to realise. The truth is, people everywhere say they want se
by bostik 8y ago
Very good questions, and something I believe we as a society AND as a profession are only starting to realise.
The truth is, people everywhere say they want security. But that's a white lie. What people really want is convenience. That is also the wedge we as a developer community can work with.
I truly believe that if you can make the secure option also the more convenient option, you won't be able to keep people away.[ß] As far as usability goes, secure and/or hardened software is still atrocious.
The point about meatspace bank is a really good one. Well, as it happens, WhatsApp based banking is a real thing. I found one startup doing that[0], but even before this I remember that somewhere (Philippines? Indonesia? Kenya?) WA was already used for bank customer support.
Now, is that somehow more secure than a well done, well maintained, properly hardened banking app from a dedicated big player? Certainly not. But it's hell of a lot better than a MVP from a company that might be barely in their second year to a basic banking license. It has the benefit of adding useful business traffic to a reasonably secure transport. Obviously it still depends on a known-malicious third party for routing, but then again, for a truly secure communications system you have to assume that you're dealing with compromised and/or actively malicious infrastructure.
Which makes it a very good first step. For any real progress, we will need at least another decade of research into usable, latency-sensitive, information-theoretically noisy communication systems. Secure and ~anonymous message routing is going to be a damn hard problem. (Without the latency part, and assuming very cheap bandwidth, something like a probabilistic K-anonymity based batched multicast might be a reasonable starting point.)
Even then, the usability has to be baked in and considered from the start.
> For noise on secure channels, I torrent random stuff. That all goes through a VPN service.
Now that's a really nice countermeasure. Well done!
ß: Global censorship and blanket bans with aggressive enforcement notwithstanding.
0: Company is apparently called "Absa".
- taejo 8y ago> 0: Company is apparently called "Absa". FYI, Absa is one of South Africa's largest banks, formed in 1991 by the merger of several large, long-established banks, and by now owns all of Barclays' African operations. It's not a startup.
- bostik 8y ago/me recovers foot from mouth. Thank you, I stand corrected.
- mirimir 8y agoMaybe a bank could support something like Briar or Ricochet, with P2P between Tor .onion instances. With secure 2FA, using hardware tokens. I'd switch in a nanosecond. But they'd likely never satisfy KYC rules :( And I do see many banks starting to use WhatsApp. It'd be better if they (at least) used Signal, but it's a start.