3 ms·

The barriers to entry for building HTTPS software are a lot lower than building out cellular infrastructure. For HTTPS you have a lot of altruistic people and c

The barriers to entry for building HTTPS software are a lot lower than building out cellular infrastructure. For HTTPS you have a lot of altruistic people and companies, like letsencrypt and Mozilla willing to give some resources to make HTTPS everywhere possible. There really isn’t a similar entity in the cellular carrier world. Trying to start something new tomorrow that is more secure would take a huge investment and would likely take a very long time to recoup that investment in today’s climate, as mentioned it’s not enough to get regular users to switch. So unless the government mandates it which I think we all agree is not in their best interest or some very rich person comes along and offers carriers a compelling reason to switch I just don’t see it happening. And I totally agree with you that it should be done. I just don’t see how given where we are today.

dahart 7y ago
> The barriers to entry for building HTTPS software are a lot lower than building out cellular infrastructure. Why assume extra cell security would be a hardware build-out? Surely all towers in existence can get remote firmware upgrades, the same way all of todays routers can? > For HTTPS you have a lot of altruistic people and companies, like letsencrypt and Mozilla willing to give some resources to make HTTPS everywhere possible. That seems true in retrospect, but there was lots resistance to, and futility thinking about HTTPS before it happened, I remember it, I was there. It only seems like there are altruistic people helping now that it basically is everywhere and now that it’s easy & cheap to do, and everyone knows it’s a good idea. > So unless the government mandates it Agreed that’s unlikely to happen, but it doesn’t seem like a real barrier to me. Maybe GDPR or Europe will take the lead on this one too. But very little of the security & privacy we have in the US has ever come from a government mandate, yet we do have some. HTTPS wasn’t a government mandate. They didn’t oppose it either, possibly because they have keys and/or cooperative ISPs, but they sure didn’t do anything to push it forward. > I just don’t see how given where we are today. Public awareness about the issue for one. Rather than saying it’s futile and will probably never happen, talking to your friends and family about it will help. Though we have a super long way to go, improvements in privacy do tend to happen once the public truly understands how they’re being spied on. Privacy pushes by Apple and Google could make it happen. Even Apple alone might be able to make it happen, and they’re currently on the side of privacy. It might also unfortunately take more widely reported cases of StingRay before people perk up to this issue.
- smhenderson 7y ago
  True, firmware updates are a possible upgrade path, I don't know much about cellular hardware so I can't speak to what capabilities can be added that way. I agree about public awareness but if I'm pessimistic it's because I do talk to my friends and family about it and they all think I'm just paranoid. :-) They just can't understand why I don't have a FB account, don't use iCloud or Google Docs. Everyone uses it, they say, how could it be bad if everyone is using it? Granted having phone calls spied on might get their attention a bit more but I still get an attitude from people like "I'm not doing anything wrong, why would they ever listen to or track me?".

dahart 7y ago

> The barriers to entry for building HTTPS software are a lot lower than building out cellular infrastructure. Why assume extra cell security would be a hardware build-out? Surely all towers in existence can get remote firmware upgrades, the same way all of todays routers can? > For HTTPS you have a lot of altruistic people and companies, like letsencrypt and Mozilla willing to give some resources to make HTTPS everywhere possible. That seems true in retrospect, but there was lots resistance to, and futility thinking about HTTPS before it happened, I remember it, I was there. It only seems like there are altruistic people helping now that it basically is everywhere and now that it’s easy & cheap to do, and everyone knows it’s a good idea. > So unless the government mandates it Agreed that’s unlikely to happen, but it doesn’t seem like a real barrier to me. Maybe GDPR or Europe will take the lead on this one too. But very little of the security & privacy we have in the US has ever come from a government mandate, yet we do have some. HTTPS wasn’t a government mandate. They didn’t oppose it either, possibly because they have keys and/or cooperative ISPs, but they sure didn’t do anything to push it forward. > I just don’t see how given where we are today. Public awareness about the issue for one. Rather than saying it’s futile and will probably never happen, talking to your friends and family about it will help. Though we have a super long way to go, improvements in privacy do tend to happen once the public truly understands how they’re being spied on. Privacy pushes by Apple and Google could make it happen. Even Apple alone might be able to make it happen, and they’re currently on the side of privacy. It might also unfortunately take more widely reported cases of StingRay before people perk up to this issue.

smhenderson 7y ago
True, firmware updates are a possible upgrade path, I don't know much about cellular hardware so I can't speak to what capabilities can be added that way. I agree about public awareness but if I'm pessimistic it's because I do talk to my friends and family about it and they all think I'm just paranoid. :-) They just can't understand why I don't have a FB account, don't use iCloud or Google Docs. Everyone uses it, they say, how could it be bad if everyone is using it? Granted having phone calls spied on might get their attention a bit more but I still get an attitude from people like "I'm not doing anything wrong, why would they ever listen to or track me?".