3 ms·

> out of sight and mind of the user Which can be sometimes dangerous as more and more crypto is designed to be set-and-forget. It leaves the windows open for b

• shadowgovt 7y ago
  You can require something people won't do all you want, and it doesn't get done. Cryptographic theory breaks down at the UX layer. If you try to improve security by cycling passwords too frequently, users start writing them on sticky notes tacked to their monitors. If you require users to keep their private keys in their own possession, users lose their private keys, get angry when you can't reconstitute those keys for them, and go use a service that can offer that feature. I think there's a reason the entire ecosystem has moved in the direction of trusted actors who could, in theory, exploit that trust to know everything they can about the signal passing through their trusted zone (with those who trust nobody still operating independently as a fringe minority).
  • snarf21 7y ago
    Exactly. The challenge is the balance between security and convenience. The issue is that without full management of keys and building of source that has been signed and then investigated, you have to trust someone. I think this is the issue, if you decide to trust, then you trust. The harder question is who can you actually trust.