5 ms·

I agree with the sentiment, but Assange's prose is a little dense. Maybe it's OK for his target audience, as I assume the layman won't be reading cryptome.org.

by acabal 14y ago

I agree with the sentiment, but Assange's prose is a little dense. Maybe it's OK for his target audience, as I assume the layman won't be reading cryptome.org. What we really need is a champion to explain in relatable, plain English why encryption is essential even for mom and dad, and to explain it in a more mainstream venue. I think a big reason why people don't encrypt mail, etc., is because: 1) they don't know why it's important because nobody can explain it to them in relatable terms (like saying: when you send an email, Google keeps a copy forever, and the FBI can read it just by picking up a phone and asking nicely), and 2) if they do know the importance, the practicalities of encryption are explained impenetrably. A blur of acronyms, bad metaphors ("keys?" terrible choice of metaphor, considering how a pair is intertwined and their actual use), and no well-known authority you can trust to explain it all simply. The problem isn't that people don't care. They would care if they knew the realities of how their communications are stored, processed, and exposed to their governments. The problem is that nobody can explain it to them in a way that's not ridiculously complex or laden with terms like "Platonic realm" and "transnational dystopia".

18hrs 14y ago
For this reason I am fond of Jonathan Zittrain. Not that he particularly aligns with Assange but he is very good at presenting these issues in a compelling manner.
- belorn 14y ago
  Eben Moglen has also made several good talks about the abolishment of privacy, and its effects. I would especially suggest listening to the Berlin talk made this year called "Why Freedom of Thought Requires Free Media and Why Free Media Require Free Technology".
  - epa 14y ago
    Link for the lazy: http://youtu.be/sKOk4Y4inVY http://youtu.be/sKOk4Y4inVY
SoftwareMaven 14y ago
The problem isn't that people don't care. You are right, people care. But not about things that would make reducing government power likely nor encrypting things by default probable. They care about getting to work in the morning and getting home at night. They care about dinner with the family and a couple hours mindless television. They care about being safe while they do these things, and they've fully bought into the government's mantra of "we will protect you", so, as long as that's happening, they don't care about anything else. Go talk to just about anyone outside of sites like Reddit or HN about the TSA, and you will be told how good a job they are doing. When the government tells them it is time to randomly drop their pants for the cavity check, as long as they are told it is making them safe, they will willingly oblige. As much as the government's power grab, the complete lack of concern for it scares the hell out of me.
- tptacek 14y ago
  The government doesn't have a "mantra" of "we will protect you". It has an obligation to actually protect its citizens, and, in America, does a pretty good job of it. The notion that reliance on the government for protection is a brainwashed delusion is one of those conversational signifiers that convince normal people that all this encryption stuff has nothing to do with them.
  - SoftwareMaven 14y ago
    Of course the government's job is to protect it's people. Even the most libertarian-minded people subscribe to that. The problem is the government has been leaning on that to expand to things that are of questionable "protection". Does millimeter-wave scanning protect you? The government sure expects you to believe it does. What about seizure of property? That will surely protect you from drugs. Why should we need a warrant for things like accessing somebody's email? Terrorists might be sending emails. In some way, each of these things might increase our safety, but the cost of that protection is intolerable to me and many others. Unfortunately, most people don't seem to realize any price is being paid.
    - 14y ago
mylittlepony 14y ago
It's a very hard problem IMO. Not just finding the words, but everything. For example, before learning linux to a degree where it wasn't a pain to use as a desktop, I thought it made no sense to waste time learning this or that security feature (like email encryption), because an expert would probably be able to fuck me anyway. Now that I have a better understanding, and I can mentally trace the information from end to end, know where it could be compromised, etc, I started caring, secured everything the best I could, and my friends now call me a paranoid (that didn't stop me from installing Thunderbird and Enigmail in their PC's). So I think someone should explain to the people in a clear way that you don't need 100% security, but you need to understand when and where your information can get compromised, and what you can do about it. Eg: - Private message on facebook - you are screwed - Messenger - you are screwed - Post on a blog - you are screwed, unless you posted anonymously and hidden your IP (which is not that easy, we know of many geeks who were caught even when they were using Thor, because they didn't fully understand the technology - hint: exit nodes) - Email - you can encrypt it, and you are safe as long as both computers (sender's and receiver's) stay safe (assuming you store your private key there) - Data on your computer - you are safe unless malware is installed, or someone gets physical access. You can use full disk encryption, but you will probably have to use Linux (personally, I use Ubuntu), so this is a far fetched goal for the regular Joe. There is also truecrypt for windows, but it's not full disk if I recall correctly. - Etc. I'll add a recent anecdote here: Just the other day a friend of mine replied to one of my emails, saying that gmail broke the encrypted email (meaning he couldn't read it, not that gmail decrytped it). In his reply, I received the broken email, and four emails from a private conversation he was having with other people. Something happened in gmail, something went wrong, and I got those emails. They came with headers and everything, he didn't copy/paste those (he wouldn't know how to do that). So there's another reason to encrypt emails: mails server can make mistakes apparently.
- mylittlepony 14y ago
  Can the downvoter show his face and elaborate? Thanks
  - nl 14y ago
    I wasn't the downvoter, but I suspect they may have been pointing out you are missing the forest for the trees. "The people" don't need detailed explanations about why one form of technology is "more secure" than another. Instead they need motivation to care about security from their government.
zobzu 14y ago
The main reason I think, is because its hard. Either you use a 3rd party service to encrypt, its easy and also extremely dumb (since its not end to end encryption). Either you use PGP or SMIME and guess what: it's too hard. Their design is fine. I especially like GnuPG (PGP), but the UI, even in CLI, is terrible, terrible! Most people don't even understand that a GnuPG keychain generally contains 2 private keys, not one (one for signing, one for encryption!) or the concept of master signing key and subkeys. These concepts are relatively simple, but their use is hard. Terribly hard.
- Egregore 14y ago
  My idea was that public key cryptography should be done under the hood, so I created a easy to use ResoMail, but people still were not interested (or I was a bad marketer).
  - zobzu 14y ago
    It uses it's own protocol/port/programs it seems. Too many people rely on email right now. Else, we could just use XMPP. Thus the solution should work over email, and with our current email clients. S/MIME/GnuPG/PGP do, but their implementation is far from friendly.
    - Egregore 14y ago
      The part of the solution is to switch to secure domain names, each domain name comes with bundled key pair (like SSL) this is why it's easier to work securely with public key encryption under the hood - the signing of the e-mail public key is done under the hood, the user doesn't have to do it manually.
- bwood 14y ago
  Here's a relevant paper called Why Johnny Can't Encrypt[1], which does an excellent job of defining understanding and usability problems with encryption. It's certainly dated, but I find that its main points are still very true today. [1] http://www.gaudior.net/alma/johnny.pdf http://www.gaudior.net/alma/johnny.pdf
saraid216 14y ago
I wonder how many people who think it's important think that it's important enough to merit actually being said champion.
easytiger 14y ago
how about, without encrypted comms, its like posting a letter by not putting it in an evelope and sticking it to the outside of a bus
betterunix 14y ago
"The problem isn't that people don't care" I think you are overly optimistic here. Let's put it this way: if people were told that they had to report one crime committed by their neighbors in order to watch the superbowl, what do you think would happen? "They would care if they knew the realities of how their communications are stored, processed, and exposed to their governments" I have a lot of friends who know this, some of whom know it in more depth than many HN readers. Guess what? They all stopped bothering to maintain a PGP key. They all carry cell phones, and they do not even take the time to try to disable location services. They are all users of at least one of (Facebook Twitter Google+ GMail LinkedIn). If the people who know these things do not care, what make you think that people do not know these things would care if they became knowledgeable?

by acabal 14y ago

18hrs 14y ago

For this reason I am fond of Jonathan Zittrain. Not that he particularly aligns with Assange but he is very good at presenting these issues in a compelling manner.

belorn 14y ago
Eben Moglen has also made several good talks about the abolishment of privacy, and its effects. I would especially suggest listening to the Berlin talk made this year called "Why Freedom of Thought Requires Free Media and Why Free Media Require Free Technology".
- epa 14y ago
  Link for the lazy: http://youtu.be/sKOk4Y4inVY http://youtu.be/sKOk4Y4inVY

SoftwareMaven 14y ago

The problem isn't that people don't care. You are right, people care. But not about things that would make reducing government power likely nor encrypting things by default probable. They care about getting to work in the morning and getting home at night. They care about dinner with the family and a couple hours mindless television. They care about being safe while they do these things, and they've fully bought into the government's mantra of "we will protect you", so, as long as that's happening, they don't care about anything else. Go talk to just about anyone outside of sites like Reddit or HN about the TSA, and you will be told how good a job they are doing. When the government tells them it is time to randomly drop their pants for the cavity check, as long as they are told it is making them safe, they will willingly oblige. As much as the government's power grab, the complete lack of concern for it scares the hell out of me.

tptacek 14y ago
The government doesn't have a "mantra" of "we will protect you". It has an obligation to actually protect its citizens, and, in America, does a pretty good job of it. The notion that reliance on the government for protection is a brainwashed delusion is one of those conversational signifiers that convince normal people that all this encryption stuff has nothing to do with them.
- SoftwareMaven 14y ago
  Of course the government's job is to protect it's people. Even the most libertarian-minded people subscribe to that. The problem is the government has been leaning on that to expand to things that are of questionable "protection". Does millimeter-wave scanning protect you? The government sure expects you to believe it does. What about seizure of property? That will surely protect you from drugs. Why should we need a warrant for things like accessing somebody's email? Terrorists might be sending emails. In some way, each of these things might increase our safety, but the cost of that protection is intolerable to me and many others. Unfortunately, most people don't seem to realize any price is being paid.
  - 14y ago

mylittlepony 14y ago

It's a very hard problem IMO. Not just finding the words, but everything. For example, before learning linux to a degree where it wasn't a pain to use as a desktop, I thought it made no sense to waste time learning this or that security feature (like email encryption), because an expert would probably be able to fuck me anyway. Now that I have a better understanding, and I can mentally trace the information from end to end, know where it could be compromised, etc, I started caring, secured everything the best I could, and my friends now call me a paranoid (that didn't stop me from installing Thunderbird and Enigmail in their PC's). So I think someone should explain to the people in a clear way that you don't need 100% security, but you need to understand when and where your information can get compromised, and what you can do about it. Eg: - Private message on facebook - you are screwed - Messenger - you are screwed - Post on a blog - you are screwed, unless you posted anonymously and hidden your IP (which is not that easy, we know of many geeks who were caught even when they were using Thor, because they didn't fully understand the technology - hint: exit nodes) - Email - you can encrypt it, and you are safe as long as both computers (sender's and receiver's) stay safe (assuming you store your private key there) - Data on your computer - you are safe unless malware is installed, or someone gets physical access. You can use full disk encryption, but you will probably have to use Linux (personally, I use Ubuntu), so this is a far fetched goal for the regular Joe. There is also truecrypt for windows, but it's not full disk if I recall correctly. - Etc. I'll add a recent anecdote here: Just the other day a friend of mine replied to one of my emails, saying that gmail broke the encrypted email (meaning he couldn't read it, not that gmail decrytped it). In his reply, I received the broken email, and four emails from a private conversation he was having with other people. Something happened in gmail, something went wrong, and I got those emails. They came with headers and everything, he didn't copy/paste those (he wouldn't know how to do that). So there's another reason to encrypt emails: mails server can make mistakes apparently.

mylittlepony 14y ago
Can the downvoter show his face and elaborate? Thanks
- nl 14y ago
  I wasn't the downvoter, but I suspect they may have been pointing out you are missing the forest for the trees. "The people" don't need detailed explanations about why one form of technology is "more secure" than another. Instead they need motivation to care about security from their government.

zobzu 14y ago

The main reason I think, is because its hard. Either you use a 3rd party service to encrypt, its easy and also extremely dumb (since its not end to end encryption). Either you use PGP or SMIME and guess what: it's too hard. Their design is fine. I especially like GnuPG (PGP), but the UI, even in CLI, is terrible, terrible! Most people don't even understand that a GnuPG keychain generally contains 2 private keys, not one (one for signing, one for encryption!) or the concept of master signing key and subkeys. These concepts are relatively simple, but their use is hard. Terribly hard.

Egregore 14y ago
My idea was that public key cryptography should be done under the hood, so I created a easy to use ResoMail, but people still were not interested (or I was a bad marketer).
- zobzu 14y ago
  It uses it's own protocol/port/programs it seems. Too many people rely on email right now. Else, we could just use XMPP. Thus the solution should work over email, and with our current email clients. S/MIME/GnuPG/PGP do, but their implementation is far from friendly.
  - Egregore 14y ago
    The part of the solution is to switch to secure domain names, each domain name comes with bundled key pair (like SSL) this is why it's easier to work securely with public key encryption under the hood - the signing of the e-mail public key is done under the hood, the user doesn't have to do it manually.
bwood 14y ago
Here's a relevant paper called Why Johnny Can't Encrypt[1], which does an excellent job of defining understanding and usability problems with encryption. It's certainly dated, but I find that its main points are still very true today. [1] http://www.gaudior.net/alma/johnny.pdf http://www.gaudior.net/alma/johnny.pdf

saraid216 14y ago

I wonder how many people who think it's important think that it's important enough to merit actually being said champion.

easytiger 14y ago

how about, without encrypted comms, its like posting a letter by not putting it in an evelope and sticking it to the outside of a bus

betterunix 14y ago

"The problem isn't that people don't care" I think you are overly optimistic here. Let's put it this way: if people were told that they had to report one crime committed by their neighbors in order to watch the superbowl, what do you think would happen? "They would care if they knew the realities of how their communications are stored, processed, and exposed to their governments" I have a lot of friends who know this, some of whom know it in more depth than many HN readers. Guess what? They all stopped bothering to maintain a PGP key. They all carry cell phones, and they do not even take the time to try to disable location services. They are all users of at least one of (Facebook Twitter Google+ GMail LinkedIn). If the people who know these things do not care, what make you think that people do not know these things would care if they became knowledgeable?