5 ms·
This is a great question, but you should bear in mind that there's almost always going to be a tradeoff between security/privacy/anonymity and convenience. Enc
by gnosis 13y ago
This is a great question, but you should bear in mind that there's
almost always going to be a tradeoff between
security/privacy/anonymity and convenience.
Encypting your email and having to deal with key managment issues, and
hosting your own email server is going to be more of a hassle than
just using someone else's "free" cloud-based service.
Setting up and managing your own services is going to be a burden and
a time sink, even if you have the skills, knowledge, and copious free
time to do it all.
The question becomes: how much is your privacy and security worth to
you? Unfortunately, for most people the answer is "not that much".
Nevermind that most of them don't have the knowledge or skills to set
up and manage their own services even if they valued their security
and privacy enough to sacrifice so much time and effort to it.
The problems are magnified when you consider that most applications
are not built with security, privacy, or anonymity in mind. And when
you have to use these applications to interact with other people (most
of which probably won't be nearly as security or privacy conscious as
you are), you're going to have an uphill battle to protect your own
privacy. For instance, good luck getting your computer illiterate parents, friends, colleagues, and bosses to properly use GPG to encrypt their emails to you.
This doesn't even begin to address the issues of privacy and security
in the "real world" as opposed to the digital one, nor of the
digital footprints you leave as you consume online information and
media, and interact with others on various forums.
The end result is that online privacy and security are largely becoming the
mainstay of the super-paranoid technological elite and the ultra-rich,
who can afford to hire security teams to take care of their privacy
for them, and of the technological outcast, who (willingly or
unwillingly) manages to avoid using the net at all.
- danso 13y agoI think you've approached the question in the right way. There is no such thing as security without a tradeoff...everyone who's ever traveled through an airport knows that. The cloud is useful because it's so easy to share things -- and that "leakiness" makes it inherently unsafe. The NSA had its own easy-access problem lately...Snowden reportedly snuck data out using USB drives, something that was purportedly banned after a 2008 virus incident...and yet, some sysop apparently thought it'd be a good idea to let a few USB ports survive, because the things are so damned useful. And now look at what that wrought the NSA. It's not just inconvenience that you have to put up when going for security, it's the risk that the inconvenience will cause you to enact blind spots to ease your day...and easing inconvenience was exactly the reason why people use cloud services (and USB keys) in the first place. I'm not trying to espouse fatalism (i.e. everyone just give up their data to the G-men). Just pointing out that what the OP wants is basically a unicorn.
- Zigurd 13y ago> There is no such thing as security without a tradeoff The original implementation of Skype was convenient and secure.
- venus 13y agoWell, that traded off the govt's ability to wiretap.
- Zigurd 13y agoWouldn't every system based on strong encryption prevent wiretaps? The only way to do that and preserve the power to wiretap is to make open source encryption illegal and mandate the use of key escrow. That would be hard to enforce. It appears that neither the developers of Skype nor the government of Estonia viewed that as a bad trade-off.
- venus 13y agoI wasn't trying to make some kind of statement with my comment - I was merely pointing out an identifiable trade-off. That said, if and when an easy-to-use, truly secure p2p communication system ever gains real traction then action against it will probably be on the table. Banning won't really work, as you say, but it can probably be made inconvenient/unpalatable enough to discourage most users. I think most people agree that there do exist legitimate cases for governmental wiretapping, as long as the rules are agreed upon and followed strictly. Genuine untappable comms will be a threat to that legitimate government function and I don't think, barring some radical shift in popular opinion, there will be much opposition to such a ban.
- gnosis 13y agoConventional encryption (strong or otherwise) does absolutely nothing to prevent wiretaps. If the encryption algorithm that's used is well respected among cryptographers and has no known, practically exploitable weaknesses; if this algorithm has been implemented correctly in the encryption software; if the software is used properly by every party involved in the communcation; if these parties' systems have not been compromised; if the people or entitites interested in your communication are not (like the NSA is speculated to be) 20 to 30 years ahead of the public cryptography community -- all very big if's -- then you might buy yourself some time until the encryption is finally broken (something that might happen tomorrow, or next month, or next year, or 20 years from now, or never, who knows?). In the meantime, your encrypted communication could be intercepted, recorded, and stored indefinitely -- and available for a practically limitless number of decryption attempts in the future.