4 ms·
As developers perhaps the most effective thing we can do from a long-term perspective is baking strong cryptography in to all of the products we create, and opt
by acabal 13y ago
As developers perhaps the most effective thing we can do from a long-term perspective is baking strong cryptography in to all of the products we create, and opting for open source whenever possible. (After all, open source is the only way we can guarantee that the software we're using really doesn't snoop on us.)
If crypto were easier to use and presented as a default, more regular people would wind up using it and we'd slowly start stymieing the NSA and similar organizations.
Playing politics and calling your congressman isn't going to work in the long term, as you said. We might get one or two laws changed in the short term, but things can change back in the scale of decades and we could be even worse off. The only real solution is to make it mathematically impossible for agencies to read our communications now and in the future.
- SoftwareMaven 13y agoTo make crypto truly secure, the end user has to take on management of their key and that key can never reside on your servers. Users can barely manage their password; expecting them to manage something that, if they lose, takes all their data with them, is asking a lot. I tried to get a startup off the ground for 2 years that would secure gmail, and we went round and round on this. We wanted to not be able to read the user's mail, but the impact on usability was so large, users wouldn't touch it. How do we train users to manage keys? What would be really nice is true homomorphic encryption.
- toufka 13y agoGive us a try? It seems this is the default line and that the users never get to piss off the support people because they're never given the chance. Let us burn ourselves and then we can learn to use the stove. If we never understand the importance of that key we'll never get used to maintaining it properly. Quite clearly - is there any messaging service that allows users to end-to-end encrypt? That is not PGP? There is such a conspicuous void in the market here...
- Peaker 13y agoOpen source unfortunately gives no such guarantee [1]. [1]. https://www.ece.cmu.edu/~ganger/712.fall02/papers/p761-thompson.pdf https://www.ece.cmu.edu/~ganger/712.fall02/papers/p761-thomp... (Reflections on trusting trust)