3 ms·
Strawman recapitulation of PHKs thoughts. Unfortunately, the conclusions are both wrong, and naïve at worst. Crypto that gets used has to be easy-to-use, MySQ
by ballard 13y ago
Strawman recapitulation of PHKs thoughts. Unfortunately, the conclusions are both wrong, and naïve at worst.
Crypto that gets used has to be easy-to-use, MySQL style. I think a project like tcpcrypt is great example, in theory. Simple is good because the pain of setup has to be least. (Tcpcrypt is opportunistic encryption that needs no additional setup and is different from SSL.)
Crypto does work. Snowden admitted as such.
“Encryption works. Properly implemented strong crypto systems are one of the few things that you can rely on. Unfortunately, endpoint security is so terrifically weak that NSA can frequently find ways around it.”
http://m.techcrunch.com/2013/06/17/encrypting-your-email-works-says-nsa-whistleblower-edward-snowden/ http://m.techcrunch.com/2013/06/17/encrypting-your-email-wor...
(The last point is another form of the ancient security problem of taking steps to minimize chances of plaintext disclosure.)
The cost to capture or recover plaintext should be much greater to the proportion of the potential value of the PT over the time it could cause damage.
Just giving up is defeatist and expects that some future government made of fallible people would suddenly get enlightenment and act benignly. Never going to happen, there is too much money and power at stake. (USG fears its citizens but abuses power to crucify dissenters.)
Encrypting almost everything is one immediate way to forcibly remove the possibility of abuse. Remember that even if (and that's a big "if") political sands were shifted one way, they would certainly shift back to a culture of secrecy and expedient Machevellianism. If you don't take reasonable measures to protect yourself, you don't understand what's going on or what works. There are no easy fixes, only defense-in-depth. Security is fundamentally an unending competition of gambits and countermeasures that will continue so long as people have secrets or desire freedom from intrusion.
- eru 13y ago> Crypto that gets used has to be easy-to-use, MySQL style. I think a project like tcpcrypt is great example, in theory. Simple is good because the pain of setup has to be least. (Tcpcrypt is opportunistic encryption that needs no additional setup and is different from SSL.) The off-the-record (OTR) plugins for various IM clients spring to mind as easy to use.
- Argorak 13y agoExcept that a lot of people never care about validating the peers fingerprint. "Hey, I am A, I am at another computer at the moment, hence then new keys." (I know this is somehow mitigated by SMP in libotr, but some clients have not implemented it yet, e.g.: https://trac.adium.im/ticket/9768 https://trac.adium.im/ticket/9768)
- ballard 13y agoFunny you mention OTR. I started to write that and thought of this and next comment down. Why not show a no configuration technology that could be packaged/advertised a little better and be really useful instead?