3 ms·

Bollocks. Users can be educated. Throwing our hands up and saying that users are too stupid to understand crypto so we have to implement it in ways that don't w

Bollocks. Users can be educated. Throwing our hands up and saying that users are too stupid to understand crypto so we have to implement it in ways that don't work is advocating wasting everyone's time. Imagine if the car industry had decided that users wouldn't be able to understand car keys?

derefr 12y ago
You can't teach people to do something less convenient than what they're already doing. Car keys are more convenient than never letting your car out of your sight outside of your own garage (which is what people were doing before car keys.) PKI, as currently imagined, is less convenient than just speaking freely and feeling a nagging sensation that someone might be listening (which is what people are doing now.)
- stevejones 12y ago
  The difficulties in PKI are not that hard. Most of the problems are social, such as the belief that any implementation of PKI must be absolutely 100% bulletproof. Corporate deployments of PGP with no passphrase make the difficulty of executing spear phishing attacks considerably higher (especially when you consider that these are the usual way of getting initial access to corporate systems).
flavor8 12y ago
Not bollocks at all. Non-technical people shouldn't be expected to understand implementation details in order to use a system. Key exchange can be done without exposing users to the details of the system.
- boomlinde 12y ago
  While I think it's best left assumed that they won't, I definitely think that non-technical users should make an effort to understand things like the basics of a key exchange, for their own sake. After all, they are relying on these systems to exchange sensitive information. In general I think people should be more careful about handing out personal information.
  - flavor8 12y ago
    People use SSL every day and I bet most of the population, software engineers included, don't understand it. In fact most of the population probably don't even know that they're using SSL.
- stevejones 12y ago
  Email addresses are an implementation detail.

derefr 12y ago

You can't teach people to do something less convenient than what they're already doing. Car keys are more convenient than never letting your car out of your sight outside of your own garage (which is what people were doing before car keys.) PKI, as currently imagined, is less convenient than just speaking freely and feeling a nagging sensation that someone might be listening (which is what people are doing now.)

stevejones 12y ago
The difficulties in PKI are not that hard. Most of the problems are social, such as the belief that any implementation of PKI must be absolutely 100% bulletproof. Corporate deployments of PGP with no passphrase make the difficulty of executing spear phishing attacks considerably higher (especially when you consider that these are the usual way of getting initial access to corporate systems).

flavor8 12y ago

Not bollocks at all. Non-technical people shouldn't be expected to understand implementation details in order to use a system. Key exchange can be done without exposing users to the details of the system.

boomlinde 12y ago
While I think it's best left assumed that they won't, I definitely think that non-technical users should make an effort to understand things like the basics of a key exchange, for their own sake. After all, they are relying on these systems to exchange sensitive information. In general I think people should be more careful about handing out personal information.
- flavor8 12y ago
  People use SSL every day and I bet most of the population, software engineers included, don't understand it. In fact most of the population probably don't even know that they're using SSL.
stevejones 12y ago
Email addresses are an implementation detail.