5 ms·

I wonder if we are experiencing the typical adoption curve of security. That is, a technology arrives, we rush to adopt. Then over time we become aware of the c

by josho 12y ago

I wonder if we are experiencing the typical adoption curve of security. That is, a technology arrives, we rush to adopt. Then over time we become aware of the consequences of this new technology (eg. loss of privacy) and legislation/policy steps in to correct that gap. This time however I am not convinced that the US will ever be ready to correct the situation (I am more bullish on Europe). It strikes me that the organizations (companies and government departments) gain to much by their new incursions into privacy and data. While these same organizations are also some of the most powerful, so they have the influence to ensure that corrections from legislation and policy remain only superficial.

doctorshady 12y ago
I dunno, some of the "solutions" have historically been a little ridiculous. Remember how AMPS networks could be listened to with off the shelf scanners? The solution was to make it illegal to sell scanners that could listen to the 800 MHz band.
chrisfosterelli 12y ago
I don't think legislation/policy is the solution. We have seen time and time again that when the government steps in they create ineffective and ridiculous boundaries that do little in practice. Problems like these need to be solved with technology, user friendly and default encryption would go a long way in most of these cases.
- josho 12y ago
  This is beyond a technology problem. For example, even with encryption everywhere we leak metadata about ourselves. Recent discussions here and elsewhere have shown the value of metadata. Further, at some point data needs to be decrypted for it to be used, so we still need to wrestle with who has the final say over what is allowed with that data, and what are the consequences when the data isn't handled correctly. Currently, most of the rules are governed by companies and consumers have little say over their own information. We've only started to see abuses of this today (e.g. Target as the article references), but the potential for abuse is only growing as we see companies discover new value of their databases.
  - chrisfosterelli 12y ago
    The usefulness of encryption almost always depends on who holds the keys. Yes, it has to be decrypted at some point, but when it's only the user then it's much less of a problem. I see what you're saying though -- it's not an easy problem to solve. Maybe some combination of legislation, technology, and user awareness is the solution, but I fail to come up with any scenarios where sole government regulation has ever helped.
    - tormeh 12y ago
      In tech? Maybe you're right. In society in general? That's a crazy statement. I think we just need to wait for the technology-illiterate politicians to die out. It's a known problem that consensus based progress is constrained by the human lifespan.
      - chrisfosterelli 12y ago
        Yes, sorry I should have clarified I was referring specifically to legislature surrounding tech. I agree, many of the people who make legislation for tech barely understand how to use a computer in the first place and rely on crappy metaphors and explanations from other people. A more technology-literate set of politicians would help hugely.
- acdha 12y ago
  > We have seen time and time again that when the government steps in they create ineffective and ridiculous boundaries that do little in practice. Right now, there's no cost for having weak security. What you're talking about is the technocratic approach, which is often what industry lobbies heavily for – get the government to bless whatever you were going to do anyway and make it complicated to increase the barrier to entry for new companies. This is what we have in many cases coupled with laws which shield companies from the consequences of their mistakes (e.g. try suing a credit agency for spreading incorrect data about you). It's not a given that it has to work this way – the other approach which many people in the security industry have called for is changing the laws to shift liability to the companies. That mandates the desirable outcome but allows companies to pick a level of risk which they (and their insurers) are comfortable with – which provides nice incentives to do things like not collect sensitive data if possible – and use whatever technology is appropriate to meet those needs. > Problems like these need to be solved with technology, user friendly and default encryption This is a common misunderstanding. Solving these problems – and ensuring that they stay solved in the future – ultimately costs money. Companies will not spend that unless they have both a requirement and a reasonable expectation that there will be noticeable consequences for not meeting it. Without enforcement, you'll get things like those meaningless Verisign / McAfee banners on webpages which signals that they consider security as a marketing exercise. Since the average person is utterly unable to compare different products in this manner and it's a difficult, ongoing job even for the skilled security practitioner, there has to be some outside pressure to make information available. Once you have that, the technology will follow.
  - chrisfosterelli 12y ago
    That all sounds good in theory, but in practice I would argue you can't simply create effective laws like that. I agree that companies will not spend on security unless they have a reason too -- but how exactly can you effectively legislate that? Helping people make informed choices with where they put their business is a much better solution, in my opinion. You say that there is no cost for having weak security, but that is not because there is no legislation, it's in spite of it. Legislation written by people who don't understand the technology they are regulating is not helping.
- hackuser 12y ago
  > I don't think legislation/policy is the solution. We have seen time and time again that when the government steps in they create ineffective and ridiculous boundaries that do little in practice. I haven't seen that, though I know it's an idea that is commonly repeated. My drinking water, buildings, roads, car safety, airline safety, etc. are pretty good. MHO is that the 2008 financial crisis [EDIT: largely] was due to a lack of regulation. Government isn't perfect, but no institution or company is. Certainly private business is not, and at least I get a vote in how government does things. I don't see a technological solution to these problems and I think a legal one is the best idea.

by josho 12y ago

doctorshady 12y ago

I dunno, some of the "solutions" have historically been a little ridiculous. Remember how AMPS networks could be listened to with off the shelf scanners? The solution was to make it illegal to sell scanners that could listen to the 800 MHz band.

chrisfosterelli 12y ago

I don't think legislation/policy is the solution. We have seen time and time again that when the government steps in they create ineffective and ridiculous boundaries that do little in practice. Problems like these need to be solved with technology, user friendly and default encryption would go a long way in most of these cases.

josho 12y ago
This is beyond a technology problem. For example, even with encryption everywhere we leak metadata about ourselves. Recent discussions here and elsewhere have shown the value of metadata. Further, at some point data needs to be decrypted for it to be used, so we still need to wrestle with who has the final say over what is allowed with that data, and what are the consequences when the data isn't handled correctly. Currently, most of the rules are governed by companies and consumers have little say over their own information. We've only started to see abuses of this today (e.g. Target as the article references), but the potential for abuse is only growing as we see companies discover new value of their databases.
- chrisfosterelli 12y ago
  The usefulness of encryption almost always depends on who holds the keys. Yes, it has to be decrypted at some point, but when it's only the user then it's much less of a problem. I see what you're saying though -- it's not an easy problem to solve. Maybe some combination of legislation, technology, and user awareness is the solution, but I fail to come up with any scenarios where sole government regulation has ever helped.
  - tormeh 12y ago
    In tech? Maybe you're right. In society in general? That's a crazy statement. I think we just need to wait for the technology-illiterate politicians to die out. It's a known problem that consensus based progress is constrained by the human lifespan.
    - chrisfosterelli 12y ago
      Yes, sorry I should have clarified I was referring specifically to legislature surrounding tech. I agree, many of the people who make legislation for tech barely understand how to use a computer in the first place and rely on crappy metaphors and explanations from other people. A more technology-literate set of politicians would help hugely.
acdha 12y ago
> We have seen time and time again that when the government steps in they create ineffective and ridiculous boundaries that do little in practice. Right now, there's no cost for having weak security. What you're talking about is the technocratic approach, which is often what industry lobbies heavily for – get the government to bless whatever you were going to do anyway and make it complicated to increase the barrier to entry for new companies. This is what we have in many cases coupled with laws which shield companies from the consequences of their mistakes (e.g. try suing a credit agency for spreading incorrect data about you). It's not a given that it has to work this way – the other approach which many people in the security industry have called for is changing the laws to shift liability to the companies. That mandates the desirable outcome but allows companies to pick a level of risk which they (and their insurers) are comfortable with – which provides nice incentives to do things like not collect sensitive data if possible – and use whatever technology is appropriate to meet those needs. > Problems like these need to be solved with technology, user friendly and default encryption This is a common misunderstanding. Solving these problems – and ensuring that they stay solved in the future – ultimately costs money. Companies will not spend that unless they have both a requirement and a reasonable expectation that there will be noticeable consequences for not meeting it. Without enforcement, you'll get things like those meaningless Verisign / McAfee banners on webpages which signals that they consider security as a marketing exercise. Since the average person is utterly unable to compare different products in this manner and it's a difficult, ongoing job even for the skilled security practitioner, there has to be some outside pressure to make information available. Once you have that, the technology will follow.
- chrisfosterelli 12y ago
  That all sounds good in theory, but in practice I would argue you can't simply create effective laws like that. I agree that companies will not spend on security unless they have a reason too -- but how exactly can you effectively legislate that? Helping people make informed choices with where they put their business is a much better solution, in my opinion. You say that there is no cost for having weak security, but that is not because there is no legislation, it's in spite of it. Legislation written by people who don't understand the technology they are regulating is not helping.
hackuser 12y ago
> I don't think legislation/policy is the solution. We have seen time and time again that when the government steps in they create ineffective and ridiculous boundaries that do little in practice. I haven't seen that, though I know it's an idea that is commonly repeated. My drinking water, buildings, roads, car safety, airline safety, etc. are pretty good. MHO is that the 2008 financial crisis [EDIT: largely] was due to a lack of regulation. Government isn't perfect, but no institution or company is. Certainly private business is not, and at least I get a vote in how government does things. I don't see a technological solution to these problems and I think a legal one is the best idea.