3 ms·

If you define security failure as "keeping things from your parents", ya I suppose that might qualify. However, when all it takes is someone deciding they want

If you define security failure as "keeping things from your parents", ya I suppose that might qualify. However, when all it takes is someone deciding they want to copy the picture and spread it...I think it results in a dangerous situation where the "customer" thinks its secure/safe but the reality is it isn't. I've seen so much damage caused by that sort of event that I take the idea that people consider such things "secure" or "private" offensive.

walterbell 12y ago
It is absolutely dangerous. As is crossing the road. The security community is culpable for failing to find meaningful middle grounds that are acceptable to customers and which generate the revenue that can fund the development of strong security. As a result, non-infosec people build "good enough for naive users", get traction and fix only when forced by a breach or failure. There are two ways to find (in the Steve Blank customer discovery / product management sense) a profitable middle ground: (1) start out with a weak security posture until public breaches force improvements to a stronger "good enough" (2) start out with strong architecture and consciously weaken to find a "good enough" point that is usable by a mass audience. What alternative do Snapchat customers have today? TextSecure is subsidized by Twitter, let's hope Twitter has a long future. VC-backed Wickr is going after the financial sector. We need more security people who are not offended by scenario #2, because their distaste for the option makes them most qualified to make difficult compromises and disclose the associated risks so that customers can make informed choices.