3 ms·

this is a little tangential but I continue to be astonished that dropbox has been able to continue operating without client side encryption, especially after th

by lingben 12y ago

this is a little tangential but I continue to be astonished that dropbox has been able to continue operating without client side encryption, especially after the 2011 debacle

api 12y ago
Users don't care about security or privacy. This has been demonstrated again and again, with Dropbox as a premier case in point. By "care" I mean "change buying habits" or "plop down money." Talk is cheap. People will say they care about security or privacy but since they do not change their spending behavior these are just words. Where people spend money is the only thing that matters in terms of steering corporate behavior or product road maps. What users care about is convenience, overall user experience (UX), and cost, in roughly that order. Enterprises and governments do care a bit more about security, but they often don't understand it and make poor buying decisions in that space. * Edit: A few tech-savvy or politically concerned users do care about security and privacy, but this is (1) a small category, and (2) generally a group that doesn't want to pay for things and thinks everything should be free. #2 is the most significant factor-- if you don't pay for things you don't exist.
- cilantro1994 12y ago
  You are 100% spot-on. I can vouch for every one of your statement based on my decade long industry experience. Regular people are not going to give rats ass to privacy or security unless otherwise they see bodies falling from the sky. At the same time the minority who give importance to security and privacy think getting money for product is an evil thing to do and don't understand economics.
- jamwt 12y ago
  That and the fact that they will inevitably lose their data when they mishandle or misplace their keys. In the rare case that they are the sophisticated type of user who will most likely (and even that likelihood could be debated) safely handle and retain their irrecoverable secrets, they're already solving their problem by doing client-side encryption on their own. Maybe that's what you meant by convenience/user experience. Client side encryption with a nontrivial, irrecoverable key that must be remembered and kept secret by the end user is not a very usable system for the vast majority of people.

by lingben 12y ago

this is a little tangential but I continue to be astonished that dropbox has been able to continue operating without client side encryption, especially after the 2011 debacle

api 12y ago

Users don't care about security or privacy. This has been demonstrated again and again, with Dropbox as a premier case in point. By "care" I mean "change buying habits" or "plop down money." Talk is cheap. People will say they care about security or privacy but since they do not change their spending behavior these are just words. Where people spend money is the only thing that matters in terms of steering corporate behavior or product road maps. What users care about is convenience, overall user experience (UX), and cost, in roughly that order. Enterprises and governments do care a bit more about security, but they often don't understand it and make poor buying decisions in that space. * Edit: A few tech-savvy or politically concerned users do care about security and privacy, but this is (1) a small category, and (2) generally a group that doesn't want to pay for things and thinks everything should be free. #2 is the most significant factor-- if you don't pay for things you don't exist.

cilantro1994 12y ago
You are 100% spot-on. I can vouch for every one of your statement based on my decade long industry experience. Regular people are not going to give rats ass to privacy or security unless otherwise they see bodies falling from the sky. At the same time the minority who give importance to security and privacy think getting money for product is an evil thing to do and don't understand economics.
jamwt 12y ago
That and the fact that they will inevitably lose their data when they mishandle or misplace their keys. In the rare case that they are the sophisticated type of user who will most likely (and even that likelihood could be debated) safely handle and retain their irrecoverable secrets, they're already solving their problem by doing client-side encryption on their own. Maybe that's what you meant by convenience/user experience. Client side encryption with a nontrivial, irrecoverable key that must be remembered and kept secret by the end user is not a very usable system for the vast majority of people.