> According to Inman, the uptake of the research community’s cryptographic ideas came at a much slower pace than he had expected. As a result, less foreign traf

> According to Inman, the uptake of the research community’s cryptographic ideas came at a much slower pace than he had expected. As a result, less foreign traffic ended up being encrypted than the agency had projected, and the consequences for national security were not as dramatic as he had feared. Essentially, Inman recalled, “there was no demand” for encryption systems outside of governments, even though many high-grade systems eventually became available. Some things don't change. Despite the fact that the bedrock of basically all noteworthy asymmetric cryptography was laid in just a handful of years 40 years ago, and despite the fact we've had crypto protocols to solve a lot of really compelling problems for decades, the NSA, and government generally, still has little worry about. The market has a way of selecting really lowsy solutions when it comes to privacy. Consider: - The abysmal state of implementation. Over-engineered, poorly designed, poorly implemented, and poorly deployed. Did I miss the memo for the billions of dollars of investment and meticulous engineering being poured in to the cryptography Space Race? I guess a couple of OpenSSL forks is a start, right? - Zero adoption of personal digital signatures. Zilch. Nudda. You can't prove authorship of anything, and can be framed for almost anything. None of the logs being made of your activities are seen by you, let alone signed-off by you as authentic. - The complete lack of good, usable, client authentication. We've known how to do secure password authentication, even in the presence of weak passwords, since before the web existed, yet we have nothing. Google authenticator is the only meaningful contribution to authentication on the web since the 90s (Pretty much all the third-party systems conflate the issue of identification and authorisation) - Complete centralisation of interpersonal messaging (Email -> Your webmail provider, SMS, Whatsapp, Facebook Messenger etc). It's all unencrypted, logged, and subverted for government or commercial interests. - Blackboxification of consumer electronics. Yet somehow, despite the urgency in keeping DRM keys secret, essentially the same technology, we don't have usable HSMs in consumer devices like phones yet. - Extensive surveillance of all our financial activity. Our supermarkets can track our personal shopping habits down to the items we buy week on week, and our banks knows where you like to buy your Sunday lunch. We've known how to achieve cash-equivalent privacy digitally for 20 years. All we have is Bitcoin which, while heading in the right direction on trust, serves some grand libertarian ideal and accomplishes little in terms of privacy or user friendliness. Go read about Digicash, in another life it could have shipped with Windows 95. - The complete lack of good trust models and, more importantly, the lack of any education or inclination amongst the general public, particularly among the young and technologically comfortable, to question whether we should really be trusting website X, company Y or app Q with our personal data and habits. Social networks have changed attitudes toward sharing our personal life in one generation. My dad considers Facebook statuses bizarre. My grandma still doesn't trust plastic or direct debits, and prefers cash. We're caught in a generation gap where we have no reason to trust many entities, but have so much incentive to risk it anyway. ... clearly the demand for cryptography is still low.