2 ms·

That's because simple file encryption is really hard, and when it works well, you don't even notice that it's working. Encryption is completely invisible to com

by jbob2000 12y ago

That's because simple file encryption is really hard, and when it works well, you don't even notice that it's working. Encryption is completely invisible to common people. It's not like locking your money in a safe, where you can feel the heaviness of the door and hear the clank of the lock.

api 12y ago
"It's not like locking your money in a safe, where you can feel the heaviness of the door and hear the clank of the lock." I think the perfect is being the enemy of the good here. Personally I would pay for a really good UI for doing that -- just encrypting files so I can stash them safely in cloud storage or transfer really sensitive stuff. I'd love to be able to right-click and encrypt/decrypt with a GPG public key or symmetric passphrase. I have full disk encryption, but that's very coarse-grained. Unlock the machine and it's defeated. My hack right now is to use encrypted OS X .sparseimage files, but that's OS-specific and clunky. I also have these scripts: https://raw.githubusercontent.com/zerotier/ZeroTierOne/master/attic/encrypt https://raw.githubusercontent.com/zerotier/ZeroTierOne/maste... https://raw.githubusercontent.com/zerotier/ZeroTierOne/master/attic/decrypt https://raw.githubusercontent.com/zerotier/ZeroTierOne/maste... They kind of suck but do the job in a platform-independent way. They could be made slightly better by trying to secure-erase the original source file, etc., but they work. The other problem with invisible omnipresent encryption is that it lacks a quality that I call "situational awareness." I like knowing that something has in fact been encrypted. Seeing a file extension change, like gzipping a file, tells me that yes in fact something has happened. A classic example I use of poor situational awareness in security is IPSec encryption setup between two boxes. The only way I know of to verify that the traffic is actually encrypted is to tcpdump the raw interface and look. The (piss-poor) IPSec tools do not really tell you this in a non-confusing straightforward way.

api 12y ago

"It's not like locking your money in a safe, where you can feel the heaviness of the door and hear the clank of the lock." I think the perfect is being the enemy of the good here. Personally I would pay for a really good UI for doing that -- just encrypting files so I can stash them safely in cloud storage or transfer really sensitive stuff. I'd love to be able to right-click and encrypt/decrypt with a GPG public key or symmetric passphrase. I have full disk encryption, but that's very coarse-grained. Unlock the machine and it's defeated. My hack right now is to use encrypted OS X .sparseimage files, but that's OS-specific and clunky. I also have these scripts: https://raw.githubusercontent.com/zerotier/ZeroTierOne/master/attic/encrypt https://raw.githubusercontent.com/zerotier/ZeroTierOne/maste... https://raw.githubusercontent.com/zerotier/ZeroTierOne/master/attic/decrypt https://raw.githubusercontent.com/zerotier/ZeroTierOne/maste... They kind of suck but do the job in a platform-independent way. They could be made slightly better by trying to secure-erase the original source file, etc., but they work. The other problem with invisible omnipresent encryption is that it lacks a quality that I call "situational awareness." I like knowing that something has in fact been encrypted. Seeing a file extension change, like gzipping a file, tells me that yes in fact something has happened. A classic example I use of poor situational awareness in security is IPSec encryption setup between two boxes. The only way I know of to verify that the traffic is actually encrypted is to tcpdump the raw interface and look. The (piss-poor) IPSec tools do not really tell you this in a non-confusing straightforward way.