10 ms·

>2. Create a global movement that encourages user-side encryption I can't even get my close friends/family to install something as simple as textsecure. :(

ploxiln 12y ago
Indeed. When CTOs and CEOs can't help but defer security fixes before anything else, since features matter now and security matters sometime later, how could the "common person" ever choose real security? They might be scared into paying someone money to make the problem go away, like personal firewall and anti-virus (which as we know makes real applications break more than they block malware from working), or they'll do something therapeutic but useless, like some people used to run defrag every day. I'm not sure exactly what will happen in the future, and besides ever bigger and more disruptive hacks, I'm sure we'll carry on somehow with sillier and sillier measures, adding layers to the ones that already don't really make sense if you think too hard. People always manage somehow.
- livefreediehard 12y ago
  > besides ever bigger and more disruptive hacks I hate to say this, but there's your answer. Or at least an answer. If the goal is to reach a massive audience and convince them that their existing Internet usage is insecure, there are ways of doing that. In the same way that Firesheep showed websites that they needed to use HTTPS for all sessions communication beyond just login, a demonstration or series of demonstrations could exist that show hundreds of millions of users and/or the media that they can't rely on websites to adequately protect them, and such demonstrations could explicitly bring user-side encryption to the forefront of the conversation. I seriously don't condone the above and typically view Anonymous-like groups as misguided and self-absorbed. I'm just pointing out that it is possible to reach laypeople. Hopefully there are better ways to do that.
dmschulman 12y ago
I think this point is important to creating a wide spread adoption of encryption tools, and here you present one of the major barriers to adoption. As much as I hate this term now a days, some way to gameify the idea of using encryption might help spur people's use of the technology. Once enough people have adopted a specific app or software then it's much easier to bring outsiders onboard.
- Alupis 12y ago
  Personally I think it's about making it easier for things to be encrypted. For example, when you save a document, perhaps the text editors should just automatically encrypt the file based on a password the user setup when they first installed the program. Right now things like PGP are difficult for even "experienced" users to setup and maintain, let alone the average joe. Setting up encrypted volumes, or directories, etc... it just goes over most people's heads and/or their willingness/amount of effort, so they just don't do it. I think switching from "you should consider encrypting things" to an "everything is encrypted by default" society, propelled forwards by software that makes it easy, automatic, and default... that's when we will make progress.
  - jeena 12y ago
    Although for most people the risk of forgetting a password and that way losing their documents forever is so many magnitudes higher than the NSA reading those mostly harmless documents. I think also for that reason it is that our front doors are easy to open by a locksmith without the need of destroying them completely.
    - zanny 12y ago
      And in this case, the NSA has global keys to a lot of services designed like front doors. The difference is that the effort required to break open the front doors of every home in the world is unreasonable, whereas the effort to break into every back doored or security-free software solution is reasonable enough for the NSA to do it. Better option than passwords is keys anyway. Way too many services depend on human memorizable numbers, which we know all too well is a transient thing at best - every year, as computational power rises, the "average" password gets weaker, and nobody uses good passwords. People just need a personal key to encrypt and decrypt with. They need to protect that key, maybe by password, maybe by printing it out. One good key can easily replace all the horrible password schemes in the world. But software needs to be written, especially save dialogs, to easily "pick" a key to encrypt with, and when you open files a history of keys used and a browser to open keys to decrypt opened files with. Of course Windows will never have anything like that, but at least Dolphin and Nautilus can look to adopt those kinds of workflows.
anopows 12y ago
As far as I know WhatsApp has implemented TextSecure
- tacojuan 12y ago
  Oddly enough nobody knew what WhatsApp was when I asked them. They all just use Snapchat or the built in SMS application.
  - omnimus 12y ago
    WhatsApp is also owned by facebook, so.. i doubt they cut of ways to get to the communications. I think it might use textsecures encryption but they will also have key.
  - mahyarm 12y ago
    Try not USA/Canada and you quickly find out WhatsApp is a Big Deal (tm). It has a 600 million user count.
    - pakled_engineer 12y ago
      Viber is also huge in the Philippines as a telecom there offers free Facebook + Viber without needing prepaid credit/wifi. They could roll a textsecure layer too
  - kbart 12y ago
    It's very popular in Europe, even more so (as far as I've heard) in South America, where it's used mainly instead of SMS. Heck, even my father use WhatsApp and I can't make him stop clicking on "You have 1 new message" ads. Though I deleted my WhatsApp as soon as it was acquired by Facebook.
  - CalRobert 12y ago
    I get about one SMS a month (usually from an old person or an automated system). Whatsapp has pretty much _completely_ replaced SMS here in Europe.
patcon 12y ago
I'm personally banking on the idea that convincing more people to go data-only will be the game-changer. Apps like "Hushed" [1] already wrap phone/sms functionality from Twilio inside an amazing interface where you can pick up numbers anywhere on earth for any period from a week ($3) to a year ($30). The thought is that when everyone is just seeking out the cheapest data deal, not only does is unbundle and disempower the giant telcos (a good thing), but it also gets users and developers in the mindset of a single data tier. This is where real security and privacy gains can be had. For example, I've gotten some friends using textsecure, but they've ditched it after being confused why turning off their data prevented them from getting timely sms messages. (Encrypted text messages are silently routed through data when conversation partner has textsecure, even though the identifier seems to be a regular phone number to the user, just like with SMS messages.) When users start using all-data plans, tools will be developed to help users go into a conservation mode akin to turning off data, just as they do now. Instead of turning off data, users will be able to use a simple firewall to block everything but voip/text messaging apps. As an added bonus, any trend toward making data-only more convenient will also mean that using wifi-only devices and mobile hotspots will be equally convenient. Those who want the manual baseband separation of that setup (unavailable on current full-featured phones with radios), will not have to jump through crazy hoops to get it, and so security will take a big leap forward :) /rant [1]: http://hushed.com/ http://hushed.com/
- ptrklly 12y ago
  Interesting. One concern I'd have is that I actually find the segmentation of data / sms / voice to be a feature because it corresponds well to my priorities. For example, I can turn off auto-sync to save battery power or to decrease distractions from my phone, but still have SMS and be available. If people really want to get a hold of me asap (and they're important enough to me to have my cell number) they will text me. Of course there are alternate ways to allow users to do this--Google circles and Facebook lists come to mind--but they all are a pain to maintain, use.
  - sliverstorm 12y ago
    Yeah, I'd really miss SMS & GSM phone calls. They both have their place. Both perform dramatically better than data in poor reception, and save power.
skylan_q 12y ago
Tell them it will speed up their computer.
- SoftwareMaven 12y ago
  Please don't. I realize this was said tongue-in-cheek, but the ramifications of using local encryption without understanding it are large. You have to be willing to take on key management, or you risk losing every bit of data or being just as insecure as you would have been without encryption (with a slower computer as an added bonus). Unfortunately, it takes at least a little buy-in from the user to make encryption work. We need better tools, for sure, but that final piece of holding the key needs to be taught and the responsibility accepted.
Iv 12y ago
What made me abandon all hope was when Glenn Greenwald, presumably an expert journalist when it comes to surveillance, said he was reluctant at first to install a cryptography software to communicate with Snowden.
- mixmastamyk 12y ago
  He surely wasn't an expert before this, though I bet he's learned a lot during the process of reporting on it, as we have reading it.
kordless 12y ago
That's why we have to build decentralized backend systems to follow them around and store their data. We also need to focus on ease of use on the frontend of those systems. It's not like they are going to do this themselves. We have to do it for them, for all of us.
- dsernst 12y ago
  A friend of mine used the Dropbox API to let his webapp's users store their own data, encrypted and decrypted with npm crypto. If I recall correctly, the user just had to OAuth with Dropbox on signup and sign in -- the rest was handled seamlessly. I just wrote him to ask if he's blogged about this. Send me a message (in profile) if you'd like more info about this approach.

ploxiln 12y ago

Indeed. When CTOs and CEOs can't help but defer security fixes before anything else, since features matter now and security matters sometime later, how could the "common person" ever choose real security? They might be scared into paying someone money to make the problem go away, like personal firewall and anti-virus (which as we know makes real applications break more than they block malware from working), or they'll do something therapeutic but useless, like some people used to run defrag every day. I'm not sure exactly what will happen in the future, and besides ever bigger and more disruptive hacks, I'm sure we'll carry on somehow with sillier and sillier measures, adding layers to the ones that already don't really make sense if you think too hard. People always manage somehow.

livefreediehard 12y ago
> besides ever bigger and more disruptive hacks I hate to say this, but there's your answer. Or at least an answer. If the goal is to reach a massive audience and convince them that their existing Internet usage is insecure, there are ways of doing that. In the same way that Firesheep showed websites that they needed to use HTTPS for all sessions communication beyond just login, a demonstration or series of demonstrations could exist that show hundreds of millions of users and/or the media that they can't rely on websites to adequately protect them, and such demonstrations could explicitly bring user-side encryption to the forefront of the conversation. I seriously don't condone the above and typically view Anonymous-like groups as misguided and self-absorbed. I'm just pointing out that it is possible to reach laypeople. Hopefully there are better ways to do that.

dmschulman 12y ago

I think this point is important to creating a wide spread adoption of encryption tools, and here you present one of the major barriers to adoption. As much as I hate this term now a days, some way to gameify the idea of using encryption might help spur people's use of the technology. Once enough people have adopted a specific app or software then it's much easier to bring outsiders onboard.

Alupis 12y ago
Personally I think it's about making it easier for things to be encrypted. For example, when you save a document, perhaps the text editors should just automatically encrypt the file based on a password the user setup when they first installed the program. Right now things like PGP are difficult for even "experienced" users to setup and maintain, let alone the average joe. Setting up encrypted volumes, or directories, etc... it just goes over most people's heads and/or their willingness/amount of effort, so they just don't do it. I think switching from "you should consider encrypting things" to an "everything is encrypted by default" society, propelled forwards by software that makes it easy, automatic, and default... that's when we will make progress.
- jeena 12y ago
  Although for most people the risk of forgetting a password and that way losing their documents forever is so many magnitudes higher than the NSA reading those mostly harmless documents. I think also for that reason it is that our front doors are easy to open by a locksmith without the need of destroying them completely.
  - zanny 12y ago
    And in this case, the NSA has global keys to a lot of services designed like front doors. The difference is that the effort required to break open the front doors of every home in the world is unreasonable, whereas the effort to break into every back doored or security-free software solution is reasonable enough for the NSA to do it. Better option than passwords is keys anyway. Way too many services depend on human memorizable numbers, which we know all too well is a transient thing at best - every year, as computational power rises, the "average" password gets weaker, and nobody uses good passwords. People just need a personal key to encrypt and decrypt with. They need to protect that key, maybe by password, maybe by printing it out. One good key can easily replace all the horrible password schemes in the world. But software needs to be written, especially save dialogs, to easily "pick" a key to encrypt with, and when you open files a history of keys used and a browser to open keys to decrypt opened files with. Of course Windows will never have anything like that, but at least Dolphin and Nautilus can look to adopt those kinds of workflows.

anopows 12y ago

As far as I know WhatsApp has implemented TextSecure

tacojuan 12y ago
Oddly enough nobody knew what WhatsApp was when I asked them. They all just use Snapchat or the built in SMS application.
- omnimus 12y ago
  WhatsApp is also owned by facebook, so.. i doubt they cut of ways to get to the communications. I think it might use textsecures encryption but they will also have key.
- mahyarm 12y ago
  Try not USA/Canada and you quickly find out WhatsApp is a Big Deal (tm). It has a 600 million user count.
  - pakled_engineer 12y ago
    Viber is also huge in the Philippines as a telecom there offers free Facebook + Viber without needing prepaid credit/wifi. They could roll a textsecure layer too
- kbart 12y ago
  It's very popular in Europe, even more so (as far as I've heard) in South America, where it's used mainly instead of SMS. Heck, even my father use WhatsApp and I can't make him stop clicking on "You have 1 new message" ads. Though I deleted my WhatsApp as soon as it was acquired by Facebook.
- CalRobert 12y ago
  I get about one SMS a month (usually from an old person or an automated system). Whatsapp has pretty much _completely_ replaced SMS here in Europe.

patcon 12y ago

I'm personally banking on the idea that convincing more people to go data-only will be the game-changer. Apps like "Hushed" [1] already wrap phone/sms functionality from Twilio inside an amazing interface where you can pick up numbers anywhere on earth for any period from a week ($3) to a year ($30). The thought is that when everyone is just seeking out the cheapest data deal, not only does is unbundle and disempower the giant telcos (a good thing), but it also gets users and developers in the mindset of a single data tier. This is where real security and privacy gains can be had. For example, I've gotten some friends using textsecure, but they've ditched it after being confused why turning off their data prevented them from getting timely sms messages. (Encrypted text messages are silently routed through data when conversation partner has textsecure, even though the identifier seems to be a regular phone number to the user, just like with SMS messages.) When users start using all-data plans, tools will be developed to help users go into a conservation mode akin to turning off data, just as they do now. Instead of turning off data, users will be able to use a simple firewall to block everything but voip/text messaging apps. As an added bonus, any trend toward making data-only more convenient will also mean that using wifi-only devices and mobile hotspots will be equally convenient. Those who want the manual baseband separation of that setup (unavailable on current full-featured phones with radios), will not have to jump through crazy hoops to get it, and so security will take a big leap forward :) /rant [1]: http://hushed.com/ http://hushed.com/

ptrklly 12y ago
Interesting. One concern I'd have is that I actually find the segmentation of data / sms / voice to be a feature because it corresponds well to my priorities. For example, I can turn off auto-sync to save battery power or to decrease distractions from my phone, but still have SMS and be available. If people really want to get a hold of me asap (and they're important enough to me to have my cell number) they will text me. Of course there are alternate ways to allow users to do this--Google circles and Facebook lists come to mind--but they all are a pain to maintain, use.
- sliverstorm 12y ago
  Yeah, I'd really miss SMS & GSM phone calls. They both have their place. Both perform dramatically better than data in poor reception, and save power.

skylan_q 12y ago

Tell them it will speed up their computer.

SoftwareMaven 12y ago
Please don't. I realize this was said tongue-in-cheek, but the ramifications of using local encryption without understanding it are large. You have to be willing to take on key management, or you risk losing every bit of data or being just as insecure as you would have been without encryption (with a slower computer as an added bonus). Unfortunately, it takes at least a little buy-in from the user to make encryption work. We need better tools, for sure, but that final piece of holding the key needs to be taught and the responsibility accepted.

Iv 12y ago

What made me abandon all hope was when Glenn Greenwald, presumably an expert journalist when it comes to surveillance, said he was reluctant at first to install a cryptography software to communicate with Snowden.

mixmastamyk 12y ago
He surely wasn't an expert before this, though I bet he's learned a lot during the process of reporting on it, as we have reading it.

kordless 12y ago

That's why we have to build decentralized backend systems to follow them around and store their data. We also need to focus on ease of use on the frontend of those systems. It's not like they are going to do this themselves. We have to do it for them, for all of us.

dsernst 12y ago
A friend of mine used the Dropbox API to let his webapp's users store their own data, encrypted and decrypted with npm crypto. If I recall correctly, the user just had to OAuth with Dropbox on signup and sign in -- the rest was handled seamlessly. I just wrote him to ask if he's blogged about this. Send me a message (in profile) if you'd like more info about this approach.