3 ms·

You let the USER decide who to trust, as they are the only person who has enough information to do so. Maybe they trust the community for some things, maybe the

by pdkl95 11y ago

You let the USER decide who to trust, as they are the only person who has enough information to do so. Maybe they trust the community for some things, maybe they trust a government for a different set of use cases, and maybe they trust their nerd friend for other stuff.

octo_t 11y ago
and what should the default be for non-technical users? no trust at all? And asking each time "do you want to trust this root certificate"? (because we know how well that works....)
- pdkl95 11y ago
  No, we need a system where different types of trust can be selected. (see my other post) A PKI system like we have now is one of them, but we need a system where that is not the only available trust. Yes, it will be necessary to educate people about this topic (and never discussing it with the user will only keep them ignorant). Right now we have a system where users are forced to trust various CA, and if someone decides they want to trust something else, that is difficult or impossible. The problem of WHO to trust for a particular website (that is, every website) is a separate problem which can be solved over time. My point is that we don't even have the tools to let people even being to solve that problem.
- pessimizer 11y ago
  >and what should the default be for non-technical users? no trust at all? Yes. They should pay a service to keep track of who they should trust. They wouldn't be opened up to any more risk by this than as with the status quo, MS + Apple + Google would end up giving it away for "free" for those don't have a problem with that or don't know better, and the option to get more technical about issues of trust would always be available to them.
Guvante 11y ago
You already have the tools to change who you trust. If you are afraid of automatic updates to your trusted domain list then setup a VM to test the updates or use a script to verify when the list changes.
mentat 11y ago
If there's anything we've learned from the last 20 years in security it's that the user is the least fit to decide. They are bad at passwords, they are bad at clicking things in email, they just are not security conscious. "Click here to trust my CA", how's that going to end?
- IE6 11y ago
  Agree - most users of computers do not know anything bout infosec nor do they care.
- userbinator 11y ago
  If anything that is an education problem, which is further compounded by the trend of wanting to turn users into completely passive entities who don't know or have to do anything, because then they are more easily controlled and manipulated. The industry does not encourage users to think and learn. The industry wants its software to do the thinking for them. It doesn't want users to think about trust at all. I think that is the scariest part of where things are heading.
  - xenadu02 11y ago
    That's the great fallacy though. The amount of technical knowledge required to make truly informed security decisions is out of the question for 99% of all computer/mobile users. It isn't about being passive; it's about having lives and jobs and other things to do with their time. A heart surgeon may be a genius but he doesn't have time to keep up with the latest research and teach himself PKI, certificates, crypto, and permission models across all the platforms he uses (and keep up to date on those too!) Users will not waste their time thinkin about trust. The history of our industry is ample evidence that it would be a losing battle. Not to mention a single mistake can be ruinous, requiring absolute perfection 100% of the time (from users and programmers).
    - nitrogen 11y ago
      Not to mention a single mistake can be ruinous, requiring absolute perfection 100% of the time (from users and programmers). One can hope that, eventually, formally mathematically verified open source systems will help solve the issue, at least on the programming side.

by pdkl95 11y ago

octo_t 11y ago

and what should the default be for non-technical users? no trust at all? And asking each time "do you want to trust this root certificate"? (because we know how well that works....)

pdkl95 11y ago
No, we need a system where different types of trust can be selected. (see my other post) A PKI system like we have now is one of them, but we need a system where that is not the only available trust. Yes, it will be necessary to educate people about this topic (and never discussing it with the user will only keep them ignorant). Right now we have a system where users are forced to trust various CA, and if someone decides they want to trust something else, that is difficult or impossible. The problem of WHO to trust for a particular website (that is, every website) is a separate problem which can be solved over time. My point is that we don't even have the tools to let people even being to solve that problem.
pessimizer 11y ago
>and what should the default be for non-technical users? no trust at all? Yes. They should pay a service to keep track of who they should trust. They wouldn't be opened up to any more risk by this than as with the status quo, MS + Apple + Google would end up giving it away for "free" for those don't have a problem with that or don't know better, and the option to get more technical about issues of trust would always be available to them.

Guvante 11y ago

You already have the tools to change who you trust. If you are afraid of automatic updates to your trusted domain list then setup a VM to test the updates or use a script to verify when the list changes.

mentat 11y ago

If there's anything we've learned from the last 20 years in security it's that the user is the least fit to decide. They are bad at passwords, they are bad at clicking things in email, they just are not security conscious. "Click here to trust my CA", how's that going to end?

IE6 11y ago
Agree - most users of computers do not know anything bout infosec nor do they care.
userbinator 11y ago
If anything that is an education problem, which is further compounded by the trend of wanting to turn users into completely passive entities who don't know or have to do anything, because then they are more easily controlled and manipulated. The industry does not encourage users to think and learn. The industry wants its software to do the thinking for them. It doesn't want users to think about trust at all. I think that is the scariest part of where things are heading.
- xenadu02 11y ago
  That's the great fallacy though. The amount of technical knowledge required to make truly informed security decisions is out of the question for 99% of all computer/mobile users. It isn't about being passive; it's about having lives and jobs and other things to do with their time. A heart surgeon may be a genius but he doesn't have time to keep up with the latest research and teach himself PKI, certificates, crypto, and permission models across all the platforms he uses (and keep up to date on those too!) Users will not waste their time thinkin about trust. The history of our industry is ample evidence that it would be a losing battle. Not to mention a single mistake can be ruinous, requiring absolute perfection 100% of the time (from users and programmers).
  - nitrogen 11y ago
    Not to mention a single mistake can be ruinous, requiring absolute perfection 100% of the time (from users and programmers). One can hope that, eventually, formally mathematically verified open source systems will help solve the issue, at least on the programming side.