Wow, I made the very same point some time ago and was dogpiled by Boingers claiming itās as easy as remembering to flush.
Suck is the wrong word. The tools would suck if they were vulnerable. But when will somebody come out with crypto for soccer moms? That will be a real breakthrough - when millions of ordinary people protect their own privacy.
Itās like arguing with Linux users about whether or not the command line is an obstacle to broader adoption.
I bet all of these people would be able to send an encrypted message with Appleās iMessage though.
Good point, I know nothing about this.
There really is crypto for soccer moms out there. Hospitals have been required by law to include crypto in their email systems for a while now. Those systems are designed to be used by doctors so most of them are dead simple. The only drawback is that these mail companies focus on medical practices so their rates are unreasonable/
Apple publishes their iOS security model here:
Itās a wonderful document and shows how well thought out their design is. I wish all OS and handset makers would publish something similar.
Come to think of it, my Outlook has a āsecureā button. I donāt use it much, I even forgot it was there, but maybe thatās exactly the thing I was asking for. I donāt have anything like that at home, but at work, itās a start.
There are a bunch of totally secure email platforms out there that are drop-dead simple:
Just 2 examples that come immediately to mind:
Yes, raw PGP sucks and will never be widely adopted. But secure, encrypted email is available and itās just weird to me that itās not used more widely.
Someone with better crypto experience than I can review this, but: Why canāt all e-mail clients be set up to:
- create a certificate request and request a certificate from a CA at the e-mail provider (if required for PGP)
- create the necessary PGP keys
- register the public PGP key at the e-mail provider as an attribute of the user
- send all email encrypted
- request the public key of each recipient when a piece of e-mail is opened, via LDAP to the server (and the server in turn can pass the request to the senderās home server), and decrypt the mail only when it is opened for reading?
Seems to me the best way to serve the masses of people who donāt understand these tools is to have them turned on by default and work without the user doing anything .
Because each remove from the provably secure and transparently back-door free PGP original is increasingly insecure. I trust PGP - give me a really good reason to trust an iteration which makes it easier to use. Lazy journalism.
So that more people will use it. Itās a similar concept of herd immunity being directly related to how many in the population are vaccinated.
Lazy commenter.
Most of the systems, or most of the doctors?
Duh! The whole point is you can see end to end exactly what it is doing.
As soon as you introduce layers of slick ālook how easyā you no longer know.
Read and learn from history.
It is not like herd immunity. It is exactly like securing your own communications.
Like getting immunized so you donāt get infections?
Or is it something else?
Information security is not biology. Even using it as analogy is a confession of failure.PGP has pretty good privacy. Every step you take away from it exposes you. I would take a bet that most people that create easy user systems for hard crypto are not to be trusted.
Ok dude. Harder is better for society, like you say.
Breaking out the whole āenterprise PKIā thing and actually getting it up and running properly will probably leave some of your IT department with abnormally flat affect and thousand-yard stares; but MS has enough customers(probably a fairly small percentage by quantity; but one that includes a lot of atypically valuable ones) who demand those capabilities that they are available. They care little or nothing about making them usable for individual purchasers of Office; but if FooCorp LLC wants to ensure that all internal email is locked up tight and not wriggling away from the retention policy; it can be done.
The FOSS-idealist tools have a markedly lower barrier to entry; but you are markedly less likely to discover them deployed and configured for you, so it is usually DIY or not at all; rather than ānot at all; or potentially mandatoryā.
Yeah, itās probably telling that until Edward Snowden contacted him, Glenn Greenwald didnāt know how to use most of the encryption tools he now talks about.
I am so totally going to take your word for it, since I have no idea what that means.
