Hacker News Reader

The problem isn't that people don't care.

You are right, people care. But not about things that would make reducing government power likely nor encrypting things by default probable.

They care about getting to work in the morning and getting home at night. They care about dinner with the family and a couple hours mindless television. They care about being safe while they do these things, and they've fully bought into the government's mantra of "we will protect you", so, as long as that's happening, they don't care about anything else.

Go talk to just about anyone outside of sites like Reddit or HN about the TSA, and you will be told how good a job they are doing. When the government tells them it is time to randomly drop their pants for the cavity check, as long as they are told it is making them safe, they will willingly oblige.

As much as the government's power grab, the complete lack of concern for it scares the hell out of me.

The government doesn't have a "mantra" of "we will protect you". It has an obligation to actually protect its citizens, and, in America, does a pretty good job of it.

The notion that reliance on the government for protection is a brainwashed delusion is one of those conversational signifiers that convince normal people that all this encryption stuff has nothing to do with them.

Of course the government's job is to protect it's people. Even the most libertarian-minded people subscribe to that.

The problem is the government has been leaning on that to expand to things that are of questionable "protection".

Does millimeter-wave scanning protect you? The government sure expects you to believe it does.

What about seizure of property? That will surely protect you from drugs.

Why should we need a warrant for things like accessing somebody's email? Terrorists might be sending emails.

In some way, each of these things might increase our safety, but the cost of that protection is intolerable to me and many others. Unfortunately, most people don't seem to realize any price is being paid.

> people don't seem to realize any price is being paid.

this hit the nail on the head, because the pain of the price isn't felt by the average person _at all_. It is only felt by people at society's margin, who may skirt the law at times.

Now, someone might argue that this is actually a good result, because this will prevent laws from being skirted at all! If, or when some form of revolution is required, that necessarily entails breaking the law (otherwise it wouldn't be a revolution). This means, by slowly seeping such privacy invasion laws into place, its like boiling a frog alive - the frog doesn't even know its being killed.

This is why you have to watch very carefully, any form of censorship, or measures that strip away any sort of right that a citizen is entitled to.

unfortunately, no one is going to care. i hope i will be dead by the time things turn sour (if indeed they do).

People are especially not going to care if we frame our arguments against the TSA as a symptom of the entire system being an illusion used to turn us into docile sheep while providing the illusion of protection.

So how would you frame the discussion? How would you convince people that the security they think they are getting isn't as good as they are being told and the price they are paying is higher than (I think) we should be paying?

    > It has an obligation to actually protect its citizens

Perhaps you can claim agents acting on behalf of the state have a metaphorical obligation to protect citizens. But they do not have a literal, legal, or contractual obligation to do so in the majority of circumstances:

http://en.wikipedia.org/wiki/Warren_v._District_of_Columbia

http://en.wikipedia.org/wiki/DeShaney_v._Winnebago_County

http://en.wikipedia.org/wiki/Castle_Rock_v._Gonzales

The main reason I think, is because its hard.

Either you use a 3rd party service to encrypt, its easy and also extremely dumb (since its not end to end encryption).

Either you use PGP or SMIME and guess what: it's too hard. Their design is fine. I especially like GnuPG (PGP), but the UI, even in CLI, is terrible, terrible!

Most people don't even understand that a GnuPG keychain generally contains 2 private keys, not one (one for signing, one for encryption!) or the concept of master signing key and subkeys.

These concepts are relatively simple, but their use is hard. Terribly hard.

My idea was that public key cryptography should be done under the hood, so I created a easy to use ResoMail, but people still were not interested (or I was a bad marketer).

It uses it's own protocol/port/programs it seems. Too many people rely on email right now. Else, we could just use XMPP.

Thus the solution should work over email, and with our current email clients. S/MIME/GnuPG/PGP do, but their implementation is far from friendly.

The part of the solution is to switch to secure domain names, each domain name comes with bundled key pair (like SSL) this is why it's easier to work securely with public key encryption under the hood - the signing of the e-mail public key is done under the hood, the user doesn't have to do it manually.

Here's a relevant paper called Why Johnny Can't Encrypt[1], which does an excellent job of defining understanding and usability problems with encryption. It's certainly dated, but I find that its main points are still very true today.

[1] http://www.gaudior.net/alma/johnny.pdf

For this reason I am fond of Jonathan Zittrain. Not that he particularly aligns with Assange but he is very good at presenting these issues in a compelling manner.

Eben Moglen has also made several good talks about the abolishment of privacy, and its effects. I would especially suggest listening to the Berlin talk made this year called "Why Freedom of Thought Requires Free Media and Why Free Media Require Free Technology".

Link for the lazy: http://youtu.be/sKOk4Y4inVY

"The problem isn't that people don't care"

I think you are overly optimistic here. Let's put it this way: if people were told that they had to report one crime committed by their neighbors in order to watch the superbowl, what do you think would happen?

"They would care if they knew the realities of how their communications are stored, processed, and exposed to their governments"

I have a lot of friends who know this, some of whom know it in more depth than many HN readers. Guess what? They all stopped bothering to maintain a PGP key. They all carry cell phones, and they do not even take the time to try to disable location services. They are all users of at least one of (Facebook Twitter Google+ GMail LinkedIn). If the people who know these things do not care, what make you think that people do not know these things would care if they became knowledgeable?

I wonder how many people who think it's important think that it's important enough to merit actually being said champion.

how about, without encrypted comms, its like posting a letter by not putting it in an evelope and sticking it to the outside of a bus

It's a very hard problem IMO. Not just finding the words, but everything. For example, before learning linux to a degree where it wasn't a pain to use as a desktop, I thought it made no sense to waste time learning this or that security feature (like email encryption), because an expert would probably be able to fuck me anyway. Now that I have a better understanding, and I can mentally trace the information from end to end, know where it could be compromised, etc, I started caring, secured everything the best I could, and my friends now call me a paranoid (that didn't stop me from installing Thunderbird and Enigmail in their PC's).

So I think someone should explain to the people in a clear way that you don't need 100% security, but you need to understand when and where your information can get compromised, and what you can do about it. Eg:

- Private message on facebook - you are screwed

- Messenger - you are screwed

- Post on a blog - you are screwed, unless you posted anonymously and hidden your IP (which is not that easy, we know of many geeks who were caught even when they were using Thor, because they didn't fully understand the technology - hint: exit nodes)

- Email - you can encrypt it, and you are safe as long as both computers (sender's and receiver's) stay safe (assuming you store your private key there)

- Data on your computer - you are safe unless malware is installed, or someone gets physical access. You can use full disk encryption, but you will probably have to use Linux (personally, I use Ubuntu), so this is a far fetched goal for the regular Joe. There is also truecrypt for windows, but it's not full disk if I recall correctly.

- Etc.

I'll add a recent anecdote here: Just the other day a friend of mine replied to one of my emails, saying that gmail broke the encrypted email (meaning he couldn't read it, not that gmail decrytped it). In his reply, I received the broken email, and four emails from a private conversation he was having with other people. Something happened in gmail, something went wrong, and I got those emails. They came with headers and everything, he didn't copy/paste those (he wouldn't know how to do that). So there's another reason to encrypt emails: mails server can make mistakes apparently.

Can the downvoter show his face and elaborate? Thanks

I wasn't the downvoter, but I suspect they may have been pointing out you are missing the forest for the trees.

"The people" don't need detailed explanations about why one form of technology is "more secure" than another. Instead they need motivation to care about security from their government.

Yes I understand that. But in my case, even being into computers, and wanting privacy, I dind't even know where to begin. A friend of mine told me he is in that exact position right now: he doesn't bother, because he does not have a full picture, and thinks he won't be safe should the government decide to target him. Here's another case: someone I know needed to protect some data and store it. I gave him fool-proof steps on how to do that, and explained how it worked. How did it end? He just stored everything unsafely in a pendrive and took it with him everywhere, he even sleeped with it. Granted, he was safe from a warrant to confiscate his PC, I concede that. But it was a pain and he probably had deleted the files from the PC insecurely, so it was in vane.

Security and "being able to sleep" is more about understanding, and less about installing things on your PC. If everyone suddenly started encrypting their emails, of course we would be safer. But nobody is going to bother doing that, if they don't really feel safe (because they don't understand how safe they are, or which risks they are taking).

TL;DR - To sum up, even if you get people to want privacy, there is quite more work to do after that. People have lives to live, and if the cost of privacy is becoming a security expert, in most cases they won't bother.

Can you please elaborate on Tor exit nodes vulnerability? As far as I know they can read your passwords if you're not using secure connection, but how can it compromise your identity? I'm assuming the new account was created for an anonymous blog post.

Exactly, if you are careful you are safe. But it takes just one mistake to get caught. For example, if you have javascript activated (without it most of the web is useless), you could get fingerprinted, and then make a match with facebook or gmail, or if you are already a suspect, just get raided and make the match there. I don't know exactly how these guys I mentioned got caught, they probably did something stupid like logging in to a website with a real account. If I remember correctly, the news article only said that the police started running an exit node and sniffing the data that went out.