thinner

FTA:"THAT ATTACK SOUNDS COMPLICATED! SURELY, YOU'RE BETTER OFF WITH CRYPTO THAN WITHOUT IT? There are three misconceptions embedded in that common objection, all of them grave..."

I guess I shouldn't lock my car, either, right? After all, someone could simply break my windows and steal whatever I have inside. Or maybe, just maybe, using some protection actually is better than using no protection, provided you don't put more faith in the protection than the protection warrants. Just like I wouldn't store gold bars in my car, I wouldn't use jscrypto to protect things that were too important for that level of protection. I will, however, feel okay about keeping my sunglasses in my car, and I will feel okay about using jscrypto to send my phone number over email.

Really? You can't concede that an implementation like this is better than rot13?

I simply disagree on practical terms. If I have the choice between the two, I am going to make my mom encrypt it with this library. That doesn't mean I feel perfectly safe and secure about it, but I feel better than not having encrypted it at all. Much like using a car alarm - I know it cannot ultimately prevent someone from stealing my car, but it certainly weeds out all but the most persistent attackers.

Moreover, for noncritical things, like my example of fantasy football plans, this appears to be a perfectly reasonable solution.

I would argue that rot13 is better than unencrypted, and that this is a step up from rot13. Sure, it's imperfect, but it's still better than nothing, and while I'm only a mediocre programmer, it appears to be easy-to-use, to boot. Better-than-nothing and easy-to-use seems like something more useful than "for demonstration purposes only", don't you think?

Given the option between his mom sending it unencrypted, and encrypting it with an easy-to-use extension he set up for her, why not encrypt it? Surely it can't _hurt_ an already horrible situation?

That's a fair point. The idea that it could be used "for demonstration purposes only", though, seems to go too far in that direction. It seems like a useful library, just not for organizing a coup.

A comment from that post:

"actually, i think an honest look at the security/privacy mechanisms provided by today’s tools precisely describes a case where ‘a little better than awful’ would be preferred. my mother emailed me some bank account information just last week. there isn’t any exploit required there. security software experts have failed horribly to provide tools that actual living breathing human beings might use and this is why most of them have just given up and use hotmail.

i personally find it astounding that the kind of people who will deny this probably have an actual brand new credit card sitting in their unlocked mailbox and feel perfectly comfortable with this fact.

your information’s security is only as strong as it’s weakest link. this includes the locks on your home, your mailbox, and the granularity you shred your trash with."

Does anything qualify as 'real crypto'? Every implementation will always and forever have weaknesses. I don't have a problem with someone putting together a package that makes it easy to do crypto stronger than rot13 - isn't that a step forward? We'd all like GPG/PGP easy in the browser with native code, but until then, what's wrong with an intermediate step that appears to be at least pretty good and fairly easy to use? Maybe it's not enough for organizing a coup, but for keeping your fantasy football strategies a secret - why not?