[liberationtech] Firesheep: Making the Complicated Trivial

[Jim Youll]

writing in your defense...

On Oct 27, 2010, at 12:50 PM, Gregory Maxwell wrote:

> Not trying to put authentication in the transport layer is _essential_
> to usability because all authentication methods have user interface
> implications.  Do you disagree?

All authentication methods  /in life/ have user interface implications. Every one that works, that is.

Technology creators have so far not delivered the correct analogue to real-world authentication. We can't even really do the equivalent of looking at a driver's license and then a face to say "yeah, that's probably the guy." PGP came really close but works best with a big set of people vouching for you, and that takes forever. Normal people don't go to key-signing parties and never will.

> Currently there is no easy to use way for you and I to mutually
> authenticate each other. Should the whole world be able to trivially
> and passively eavesdrop, profile, and modify our private conversations
> simply because we can't _both_ be bothered to go through the 20
> minutes of work or so that it would take to meaningfully validate each
> others PGP keys?  Should our non-email/file communications all be
> insecure because (other than OTR) not a single one of the applications
> available to us supports a form of authentication which is likely to
> be usable and meaningful for the kind of relationship that you and I
> have personally (e.g. we're random strangers on the internet, who
> happen to be on a common mailing list)?

We need to back away from the idea that it's useful or necessary to (a) make the process fully automatic; (b) not involve "users" at all. 

Every person has a subset of correspondents with whom end-to-end authentication and encryption are vital. For all the rest, it's not such a big deal. We need to focus on delivering the proper tools to authenticate that subset, thereby addressing most of the problem, most of the time, for most people. That'd be a hell of a start.

People are already jumping through all kinds of hoops and performing invented, not useful rituals to try to "protect themselves online." For all that effort going out, pursuing witchcraft and things they've heard on the street, they're not getting much in return. This reminds me of the issue of sex ed in schools vs. kids learning about birth control from one another... you get a lot of solutions that "sound plausible" and that are attractively easy to do (to the uninformed), but don't work very well. The father of a friend of mine "deletes all the cookies" every morning, for example, before doing any browsing.

Let's give them something productive, provably useful, to do with all that concern and energy. Doing the right thing will take up less of their time in the long run.

Confidential to those who are about to write: and, so, WHAT? :
	I worked on this problem a few years ago. I wrote a lot of code. 
	The solution is mostly about involving people in their own protection, in meaningful ways.
	I would like to pull the project out of the cupboard and at least work on formalizing it, testing the methodologies, and getting critiques.
	However, at present I have no standing/affiliation anywhere and don't want to pursue it all on my own out of pocket (because I can't - sad, I know).
	So, if you can help me fix that last part, maybe we can collectively speak to the real problem.
 
- j