[liberationtech] FW: The security and ethics

[Graham Webster]

On Feb 9, 2011, at 4:36 PM, Jacob Appelbaum <jacob at appelbaum.net> wrote:

> On 02/09/2011 11:24 AM, Graham Webster wrote:
>> Apologies for the fast follow-up. I did not mean to say there were _no_
>> certification mechanisms (obviously RSA does certification, as I assume do
>> other entities), but rather that the knowledge about whom to trust is not
>> widely distributed, as it is with lawyers or doctors. Perhaps a key
>> difference is that huge numbers of people _know_ how lawyers and doctors are
>> held accountable, whereas knowing what qualification would be appropriate
>> for an individual or organization's needs is not a common thing. -gw
>> 
> 
> What good is certification of people? Are my criticisms of Skype more or
> less valid when I have a CISSP or some piece of paper from RSA?
> 
> Certification of software such as FIPS ratings are *interesting* but
> there are lots of problems involved.

Certification is good if people don't have the resources to evaluate on their own the reputation of an individual but do have the resources to evaluate the reputation of a certifying authority. In my example of a lawyer, we know the court system in the united states is pretty decent for all its follies, and that lawyers have to perform within acceptable parameters (no negligence please; confidentiality guaranteed under most circumstances). So bar membership and standing before the court use the reputation of the government to communicate minimal standards that we can't very well study up to ourselves. 

So, if my imaginary NGO wants to secure it's communications with potentially vulnerable individuals, the preceding discussion suggests that we should probably consult experts rather than configuring our own communication system and secure storage. Unfortunately, the security world is a black box to most social actors. A trusted and trustworthy reputation management scheme would let non-experts figure out who has the skills to help. Judging whether they are acting in good faith would have to depend on intuition, contract law, etc.

So, your critiques of Skype are just as good one way or another, but if there existed a reputation-based accountability mechanism such as a certification regime, I wouldn't have to look up your background as thoroughly before trusting that i can or cannot safely use the technology for my purposes.

This is why I didn't initially think to include RSA, because outside of certain corporate contexts, such a certification has little meaning to potential clients. I for one have one of those two-factor authentication dongles on my keychain but don't know whether i can trust that the rest of the system is secure enough to make this little artifact useful.

As for certifying software, my sense is you still need someone competent to run a reasonably secure server, which is nontrivial for non-experts.

Graham





> 
> All the best,
> Jacob
> _______________________________________________
> liberationtech mailing list
> liberationtech at lists.stanford.edu
> 
> Should you need to change your subscription options, please go to:
> 
> https://mailman.stanford.edu/mailman/listinfo/liberationtech
> 
> If you would like to receive a daily digest, click "yes" (once you click above) next to "would you like to receive list mail batched in a daily digest?"
> 
> You will need the user name and password you receive from the list moderator in monthly reminders.
> 
> Should you need immediate assistance, please contact the list moderator.
> 
> Please don't forget to follow us on http://twitter.com/#!/Liberationtech