/sec/ education

>not many people are /sec/, so you have to be not /sec/ with them. I see variations on the above theme so often that I usually ignore it, but seeing this on lainchan, where the people are generally more mindful/intelligent, nauseates me. Are you all really forgetting that you could either: 1. teach each (or which you chose, where too many; how to choose which to teach is another question deserving at least 7 nonredundant longer comments) individually (the message gets across easier if it's one on one, where you can tailor the form/style of making it easier for them to know (which is the definition of teaching) that you use with that individual to that individual) the benefits of being /sec/ (motivation) and how to be /sec/ (technique) (including various tools that automate the being /sec/, while explaining the various dangers and how they effect the expectation (a la Probability) of privacy); or 2. don't compromise your being /sec/ by not interacting with them. The world is a large place (despite what some entertainers and statisticians would have you think), there are many people that are /sec/.

>>7354 The world is not a yes security or no security Boolean threat model, people choices and threat models are more complicated than your opening post gives them credit for. Yes with people being lazy, apathetic and trading privacy and other things for convenience it often seems like people have a Boolean threat model, but that isn't the case. Regarding security education, security education only makes sense to stakeholders if they want to learn and they have a reason / buy in / engagement for what you are teaching them. Security education also has certain time and effort commitments on the teacher and the student. People haven't forgotten about the importance of security, but their threat model is not your threat model , the impedance mismatch is what nauseates you. Your second strategy doesn't really work, because people have families and friends and other working relationships where they can't just disengage because those people don't have the same security knowledge or discipline as them. See https://xkcd.com/1810/ and https://xkcd.com/1254/ for more information about why the isolation strategy just leads to human's falling back to lowest common denomination communication with lowest level of security. There isn't security training in schools (except for disaster awareness, and for school shooting or lockdown procedures, and martial arts electives for sport), and most security training is send as something that is learnt by operatives of intelligence agencies or law enforcement or bouncers and other physical security workers. Levels of security education by the immediate family unit, vary based on geographical and social economic areas and on cultural norms. There will always be the spectrum of usability systems vs secure systems vs useful systems. And as such there will also the trade off for practices and tools that are secure for a given threat model and use case but take time and effort to use, and practices and tools that less time and effort but are not secure for the same threat model and use case. See https://jnd.org/when_security_gets_in_the_way/ and the first attachment and https://xkcd.com/538/ for more information.

https://xkcd.com/1810/ and https://xkcd.com/1254/ don't adress privacy or security, but [i]prior[\i] laziness, and the increased [i]posterior[\i] laziness, with the former showing consequent social complexity of [i]prior[\i] laziness, and the latter showing the consequent personal complexity of [i]prior[\i] laziness. https://xkcd.com/538/ shows the benefit of good security, cast in a negative light for the purposes of humor. The point is that a system is secure if the weakest link is the user (for which there are ways to make the user more secure, which I think OP was including in his "teach them" point). It is my sincere (and ultimately selfish, for obvious reasons) hope that you don't give entertainment any authority over security, or other important things. Regarding usability, yes, it's an important factor in security, but there are perfectly usable secure systems, whose main cost is the (usually inexpensive) upfront cost of switching to the secure system. Where security gets in the way, it is usually the particular (fairly lazy) solution/implementation that is getting in the way. Had Google thought through the possibility of hosting untrusted guests in a nonsecured auditorium (which they probably did), they would have forseen to either attach some sort of bathroom to the nonsecured area, or would have a system in place for dealing with the event where an untrusted guest enters the insecured area, by checking that nothing has been tampered with, and in the event that something has been tampered with, would have prepared a response to restore themselves from the harm that a would be malefactor might have done. The problem is that we are continually forced to use [i]arbitrary[\i] security procedures. Had we been using [i]well planned[\i] security procedures, we would not have to resort to breaking or circumventing them. I understood the meaning of the original post's "/sec/" as any other sensible definition of security, not the strawman that >>7356 seems to have built out of the (sensibly written, though not very informative) original post. I agree that the original post is not giving people credit for being nuanced (the boolean algebra applies as much to soft/fuzzy (probabilistic) logic as it does to hard (bivalent) logic. The world is not a boolean threat model because it is not a model, what >>7356 probably meant is that boolean threat models are not sufficiently representative of the world, even though they are sufficient for modeling threat. Threat is danger with perhaps the added metaphysical distinction of will (which doesn't effect the mathematics here), danger is negative expectation (these are all mathematically equivalent), expectation is an integral over the probability space in question, probability spaces are made of points that are occurences, occurences are members of events, events are subsets of a probability space, occurences are equivalent to simple events, simple events are singleton events, simple events can union to form (complex) events. Events are sufficiently modeled by boolean algebra, because events are just sets, and sets are sufficiently modeled by boolean algebra), but it doesn't seem to be saying anything about how nuanced (or not) people are in their thinking about security. Also, https://jnd.org/when_security_gets_in_the_way/ says >It is time to make [security professionals] first-class citizens working with the product team throughout the entire development cycle to produce cohesive systems that are understandable and usable, functional and safe, secure and private. It's similar to cinema: where the composers and other sound writers (e.g. sound effects, though the line between the two is blurry, as tends to be the case with art) are included in the creative process, the films have good sound. Likewise, where the security professionals are included in the design and implementation processes, the system is secure, effective, and usable. I think it's strange that >>7356 includes a pointer to an article explaining that it's perfectly doable to have secure, usable, and effective systems, to try to support what seems to be an attempt to rebut the original post. >Note the two different components: the understanding of the necessity for protection and the reasonableness of the effort required This would be, along with including a pointer to a decent tutorial of the various security techniques, what you would be teaching your friends, family, and colleagues. >biometric identifiers I'm not big on biometric identifiers, if someone kidnaps me and beats me with a wrench to try to get me to tell them my password, My control of their access to the system only ends when I tell them my password; if someone kidnaps me and forces my fingers, eyes, face, or whatever other biologically unique body part, onto the apropriate scanner, My control of their access to the system ends as soon as I'm abducted. >the impedance mismatch is what nauseates you Do tell us more about the second-person-corrigibility of first-person qualial statements. What is it that you have discovered about the inner workings of other minds that you have not shared with the Metaphysical and Psychological communities? Or are they supressing your research for some reason.. https://xkcd.com/2113/

>>7354 I think partly is due to the sheer difficulty of getting people to care about their own personal security. Internet culture, in general, has shifted into accepting to divulge personal information to third party, untrusted, services as a fact of reality on the Internet. But this could also be due to what >>7356 has said above regarding a mismatch on personal threat models. However, in contrary to >>7356, I do think that at certain groups of individuals, the value and importance of security, specifically digital security, is diminishing. An example of which could be my own personal experience as I am currently finding it harder and harder to convince people to use more secure services. As for often they reply: "Everything is not private anymore, anyway. There's no point. Plus it is inconvenient, everyone is on *generic social media site* nowadays." I guess a question to the thread: What would you say when given that same response?

>>7432 >Internet culture, in general I don't think anyone can really say anything too specific or universal about the current internet culture in general, we used to be able to say some very specific, generally applicable, things about internet culture, because the people who were on the internet were people who understood all the parts of the internet and how they worked together (simply because, in order to connect, you had to know these things. there were, of course, thosue who knew people who knew these things, and they were either taught about the culture, learned the culture and assimilated themselves into it, limited their use some aspects of it that they understood so as to not stand out, or were seen as blatant outsiders. "nontechnical people, as they may be called, were few and far between), as well as the possibilities that the internet could provide (given that they are careful about how they go about using the internet), this homogeny let us say quite specific things about what the internet was like. currently, it's easy for anyone to connect, some companies even go so far as to make their products insecure, just so that it's easier for some of them to connect (because, they think (somewhat rightly, but slightly perversely) that more ease of use (even at the cost of worse security) implies more customers, and more customers implies more profit). it's so easy for just about anyone to connect, that almost all of them do connect, and not everyone is willing to learn about all the possibilities offered by this magic communication system, so that they basically live their internet lives like they would have lived their lives anyway (just that the internet is a bit more robust and often cheaper or faster). this is where you get things like PGP getting convoluted to try to include ways to know what human owns what key, and why you get people using video-chat to convey something that could have been conveyed via plain text, and why there are some very annoying colorful motion-graphical visual designs of websites, that require who-knows-what sort of magic hand waves or vials of blue smoke to get them working properly (this one is on the artists who don't have mastery of the digital craft masquerading as designers, and other people with limited talent, limited skill). to make a statement about "internet culture" if such a thing exists anymore, is to make a statement about the culture of half of humanity. there are all sorts of human people, and there are all sorts of internet-user people. it's up to us to decide what sorts of behaviour we support, what sorts of people we support. if you don't mind that most people are in danger, fine. just remember that their lack of safety affects your safety. when we try to create one system to accomodate all the different sorts of people, it gets convoluted fast, take, for example: >inconvenient security Boy, is PGP inconvenient as ファック。 All I wanted was to make (and exchange) a keypair, and dance the easy message-crypto dance: encrypting messages from me with my private key to ensure authenticity, then with their public key to ensure privacy, decrypting messages to me with my private key to ensure privacy, then with their public key to ensure authenticity. But, n[i]ooo[\i], they had to add a bunch of fluff. And it is fluff (or ought to be seperated into the various parts, so that it isn't one convoluted mess). The main thing about keypairs that you can prove is that any message encrypted by the private key of that pair will be decryptable only by the corresponding public key, and vice versa. You cannot prove that a given human is the owner of a given key, nor can you prove that a given key is owned by a given human, that's beyond the scope of the system. Sure, it's maybe possible to establish fairly decent probabilities that they are in such a relation, but that gets convoluted fast, as we see with PGP. The beauty of the idea was that you don't need to prove all that, all you really need to do is treat each public key as a sort of name for some person who you only know by that name (with the benefit that the likelihood of another having the same name is extremely small), thus you essentially treat the public key [i]as[\i] the person, and watch the behaviour of that person (which will be trivially provably the behaviour of that person, because it is all signed by their private key, which is verified using their public key, and any behaviour which is not signed thus is treated as not them (and if it's not signed at all, it's treated as a sort of cryptographic 'wild west', where no reasonable person trusts anything, because there is no establishing of trustworthiness)) I guess what I'm trying to get at is this: is there any cryptographic software system compatible with PGP (in terms of what's encrypted with one software system being decryptable with the other software system), but only provides the (sufficient) abilities 'generate keypair', 'encrypt message using key', 'decrypt message using key'? e.g. [code]cryptosoftware -t to_recipient -f from_sender -e message_to_encrypt[\code] would encrypt message_to_encrypt using the private key of from_sender, then public key of to_recipient; [code]cryptosoftware -t to_recipient -f from_sender -d message_to_decrypt[\code] would decrypt message_to_decrypt using the private key of to_recipient, then public key of from_sender. To be cleaer, I'm all for having a variety of algorithms, but my concern here is what one can do with the algorithms, how easy it is to do those things with those algorithms, and how easy it is to learn how to do those things with those algorithms (respectively: capability / mechanism, usability / elegant interface, learnability / proper documentation), as opposed to which algorithms are best (which is for probabilists and cryptologers to understand and advise us of, and is likely dependant on the circumstance) on a side note, if you are less worried about establishing reputation, but still interested in privacy and authenticity, you could generate a new keypair for each person with which you correspond, much like you generate a new email account for each person with which you correspond, which doesn't add too much complexity up front, and reduces the long term complexity be keeping different parts of your social life separate. of course, if you want, you can link the keys together by having each say that they are of the same owner it's better for each to have a system that works for them, that is compatible with other similar systems. else, we find that, somehow, that everything is one ring fits none.

>>7451 >all you really need to do is treat each public key as a sort of name for some person who you only know by that name (with the benefit that the likelihood of another having the same name is extremely small), thus you essentially treat the public key [i]as[\i] the person, and watch the behaviour of that person (which will be trivially provably the behaviour of that person, because it is all signed by their private key, which is verified using their public key, and any behaviour which is not signed thus is treated as not them (and if it's not signed at all, it's treated as a sort of cryptographic 'wild west', where no reasonable person trusts anything, because there is no establishing of trustworthiness)) this ignores a MITM attack: how do you know that someone didn't intercept the key exchange and is reading all your messages?

>>7354 I'm looking for /sec/ people, but as there aren't many near me I try to teach people about /sec/. But I always hope to find someone more skilled then me and learn more about it. >>7453 this depends from your thread model, but in general you'd like to verify keys in some way in person for more security (IF you trust that the person in front of you is not lying)

Do OP expects people on lainchan to be as autistic as he is? You wear mask only when you are going for a robbery. Do you wear secure clothes wrapped in tinfoil when you are going on the streets to buy bread, so random FBI agent accidentally walking around could not scan you with his top-secret spy devices? May be you are seeking for a place with free wi-fi spot 10 kilometers away from you just to call your mom at self-hosted nextcloud encrypted with 3 layers of RSA-4096? Excessive security for everyday use is a joke. Most data in the Internet is garbage, we discuss garbage and we talk about garbage. No one really needs security to post anime pictures, degenerate memes and news. People who give away something secure inside not-secure systems are obviously idiots. I used botnet for 10 years before I've got into security. Nothing changed. I don't even remember what I was like, and even if someone finds it out, I am already a different human being. No one knew I exist and no one knows, but now instead my home IP looks suspicious because it is connected to vpn and tor 24/7. And I don't really use tor, because there is no need to. Securing my browser and being 'anonymous'? Do you really need to shake your head because google got your IP address and hardware info through using chrome, thanks to which by the way chrome is at least usable and has hardware acceleration on linux? The data I left may be found by someone but when? At least 150 years from now, because that's how much garbage we left in. Even if garbage I left will be kept for that long time and be found, it will be thrown away because no one cares what is my mood, how my dead body looked like and what I was interested in. This data represents value only for advertisers. Statistical data represents value only when it's summed up. There are some borders of security you should keep yourself within, but it does not apply for the greatest part of your life. I.e your OS should be secure because it keeps all of your data within and your hard-drive must be encrypted if you use laptop, for the case it gets stolen. What's the point of encrypting my degenerate messages and using Matrix to talk with mr. No-one, though? It should be obvious that people who overthink and overestimate the value of their data are at least narcissistic and delusional, if not only they try to gain personality through using obscure (and senseless) rituals. Your role-playing is cool and all of that, but you need secure systems only when you exchange secure data and do something knowledge about what has at least some minimal value, that's why you need to be good in security to protect yourself.

>>7851 Excessive measures wrt privacy/anonimity/sec/etc are as everything that's disproportianate, not worth it, true. But your second line about most of the data being garbage seem like the opposite extreme - if you put on your tin foil hat only when dealing with sensitive data, you might've already professed more than was necessary. A good sense of measure goes a long way.

TL;DR Either kudos OP's picrelated's predictive power, or kudos nOP's excellent roleplay. Or was it merely postdictive?.. >>7851 The rhetorical device of applying Physical things as metaphors for Digital things is only useful in describing the essential features of the Digital thing: the scales of the costs are quite different. Wearing a physical mask in physical space costs a lot more than 'wearing' digital 'masks' in digital space Your hyperbolous use of layering the same cryptographic method on itself multiple times was gratuitous: if there is a fast way to break one layer of that cryptography, it's only 3 times as hard to break 3 layers of that same cryptography. Further, that what someone (let alone most people) post is worthless to a (let alone any) third party is a (very very) strong claim. Regarding someone getting one person's data, it's already a big deal if they get one person's data: just what can be done with that data? Unless the data about that person is proven to be benign, which is not likely the case, given the wide range of human activities, and the fairly narrow range of what is proven fairly benign, and the (also fairly narrow, but) much larger range of what is proven not benign. What is a bigger deal is that the company in question does not only get one person's data, but many persons' datas. >It should be obvious that people who overthink and overestimate the value of their data are at least narcissistic and delusional The ad hominem is neither appreciated, nor invalid. And so what if the person is delusional or narrcissistic? Are you trying to imply that people with some of various benign behavioural differences are somehow worse than others? There are no esoteric rituals, you set up your system once, and each time you open a new social relation, you follow a simple ritual (each generates a keypair, each gives the other one of the keys). Or were you unaware of automation? The protocols can be a bit more involved, and the algorithms even more so, but most of that is handled automatically by the system you have set up once for all time, even the key generation and exchange can be automated, but some might prefer, for the sake of supervision, to be the one who presses the button that does it. The only reason we, as the /sec/ 2.0 sticky reminds us, >>Hide loudly is because too many don't hide at all, and they need to be reminded that it's not only feasible, it's cheap. Thus only ignorance, which will be dispelled, or inertia, which is their problem, keeps a person from realizing it's necessity. This is, of course, not to ignore the ever necessary grandfather clause in any change to a new way. >>7453 >M[an ]I[n ]T[he ]M[iddle] attacks So what? In what >>7451 described about treating the public key as a name, you aren't talking to some person at the other side of the cryptography, you are talking to the person that is the key. Sure, you could argue that for some situations you might prefer to know more about who is on the other side of the key, but in almost all of those cases, all it does is save a small amount of time that the person that is that key would spend increasing it's reputation. There are cases when you might want to 'transfer' a fleshbound identity to the digital realm, but the means to do that are shaky at best, which I believe >>7451 already mentioned. This is part of why there are digital bank heists.

>>7856 that's not what MITM means. You could have someone who intercepts the key exchange, but still passes through all communications. Thus you could really be talking to who you think you're talking to, but all your messages could be read by the man in the middle.

>>7856 I disagree, because wearing a mask in the Internet slows you down a lot. Not only because of infinite captchas and firewalls, but also because some websites won't work correctly or won't let you in. Encrypting is a pain in the ass; entering passwords every 5 minutes to login somewhere and logout to reset tracking cookies is pain in the ass. You should also keep in mind so many things and never let anything to break and leak, you must always keep an eye for different vectors of attacks and updates - because if you do allow one leak, everything will be compromised and all of the effort is lost. Just like that dude from the silk road who was caught just because he forgot about 1 single thing, his own email. Everything about security is paranoid pain compared to instant messaging and it is obvious that most people want to turn on their device, wait for boot, open their messenger and say that their dick is incredibly hard and they want some good nudes right now. And it does not really need encryption. >just what can be done with that data If you do send something secure or too private over non-secure channels, you're ばか and of course it may be used against you. If you do express your opinion in public and it is used against you, it is not security or privacy problem. What can be done with other data? Targeting and advertising. But being secure does not save you from it. You may block the ads, but you are still being targeted and algorithms still give you data in the way profitable for the company - with the difference that now you fall into the 'neutral' statistical group. This means that if you have no ability to critical thinking you will be manipulated in both cases. Yeah, targeting is much easier and effective if you have some data on a person, but again if you turn off your brain while watching and reading it's not that big deal. Security is not going to save you. so yeah no, I doubt someone is going to abandon their social relations just because they are not secure since people don't want to surround themselves with metal walls just to discuss anime they watched today.

giving data away is mostly a case for tragedy of the commons. Sure the direct personal damage is low to none. But the collective handout allows to train increasingly more precise models to model behaviour and thus exploit you. A simple case is voting manipulation. FB did it by looking at the data and only reminding the people linked to the desired party to vote. This was only possible because everyone gave their data freely away. Even if you don't have your party openly stated - you have other common data points with people who did and thus got linked. That's how giving away data affects us negatively.

>>7395 for the love of god use more paragraphs. this post is so hard to read.