The data shows you're wrong: lack of encryption does not prevent a significant number of people from using a product.

I'm mostly repeating what I said in https://news.ycombinator.com/item?id=10580829. Further down I had several links supporting the claim that even people who have a lot to gain from encryption will often not use it if it's not enabled by default.

They start cary about privacy if a picture of them naked is exposed or if somebody "pirate" their social accounts, then they will ask for someone to blame, and then go back to business as usual.

You can't expect the average population to be proactive on this.

I don't think technologists who ask users to do complicated things or blame them when things go wrong care about privacy Especially when large tech companies make bank by not standardizing things that should be fundamental rights in communication. To me a lot of this (but not everything) is banker level arrogance similar to pension funds or housing markets where "people should have known we were selling them crap".

But it's also that people value most things over privacy. To me, valuing the hability to express yourself on facebook over freedom is not a good bet. Just like valuing the hability to smoke over your health is not a good one.

I do understand why people do it. I have my share of similar self-destructive behaviours.

Still it's commun that important things like ecology, freedom, health are discarded over confort, convenience and quick rewards.

And privacy falls exactly in that category.

This isn't just a consumer encryption problem, this is the infosec community's fight in a nutshell. To put it simply: risk is invisible.

This is why projects such as the EFF's scorecard ( https://www.eff.org/secure-messaging-scorecard ) are incredibly important, possibly more-so than the actual code various applications implement. Because without public awareness there is no incentive for companies to implement non-trivial encryption features.

To look at it another way, we're fighting a public health battle here and we should borrow the lessons they've learned. You don't eradicate Dracunculiasis by assigning a doctor to look over every person's shoulder -- you educate people that {behavior} causes {invisible thing} causes {problem}. And once people know why, they're empowered to help themselves.

- if the problem take another form, they won't act;

- if the solution needs to be adapted, they won't do it;

- when the problem doesn't exist anymore, or your understanding of the problem is very different and you realize you fought the wrong battle, it will be impossible to realocate the ressource to it. Worst, you will get discriminated if you do.

All in all, education is good, but as long as people don't generally care about the way the world works, no matter the specifi subject, it will be fighting a never ending battle.

There are plenty of us that do care about it. Sure, they didn't have to do it, they still would have had plenty of users - but they chose to do it.

WhatsApp did it because they could do it in a way that was beneficial to them coupled quite likely with internal ideological reasons to roll it out. It's a positive spin that can be spun in the tech and non-tech media and could be coupled to improve their reputation as long as it's being run with the overall privacy / encryption debate stories. It also future proofs their platform that when they do come under direct fire they don't have to be seen as reactive.

To have a good grasp of what matters to the public, remember that Apple once did a whole ad campaing over the fact that the new iPhone could copy/paste. We mocked it. And the joke is on us, cause it worked briantly. This is what people cares about, and more over, this is what people knows about.

I doubt that. I agree with you that many use unencrypted products though, so you have a point. However in almost all events I can remember the people committing terrorist acts where already known to at least some agencies. The agencies already drown in false positives. There is no indication that this will change. This strengthens my point: it is not about terrorists.

If even that level of prior knowledge is being ignored to push for yet more data (and more false positives) it becomes really hard to believe that this request is being made on the level.

Sending a GnuPG encrypted email on the other hand is way too much to ask for the layperson.

Getting the message sent and successfully received is of more importance. It's better if its also encrypted. It's best if the messaging and encryption work together, seamlessly.

I'm glad I'm not the only one having that opinion about MS's acquisition of Skype. There's this article from July 2012, after the MS acquisition and before the Snowden leaks: https://www.washingtonpost.com/business/economy/skype-makes-...

> The FBI, whose officials have complained to Congress about the “going dark” problem, issued a statement Wednesday night saying it couldn’t comment on a particular company or service but that surveillance of conversations “requires review and approval by a court. It is used only in national security matters and to combat the most serious crimes.”

and most importantly

> But changes allowing police surveillance of online chats had been made since late last year, a knowledgeable industry official said Wednesday.

As an anecdote, just wanted to add that I live in an Eastern European country which has started to at least try to put up a fight against endemic corruption, with the help of some Western countries (i.e. the American and the UK ambassadors issuing worrying statements from time to time saying "corruption is bad" and meeting the head of the Anti-Corruption body).

Anyway, in a couple of anti-corruption cases investigated by our local anti-corruption prosecutors there were mentions of the authorities having access to the corrupt people's Skype conversations. Now, our NSA-like structure is no way as powerful as the real NSA, computationally speaking, so I don't see them breaking Skype's built-in encoding all by themselves, unless given that information on a silver plate by our friends from across the Atlantic Ocean. In exchange, we might help them with keeping nasty terrorists locked in an improptu prison, because that's how friends help each other out. (http://www.independent.co.uk/news/world/europe/inside-romani...)

This might be difficult. With iOS, Android or Windows you have to trust the OS Vendor. I assume especially on iOS it might be difficult to supply any meaningful encryption at all if Apple decides to not supporting it.

There is a small but growing market for strong encryption. US companies will find themselves losing some amount of market share due to encryption restrictions. We already saw this once with the previous crypto wars. The U.S. thought that they could corner the market on good crypto and instead ended up losing a good portion of the market. The U.S. lost that war and they can totally lose this one for the same reason. We don't have a monopoly on good crypto in the U.S. and if they have their way we'll end up with only bad crypto.

What are the other nails in your opinion? To me it seems that the Silicon Valley is doing quite well.

There are Amazon employees who could be ordered by the US of A to break German law and extract data from customers at the Frankfurt site. In my judgment, the chance of their being prosecuted in Germany would be indistinguishable from 100%, so the real question is, has Amazon set up its organization such that people who are safely in the US can access such data.

I wonder if they already separate privileges between regions so one rogue employee can't take down all of their regions.

Sounds like an "exit strategy" - TrueCrypt might even be an example of this.