Re:A thorough PGP tutorial
by tptacek on Sunday July 07, 2013 @11:35PM
(#6005027)
I would if I could, but another distinction between real cryptographers and amateur ones is a desire not to publicize things until the design is trustworthy. I think you'll have to take my word for this (but I'll try to think of one I can share).
[ Parent
| on HN ]
Are they better in that they are easier to use (and thus promote security)?
What does this mean? We just got finished talking about a system that was profoundly less secure because it tried too hard to be easy to use.
I understand this discussion is about avoiding snake oil, and only using good quality trusted respected systems, and using them carefully, but making them easier to use.
Some examples from PGP include Bob signing Ann's key without sufficient verification, or people publishing their private and public keys by accident.
Remembering that many people are just hopeless at security ('123456' used as passwords; people clicking through browser certificate warnings; people installing malware and ignoring OS warnings about untrusted sources) it seems a reasonable point to make: "Secure products can be made easier to use, and if they are both good and easy to use it will enhance security".