I would suggest changing it to something more direct like "Breaking kneecaps" or something along those lines.

May sound far-fetched, but it isn't.

Not in the UK, for example.

> The Regulation of Investigatory Powers Act 2000 (RIPA), Part III, activated by ministerial order in October 2007,[20] requires persons to supply decrypted information and/or keys to government representatives with a court order. Failure to disclose carries a maximum penalty of two years in jail. The provision was first used against animal rights activists in November 2007,[21] and at least three people have been prosecuted and convicted for refusing to surrender their encryption keys,[22] one of whom was sentenced to 13 months' imprisonment.

https://en.wikipedia.org/wiki/Key_disclosure_law#United_King...

(The singular with a "the" means the Bitcoin blockchain, which is increasingly centralised under a decreasing number of Chinese mining pools. And this is apart from the stupendous list of problems with literally every single aspect of Bitcoin. It may not be a great idea to pin any of our hopes on the digital Cue::Cat.)

Or a different social order (my favorite) - but the first problem is probably much easier to solve in a short time-frame.

We get that, then we might integrate it with our existing technologies to implement and use it. Need the foundation first, though.

Pick one. That is why we are in the mess we are in

Decentralised systems tend to lose to centralised ones because there's no money locus for advertising, development or curation.

It's not totally doomed; the popularity of Snapchat suggests there is demand for services that don't make everything saved and visible forever.

Disagree. In practice security as a guarantee must do so (e.g. the OpenBSD opinion), but security as a gradient need not (e.g. the web opinion).

If Browser X defaults to the TLS version of a page regardless of what the user requested, but gracefully falls back to the unsecured page without action but with a yellow banner across the URL, does this not increase user security without preventing them from doing insecure things?

The objective is not perfect security but rather increased herd security.

If the minimum security threshold (specifically with respect to encryption) is raised, then we all benefit. Decentralized vs centralized and the feasibility of each are an argument for farther down the road (as long as we don't lock ourselves into one or the other). There's much lower-hanging fruit!

For instance, encryption lets me back up files to cloud services that I don't trust. Without the technology of encryption, my security requirement would have me not backing up files at all. I wouldn't just decide "oh, whatever" and back up unencrypted files.

SSL lets me access my bank safely (enough) from a coffeeshop wifi connection. Without SSL, I'd walk into a physical bank or ATM. I wouldn't decide "probably nobody's trying to hack me" and connect to my bank in cleartext.

Bad technologies manifest as an obstacle to users, yes. But passwords are pretty much the epitome of bad technology in the security field. (It's a legitimately hard problem, so I'm not claiming that people should be doing other things, but we also shouldn't let ourselves think that passwords are good.)

SSL, for all that the implementation sucked and still sucks, enabled the e-commerce revolution of the mid-'90s.

Any recommendation on an accessible, audited, client for Windows users? Running some company's random binary, especially when you log in and they can identify you, implies a fair amount of trust. Tarsnap's the best one I know of and it's not really accessible for most users.

Truecrypt has been audited, works on Windows, and appears to offer an encrypted file container that you can attach to a Windows drive letter.

What you could do is create the container, let DropBox (or whatever) sync the file containing the container, then perform your file operations within the container.

Depending on your needs, there's also GPG4Win, which comes recommended by the GPG project maintainers. AFAIK, GPG hasn't been subject to an extensive audit, but it is venerable, open source, and developed in the open. (Yeah, so was OpenSSL, I know. ;) )

I don't know that there's a way to make a transparently encrypted container with GPG as there is in TrueCrypt, so I suspect that you'd have to:

* Copy your encrypted files

* Decrypt them

* Edit them

* Reencrypt them

* Copy them to the sync directory.

Sounds like a bit of work to me.

If you were on Linux, you could probably use dm-crypt on a loop device, and just sync the underlying encrypted file, but -again-, I have no idea how much auditing has been done on the underlying code (and this fails your "for Windows users" requirement).

Oh, BTW, I replied to our Erlang thread. If you're interested in taking a second look at Erlang, I link to a few things in the comment that might be interesting to you.

I've not found an open source tool that does block level backups with diff/compression support. Getting the client experience right is hard and not a whole lot of fun, so I'm guessing there's little incentive for companies to open source that valuable part.

Thanks for the info on Erlang.

I'm still not quite satisfied either.

Yeah, I've got nothing there.

Edit: I would ask "How hard could it be to solve 90% of the problem?", but various BigCos have had spectacular failures in recent memory, so I guess the problem is pretty damn hard.

I wonder how terrible using git as the backbone for one's sync software would be.

Better to have a written down strong password than an easy to remember password not written down.

I've heard somewhere of military organizations having people trained to go in an office and search the places people "hide" their password sticky-notes...

I do agree with your profit motive. I consider that a potential opportunity rather than a problem.

Most altcoins are Proof of Stake, where mining via computing hashes doesn't take place. "Blockchains" isn't limited to Proof of Work, you can even get non-PoS/PoW blockchains such as Hyperledger.

Do you mean most that aren't autogenerated ones that stop being mined a few months in, or do you mean to include those?

I'm a bit surprised about "most" but if you mean "most that do something" then I could believe that, but I am still surprised.

Yeah, e-mail systems lost :-) Anyway, corporate monopols are problem, not systems.

Here are a few of his thoughts on the matter:

https://www.schneier.com/blog/archives/2009/02/balancing_sec...

https://www.schneier.com/blog/archives/2009/08/security_vs_u...

https://www.schneier.com/blog/archives/2009/09/unauthenticat...

Schenier's own words: """ Designing systems for usability is hard, especially when security is involved. Almost by definition, making something secure makes it less usable. """

Feel free to disagree with one of the leading experts in the field, but I doubt you'll end up right.

No, he both isn't that and isn't regarded as that either.

Define security. Not too long ago it was considered "rude" to have a not world-readable home directory on a unix server.

Today, "everyone" is worried about SIGINT by nation states. Meanwhile, there's little talk about things that can actually protect you from criminals like why is code written so shittily in general and why aren't we using a Rust-like solution for internet facing applications? Why is AV useless and unable to stop well-known malware like cryptocker variants? Why are my desktop/cloud files unencrypted by default? Why phishing scammers are constantly emailing me with realistic looking fake sites? Why doesn't Microsoft have a solution to the "download invoice.pdf.exe" problem?

Yes, Obama reading my "maymays" is bothersome, but that's not what my grandma needs. She needs a better way to get online and not get infected, her identity stolen, etc. So, who gets to define priorities here? You? I'd rather lean towards protecting Grandma's than geeks obsessed with the NSA's data collection program. Morally, I see the former as more important. That's my bias and its as valid as yours. If we can't agree then who can?

Grandma needs a phone. A lot of those problems are implicitly disappearing as a majority of tech-illiterate users are moving to mobile platforms, which are far more locked down.

> So, who gets to define priorities here? You?

Those that work on it? Why isn't that obvious? Steps towards fixing either problems are good, so those that work on them get to work on whatever the hell they want, really.

https://news.ycombinator.com/item?id=3915479