Disagree. In practice security as a guarantee must do so (e.g. the OpenBSD opinion), but security as a gradient need not (e.g. the web opinion).

If Browser X defaults to the TLS version of a page regardless of what the user requested, but gracefully falls back to the unsecured page without action but with a yellow banner across the URL, does this not increase user security without preventing them from doing insecure things?

The objective is not perfect security but rather increased herd security.

If the minimum security threshold (specifically with respect to encryption) is raised, then we all benefit. Decentralized vs centralized and the feasibility of each are an argument for farther down the road (as long as we don't lock ourselves into one or the other). There's much lower-hanging fruit!

For instance, encryption lets me back up files to cloud services that I don't trust. Without the technology of encryption, my security requirement would have me not backing up files at all. I wouldn't just decide "oh, whatever" and back up unencrypted files.

SSL lets me access my bank safely (enough) from a coffeeshop wifi connection. Without SSL, I'd walk into a physical bank or ATM. I wouldn't decide "probably nobody's trying to hack me" and connect to my bank in cleartext.

Bad technologies manifest as an obstacle to users, yes. But passwords are pretty much the epitome of bad technology in the security field. (It's a legitimately hard problem, so I'm not claiming that people should be doing other things, but we also shouldn't let ourselves think that passwords are good.)

SSL, for all that the implementation sucked and still sucks, enabled the e-commerce revolution of the mid-'90s.

Any recommendation on an accessible, audited, client for Windows users? Running some company's random binary, especially when you log in and they can identify you, implies a fair amount of trust. Tarsnap's the best one I know of and it's not really accessible for most users.

Truecrypt has been audited, works on Windows, and appears to offer an encrypted file container that you can attach to a Windows drive letter.

What you could do is create the container, let DropBox (or whatever) sync the file containing the container, then perform your file operations within the container.

Depending on your needs, there's also GPG4Win, which comes recommended by the GPG project maintainers. AFAIK, GPG hasn't been subject to an extensive audit, but it is venerable, open source, and developed in the open. (Yeah, so was OpenSSL, I know. ;) )

I don't know that there's a way to make a transparently encrypted container with GPG as there is in TrueCrypt, so I suspect that you'd have to:

* Copy your encrypted files

* Decrypt them

* Edit them

* Reencrypt them

* Copy them to the sync directory.

Sounds like a bit of work to me.

If you were on Linux, you could probably use dm-crypt on a loop device, and just sync the underlying encrypted file, but -again-, I have no idea how much auditing has been done on the underlying code (and this fails your "for Windows users" requirement).

Oh, BTW, I replied to our Erlang thread. If you're interested in taking a second look at Erlang, I link to a few things in the comment that might be interesting to you.

I've not found an open source tool that does block level backups with diff/compression support. Getting the client experience right is hard and not a whole lot of fun, so I'm guessing there's little incentive for companies to open source that valuable part.

Thanks for the info on Erlang.

I'm still not quite satisfied either.

Yeah, I've got nothing there.

Edit: I would ask "How hard could it be to solve 90% of the problem?", but various BigCos have had spectacular failures in recent memory, so I guess the problem is pretty damn hard.

I wonder how terrible using git as the backbone for one's sync software would be.

Better to have a written down strong password than an easy to remember password not written down.

I've heard somewhere of military organizations having people trained to go in an office and search the places people "hide" their password sticky-notes...

I do agree with your profit motive. I consider that a potential opportunity rather than a problem.

Most altcoins are Proof of Stake, where mining via computing hashes doesn't take place. "Blockchains" isn't limited to Proof of Work, you can even get non-PoS/PoW blockchains such as Hyperledger.

Do you mean most that aren't autogenerated ones that stop being mined a few months in, or do you mean to include those?

I'm a bit surprised about "most" but if you mean "most that do something" then I could believe that, but I am still surprised.

Yeah, e-mail systems lost :-) Anyway, corporate monopols are problem, not systems.