-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1 On 07/20/2015 05:53 PM, Stephen D. Williams wrote:
I hold multitudes. I am in one thread totally cypherpunk, and have been for a very long time. There are innumerable ways to compromise and be compromised for all kinds of good and mostly bad reasons. Perfect protection is tough for in many ways and we should keep striving to get closer to that ideal security stance.
On the other hand, life is a balance. I probably shouldn't have tried to make the point here, but it is something a security professional should understand well: The right amount of security should be moderated by the tradeoff of costs vs. overhead vs. maximizing benefit vs. minimizing loss. Security stances change over time and aren't necessarily accurately reflected by paranoid absolutism.
Right you are, in "security" context is everything. My take on the Cypherpunk Way is, start with design concepts for maximum security (!= absolute security), then trim the security constraints back just enough to permit useful work to be done on a cost effective basis. This is vs. industry standard security, where one starts with no security considerations at all, then adds just enough security to cover the largest perceived (!= actual) threats from potential adversaries. Compare UNIX style OS architecture to MS style. :)
An example along these lines that I like to keep in mind: (I really did avoid writing down passwords anywhere for a long time. And I still don't carry them with me. If I did, they wouldn't be plaintext.)
https://www.schneier.com/blog/archives/2005/06/write_down_your.htm l
I'm
a big fan of password management, as a special case in the category of "A failed data backup may cost more than a successful break-in." Lots of luck getting "normal" users to make and use more than two weak passwords, though. :o/ Steve -----BEGIN PGP SIGNATURE----- Version: GnuPG v1 iQIcBAEBAgAGBQJVrYcCAAoJEDZ0Gg87KR0Ly3YP/iRBCK0a5DksVS2VAQm4dXr+ hCK5woYAsYA5nbaS8XUjQFOHJz6yRU4iMRf8K6AFWG1MkNDv6OLz6G5lGtl7LFIH iNnrqedH6Im2y0GZdKHCjNDL3TpHwE7pXKrMPs6LQrcOzEMmXADN6NaMBR3+ng9y pVk8BvGwX9O7f9aq5OxpTPpS2GH+Rz5YVxURNMF/XlygxEDi0E1YqOi8m6WQLlOl UmZlgc1jVlfTfxrgB1E4VcdDvvoe1rxmx40y/ztmv51y3d4c9riLTPoRuuJS0+TX 0Ha6x3rQOEgAHLQUpk92e+q6cTGa+UaEqxv/sYG9dZtjQyDsoC7DvsdPjnhYPoOC Cxbdy4jEpNlGJ4gDCKmvq91e2pB8HK9OP7QwFTyHcBbFlq8ObjUwK6gtqMGiibWF 48Pll65tqr6UhMc4Xa+Ma9Zk5jjl2EziVUbVnf0dsCC7oFcksP5Yvsdz4cnEKTN4 9t6syo4fNVfmdMc5BHzWH+i7mtiBc/fsvP+O3pYEJ3TcsH/qSyt/JMjaiw0JHNUz f0axAQAA223xeuBdjtQwR64qfwNlHAlKMekMwXgHCVAmsYm3jWwnW7BsLa16ISvz X/r7qYRj8ikZrYCny676JUEOYQ7etzdfYbphWy2vBOfw/C+ZseIHG5JvTVBklhzL uwaJ+pffatAm/eAZu5Xz =+kaz -----END PGP SIGNATURE-----