an ominous comment

[Steve Kinney]

-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA1

On 07/20/2015 05:53 PM, Stephen D. Williams wrote:
> I hold multitudes.  I am in one thread totally cypherpunk, and
> have been for a very long time.  There are innumerable ways to
> compromise and be compromised for all kinds of good and mostly
> bad reasons. Perfect protection is tough for in many ways and
> we should keep striving to get closer to that ideal security
> stance.
> 
> On the other hand, life is a balance.  I probably shouldn't
> have tried to make the point here, but it is something a
> security professional should understand well: The right amount
> of security should be moderated by the tradeoff of costs vs.
> overhead vs. maximizing benefit vs. minimizing loss.  Security
> stances change over time and aren't necessarily accurately
> reflected by paranoid absolutism.

Right you are, in "security" context is everything.  My take on
the Cypherpunk Way is, start with design concepts for maximum
security (!= absolute security), then trim the security
constraints back just enough to permit useful work to be done on a
cost effective basis.

This is vs. industry standard security, where one starts with no
security considerations at all, then adds just enough security to
cover the largest perceived (!= actual) threats from potential
adversaries.

Compare UNIX style OS architecture to MS style.  :)

> An example along these lines that I like to keep in mind: (I
> really did avoid writing down passwords anywhere for a long 
> time.  And I still don't carry them with me.  If I did, they 
> wouldn't be plaintext.)
> 
> https://www.schneier.com/blog/archives/2005/06/write_down_your.htm
l

I'm
> 
a big fan of password management, as a special case in the
category of "A failed data backup may cost more than a successful
break-in."  Lots of luck getting "normal" users to make and use
more than two weak passwords, though.

:o/

Steve




-----BEGIN PGP SIGNATURE-----
Version: GnuPG v1

iQIcBAEBAgAGBQJVrYcCAAoJEDZ0Gg87KR0Ly3YP/iRBCK0a5DksVS2VAQm4dXr+
hCK5woYAsYA5nbaS8XUjQFOHJz6yRU4iMRf8K6AFWG1MkNDv6OLz6G5lGtl7LFIH
iNnrqedH6Im2y0GZdKHCjNDL3TpHwE7pXKrMPs6LQrcOzEMmXADN6NaMBR3+ng9y
pVk8BvGwX9O7f9aq5OxpTPpS2GH+Rz5YVxURNMF/XlygxEDi0E1YqOi8m6WQLlOl
UmZlgc1jVlfTfxrgB1E4VcdDvvoe1rxmx40y/ztmv51y3d4c9riLTPoRuuJS0+TX
0Ha6x3rQOEgAHLQUpk92e+q6cTGa+UaEqxv/sYG9dZtjQyDsoC7DvsdPjnhYPoOC
Cxbdy4jEpNlGJ4gDCKmvq91e2pB8HK9OP7QwFTyHcBbFlq8ObjUwK6gtqMGiibWF
48Pll65tqr6UhMc4Xa+Ma9Zk5jjl2EziVUbVnf0dsCC7oFcksP5Yvsdz4cnEKTN4
9t6syo4fNVfmdMc5BHzWH+i7mtiBc/fsvP+O3pYEJ3TcsH/qSyt/JMjaiw0JHNUz
f0axAQAA223xeuBdjtQwR64qfwNlHAlKMekMwXgHCVAmsYm3jWwnW7BsLa16ISvz
X/r7qYRj8ikZrYCny676JUEOYQ7etzdfYbphWy2vBOfw/C+ZseIHG5JvTVBklhzL
uwaJ+pffatAm/eAZu5Xz
=+kaz
-----END PGP SIGNATURE-----