Liveblogged at HOPE X.
Quinn Norton
In the past year, there has been a lot of attention towards major adversaries, like the NSA. Most of the time, we’re actually up against small adversaries. Most adversaries are just jerks. Small adversaries target everyone, with whatever technology they have. It might be gossip around the water cooler. It might be local law enforcement, or your IT department, in schools, corporations, or NGOs. They’re honor killings, partners committing domestic violence, friends who mean well, stalkers who don’t mean well, or random interactions.
What are the tools of small adversaries? A common one is making someone give you their password to email, Facebook, etc. Hacker tools can be used in negative ways. The people Quinn works with as a journalist need security tools that work practically, not academically. How do adversaries get access? Usually through email. More and more tools are becoming available. The tools used by small adversaries, are modeled after those used by large ones.
For most folks, security takes away from personal and productive time. It’s how hackers make a living, but it costs people their lives. The solution is not to make everyone more like hackers. We can’t bring users to security, security needs to go to them. “Do we really want our doctor to drop everything and learn PGP? Or do we want him to take a second look at that x-ray.” She estimates the cost of damage from small adversaries to be over $445 billion per year. But there’s also human cost in lost relationships, and lives. She asks how many people were harassed into suicide, couldn’t find medical information they needed, who died because technology enabled the wrong behavior or got in their way.
The Kitten Groomer is a devices Quinn helped develop. If you have a USB you can’t trust, it copies data to a clean USB and tries to filter malware. It plays a song or flashes a light when it’s done. That’s the only interface.
Some tools Quinn likes: Silent Circle, Crypto Cat, Pidgin, SnapChat. As an aside, Pidgin users have to turn off logging. Creating software that doesn’t log by default is a huge win. Encryption doesn’t matter if you’re saving everything in a log. Snap Chat does a great job of setting user expectations that data shouldn’t be saved.
Bad encryption is bad and hurts people. But not using encryption is worse. If your app gets users, you can always fix the bugs in the back end. UI is hard to fix. You can sometimes fix bad back ends with a good UI, but you can’t fix a bad UI with a better back end. What is the goal of encryption? The goal of encryption software authors is to be unbreakable. The goal of users is to be unbroken, uncaught, and unstopped. Those are different goals. If bad encryption buys you the 20 minutes you need to escape an adversary, it works. When you’ve been caught, you switch to social coding. What hackers call “social engineering.” the rest of us call “conversation.” In short, uncatchable is no better than uncaught.
What do we need? We need more two-factor authentication. We need more auditing. Unaudited open-source software is no better than audited closed software. We need more bad tools and then we need to fix them. We need to focus on empowering users, to give them agency and knowledge.
Ultimately, if you want to fight a big adversary, you need all of your users to feel powerful, not scared, like they feel now.
Question and Answer
Comment: There’s a nice follow-on effect to getting more people using tools, even if they’re bad. Even if the adversaries can break bad tools, they have to spend their time doing it.
Comment: Sometimes passwords are not the right way to do it. We need security that looks normal.
Question: How can we get wider adoption?
Quinn: We need to figure out how to make the things we already have more secure. We should take clues from what people are using. Digital literacy is a big issue with educators. You should connect with educators who are desperate for people to help them. To do that, the security community will need to learn better manners.
Question: How do you keep people up to date with new and changing tools.
Quinn: Tools, especially communication tools, get adopted by communities, not users. The value of a communication tool grows with the number of people who are using it. However we do training, people will get training for their communities.
Question: Are there resources for social coding measures?
Quinn: It’s incredibly community specific. I start by looking for the prominent people in a community. Many communities are trying to stay sub rosa. Recommends It’s Complicated: The Social Lives of Networked Teens by Danah Boyd.
Question: If cryptography is good as long as it works when it’s needed, what do we do if tools become entrenched after they’ve failed to be useful.
Quinn: You keep fixing things as long as you can, and replace them when you need to. This is a fundamental problem of engineering.
Question: How do you encourage people to use better versions of their tools.
Answer: We have almost no successes with adoption.
Question: How can a school teach security when one of their goals is not to give children privacy?
Quinn: We teach them what the network is and how the network sees them. Kids are privacy-seeking, we just need to give them the information they need. Her daughter, after learning about cookies, decided on her own to use a separate browser for watching YouTube videos.