Hacker News Reader

Comment by themarkn | Hacker News Reader

It's ok for it not to pass the smell test, because what you have stated is not actually the argument being made. The number of languages and dialects was (presumably) brought up to emphasize the many differences in scale and culture (especially government corruption) between India's population and Estonia's that might introduce complexities, incentives, and opportunities for bad actions in one situation that are not applicable in the other.

View on HN

Either it’s secure or it isn’t. If it isn’t secure then it doesn’t matter if there are only 1.3 million people in the country; I promise someone from outside the country will try to break it.

Not sure what you mean. Nothing is secure, ever, in a binary sense of being just one thing or the other. It's all a balance between level of security and level of practical usability. Often we've made things easy to use but hard to secure. Like SSNs. But regardless of the source of an attack, the reward for breaking 1 billion targets on the same system vs 1.3 million on a different system is probably much higher. So the inconveniences of more secure systems must be weighed in context of the desirability of the information within them. More attractive targets need more secure, less easy to use, systems.

> More attractive targets need more secure, less easy to use, systems.

That seems to me like a justification for doing the least amount of work needed. Sure, it's true to some degree, but (taking this case as an example) PKI is objectively uncountably better than a PSK-like structure. There's a base security level and until that's reached, there's no need to expend money and time or inconvenience users to gain greater security. Anyone who doesn't get to that level while designing a project of any importance is a lazy idiot.

Yeah this is a fair point, didn't mean to suggest that easy security wins that dont't inconvenience the user or add cost in some other way aren't worth making.

> More attractive targets need more secure, less easy to use, systems.

Actually, it needs to be both secure and easy to use to work.

Reply on news.ycombinator.com