People don’t care. They don’t even know that they should care. People have no clue how their PC or smartphone or internet access work. They don’t know what a hard drive is, they don’t know what encryption does, and their brain will explode if you try to explain what a MITM attack is. They just know that they had to return to the store last time they forgot their password so the geek with the “Apple Genius” T-shirt could reset it for them. So now it’s set to the kid’s birthdate. Because they don’t know how any of that stuff works, they have no choice but to trust the closest thing they have to an authority on the subject: their ISP, the guys who make their smartphone or their bank’s website, that salesperson at Best Buy who told them to install an antivirus.
Security is hard. Remembering passwords is complicated, picking good passwords is near impossible if you don’t have a tool to do it for you, and remembering those passwords is impossible. 2FA is a pain to set up even if ou know what you’re doing, and don’t even get me started on configuring “advanced” options (in which I bundle Fido2 / U2F for the foreseeable future). And recovery keys you’re supposed to print out and store in a safe, seriously?
Data is intangible. Contrary to a car theft or a house break-in, people struggle to assign a value to data loss or theft. Hell, I work in IT and I couldn’t begin to estimate the prejudice if someone were to gain access to my personal data. LoJacks and baby monitors help secure something that people can place a value on. What’s the value of my holiday pics?
Because of all this, security doesn’t sell. So companies have no incentive to invest in security, so security remains complicated and rare, so nobody gets to use good security and find out that it has a value, so security doesn’t sell.
I can’t even say that it will get better over time, as the young generations were raised to hand over control of their digital lives to corporate data harvesters.
Sorry for the bleakness of this post, but I’ve chosen to be jaded rather than depressed.