Hacker News Reader

Comment by highwaylights | Hacker News Reader

Reading the linked article is hard going.

“Imagine if you gave up on the Internet in 2000”. This again.

This is how distorted people’s perceptions become when they live their whole life in echo chambers.

Leaving the obvious aside, It genuinely seems like a lot of those still pushing this are utterly unaware of the harms their whole mess has caused.

Also, they’ve made it way harder to teach non-techies how to stay safe online in the future by co-opting the term “crypto”. They immediately think any use of the term crypto is related to this stuff. Your Digital ponzi scam != cryptography.

The worst part is how the public now thinks if you’re involved in software you must be a massive believer in cc/NFTs because they keep hearing about it so all techies must think it’s awesome, right!?

It’s exhausting.

View on HN

I agree with your general point, but suggesting non-techies should learn about cryptography in order to stay safe online is pretty ridiculous; if people need an understanding of cryto to be safe we might as well switch the Internet off.

If it were up to me every person with access to a computer where other people's personal or financial data is handled should be required to get a security certification stating they have a basic understanding of digital signatures, certificates, HTTPS, encryption and how to protect against common threats (phishing, social engineering). If people can't do that they might as well go back to typewriters and FAX machines.

In banks (and similarly regulated institutions) there's mandatory security training to educate employees. Sadly, in my experience, this "training" is essentially like those kids rides at an amusement park where you're stuck in a trolly till the end – it's slow and mostly tedious but sometimes there's one bit of trivia that might delight. In the end, there's a very simple multiple choice test that is worded to make it more or less obvious what the correct answers are. If you do get it wrong you get infinite retries and there are only so many questions...

I'd love to see mandatory education in basic cryptography and such, but in reality I'd assume that even that would end up being security theater for the sake of ticking a box on the compliance score sheet.

This sounds like the OSHA 10 class I recently had to do. I think the issue here is that if a business wants workers it is incentivized to make the tests as easy as possible, not to make sure their employees know what they’re doing.

Agreed. On top of that, everyone who owns a car should be required to learn how to change their serpentine belts, oil, replace spark plugs, and alternator. They should be required to sign a paper saying they will change their tires with a spare on the side of the road and carry a jump starter with them at all times. The roads would be a safer place if people knew what was going on inside their cars and how to operate them.

Definitely. And also consider whether you are in agreement with the 1500 hours of training required to be a barber: https://www.barber-license.com/rhode-island/

Learning to use cryptography is not at all ridiculous. Understanding that HTTPS provides a level of scrambling to traffic is totally reasonable.

I don't think GP was talking about learning modulo arithmetic and prime factorisation.

I rather think you'd generalise https as "secure", and http as "not".

No mention of crypto required.

secure from what, though

And that's how you get people that think that every website starting with "https" is secure and legit, even though it's trivial for malicious sites to use TLS.

Fundamental cryptographic primitives (encryption, signatures,...) don't require any advanced math to understand if you don't go into the concrete instantiations. The technical community should really try to better teach these concepts to the general public as we move further into the digital age.

I sort of agree but also sorta irrelevant?

The important point is that TLS is referred to as crypto in some cases, and I believe that's what the GGP was referring to. Were I writing an expository piece, sure, I might use different language, but that's not really what my reply was about.

Surely someone who is talking about TLS knows enough about IT to understand the context of crypto is different than cryptocurrency?

I think people need to understand what's protected. Something like "https guarantees that your are connected to the website displayed in the address bar and that no one can see the content of the communication"

It's important because for example it makes it clearer why they should still check the url in the address bar (and not get phished) or that the communication with the website itself is not hidden (only the content is), etc.

> website displayed in the address bar

I would probably start there and work your way up to https :(

"What makes it secure" is a common (and reasonable) question from anybody curiously minded.

The answer is symmetric cryptography, and you can give a layman example of what that is. But the key word is cryptography.

>No mention of crypto required.

what do you think you're teaching, then? Just general good practices?

A teen can be told and taught to wear a condom without explanation of the virology and biology behind the things that it helps to avoid -- similarly Grandma can learn the importance behind https without memorizing the cypher suites; it's still an aspect of cryptography.

This is exactly what I was getting at, thanks.

To give another example where this comes up: keeping backups of your data is prudent. Encrypting those backups is a good idea in a lot of cases to protect your data in case of device theft. While most modern systems make this as simple as possible for the casual user it still helps the user to have a basic understanding of what’s actually going on and the implications.

> I agree with your general point, but suggesting non-techies should learn about cryptography in order to stay safe online is pretty ridiculous

I think it's about understanding concepts and uses, not the inner workings. As an example, Glenn Greenwald (despite being a reporter handling sensitive topics) didn't know how to use encryption when he was contacted by Snowden, and learned it later. [1]

I think it would be very useful if the general public could use encryption to the same level they drive cars.

[1]: https://theintercept.com/2014/10/28/smuggling-snowden-secret...

If you're in the cryptography business I'd just refer to it as digital security. ( Or cybersecurity if you prefer ).

It's the same concept but without the baggage of "crypto".

Yes but

Why should I change? They’re the ones who suck.

Come on, I'm sure that before bitcoin was invented, no one used the term "crypto" to refer to "cryptography"; doing that would be more cringy than this article itself.

Literally everyone did

https://en.wikipedia.org/wiki/Crypto_(book) is from 2001 and it may give you a good indication of what the term crypto was referring to back then.

> I'm sure

And yet you are wrong :)

yp.to - D. J. Bernstein's[1] domain registered in 1997 preceeds Bitcoin[2] by 12 years.

[1] https://cr.yp.to/

[2] https://bitcoin.org/bitcoin.pdf

Here's OpenSSL calling cryptography crypto in 1998: https://github.com/openssl/openssl/commits/master?after=9313...

And libgcrypt in 2000: https://github.com/gpg/libgcrypt/commit/bf2fc9201cfa96cd70ef...

Totally normal and not cringy at all.

Edit: And on Usenet in 1982: https://www.usenetarchives.com/view.php?id=net.misc&mid=dGVr...

Someone on the Internet is very wrong today.

Alright, touche.

As someone who was a developer well before Bitcoin was invented, yes, we did.

Here's a conference from 1981 put on by the IEEE:

https://www.iacr.org/archive/crypto81/1_front_matter.pdf

> I'm sure that before bitcoin was invented, no one used the term "crypto" to refer to "cryptography"

I have to assume this is sarcasm, right?

That's literally what "crypto" has always meant for decades, cryptography.

The Crypto conference started in 1981 for instance.

https://www.iacr.org/meetings/crypto/

Well yeah, there was a time when the title song for the Flintstones could contain the verse "we'll have a gay old time" without anyone questioning Fred and Barney's sexual orientation. Those times are gone too...

i still use the old meaning of gay. It has such a wonderful meaning

You could say the old meaning of gay is quite...gay

All I can do is upvote this but I kind of want it printed on a hoodie or something as well.

How about encryption? It's called e2ee after all.

They're different though. Encryption is just one application of cryptography.

yeah, the vocabulary used in public discussed has done a weird shift to accommodate the takeovers of various marketing departments.

What used to be "crypto" is now "cyber".

What used to be "cyber" is now "metaverse".

Cybersecurity is also much more accurate description of the skills/work required to stay safe online.

Most computers are not compromised because of flaws in cryptography or the application thereof, they are compromised because of operational security (opening suspicious email attachments, reusing passwords, running systems with default admin passwords, etc). These things have little to do with cryptography and are much better understood as "cybersecurity".

> The worst part is how the public now thinks if you’re involved in software you must be a massive believer in cc/NFTs because they keep hearing about it so all techies must think it’s awesome, right!?

This used to be the case about a year ago, now I see the trend shifting towards AI.

Interestingly, some local "crypto" conference just rebranded as "future tech". Seems like "crypto" became a red flag deterring customers.

Oooh, maybe those of us involved with cryptography will get the term back? I'd love that.

the subreddit for "buttcoin" does a pretty good job lampooning cryptocurrency true believers.

https://www.reddit.com/r/Buttcoin/

Nah, they go too far in hating it beyond the bounds of actual reality. I hate cryptocurrency as much as the next guy, but I got banned from that sub for pointing out that credit card transactions don't actually settle instantly and chargebacks exist.

Every tech friend I know is deeply cynical about NFTs and pretty much everything else now because anything that happens is immediately turned into some sort of grift by ravenous capitalists.

Most of all my tech friends are skeptical about most things we encounter in life. We're just naturally curious and ask questions to learn more. Asking questions about NFTs and the benefits of cryptocurrencies has led to a consensus of it being mostly pointless in the case of NFTs or a way to skirt around regulations in the case of cryptocurrencies.

The people I've found that have embraced NFTs and altcoins are the ones that are much more focused on business and making money rather than the tech under it all.

> has led to a consensus

Do you have a source or some proof for this statement?

I meant among many of my friends, so it's all anecdotal.

Sorry but HN is just too biased against anything blockchain-related.

There are tons of reasons to use Web3. You typically do so when you want a community to manage some value without trusting a middleman. Here are a lot of examples: https://intercoin.org/applications

I don't find most of those persuasive, and the couple that would actually benefit from the blockchain are niche applications that most people would never use.

Reply on news.ycombinator.com