Hacker News Reader

Comment by crazygringo | Hacker News Reader

I can sympathize with the general notion that more encryption is better, even if I wouldn't go to the extreme of declaring it a duty. But the author just completely lost me at:

> We should all use PGP, SSL or equivalent tools; VPNs, Tor and/or SSH tunnelling; IPFS, or other distributed file systems — and ditch proprietary OS's in favour of Linux or truly free Android distros... Those tools and techniques should cease to be arcane nice-to-haves for nerds: we must get more non-technical people onboard.

This is so unrealistic and impractical as a moral "duty" for "all", it undercuts my ability to take the rest of the piece seriously. It's not any kind of seriously considered ethical analysis, weighing the pros and cons of what's actually best or most effective in the real world -- it's a pipe dream.

View on HN

"Those tools and techniques should cease to be arcane nice-to-haves for nerds: we must get more non-technical people onboard" is key here, I would say.

If those tools cease to require arcance incantations and work seamlessly like every other thing everyone else is already using, then I don't think it's unrealistic at all.

It's only impractical if you actually require end users to understand and apply all of these technologies. It's a lot more tractable if they're abstracted away.

The fact is that developers very (very) rarely have to interface directly with TLS or the Signal protocol, yet billions of non-technical users implicitly use them in our browsers and via Signal or WhatsApp.

In my view, the challenge in the adoption of secure/private-by-design tech is the simplicity and usability of the interfaces and the capabilities these tools provide.

We need secure tools to compete on capability in order to garner mass usage. Without (significant) feature superiority there's little reason for users to make the switch. I'm actively trying to solve some of these problems at Backbone [0]; aiming to build a usable, secure experience for end users and a simple, robust end-to-end-encryption interface for developers.

[0] https://backbone.dev/

> Without (significant) feature superiority

Problem is – if you can't trust any server, end-to-end encryption naturally often leads to feature inferiority in the context of multi-device usage.

The fact that it's unrealistic doesn't mean that we shouldn't try to achieve it. And the first step towards achieving something big is to state it as a goal when it's still unrealistic.

At some point, going to the moon was unrealistic. Right now, ending wars is unrealistic, but it's also absolutely necessary.

If you instantly switched over the average person and took away their Windows/Mac, they would be lost and would constantly get bit by the cons of those technologies. Ever had to teach someone something simple in Excel? Imagine how teaching them SSH would go.

However, that doesn't mean it can't be a gradual process that takes years or generations even.

I feel like the "all" in this passage is everyone who is capable, not the population in general. The population in general is the second phase, but they need a beachhead to be established to help them. First the capable group needs to stop hiding behind the excuse that the incapable group can't do what they can but won't.

> it undercuts my ability to take the rest of the piece seriously at all.

This lack of ability to be able to control your emotions undercuts my ability to take the rest of the comment seriously at all. It's not any kind of seriously considered rational comment, weighing the pros and cons of the thoughts presented -- it's bad commentary.

Living in a pipe dream where you think people want to be educated about maximizing their freedom, at the expense of their time or convenience, is delusional. That's why the rest of the piece is basically irrelevant, if it only works when everyone or the majority follow through with this plan.

What's unrealistic about it? I've been doing it for more then a decade.

What's unrealistic about it? "We should all."

You have an extremely generous and optimistic view of the cognitive capital of the average person.

That's probably the most self-aggrandizing interpretation. Could it be that other people have other priorities or interests rather than spending their time figuring out how to obtain digital privacy without compromising in the areas they care about? No surely it's their low "cognitive capital" /s

You are very fortunate to never had the displeasure of having to interact with profoundly stupid people. Not ignorant, not uneducated, but genuinely stupid and slow people.

E.g., People for whom significant, immediate, unexpected mechanical feedback in operating something simple, like window blinds, wouldn't cause them to consider whether they might be doing something wrong, and instead continue operariting the blinds in the wrong direction until they snap and break, genuinely being unaware that they were doing it wrong.

People who are genuinely lacking the common sense you'd expect a human to have, not even with any cognitive disability or learning disorder of any kind - just genuinely stupid but otherwise ordinary people.

What are you talking about? How does this relate to anything in the discussion? Besides, you were denigrating the intelligence of the average person, as though that's the reason they don't acquire all the skills necessary to have digital privacy.

Ironically, that's a stupid assumption to have. You might be in your own bubble, but I know many very intelligent people who do not have the time or interest in gaining digital privacy. It's not as easy or without compromise as you seem to think.

I'm so sick and tired of techies infantilizing the rest of the population. It started with making apps "accessible" but the result is that they've dumbed down an entire generation by limiting them to their locked down mobile phones. Now everything supposedly should be accessible to everyone without them having to invest a second of thought, so much so that this now has somehow become the norm.

People who care will figure it out, and those who don't will be left behind.

But no, thats not acceptable because you have to gouge everyone to make as much money as possible nowadays.

The mobile phone is the only secure computer a non-techie owns.

At the low, low cost of the entirety of their privacy in their digital life.

Quite a few people could do what the article asks if sufficiently motivated. How do you propose to motivate them?

I often have trouble convincing people to install Signal, which requires about two minutes for people who barely know how to use their smartphones and under one for people who know where the app store is. If a majority people don't have the motivation to do that much, we have a very uphill battle.

Most of the population are not tech involved people, they like and use the entertaining/communication related features of the device. Making things extremely easy is what tech is all about.

People who care will figure it out, and those who don't will be left behind. Is that not the case for most of history? Atleast apps as you say are accessible to everyone without them having to invest a second thought.

Why should the average joe have to consider a second thought? If my Dad wants to watch his favourite TV show, he should be able to do that in the most accessible way possible.

Perhaps Microsoft shouldn't have built a GUI and should've kept the CMD line around so that we would've all had to learn to "do it the hard way" and wouldn't have been infantilizing us with buttons, graphics, file explorers, hyperlinks and applications.

Could your technophobic family handle it? You grandmother? That weird uncle that decries anything digital but has the latest iPhone with all the default config in place?

And do you think all of your non-tech-savvy relative would go for it?

They already use https for almost everything, don't they? It wasn't the case from the beginning.

The impact of using https versus http is miniscule compared to the impact of using Tor versus not.

Yes, I agree that everyone should have access to those technologies by default. I also think that the implementation for the layperson will make the projects almost unrecognizable.

I disagree; the impact of https is huge: your page cannot be hijacked by an intermediate party (e.g. your Internet provider). Nobody can insert malicious javascript into the page or modify its contents for a social engineering attack. You can be sure that your personal data cannot be intercepted by a third party, and so on.

I don't see it as unrealistic, as for your comprehension ability, that's debatable. For this to work on everything, it needs to be hardware implemented (security chip/SOC), to avoid taxing the CPU and rest of the system. Software engineering has been lax for so long, but paradigm is changing and it should be security first.

It's not unrealistic in technological but sociological terms.

That's not unrealistic then, it's just a lack of will.

No, it's simply unrealistic. Effort is besides the point.

Mostly not a lack of will but much more local and urgent priorities than figuring out SSH and PGP, like jobs and chores for example.

As I said in another comment, it's not about everyone installing ssh and pgp and configuring them and learning how to use them, it's about us in the tech community to provide tools so easy to use you don't even know you're using state-of-the-art privacy tools. Like what Signal has done, and now it is expected that any messenger at least positions themselves on the end-to-end-encryption. Or like what Deltachat is doing with automatically configuring PGP such that users don't ever need to read those 3 dreaded letters.

Been there, done that. It's already hard to scale those two apps beyond your immediate circles and people won't just stop using WhatsApp or Viber or whatnot. But then try to convince your friends that they have to convince their friends. Friendships are not a pyramid scheme.

Yes, most of these tools are a pain in the ass to use, so people can't be bothered.

The only universally used tech on this list is SSL, because end users don't need to "install SSL and learn to use it" - we had to put in the work to upgrade or shitty servers, and they get the benefits.

Time had proven that the "don't you care about your privacy" argument doesn't work, so it's up to us to make the privacy-respecting tools better than the alternatives

That's exactly my point. I'm not deluded to the point I expect people to read up and install all these tools; it's our job to make these tools so ubiquitous that it doesn't take any effort to effectively use them.

Expect people to install those tools in unrealistic. But companies can implement all the features in the end product (web browser, email client, IM client etc.).

Extremely generous take on human intelligence.

If you're of above average intelligence, remember that you're likely biased to assume the average person is more intelligent than they actually are.

As I said in another comment, I'm not expecting everyone to actually learn and install those tools, I want all the people who can use them and modify them build on top and provide tools that spread the use of these technologies. I don't expect everyone to configure tor hidden services, but if we can make it so that most traffic goes through tor, because the clients and the servers use it by default, then that will be a nice step. The Tor Browser makes using tor way simpler, if that could be used and advertised as a default browser, that would be great.

To me, the sociological aspect is in the way we act together as a society, helping others do what we think is good, providing support. Not simply how one is expected to somehow learn and do everything out of nowhere.

I like the concept, but I think the problem here is that governments have the means and resources to go after folks building and distributing browsers, apps, etc.

The decentralized nature of the technologies mentioned contributes substantially to their resilience. Re-centralizing them opens new avenues of attack and new targets to silence and corrupt for the state.

He said unrealistic, not impossible.

For human-related endeavors, motivation of the stakeholders is the key part that determines whether something is realistic or not.

All kinds of technical difficulties can be fixed with effort and talent of a few people, but if something requires will of the masses and there's a lack of will, that thing is simply not going to happen no matter what you do - because there's no "just" with respect to lack of will, that's lack of something necessary that you can't easily create.

See my other replies: it's not about the will of the masses, it's about our collective will of us, the tech people, to build the tools that make using these technologies ubiquitous. We've been fixated on our own problems ("what is the best framework for building a blog ?") instead of acting with everyone else to build what we collectively want. It's our responsibility to be of use to the society, not just to us.

IMHO in this respect we already have built 'what we collectively want', however, the limiting factor is a lack of will to use or prefer privacy-preserving solutions. The society has voted with its attention and wallets, and it doesn't want what the tech people think is good for society. You can't build a technical solution to a social problem - well, you can, but it won't get used and so it won't solve anything.

"as for your comprehension ability, that's debatable"

This comes across as rude, especially in response to someone that did not themselves say anything warranting a rude response. You can disagree and make your point without doing this. I'm pointing it out because you genuinely may not be aware and I want to give the benefit of doubt (something I myself too often do not do online).

Thank you for your concern, it was purposefully rude.

Reply on news.ycombinator.com