All Security
Hinges on the arrival
Of people with guns All Security
Hinges on the arrival
Of people with guns All security
is merely a fantasy
of mortal people.every comment that has little bit content of security/cryptography/secure/blockchain/CIA etc always mention this particular entry
If they want our information, they should have to become literal tyrants, send armed men after us and violate human rights in order to get it. Not push a button on a computer to tap into their warrantless global dragnet surveilance networks and suddenly have our entire private lives revealed to them on a computer screen.
Yes, people will fold if they are kidnapped and tortured. That's not news. Forcing them to stoop to that is the entire design. Once the situation has escalated to that level, you are justified in killing them in self-defense. Torturers don't make a habit of allowing their victims to live and testify about it.
Don't make me link 1053 ;)
One would be that people are the weak point in your security system. If all your organizational security hinges on one guy not folding, that guy is the natural target. Whether a literal 5$ wrench is used or they bribe him makes no difference.
That means you could consider shaping your org in a way that is resistent against this by e.g. decentralizing secrets. That means instead of bringing a "5$ wrench" to one person (which may even work without raising suspicion), you now need to convince multiple people at once which is much more unlikely to work without being detected.
The only defence is to not have the secret at all.
As for secrets, you sometimes need to have them for very good reasons. If you can reach the same goals without a secret while having the same protection going without a secret is a good choice.
But let's assume if you want the cryptographic protections of confidentiality (through encryption), authenticity (through signatures) and integrity (also through signatures or hashes) chances are someone somewhere has to store a secret. If that someone isn't you it is someone else (or something else).
But if you want to protect data with encryption and you should be the only one who can decrypt it I don't really know how you would do it without any form of secret.