-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1 On 07/20/2015 05:53 PM, Stephen D. Williams wrote: > I hold multitudes. I am in one thread totally cypherpunk, and > have been for a very long time. There are innumerable ways to > compromise and be compromised for all kinds of good and mostly > bad reasons. Perfect protection is tough for in many ways and > we should keep striving to get closer to that ideal security > stance. > > On the other hand, life is a balance. I probably shouldn't > have tried to make the point here, but it is something a > security professional should understand well: The right amount > of security should be moderated by the tradeoff of costs vs. > overhead vs. maximizing benefit vs. minimizing loss. Security > stances change over time and aren't necessarily accurately > reflected by paranoid absolutism.
Right you are, in "security" context is everything. My take on the Cypherpunk Way is, start with design concepts for maximum security (!= absolute security), then trim the security constraints back just enough to permit useful work to be done on a cost effective basis. This is vs. industry standard security, where one starts with no security considerations at all, then adds just enough security to cover the largest perceived (!= actual) threats from potential adversaries. Compare UNIX style OS architecture to MS style. :) > An example along these lines that I like to keep in mind: (I > really did avoid writing down passwords anywhere for a long > time. And I still don't carry them with me. If I did, they > wouldn't be plaintext.) > > https://www.schneier.com/blog/archives/2005/06/write_down_your.htm l I'm > a big fan of password management, as a special case in the category of "A failed data backup may cost more than a successful break-in." Lots of luck getting "normal" users to make and use more than two weak passwords, though. :o/ Steve -----BEGIN PGP SIGNATURE----- Version: GnuPG v1 iQIcBAEBAgAGBQJVrYcCAAoJEDZ0Gg87KR0Ly3YP/iRBCK0a5DksVS2VAQm4dXr+ hCK5woYAsYA5nbaS8XUjQFOHJz6yRU4iMRf8K6AFWG1MkNDv6OLz6G5lGtl7LFIH iNnrqedH6Im2y0GZdKHCjNDL3TpHwE7pXKrMPs6LQrcOzEMmXADN6NaMBR3+ng9y pVk8BvGwX9O7f9aq5OxpTPpS2GH+Rz5YVxURNMF/XlygxEDi0E1YqOi8m6WQLlOl UmZlgc1jVlfTfxrgB1E4VcdDvvoe1rxmx40y/ztmv51y3d4c9riLTPoRuuJS0+TX 0Ha6x3rQOEgAHLQUpk92e+q6cTGa+UaEqxv/sYG9dZtjQyDsoC7DvsdPjnhYPoOC Cxbdy4jEpNlGJ4gDCKmvq91e2pB8HK9OP7QwFTyHcBbFlq8ObjUwK6gtqMGiibWF 48Pll65tqr6UhMc4Xa+Ma9Zk5jjl2EziVUbVnf0dsCC7oFcksP5Yvsdz4cnEKTN4 9t6syo4fNVfmdMc5BHzWH+i7mtiBc/fsvP+O3pYEJ3TcsH/qSyt/JMjaiw0JHNUz f0axAQAA223xeuBdjtQwR64qfwNlHAlKMekMwXgHCVAmsYm3jWwnW7BsLa16ISvz X/r7qYRj8ikZrYCny676JUEOYQ7etzdfYbphWy2vBOfw/C+ZseIHG5JvTVBklhzL uwaJ+pffatAm/eAZu5Xz =+kaz -----END PGP SIGNATURE-----
