cross pond high tech

Society doesn't work without trust

Human being is the only species with trust. We trust hundreds of strangers without even thinking about it.

 

How do we enable trust?

 

How does security enable trust. How do we induce trust?

• Trusting friends is about who they are as persons.
• Trusting strangers is about their actions

 

Trust: confidence, consistence, compliancy. It's about cooperation.

• We trust people, companies and systems
• We trust systems to produce expected behaviors

 

All complex ecosystems require cooperation. In any cooperative system, there is a way to subvert the system for personal interests.

 

These are called defectors in game theory. They are parasites. They can survive if they are contained. If too many parasites the body dies and the parasites die too.

 

Society doesn't work if everybody steals. Security can be defined as a tax on the honests.

 

Social species: individual competition plus group competition.

 

Security is to keep defection level at an acceptable minimum that is not zero.

 

NSA defector Edward Snowden raises moral debates but the point is that he is a defector. How group enforce the norm. Even mafia groups.

It is about societal pressure.

 

4 types of societal pressure

 

1. moral: we don't steal because we know stealing is wrong.
2. reputation: also in our heads but link to other's reactions. Humans are the only species to transmit reputation.
   Experiment: coffee machine + honesty box. Putting a photograph of a pair of eyes in the box bottom decreased the cheat rate dramatically
3. laws: formalizing reputation, and focusing only on penalties (because of the cost implied by rewarding the majority of honest people). With exceptions in the shape of tax breaks
4. technology: security systems. Door locks, alarms, ... Some of them extending globally. ATM cards are protected globally.

 

Example: eBay feedback mechanism is a reputational security system that worked remarkably for years as the main security system.

 

How does technology affects us?

Technology is what allows society to scale. It is neutral.

Filesharing: social pressure vs technology

Attackers have a first mover advantage and are more adaptive.

 

Mid 90's Internet going commercial: hackers used it immediately while it took 10 years to the police to figure out how to address it

Such delay is the main security gap

 

Our society is at a point where technology is faster than social changes which means that the security gap widens.

Before: buy this and you'll be safe

Now: when you've been attacked, please talk to us and we'll help

 

It's the antivirus history

Smart paradigm: detect unknown viruses including false positives

Stupid paradigm: check for signatures and update once or twice a day

 

The stupid paradigm seems to have won.

 

So technology will always favor defectors? True, but large organizations can now use technology in a much more effective manner.

Our society has the most technology and the largest institutions.

 

The battle is amplifying between agile defectors and slower yet more effective institutions. Losers are those of us in the middle.

 

To him it is not even clear how there is a balance nor how it will evolve.

 

As a conclusion

 

1. there will always be defectors
2. ourselves are not 100% cooperative, we all defect some time in a way
3. law of diminishing returns
4. there are good and bad defectors and history decided afterwards. That will be the case for Edward Snowden
5. society need defectors. This is how we evolve. Defectors are at the forefront of social change: freeing the slaves, giving women voting rights

 

All six major browser vendors have plans to support DNS-over-HTTPS (or DoH), a protocol that encrypts DNS traffic and helps improve a user's privacy on the web.

The DoH protocol has been one of the year's hot topics. It's a protocol that, when deployed inside a browser, it allows the browser to hide DNS requests and responses inside regular-looking HTTPS traffic.

Doing this makes a user's DNS traffic invisible to third-party network observers, such as ISPs. But while users love DoH and have deemed it a privacy boon, ISPs, networking operators, and cyber-security vendors hate it.

A UK ISP called Mozilla an "internet villain" for its plans to roll out DoH, and a Comcast-backed lobby group has been caught preparing a misleading document about DoH that they were planning to present to US lawmakers in the hopes of preventing DoH's broader rollout.

However, this may be a little too late. ZDNet has spent the week reaching out to major web browser providers to gauge their future plans regarding DoH, and all vendors plan to ship it, in one form or another.

In which languages are internet passwords easiest to crack?

DESPITE entreaties not to, many people choose rather predictable passwords to protect themselves online. "12345"; "password"; and the like are easy to remember but also easy for attackers to guess, especially with programs that automate the process using lists ("dictionaries") of common choices. Cambridge University computer scientist Joseph Bonneau has recently published an analysis of the passwords chosen by almost 70m (anonymised) Yahoo! users. One interesting result is shown below. The chart shows what percentage of accounts could be cracked after 1,000 attempts using such a dictionary. Amateur linguists can have fun speculating on why the Chinese do so well and the Indonesians do not. But one particularly interesting twist is how little difference using language-specific dictionaries makes. It is possible to crack roughly 4% of Chinese accounts using a Chinese dictionary; using a generic dictionary containing the most common terms from many languages, that figure drops only slightly, to 2.9%. Speakers of every language, it seems, have fairly similar preferences.