6

In addition to the fact that encryption systems like PGP are notoriously difficult to use, and that encryption doesn't always jive with cloud-based services like webmail, the fact is that most people don't believe that they have secrets that they want to keep from others, or from the government, which would make encryption necessary. How would you explain to a person who is not into security & encryption "for its own sake" (and who isn't totally paranoid) why they would want to have encryption & digital signing in their toolkit of things they can do with their computer?

Improve this question
1
  • Encryption helps you maintain privacy. What privacy you need is a personal choice. I think there's an interesting follow-up question here "How much privacy does an everyday person need" - although it's likely to be closed as "opinion based" (as with many other interesting questions - grrrr)
    – paj28
    Nov 19, 2014 at 11:43

7 Answers 7

Reset to default
3

I think the others covered signing already pretty well, so I'll present my thoughts on encryption.

Possible Reasons for encryption for everyday people

They would (or should) want it because pretty much nobody has nothing to hide. It doesn't have to be anything illegal. If people really think about it, they can come up with an embarrassing secret they do not want just anybody to know about (sex?, drugs?, health? money? discussing my little pony fanfic?). Encryption also might help reduce the effects of stalking.

Or because even innocent mails might sound different to other people (wife/husband, intelligent agency, police, etc), especially if not the whole context is given (for example a quick follow-up to an in-person discussion). Encryption might be easier than trying to put the information in context afterwards.

If they are politically motivated, they might also encrypt to raise the percentage of encrypted mail. If only people who do something illegal (or cheat, etc) encrypt, encryption attracts attention. But if enough innocent mail is encrypted as well, this assumption happens less.

They might also do it because they have to (requirement of their recipient, job requirement, etc).

For most people, these are not good enough reasons, so even if encryption was a lot easier, not a lot of people would do it (except maybe if it was the default in all mail programs, etc).

See also here for examples of sensitive information which should be encrypted and might convince some people.

Who might read their mail

I think everyday people (people who are not "totally paranoid") need to be aware of who might read their mail. It doesn't have to be the government (most everyday people would handwave this away - either as conspiracy theory or something we cannot prevent anyways). But maybe their nosy parents, siblings, roommates, partner, guest, etc. who go to their computer and see that they were not logged out of gmail. Or the creepy neighbor attacking the w-lan hoping to find naught pictures in mail-attachments. Or a criminal hoping for credit card informations. I think if they think about the who more than the what, people might be easier persuaded.

Also, I think one of the main hurdles is that even if people do decide that they want to encrypt, they need to convince all of their recipients to set up encryption themselves. And if they are only a little convinced that they need encryption, it will be extremely hard for them to convince others.

Improve this answer
2
  • Do you want your bank details stolen and all the money in your account removed? No? You need encryption.
  • Do you want anyone to alter your emails so they say something rude/incriminatory/racist? No? You need encryption.
  • Do you want people to use your network or PC to download or store illegal materials? No? You need encryption.
  • Do you want crooks to hijack your connection to Amazon and use your account to buy porn? No? You need encryption.

Sure, there are a lot of other controls, but encryption is used every day to help protect you. Generally https is the one most non-technical folks will recognise, but you should also be aware of encrypted file stores, databases etc.

Improve this answer
2
  • In all honesty, #2 is much easier by just sending an email with a faked From: header. 99.9% of people won't even notice. SPF and friends work to partially mitigate this, but far from every recieving server acts on those.
    – user
    Nov 19, 2014 at 12:17
  • 2-4 don't need encryption only authentication. That's a politically important difference because proposals to ban or restrict encryption practically always exempt authentication; certainly in the US EES/Clipper did, leading to Rivest's publication of chaffing-and-winnowing. (To be clear, I support encryption; it's just that this argument for it fails.)
    – dave_thompson_085
    Jun 9, 2020 at 4:49
1

Even a simple user doesn't think that he needs encryption , but he actually does because sometimes and i say "sometime" , those simple messages can show the psychology of a person which can leads to exploiting them in anyway you want . also as stated above encryption validates the identity of the person you're talking to .

Improve this answer
1

You need encryption if you don't want your sexts and other "naughty" messages becoming water cooler topics at the NSA's HQ.

Not a very detailed answer, but in my opinion that's the most important problem for someone that has nothing to hide (about the other risks mentioned in the other answers - how many times did your neighbor attack your WLAN and tried to spy on you ? Probably zero. How many times an attacker tried to look at your mail for personal information ? You don't know but probably not many. How many of your texts the NSA read ? Maybe all of them).

Improve this answer
1

There's two things encryption does:

  • it makes interception of communications harder.

Text sent in the clear is trivially easy to 'pick up' by anyone on the communication path you're using. If you 'have nothing to hide' then this may seem irrelevant, but bear in mind that there are plenty of unscrupulous types out there who are prepared to use personal information for fraudulent purposes.

The necessity for this should be more obvious when talking about e.g. usernames and passwords for online banking, or email accounts.

  • increases the likelihood that you're talking to who you think you are.

Some modes of encryption use public-private key pairs, or stronger verification mechanisms. SSL when talking to a website probably has a certificate that's signed by a certificate authority.

When using ssh, the first time you save a 'host fingerprint' for the remote host - the second time, if that host fingerprint has changed, it will warn you that you're talking to a different server.

Now these aren't perfect security measures, but are quite low impact to implement, and provide mitigation against a low level of risk. Just because a determined thief can kick your back door in, doesn't mean you leave it unlocked, right?

Improve this answer
0

I think everyone should run their own mail servers (non-locally, of course). However, barring that (and the security risks from faulty software), it's just a good idea to have all information that is on a stranger/untrusted party's computer be encrypted. That information is stored for a long time (with gmail, forever), so 10+ years in the future, things may be different, someone you really don't trust may get a hold of that information. That private information could end up being public information.

I don't think PGP is really difficult, I just think it's explained poorly. It's worth learning. Once you figure it out, it's pretty simple. Although manually encrypting everything you send and having the receiver manually decrypt it is a bit of a pain and no one wants to do that.

Improve this answer
0

When average internet users waive off the fact that multiple three letter agency's can view their data, they do so most of the time (in my experience) because they feel as though they have nothing to hide or anonymize, while forgetting one of the most important factors to take into mass surveillance and that being that the people who run these data collection programs are just that; people. So who's to say that someone with access such as Edward Snowden had wouldn't break a few rules or steal someone's information for their own personal gain, whether that be collecting vital personal information that they can later use for whatever reason or stealing credit card, bank or S.S. information. You're supposed to be able to trust your government but as everyone knows, that's not always the smartest thing to do.

Improve this answer
5
  • I would say that you can trust the government. If a government employed person would siphon off bank accounts without reason, it would be noticable in logs. And people with such high accesses as NSA, could very simple use the natural methods of confiscating Money, eg by making a request to the bank to confiscate Money. So why would NSA steal a creadit card number or bank account login, and empty the bank account that way, when they just can write a letter to the bank demanding the Money to be inserted at account X?
    – sebastian nielsen
    Dec 24, 2014 at 5:01
  • I don't know about you, but given such a high level of access, I could imagine 60 different ways to obtain that information without leaving any logs or traces that would suggest any information was copied or stolen. There is no forensic analysis that would be able to detect memorization, or other methods of storing information for later use. And to answer your question as to why someone at a three letter agency would need to steal someone's information, the answer is because doing things like sending subpoenas etc to banks without their supervisors permission is more likely to be noticed.
    – CPagan
    Dec 25, 2014 at 2:45
  • I don't in anyway blame you for having trust in your government, I wish it was something we could all do, but in todays world, they're a part of my threat model, and shall remain there unless things change.
    – CPagan
    Dec 25, 2014 at 2:52
  • What I mean is that if someone is going to steal, he is not going to victimize a single person, rather multiple. And then correlational logs can then be used to find such incidents. Lets say 20 different people report a fraudulent charge at online shop X. The bank check online shop X, and a IP Points to NSA. Then you backtrack the logs of whoever had access to the details of these customers, and find the employee that is untrustworthy. Then a untrustworthy person rather do a subpoena, since they are part of normal operation, and theres not possible to protest a subpoena (atleast not in sweden)
    – sebastian nielsen
    Dec 25, 2014 at 3:18
  • Do you really think the NSA use's IP address that could be pinpointed to them? And for the sake of argument if they did, don't you think they would at least use their own vpn services and proxies, Of course cross checking for patterns like that would work, but only if the attacker targeted similar groups of people, obfuscating his attacks would circumvent this type of countermeasure.
    – CPagan
    Dec 25, 2014 at 4:26

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .