In IT Security and computer power users there seems to be an excessive amount of distrust. They don't do anything or use anything because of this distrust, or use what seems like an excessive amount of protection.
Note: I am writing this from the point of view of a person living in the US. The following assumptions obviously wouldn't make sense in some oppressive governments
- Distrust of X because of MITM or general interception - Exactly how often does a MITM happen? It seems that every time I hear "Encryption, Encryption, Encryption!" its coming from a person who expects that there's a MITM attack happening everywhere; at this very moment there's a person sitting outside of their house with a wire hooked up somewhere eagerly looking at Wireshark. Lets be serious, this doesn't happen often (eg 90% of the population)
- Distrust of Service X or Program Y because you haven't verified its source - I've seen this before with everything from http://lastpass.com and http://random.org to http://gmail.com. This I think is crazy because you looking at the code does NOT guarantee that its clean. All it takes is one innocent looking line to do damage. And your supposed to find this line in 5,000, 10,000, 20,000 lines of code? Be serious, your most likely not going to find it and therefor going to be using it with a false sense of security which is arguably worse than using it with a bit of distrust.
- Distrust of public, shared, or friends network because of risk of snooping - This I have to argue with because most people don't have a packet logger or other ways of interception traffic. I'm sure 99% of networks out there just don't care about these kinds of things; they're more worried about routing and firewalling.
- Distrust of protocol X because it sends password in the clear - This is what really made me ask this question: People kept blaming FTP sending passwords in the clear as to how the account got compromised. While in that situation it made sense, it seems this excuse is thrown out every time there's a compromise when something else is really the issue (eg password is on a sticky note on the monitor). This goes back to earlier, rarely (if at all) is there a packet sniffer or other forms of snooping on your network, your isp's network, your isp's isp's network, etc.
- Distrust of anything because "How do you know its not compromised?" - How do you know there isn't a Nuclear Bomb under your house? What, going to dig up everything just to be sure? How do you know you won't get mugged on the way to work? Going to have a personal bodyguard? Also, how many times does this happen? Is there a nuclear bomb found under someone's house every day? Do you get mugged when crossing the street? Essentially I'm saying that while you don't know, you don't know a lot already and even thin, the risk of it happening is slim.
Is distrust of everything in these cases and others really necessary? Is the level of paranoia warranted? And why would people act this way?