In the real (physical) world, we seem to feel secure with just enough security, e.g.:

  • Our door lock isn't the most secure. Anyone can lock-pick / break with force.
  • Our car isn't the most robust. Anyone could die in road accident.
  • In some countries, anyone can have gun.

Yet people feel safe.

We knew very well that security is not binary. Happily trading off for ease of use, freedom, etc. Yet in the digital world, I sense the tendency to go toward 'security is binary', i.e. either fully secure algorithmically, or not even trying. Some cases:

My question is thus: Why in digital world we have tendency towards fully secure or nothing at all, while that's not the case in real world ?

  • 3
    Your statements about both the physical and virtual worlds seem incorrect to me. – Neil Smithline Mar 4 '16 at 4:42
  • 2
    "Yet people feel safe" is both a broad and wildly inaccurate statement. Also, security in the digital world is not seen as binary by security experts. The reason why we want to push for high standards of security is because there is little cost to do so, only the will to do it. – schroeder Mar 4 '16 at 5:24

The digital world offers many things that don't apply in the physical world in most cases which make it more likely that a criminal will both (a) target you and (b) succeed:

  • A high degree of anonymity
  • Difficulty of law enforcement to catch you
  • Ambiguity of the law surrounding your actions
  • Nearly unlimited ability to try, with very little chance of being "caught in the act"
  • Very few repercussions even if you are caught (how often do you see foreign hackers, whom we have caught, get extradited to face a trial?)
  • The ability to commit the crime from a remote location
  • The ability to commit the crime without the victim being aware, for example by making a copy of a hacked database but leaving everything intact, so that nobody will know until you're ready to steal as much information or money as you like
  • Large number of easy targets, all within reach (since you can attack from anywhere at any time)
  • Economics of scale (it's just as easy to hack 10,000 accounts as it is to hack 1 account; it's a lot harder to break into 10,000 houses than it is to break into 1 house)
  • Ease of entry/availability of tools to get started with crime. I don't think there is a "script kiddie" equivalent for traditional bank robbery. But just about anybody could download tools to steal money from an online bank site using poor security practices.
  • etc.

Also, I'm not sure if you've fully considered your metaphors between digital and physical worlds.

It's easy enough to break/pick a standard house lock. But would you be happy if the only protection your bank had, or the money in your 401K, was a standard house lock?

Cars may not be 100% safe, but do they make the seatbelts out of paper so that it "appears secure"? Things like javascript-only encryption without HTTPS provide the same level of safety (if you can't trust the webpage content because it's over plain HTTP, then you can't trust the encryption script served with the webpage either).

In some countries, anyone can have a gun, yet most people are not scared of getting shot on a day-to-day basis. So why be afraid if anyone can have strong cryptography?

  • Ben, thanks for answering. I think it answers why we go fully secure, but it doesn't answer the defeatist 'not even trying' case. – bradnoriega Mar 4 '16 at 9:25
  • Well for things that simply can't provide any security by their nature, when there are existing secure alternatives available (e.g. JavaScript encryption without HTTPS), I tried to answer that with paper seatbelts. – Ben Mar 4 '16 at 13:10

Not the answer you're looking for? Browse other questions tagged or ask your own question.