How can any intelligent person believe that PGP, HTTPS or anything else we have today is secure, given history and logic? [closed]

Question

It truly feels like we are living in an "afterworld", long past the era when smart, intelligent, real men and women worked on things that really did matter. I'm talking about Enigma, Lorenz, Collossus, etc. The cipher machines and code-breaking computers of the WW2. That's when things mattered.

Now, it's been ~80 years. Even the poorest person with zero intelligence or knowledge about anything can buy a device which CLAIMS to have encryption/security in the form of (for example) PGP and HTTPS. And, somehow, "we all" (the vast majority, including "geeks") seem to somehow believe that this is actually secure.

How can this be? Do they not realize that the machines they (governments and military personnel -- NOT normal people!) had in the freaking 1930s (and first part of 1940s) were insanely advanced and yet were broken with the relative "stone-age" technology of the time? How can they possibly believe that a toy encryption such as PGP or HTTPS protects against these entities, who by now have technology a trillion times as powerful as they did back then?

Hell, even our consumer toys are a trillion times as powerful as their building-sized computers of that era. Things which were kept secret for many decades. Their current computers are doubtlessly so insanely powerful that we cannot even comprehend it. Imagine in the year 2120 when they declassify the kind of code-breakers and secret spying farms they had in the year 2020... It makes my skin crawl just thinking about it.

Does anyone with any kind of understanding of security, computers, technology, history, warfare or the nature of this world really believe that PGP is secure? Or that any hardware we can buy to utilize this encryption is secure? Do they realize what they accomplished with analogue, primitive technology long, long ago? It seems ridiculous to me that any semi-smart person could possibly believe that "they" would actually give us, the "dumb masses", actually secure computers to play with. The sheer thought makes me blush.

What we have now to play with is like a toaster in the 1930s compared to an Engima or Lorenz cipher machine. For all intents and purposes, their technology is perpetually a hundred years into the future.

It's like we (including myself, in the past) just don't want to see the truth, because it forces us to realize that we are powerless little insects with no say or means to do anything that matters. The idea that people seriously think that there can be such a thing as a "smartphone" with an "end-to-end encrypted app" used to make me chuckle, but now it mostly saddens and frightens me.

Please don't respond with "it's secure enough, unless you are an enemy of the state". It's precisely when you are an "enemy of the state" that this stuff really matters!

Answer 1

I would flag it as "opinion based," but let's talk.

First, there's no "absolute defense." Nothing is secure against everything, and every defense strategy is a trade-off: Security vs Usability, and Cost of defense vs Cost of the attack.

The point on "protected unless the State is your enemy" is an example of this. State actors have lots of resources (technological, financial, and intellectual) and are able to bypass defenses that would deter other threats. Not only this, but State actors have one strong tool: The Law. This means that even if you use a service with secure ciphers, secure datacenters, secure processes and you follow OpSec rules strictly, they can summon The Law and force your partner to reveal anything they have. No broken cypher needed.

The upside of this is that The State usually have more important business to carry, and you are probably a small fish doing borderline non-approved things and being overparanoid about it. The State is not after you.

PGP is pretty solid. Phil Zimmermann was even investigated for 3 years by the US government for exporting it. The math behind it is very good. Dozens of cryptographers (even crypto-anarchists, if you want to label them as such) have studied it and the flaws got corrected over time. So I am strongly inclined to fully believe that PGP is strong enough to protect me even from the government.

If you read the reports on how Ross William Ulbricht (aka Dread Pirate Roberts) got caught behind Tor and such, you will see that even with the FBI dedicating an entire team after him for some years, he was caught by OpSec mistakes, not by FBI techo-capability.

Looking at the blogs from repressive contries (China, Iran, Cuba et al), you can see people there posting openly against their governments, protected by TLS, and they are still alive.

Smartphones are a different kind of beast. They are full-time trackers.