what is killing PKI?

[Stan Tobias]

I'm sorry, if this is not quite topical, but the questions raised on
this list why cryptography is not taken up by Johnny Public return
here often, and I would like to share my mind and expand on my previous
thoughts.

In the works cited before (this thread and other discussions),
one recurring concern could be formulated as: "Why Johnny doesn't
encrypt his Christmas greetings to his granny?", with an implicit
assumption/expectation that everybody ought to use cryptography by
default for any and everything.  I'll concentrate on the encryption only.

Summary: encryption is being applied to a social problem.

Faramir <faramir.cl at gmail.com> wrote:
> El 25-08-2012 10:33, Stan Tobias escribió:
> > Faramir wrote:
> >> IMHO, the main trouble probably is people don't feel the need to 
> >> protect their privacy. If they don't feel that need, why should
> >> they bother in learning, or even asking about privacy software?
> > 
> > Some time ago, reading a discussion I noticed this particular 
> > argument against encrypting file-sharing traffic, which can be 
> > summarized/paraphrased as:
> > 
> > "We don't want encryption, we want file-sharing be legal."
> > 
> > It's a strong political statement.  While privacy is important,
> > you don't win anything if you *have to* hide.  Freedom is often
> > fought for by asserting your rights.
>
>   Well, sure, but there are some other instances that are unrelated to
> freedom, like sharing you baby pictures... Or the increasing cases
> when a woman sends a picture of her in underwear to her boyfriend, and
> the picture ends on the news, causing her to lose her job. While we
> can argue the women did nothing wrong, and the one that must be
> punished is the person that disclosured a private picture, well, the
> fact is given the nature of internet, if you don't want Eve seeing
> your pictures, you need to send them encrypted somehow. Even if Eve is
> the only unauthorized person that saw the picture, one unauthorized
> person watching the picture is already an undesired case, even if the
> picture is not published anywhere.

I think we often conflate privacy and secrecy, which need not be the same.

Privacy is part of Freedom; both are elusive ideas, and difficult
to define.  *I think* Freedom is respect you receive from others,
on multiple levels.  Privacy are its specific rights.

My daughter has a diary.  It's not locked.  I know where to find it.
I have touched it, moved it, many times, but I have never opened it.
I teach the same my younger son.  This is privacy.

Once I have learned something by accident about someone from a note which
wasn't meant for me.  Not anything extremely important.  I have never
mentioned it to that person, or to anybody else.  That's privacy, too.

When you send a sealed letter through the Post Office, it's not the seal
that matters.  The letter can be read without breaking the seal,
or the seal can be easily removed.  What is important is that there is an
expectation of a certain behaviour, that if someone learns the contents
of your letter, they won't use that knowledge; or they won't reveal it to
others; or if it gets revealed, others will not use it; and if everybody
knows, your words will not be a witness against you in a court of law.

Write "Kill the king!" on the wall, you'll be convicted for calling to
violence; write the same in a letter - many will say you had a right
to vent your frustration this way.

Privacy is a certain aspect of social culture, it is about pretending
there are invisible barriers in an open land.  It is a Freedom you receive
from others, in exchange for the same.  Trust for trust.  This is what
builds society.  Sometimes the barriers are meant to be broken, but only
slightly, that's how we communicate, make new friends, etc.

My daughter could lock her diary from me.  It wouldn't really change
anything, but I would be sad.  Very sad.  (Translate for yourself "lock"
into "encryption" now.)


> >> might be complemented by a banner saying "I'm NOT SHOWING my
> >> body, it's just I'm NOT HIDING it".
> >> 
> >> But first we need to save money to pay the fines.
> >>           ^^^^^^^                  ^^^^^^^^^^^^^ 
> > This.  I wonder how certain
> > societies got convinced that just being nude - the most natural,
> > beautiful and human thing - was indecent and/or illegal.  Surely
> > not because everyone was dressed?  Or?
>
>   I think it is very likely it was because everyone was dressed... I
> mean, clothes are not transparent, and are very useful to keep people
> warm. It also protects the body against scratches (if you are a
> caveman, surely the walls of your "house" are not soft).

Well, the issue in itself is interesting, and I really don't know why,
but my question was meant to induce reflection and raise a certain point,
which your answer nicely resonates.

If you feel nudity should be legal, you have to show yourself naked.
If you want a right to speak, you have to go out and speak.  If you
think you have a right to gather salt on your land, you go, pick the salt
and say "My land, my salt!".  If you think you have a right to use any
bus in the city, you take a seat and announce "I'm like everybody else,
I have a right to sit here".  If you want sovereignty for Sealand, you
simply go there and announce "This is my land now!"; sometimes you have
to show your guns, too.  If you want to tell the world something which
is very important to you, you go to Wall Street.  If you want rights
for homosexuals, you go out to the street and shout "I'm a homosexual,
I'm normal, I want my rights like everybody else has".  If you want
independence for Ladonia, you simply sit down in your armchair, take your
keyboard, start Tor client, write a long blog denouncing state powers, and
demanding recognition for the Independent Republic of La... oh wait,
sorry, that hasn't worked yet.

What I mean to say is that often (but maybe not always) you need to
exercise your particular Freedom in order to gain or preserve it.
Talking about it is not enough, you have to be "there".

If you want to preserve the Privacy (like I described above), you have to
exercise it.  You have to take a risk that someone will open and read
your letter/email, and if they do, you demand them and everybody else
to leave you alone, that is to say, to respect your privacy.  If you
encrypted your letter, you wouldn't be able to exercise your right to
Privacy by demanding others not to read it.

I believe the same or similar sentiment was behind the file-sharer's
statement I paraphrased above.

Many years ago, when "London Bobby" was Great Britain's trademark,
I remember hearing in the news that British policemen opposed a new rule
that required them to wear a gun.  It was a stunning news for me back
then, because I couldn't imagine a policeman without a gun, and doubly
so, because I couldn't understand why police would want to oppose
wearing guns.  Well, IIRC, the reason was that they wanted to be seen
as community helpers, not "law enforcers"; another reason was that guns
would make them potential targets for the baddies (today many would say
"terrorists", but that meant something different in that era).

What I mean to say above, is that weapons are anti-social, they don't
build trust; and there are better means, other than guns, to maintain
peace.  Encryption is a weapon.  I believe there are many valid reasons
to use it, especially to protect other people.  It might buy you some
safety for a period of time, but it won't bring you Freedom.  You don't
get more Privacy by encrypting your messages.  If you _have to_ encrypt,
you're on the losing side.

[ I meant to write my views on the Facebook phenomenon vs privacy here,
but I want to keep more to the point, and I don't want to stretch this
post any longer; I can do it at another occasion. ]

So, if you (directed at everybody) ask Johnny why he won't encrypt his
greetings to his grandma, maybe one possible answer is that because he
simply doesn't want to live in your cage - any cage.

I hope I haven't bored you too much, regards, Stan.