[00:03.980 --> 00:06.560]  Yes, all volunteers will be paid extra for the extra hour.
[00:06.740 --> 00:07.260]  They'll be paid double.
[00:11.210 --> 00:19.680]  Okay, without too much further ado, I just want to announce that if you're into electronic music, we have concerts going on downstairs at 10 o'clock, starting at 10 p.m.
[00:19.780 --> 00:19.960]  tonight.
[00:20.420 --> 00:23.640]  Downstairs by the Escalator to the Mezzanine is a brilliant concert.
[00:24.060 --> 00:29.260]  Chiptunes, electronic music, all kinds of cool stuff, dancing, and things of that sort.
[00:29.260 --> 00:30.660]  Flashing lights if you like those.
[00:31.380 --> 00:33.790]  So check that out tonight at 10 p.m.
[00:35.720 --> 00:38.900]  Without further ado, it's my pleasure to announce the next speaker.
[00:39.170 --> 00:41.320]  This is When You Are the Adversary, Quinn Norton.
[00:49.740 --> 00:51.720]  Mics are always well above my head.
[00:54.000 --> 01:02.860]  So, over the last year and a half or so, you may have noticed that there's been some attention paid to big adversaries.
[01:04.160 --> 01:05.580]  I can't see my own slides.
[01:08.260 --> 01:09.220]  So, yeah.
[01:09.640 --> 01:13.840]  And what I love about this is how much it kind of... they mirror each other very well.
[01:13.980 --> 01:16.140]  Everybody's like, you cannot speak its name.
[01:16.140 --> 01:17.440]  No, it's not returning.
[01:17.680 --> 01:21.480]  It was crushed by the church committee in the 70s.
[01:23.040 --> 01:23.760]  No, no, no.
[01:23.840 --> 01:25.720]  It was overcome by the power of the FISA.
[01:25.720 --> 01:28.380]  But now it has turned the power of the FISA forward.
[01:29.160 --> 01:34.360]  It is very, very Voldemort-ish, our relationship with the NSA right now, especially in this community.
[01:35.920 --> 01:50.860]  But for about the same amount of time, actually longer, because these are really like the amazingly powerful, dangerous, sexy adversaries that all of us kind of in the action hero movie of our minds are up against.
[01:51.960 --> 02:00.200]  But I actually want to go through what actually happens in Harry Potter a little bit, because he doesn't spend most of the time fighting Voldemort.
[02:00.700 --> 02:08.520]  Like, at best, he spends a lot of it fighting his minions, which might be like local law enforcement, bureaucracies.
[02:09.820 --> 02:15.140]  You know, but really, what does he spend most of the time and most of the stories doing?
[02:15.400 --> 02:28.820]  He's fighting, like, family, and his peers, and administration and staff, and content filtration, and, of course, the IT department.
[02:33.730 --> 02:35.870]  So what is a small adversary?
[02:36.330 --> 02:51.270]  Well, a small adversary is someone that is out to stop you, or out to get you, or something like that, and doesn't have the unlimited power and prestige and glory of the NSA and the FBI and all these other three-letter acronyms.
[02:51.490 --> 02:58.170]  Often when I'm thinking of modeling that adversary, I think of the great database in the sky, where joins are instantaneous.
[02:59.070 --> 03:05.510]  And all that information, whether it's, like, my transit card, and my cell phone data, and all that can be instantly correlated.
[03:05.850 --> 03:09.350]  But the truth is, most adversaries are just jerks.
[03:11.970 --> 03:15.630]  And jerks are part of the meta-adversary environment as well.
[03:18.410 --> 03:22.390]  Because... and I want this to stick in for... everyone knows Nick Burns, right?
[03:22.850 --> 03:26.090]  Like, okay, I can't see you, but raise your hand if you are Nick Burns.
[03:28.030 --> 03:29.630]  I think I see, like, one or two hands.
[03:29.730 --> 03:30.590]  There's more of you.
[03:31.010 --> 03:31.710]  Face it.
[03:33.290 --> 03:33.730]  But...
[03:35.690 --> 03:38.490]  The adversaries are not super powerful.
[03:38.690 --> 03:40.150]  Sometimes they're not that smart.
[03:40.470 --> 03:43.050]  But they are out to get you, or out to stop you.
[03:44.210 --> 03:46.650]  And... and they can be quite dangerous.
[03:46.770 --> 03:48.530]  I did this because I wanted to be gender-balanced.
[03:49.510 --> 03:52.850]  But I'm also okay saying most of the creepy people are white, apparently.
[03:56.670 --> 04:04.790]  But... but these adversaries have very real effects, and they span all of our lives.
[04:05.150 --> 04:13.970]  You know, the thing about... the thing about small adversaries is that only a few people really, in their day-to-day life, worry about the big adversaries.
[04:13.970 --> 04:18.730]  But the small adversaries target everyone on the planet.
[04:19.830 --> 04:24.150]  And they target everyone with whatever technological means they have to hand.
[04:25.170 --> 04:30.410]  Sometimes... and, you know, back in history, that was gossip at the watering hole, right?
[04:30.850 --> 04:33.670]  Now, it's all sorts of things.
[04:33.910 --> 04:38.710]  But let's... let's talk about who, real quick, before I go on, who the little adversaries are.
[04:38.710 --> 04:40.450]  They can be local police.
[04:40.630 --> 04:41.750]  They can be corrupt local police.
[04:41.890 --> 04:44.430]  They can be, you know, a corrupt security guard.
[04:45.590 --> 04:47.110]  They can be your IT department.
[04:47.390 --> 04:50.750]  If you are trying to whistle-blow, they might be your IT department.
[04:50.950 --> 04:54.710]  If you are trying to get a different job, they might also be your IT department.
[04:56.070 --> 05:00.270]  If you are trying to commit industrial espionage, still your IT department.
[05:02.890 --> 05:06.890]  They are in corporations and schools and organizations and even NGOs.
[05:07.390 --> 05:13.150]  These are things that are sometimes trying to block you and stop you from getting out your communication or getting to your information.
[05:14.190 --> 05:15.670]  They are in bureaucracies.
[05:15.870 --> 05:16.830]  They are skiddies.
[05:17.710 --> 05:26.770]  I mean, I know that there's not a huge amount of respect for skiddies in this community, but there should be a huge amount of respect for the damage they can do because there's so freaking many of them.
[05:29.190 --> 05:31.290]  They're schools and they're families.
[05:32.270 --> 05:35.070]  They're honor killings at their worst.
[05:35.310 --> 05:41.890]  They're partners that are committing domestic violence to partners that don't have the information to get out of those situations.
[05:42.730 --> 05:45.350]  They're friends that mean well.
[05:47.370 --> 05:50.210]  They're stalkers that don't mean well.
[05:52.390 --> 05:54.690]  And sometimes they're just random pwnage.
[05:54.690 --> 05:59.910]  And that can have real, you know, devastating effects on people's lives with the connection.
[06:00.170 --> 06:12.890]  When your grandmother has been owned by that many botnets and she can't reach out and communicate with her family, that isolation has health consequences in later age.
[06:13.930 --> 06:17.210]  These things can be quite powerful.
[06:17.530 --> 06:21.010]  So what are the tools of small adversaries?
[06:21.170 --> 06:23.170]  Well, I mean, physical access is obviously one of them.
[06:23.170 --> 06:29.690]  One of the major tools that we see with Facebook and families is making you give up your password.
[06:31.250 --> 06:32.810]  That's a really important one.
[06:33.790 --> 06:36.290]  One of the other places we see that is Syria.
[06:39.110 --> 06:41.430]  And I'd like to let that sink in for a moment.
[06:41.890 --> 06:45.890]  And the tactic they use in Syria is to have more than one Facebook account.
[06:46.610 --> 06:51.190]  Now, is that going to come as a huge surprise to teenagers out there that you can do that?
[06:52.850 --> 06:55.530]  Are they going to be like, we've learned so much from the Syrian resistance?
[06:59.530 --> 07:03.310]  So there's all these coping mechanisms we develop with our small adversaries.
[07:03.550 --> 07:05.990]  And then there's the explicit tools.
[07:06.250 --> 07:08.550]  And a lot of us probably know these ones.
[07:08.890 --> 07:10.310]  You know, this one was just in the news.
[07:10.310 --> 07:13.910]  But there's plenty of other ones that are not necessarily billed as hacker tools.
[07:14.110 --> 07:18.150]  But let's all be clear that rats do the same thing.
[07:18.570 --> 07:21.290]  Whether you're doing it for good or evil, they are exactly the same thing.
[07:21.410 --> 07:23.890]  They are getting root and taking control of everything.
[07:25.650 --> 07:28.250]  And so, like, this is a more legitimate one.
[07:28.310 --> 07:30.270]  Although it's got this page, which I find hilarious.
[07:31.810 --> 07:33.250]  That should take care of it.
[07:38.630 --> 07:40.650]  I think it's one person that's just still laughing.
[07:42.570 --> 07:43.950]  Have you used this software?
[07:46.170 --> 07:51.270]  And of course, like, what are the ways that these things get delivered?
[07:51.270 --> 07:58.570]  Well, the main way that I've seen... and I should say a little bit about where I come from for this talk.
[07:58.850 --> 08:00.330]  Maybe earlier in the talk, but here we are.
[08:01.230 --> 08:05.750]  Where I come from with this is that I spend most of my life working in the field as a journalist.
[08:06.130 --> 08:11.830]  And the people that I'm working with who need security tools don't need them in an academic way.
[08:12.670 --> 08:14.310]  They need something right now.
[08:14.410 --> 08:16.390]  They may or may not have thought about this in advance.
[08:16.650 --> 08:18.230]  It's a real part of their life.
[08:18.230 --> 08:26.470]  I have been on the phone to somebody trying to step them through how to do an open SSL command line to encrypt a file.
[08:26.870 --> 08:30.030]  I don't recommend this as an OPSEC method.
[08:30.410 --> 08:36.250]  But when you got nothing else, you know, it is something.
[08:38.090 --> 08:42.750]  So my perspective is a really practical one.
[08:42.990 --> 08:47.530]  And at some point in all of this, I will probably piss almost everyone in this room off.
[08:47.830 --> 08:52.290]  Because I'm specifically going to try and go after a lot of the security community sacred cows.
[08:54.910 --> 08:56.770]  But we see these things.
[08:56.990 --> 08:58.090]  We see them all over the place.
[08:58.090 --> 09:02.250]  And the thing is, we also know that we aren't seeing most of them.
[09:02.870 --> 09:05.770]  So, how are they getting to people?
[09:06.030 --> 09:09.670]  Well, they're getting to people via their email a lot of the time.
[09:09.870 --> 09:11.110]  Sometimes it's physical access.
[09:11.510 --> 09:13.730]  But, oh, email attachments.
[09:14.890 --> 09:23.150]  And I just want to say about this little phishing email that I didn't have anything for the slide before my talk.
[09:23.150 --> 09:26.330]  And I just refreshed my mail three or four times.
[09:27.770 --> 09:30.210]  And then I had... I am actually a Chase customer.
[09:31.150 --> 09:34.390]  So, potentially this was closer to hitting the mark than many of them.
[09:35.810 --> 09:48.050]  So, one of the things that we need to do is we need to fix the way email and attachments and those sorts of channels make people tremendously vulnerable to small adversaries.
[09:50.110 --> 09:56.310]  And I mean, the thing is, the tools are so many and so terrible and they're multiplying.
[09:58.050 --> 09:59.130]  There's so much out there.
[09:59.350 --> 10:03.670]  And one of the reasons why there's more tools and more tools and more tools coming up.
[10:03.770 --> 10:09.410]  And I mean also, not just tools in terms of like things you can download and put onto your ex-girlfriend's computer.
[10:10.110 --> 10:10.830]  That's a thing.
[10:10.830 --> 10:13.710]  But also, ways of monitoring things.
[10:13.970 --> 10:16.870]  Snooping software for your network marketed to parents.
[10:17.270 --> 10:18.990]  Because only they would ever use it.
[10:20.470 --> 10:23.810]  Censorship being rolled out at all sorts of levels.
[10:24.070 --> 10:27.750]  Not just national levels, but all sorts of different levels that people hit it.
[10:28.410 --> 10:34.810]  Whether it's libraries, homes, schools, cafes, all sorts of stuff like that.
[10:34.810 --> 10:43.790]  And one of the things where I want to relate this back to Voldemort NSA real quick is that there's an as-above-so-below effect here.
[10:44.590 --> 10:52.770]  All these tools that eventually come down to the small adversaries, they're modeled and developed in many ways by the big adversaries.
[10:53.010 --> 10:56.350]  And that means there'll be more awesome things to come.
[11:00.320 --> 11:02.840]  This is the best graphic on the Internet, by the way.
[11:07.980 --> 11:14.100]  So, whatever we have, we will have dipshit ways of using bad versions of it on each other.
[11:15.920 --> 11:17.660]  Within fairly short order.
[11:18.360 --> 11:20.840]  And I do want you to sit with that for a moment.
[11:21.040 --> 11:30.320]  In your imagination and try to imagine what, like, the ghetto fabulous version of, like, PRISM and XKEYSCORE looks like.
[11:31.900 --> 11:37.320]  Because somebody out there is going to be, like, trying to figure out how to Beige Box a fiber optics cable at some point.
[11:38.920 --> 11:49.460]  And then, of course, one of the major problems when we start looking at the way small adversaries gain success in attacking people is that user behaviors are terrible.
[11:52.620 --> 11:54.980]  This is the second best picture on the Internet.
[11:59.280 --> 12:02.900]  And I want to go back to that, like, living in the practical world.
[12:03.720 --> 12:04.680]  I'll give you a moment.
[12:05.520 --> 12:08.660]  I want to go back to that living in the practical world thing.
[12:08.920 --> 12:13.060]  Which is that many of you, this is actually your job.
[12:13.320 --> 12:17.500]  So when you are choosing a long password, you are being paid to do that.
[12:19.020 --> 12:23.260]  When I am choosing a long password, I am losing money to do that.
[12:25.320 --> 12:26.980]  OPSEC makes you a living.
[12:27.780 --> 12:29.540]  OPSEC costs me mine.
[12:30.860 --> 12:37.420]  If you don't work in computers, all of this stuff takes away from your productive time.
[12:37.620 --> 12:39.080]  It takes away from your personal time.
[12:39.300 --> 12:45.780]  It takes away from the few precious moments you get to see your family before you go back to whatever it is you do.
[12:46.820 --> 12:49.120]  It takes away from your life.
[12:50.120 --> 12:54.760]  And I really need that to sink in to the community of tool builders and software.
[12:55.820 --> 13:00.340]  That what makes your life takes away other people's lives.
[13:01.200 --> 13:02.640]  It takes away their time.
[13:04.040 --> 13:08.480]  And that doesn't necessarily mean that the answer is they should become more like you.
[13:10.000 --> 13:12.620]  Because you don't want to do their job.
[13:14.180 --> 13:23.780]  Until you are ready to take your few hours a week hauling trash, it is not your job to make the trash hauler like doing software things.
[13:27.180 --> 13:30.860]  We have specialization in this civilization level for a reason.
[13:31.700 --> 13:33.980]  And yes, we need more digital literacy.
[13:34.120 --> 13:36.980]  And I bang on about that endlessly.
[13:37.200 --> 13:39.440]  We spend 12 years teaching people how to read.
[13:39.580 --> 13:42.260]  And about 30 minutes teaching them how to use computers.
[13:42.900 --> 13:44.060]  That's not right.
[13:44.960 --> 13:51.140]  But it's also not right for me to tell everybody here that you should be producing thousands of words a day because I'm a writer.
[13:51.260 --> 13:52.260]  Why can't you do it?
[13:53.620 --> 13:56.400]  So, there has to be a balance in there.
[13:57.320 --> 13:59.560]  Where we come to the user.
[14:01.940 --> 14:09.120]  We in the community have to understand that operational security and encryption need to go to them.
[14:10.160 --> 14:12.460]  We can't make them bring it to us.
[14:12.680 --> 14:14.860]  Or we can't bring them to where we're at.
[14:17.700 --> 14:19.160]  Because I can't read my writing.
[14:19.360 --> 14:25.400]  Anyway, because it's not realistic and it's not actually what we want.
[14:26.200 --> 14:40.920]  When we think about doctors, when we think about people who, you know, the lawyers that are trying to keep us out of prison, you know, when we think about all of these people who do these very, very specialized important things in society, do we really,
[14:41.020 --> 14:44.600]  do we really want our doctor to drop everything and learn PGP?
[14:46.040 --> 14:49.060]  Or do we actually want him to take a second look at that x-ray?
[14:50.440 --> 14:52.920]  I mean, we've got to think of the cost of these things.
[14:53.160 --> 14:57.320]  You know, we all want lawyers to use encryption for pretty good reasons.
[14:57.720 --> 15:00.320]  But honestly, I've had a lot of lawyers.
[15:00.740 --> 15:02.780]  And I'd rather they thought about the law.
[15:04.500 --> 15:06.020]  That's what I need them to do.
[15:08.420 --> 15:12.900]  And there's still only 24 hours in a day, even when you're a lawyer.
[15:16.720 --> 15:17.500]  But they're billable.
[15:17.740 --> 15:18.200]  That's true.
[15:19.700 --> 15:22.460]  So what is the cost of small adversaries?
[15:22.700 --> 15:26.220]  I mean, we sit here and talk about the ruination of society from large adversaries.
[15:26.540 --> 15:27.700]  And that's true.
[15:27.940 --> 15:29.580]  I'm not going to say it's not.
[15:29.840 --> 15:32.120]  But small adversaries aren't chump change.
[15:32.120 --> 15:37.580]  This is an estimate from one study that they cost 445 billion a year.
[15:39.740 --> 15:49.120]  That's the national, external national debt of India, plus enough to run the California school system.
[15:49.840 --> 15:50.960]  That's a lot.
[15:51.360 --> 15:53.740]  And this number is not terribly reliable.
[15:53.740 --> 15:56.380]  But I would actually put it much higher, not lower.
[15:56.900 --> 16:00.000]  Because there's dollar amounts and then there's work time lost.
[16:01.580 --> 16:03.060]  There's equipment replacements.
[16:03.280 --> 16:04.340]  There's all sorts of other things.
[16:04.480 --> 16:06.340]  And equipment replacements that happen when they don't need to.
[16:07.000 --> 16:07.980]  But that counts.
[16:09.780 --> 16:10.940]  There's transit time.
[16:11.060 --> 16:11.540]  There's all this stuff.
[16:11.540 --> 16:20.460]  There's all that time where every secretary or receptionist or support person in the world is going, Where is that icon?
[16:22.000 --> 16:22.600]  Crap.
[16:23.780 --> 16:30.240]  And that is time that comes out of the beautiful experience of being human on this world.
[16:30.500 --> 16:34.960]  That's what we're using our finite time in this beautiful universe to do.
[16:39.080 --> 16:41.240]  500,000 jobs in the U.S.
[16:42.580 --> 16:45.820]  based on kind of crashing businesses and things like that.
[16:46.120 --> 16:56.100]  Again, I think there's a really interesting figure in there in like jobs not created by a lack of digital literacy and by the fact that computers are just not working for most people.
[16:56.220 --> 16:58.020]  Computers just don't work for most people.
[16:59.480 --> 17:01.220]  And security is part of that.
[17:03.440 --> 17:06.440]  Reputations, friendships, social connections lost.
[17:06.440 --> 17:08.280]  As things get compromised.
[17:08.720 --> 17:13.740]  When I went looking for a webcam nose picking picture, it was really hard to find one if it had been blurred out.
[17:16.240 --> 17:17.860]  And then it gets more serious.
[17:18.260 --> 17:21.260]  You know, huge numbers in stalking.
[17:23.940 --> 17:27.400]  And victims of stalking deal with years of trauma.
[17:28.200 --> 17:32.440]  And then we've talked about lost productivity.
[17:33.020 --> 17:38.840]  But also this like ongoing fear that is connected with computers and with the small adversaries.
[17:39.560 --> 17:41.500]  Are my parents watching me?
[17:41.640 --> 17:43.140]  Will my dad catch me?
[17:43.300 --> 17:44.740]  What will my school think?
[17:44.960 --> 17:46.480]  Will my peers humiliate me?
[17:47.880 --> 17:51.280]  Just constant life of fear and stress.
[17:51.280 --> 17:51.480]  Yes.
[17:52.180 --> 17:53.960]  And ultimately, deaths.
[17:55.100 --> 18:02.140]  Nobody has a way of counting how many lives were ruined by not being able to get to censored information.
[18:02.460 --> 18:06.260]  How many kids killed themselves because they couldn't find resources online.
[18:06.540 --> 18:09.780]  How many people couldn't find medical information that they need.
[18:09.980 --> 18:12.720]  How many people were harassed into suicide.
[18:13.600 --> 18:16.840]  How much malfunctioning gear has caused death.
[18:17.060 --> 18:19.040]  How many people stabbing at their phone.
[18:19.320 --> 18:21.740]  Not trying to text but just trying to get it to work.
[18:22.220 --> 18:25.460]  You know, got hit by a car or drove into someone.
[18:26.240 --> 18:29.580]  And ultimately, a vehicle for intimate murder.
[18:30.080 --> 18:33.280]  Those honor killings, those domestic murders.
[18:34.860 --> 18:38.320]  Children and parents and brothers and sisters and friends.
[18:40.160 --> 18:41.120]  Ending terribly.
[18:42.960 --> 18:47.960]  Because their technology either enabled the wrong behavior or got in their way.
[18:49.980 --> 18:52.160]  So, how do we make things better?
[18:52.340 --> 18:55.000]  Now that I've gotten you into a big downer.
[18:57.260 --> 19:00.780]  You know, we're starting to make some stabs at this.
[19:00.920 --> 19:01.540]  I'm hearing...
[19:01.540 --> 19:05.600]  I've been interested in the user interface of open-source software since the 90s.
[19:05.700 --> 19:07.760]  And believe me, that is an unrewarding interest.
[19:09.820 --> 19:12.100]  But I'm seeing movement in the right direction.
[19:12.300 --> 19:13.540]  I'm seeing people start to care.
[19:13.760 --> 19:16.360]  I still think it's actually kind of messed up in its priorities.
[19:17.020 --> 19:20.440]  But I want to give a few examples of the things I like and why I like them.
[19:20.540 --> 19:22.040]  And then I want to get to my heretical statements.
[19:23.220 --> 19:27.060]  One piece of gear that I've worked on...
[19:28.660 --> 19:30.240]  When I say worked on, I mean loosely.
[19:30.780 --> 19:31.880]  I don't code.
[19:32.140 --> 19:33.600]  I have coded in the past.
[19:33.600 --> 19:36.200]  I found it painful and annoying.
[19:36.700 --> 19:38.880]  And decided I would just do other things.
[19:41.380 --> 19:43.700]  But I helped design this system.
[19:43.920 --> 19:46.960]  This is called the Kitten Groomer because somebody let me name it.
[19:49.740 --> 19:53.960]  It has another name in its other legitimate fork.
[19:53.960 --> 19:55.120]  But I'm not even saying it.
[19:55.360 --> 19:56.300]  Because Kitten Groomer is better.
[19:58.320 --> 20:00.280]  And the way this works...
[20:00.280 --> 20:02.780]  And we are still working out the bugs, oddly enough.
[20:02.980 --> 20:04.300]  Is that you get a USB.
[20:04.720 --> 20:06.960]  And you just don't know about that USB.
[20:07.320 --> 20:08.320]  Because reasons.
[20:09.040 --> 20:11.400]  And we have a little Raspberry Pi here.
[20:11.480 --> 20:12.800]  And it is running a Debian system.
[20:13.080 --> 20:16.240]  With LibreOffice and a few other pieces of software on it.
[20:16.240 --> 20:18.160]  And you plug your USB into the top.
[20:18.640 --> 20:23.200]  You plug a clean, clear, big enough USB into the bottom.
[20:23.460 --> 20:24.520]  With nothing on it.
[20:25.140 --> 20:26.420]  You plug this little guy in.
[20:26.520 --> 20:29.440]  And automatically, it's going to take the contents of the top.
[20:29.660 --> 20:30.600]  Try and clean them up.
[20:30.900 --> 20:33.080]  Make sure you've got no system file attacks.
[20:33.180 --> 20:34.320]  No auto runs or anything like that.
[20:36.680 --> 20:39.200]  And kind of a...
[20:39.200 --> 20:45.200]  Use file format transfers to try and get rid of anything that's excessively Turing complete in your documents.
[20:46.400 --> 20:51.560]  It's going to take the resulting files, copy it to the bottom one, and that's the one you put in your laptop.
[20:52.860 --> 20:58.200]  When it is done working, it either finishes flashing or it plays a little song.
[20:59.280 --> 20:59.780]  That's it.
[20:59.860 --> 21:00.660]  There's no other interface.
[21:02.360 --> 21:07.260]  The idea is to make something that, like, anyone who gets a lot of USBs can just plug this in.
[21:07.500 --> 21:07.900]  Wait.
[21:08.640 --> 21:09.220]  Unplug it.
[21:09.600 --> 21:09.960]  Go.
[21:10.900 --> 21:12.760]  We don't destroy the original information.
[21:12.760 --> 21:20.640]  Because the first priority of everyone in this system, even you, is to get your frickin' work done.
[21:21.900 --> 21:26.900]  And that means if my security measure gets in the way of your work, you will find a way around it.
[21:26.980 --> 21:27.960]  Because you have to.
[21:28.280 --> 21:31.480]  Because getting your work done is more important than the security stuff.
[21:32.520 --> 21:33.520]  And you agree.
[21:33.880 --> 21:35.700]  Like, even if you don't agree, you agree.
[21:35.900 --> 21:38.400]  Because you still want your doctor to look at your x-ray.
[21:39.280 --> 21:42.140]  And you still want your lawyer to think about keeping you out of jail.
[21:44.240 --> 21:49.160]  So, this was as low interface as we could make, a physical item for cleaning up USBs.
[21:49.560 --> 21:53.480]  Eventually, I'd like to use the same sort of techniques on email.
[21:54.200 --> 22:00.740]  I'd like to get those links out of being links and expose their URLs right in the email.
[22:00.920 --> 22:03.160]  I think that would do a great deal to reduce phishing.
[22:03.160 --> 22:06.060]  I'd love to clean up email attachments.
[22:07.700 --> 22:12.440]  But we can't make original content unavailable because that's taking the...
[22:12.440 --> 22:14.100]  That's not coming to the user.
[22:14.240 --> 22:15.620]  That's trying to make the user go to us.
[22:17.320 --> 22:22.920]  So, some of the ones that I recommend, or at least like in certain ways and in certain ways don't.
[22:23.400 --> 22:24.720]  A few icons here.
[22:24.900 --> 22:28.180]  I could have filled this with different things and talk about each one of them.
[22:28.180 --> 22:33.900]  But I wanted to pick actually from a few different kind of controversial ends of software.
[22:35.920 --> 22:36.940]  Silent Circle.
[22:37.460 --> 22:42.760]  Very well considered interfaces to Silent Circle's software and their black phone.
[22:44.460 --> 22:49.560]  It's semi-open-source, which for many people means not open-source for legitimate reasons.
[22:50.580 --> 22:52.080]  However, it is audited.
[22:52.800 --> 22:54.360]  And we'll come back to that later.
[22:59.540 --> 23:02.460]  But it's really nice to use.
[23:02.800 --> 23:04.000]  Like it's pleasant to use.
[23:04.340 --> 23:10.200]  And pretty much as soon as you make security software pleasant to use, I'm probably going to buy you a cupcake for your birthday.
[23:10.920 --> 23:12.400]  I'm real happy about that.
[23:14.500 --> 23:14.940]  Cryptocat.
[23:15.040 --> 23:18.940]  I imagine a few of you know that there's been a little controversy around Cryptocat over the years.
[23:20.640 --> 23:23.440]  But I've always felt it was a gorgeous piece of software.
[23:23.440 --> 23:25.780]  And I'll tell you one of the reasons I feel like it's gorgeous.
[23:26.100 --> 23:41.560]  Because I have discovered that somebody in a country very far away in the Middle East or Asia or even Africa or sometimes even Australia, I can get onto the phone with them.
[23:41.940 --> 23:45.120]  And this can be somebody who's literally afraid of their computer.
[23:46.200 --> 23:50.300]  And within a few minutes, I can get them using Cryptocat.
[23:51.540 --> 23:53.040]  That is amazing.
[23:53.480 --> 23:57.380]  There has never been security software that I could do that with.
[23:57.400 --> 23:58.600]  And I have tried it all.
[23:59.860 --> 24:04.520]  And from Cryptocat, I can get them interested in secure software.
[24:04.740 --> 24:10.500]  A major Middle Eastern news outlet that you have heard of, which I guess nails it down.
[24:13.560 --> 24:17.620]  I was getting one of their reporters onto Cryptocat.
[24:17.620 --> 24:23.880]  And she told me over Cryptocat that her managing editor had walked by, said, what is that?
[24:24.020 --> 24:25.000]  She explained it.
[24:25.080 --> 24:28.720]  And he said, wow, we got to learn more about that.
[24:29.200 --> 24:37.740]  No one in the history of history has ever walked by PGP and said, please, tell me more about what you're doing.
[24:43.850 --> 24:49.710]  Pigeon is a classic example of where we, as a community, kind of go wrong around this stuff.
[24:49.950 --> 24:51.830]  Because we're like, Pigeon, it has OTR.
[24:52.250 --> 24:56.310]  And it's not at all built on bad software in any way.
[24:57.390 --> 25:01.650]  At its worst, Cryptocat never compromised your whole damn machine.
[25:05.030 --> 25:07.270]  But again, once I've got...
[25:07.270 --> 25:09.790]  Cryptocat is great for getting people onto Pigeon.
[25:10.270 --> 25:10.930]  As well.
[25:11.190 --> 25:16.470]  If that's your goal, start with Cryptocat and be like, so there's a thing that makes this even easier.
[25:16.710 --> 25:17.330]  You lie.
[25:19.970 --> 25:20.890]  No, it's cool.
[25:21.310 --> 25:21.890]  Stay with me.
[25:22.990 --> 25:26.990]  Go ahead and download this and then turn off logging.
[25:27.170 --> 25:28.010]  And we'll get to that.
[25:28.130 --> 25:30.170]  Because when we're talking about small adversaries...
[25:30.770 --> 25:32.030]  I guess we'll get to that right now.
[25:32.390 --> 25:36.690]  When we're talking about small adversaries, we spend a lot of time going on about encryption.
[25:36.690 --> 25:41.530]  But encryption doesn't actually matter for most small adversaries.
[25:42.010 --> 25:45.590]  Your dad is not at the router breaking your encryption.
[25:46.030 --> 25:48.250]  That's not usually what happens.
[25:48.910 --> 25:52.090]  Even your IP department isn't breaking your encryption.
[25:52.410 --> 25:54.450]  They're going through your logs.
[25:56.190 --> 25:58.570]  Creating software that doesn't log?
[25:59.130 --> 26:01.430]  That would be such a win, people.
[26:02.910 --> 26:04.410]  Getting people to turn off logs?
[26:04.530 --> 26:05.890]  Turning off logging by default?
[26:07.190 --> 26:09.690]  Because logs are everywhere.
[26:10.110 --> 26:11.310]  And logs are what?
[26:11.470 --> 26:12.210]  F*ck you.
[26:14.390 --> 26:15.970]  Nobody has to break your encryption.
[26:16.250 --> 26:18.090]  They already know where it all is.
[26:18.550 --> 26:22.010]  And there's many, many variations in this world on the rubber hose.
[26:24.070 --> 26:31.550]  So, my biggest problem with teaching people Pidgin, besides key management...
[26:31.550 --> 26:31.750]  Anyway.
[26:32.310 --> 26:37.650]  My other biggest problem with teaching people Pidgin is making sure they turn off logging.
[26:38.870 --> 26:39.990]  It's remote.
[26:40.230 --> 26:40.810]  It's obscure.
[26:40.990 --> 26:41.610]  It's difficult.
[26:41.890 --> 26:45.050]  But I don't care how well encrypted OTR is.
[26:45.230 --> 26:56.130]  If you save it on your machine and Officer Doohickey from the next county over manages to get his cousin, the judge, to issue a warrant, you are f*cked.
[26:58.930 --> 27:00.830]  So, don't save logs, in short.
[27:01.370 --> 27:02.570]  But that gets me...
[27:02.570 --> 27:06.370]  My last icon here is Snapchat, which I'm sure all of you use and appreciate.
[27:08.710 --> 27:13.150]  But one of the things I love about Snapchat is the way it sets users' expectations.
[27:14.070 --> 27:20.610]  And it turns out a huge amount of people that when you tell them, look, here's something that's main defining features, it doesn't log.
[27:21.350 --> 27:25.230]  Like, a massive user base is going, sign me up for that.
[27:25.450 --> 27:28.970]  A much more massive one than even happened in the security community.
[27:29.610 --> 27:35.850]  Like, that's actually a natural response to wanting to not keep data that can hurt you in the future.
[27:36.650 --> 27:44.530]  So, as a community, people interested in operational security should be supporting Snapchat rather than what they do.
[27:45.430 --> 27:49.470]  Because the expectations it sets with people are so fantastic.
[27:50.630 --> 27:56.390]  So, if you come and say, well, Snapchat's great, doesn't quite work right.
[27:58.090 --> 28:05.090]  But, now that you want that, now that you expect that, let's talk about some of your other options.
[28:06.490 --> 28:12.590]  One of the keys to spreading encryption around, and I have done this a lot, is identifying your gateway drugs.
[28:14.550 --> 28:21.630]  I really do understand that bad encryption software is bad.
[28:22.990 --> 28:32.590]  I'm not blind to the fact that breakable and bad encryption that is not well implemented is something that hurts people.
[28:32.590 --> 28:34.010]  And it hurts people every day.
[28:35.170 --> 28:38.090]  But, not using encryption hurts them more.
[28:38.970 --> 28:40.830]  And it hurts a lot more of them.
[28:41.030 --> 28:43.970]  Because there's so many of these little adversaries.
[28:46.590 --> 28:50.270]  And, I'm going to go ahead and say the first of my heretical statements.
[28:51.510 --> 28:57.190]  Because it's not in any way at all heretical outside of the security community and software.
[28:57.190 --> 29:01.130]  And the rest of software, where once upon a time I worked, this is just understood.
[29:01.690 --> 29:05.330]  Which is, you can never fix the front end.
[29:05.530 --> 29:07.470]  You can always fix the back end.
[29:08.950 --> 29:14.090]  If your truly shitty encryption app gets users, we can fix the encryption.
[29:14.670 --> 29:16.150]  We can fix the design.
[29:18.450 --> 29:23.710]  But, if your truly beautiful app never gets any users, we can't fix that.
[29:25.070 --> 29:26.630]  There will always be bugs.
[29:26.630 --> 29:28.070]  There will always need to be fixes.
[29:28.750 --> 29:30.590]  And that's part of user expectation and that's good.
[29:32.210 --> 29:36.110]  But, UI, UI is hard to come back from.
[29:37.290 --> 29:45.250]  And even when there's pitfalls in the back side, we can often steer users around them with the user interface.
[29:45.490 --> 29:48.490]  You can actually fix bad back ends with good UIs.
[29:48.710 --> 29:52.530]  You can never fix UIs with a really, really amazing back end.
[29:52.990 --> 29:54.810]  All you get to is failure faster.
[30:01.590 --> 30:02.990]  I guess it wasn't that heretical.
[30:10.300 --> 30:12.960]  I'm going to confess that this is there partly because I really love it.
[30:16.200 --> 30:25.440]  The other thing that has upset many people when I've been in Twitter discussions, for instance, about the nature of encryption is what the goal is.
[30:25.440 --> 30:31.700]  Because the goal of people writing security software, or software they want to be secure, is for it to be unbreakable.
[30:32.760 --> 30:35.420]  The goal in the world is not to be unbreakable.
[30:35.560 --> 30:37.400]  It's not to be uncatchable.
[30:37.800 --> 30:38.900]  It's not to be unstoppable.
[30:39.420 --> 30:42.360]  It's to be unbroken, uncaught, and unstopped.
[30:42.360 --> 30:44.780]  These are really different goals.
[30:45.860 --> 31:00.100]  If your amazing encryption and my Caesar cipher both buy me the same 20 minutes I need to get to the next safe house, they are exactly equivalent.
[31:02.140 --> 31:04.260]  It doesn't matter which one I use.
[31:05.640 --> 31:13.820]  If my goal is that I need 20 minutes and the person I'm sending it to, and the person who's, and Eve doesn't know the Caesar cipher, we're cool.
[31:14.920 --> 31:30.740]  It's one of the reasons why when I am in the real world, talking to people with needs to hide things from adversaries, I spend a lot of time talking about social coding, social stagnography, things you can do in your speech to obscure meaning, to buy yourself time,
[31:30.920 --> 31:31.520]  stuff like that.
[31:32.860 --> 31:37.800]  Incredibly powerful social techniques for not getting caught, for not getting stopped.
[31:38.560 --> 31:41.500]  And you all know this from every time you've been stopped speeding.
[31:43.080 --> 31:46.220]  Because you're gonna come up with coded language in that situation.
[31:46.540 --> 31:50.600]  You're not like, wait, I can go back in the past and jam your radar.
[31:51.320 --> 31:55.060]  You're gonna switch to social coding in a hurry in that situation.
[31:55.240 --> 31:56.080]  You have been caught.
[31:57.180 --> 32:10.880]  And that's actually, I think that's the most common place where most people in society encounter the need to switch to social coding in a hurry because they've been caught, because their method has failed, is trying to talk their way out of a speeding ticket.
[32:12.040 --> 32:18.360]  And I want you to think about that when you think about, like, how people use Facebook to organize things.
[32:18.640 --> 32:29.680]  They're kind of continually in this process of finding ways to talk around the things that they need to, to create the kind of social manipulation they want, without the technical tools to help them.
[32:31.140 --> 32:36.640]  There was a thing I used to say at a lot of these conferences, which is that thing that you call social engineering.
[32:36.860 --> 32:38.320]  The rest of us call conversation.
[32:45.450 --> 32:47.070]  Before you clap, I was dissing you.
[32:47.250 --> 32:47.990]  I hope you know that.
[32:50.930 --> 32:57.170]  But it's true that we do need to talk about, like, where these things fit into our security landscapes.
[32:57.170 --> 33:04.490]  Not just in terms of penetration, which has been the sexy thing for most of my life, but in terms of, like, where it fits into defense.
[33:05.930 --> 33:12.030]  Where we are looking for ways to defend people through their language usage and to help them understand how to do that.
[33:13.910 --> 33:20.170]  So, my, my heretical statement, just to go back then, is, is, uncatchable is no better than uncaught.
[33:20.930 --> 33:32.690]  And that means that if your shitty-ass tool will not stop the NSA, but, you know, it's your ex-boyfriend who's a problem, then it's very simple, it's a very simple flowchart.
[33:32.790 --> 33:34.410]  Does your ex-boyfriend work for the NSA?
[33:34.510 --> 33:34.910]  Yes or no?
[33:39.570 --> 33:40.810]  There's another talk for that.
[33:40.910 --> 33:41.370]  See me after.
[33:46.350 --> 33:47.630]  So, excuse me.
[33:48.730 --> 33:56.870]  We need to create more attractive options, create sometimes not necessarily great working options, but we need to make it human.
[33:57.330 --> 34:01.250]  We need to take shitty software that people like and make it better.
[34:01.490 --> 34:03.210]  We need to do more of these things.
[34:03.350 --> 34:08.110]  In the great words of George Michael, we need to take these lies and make them true.
[34:09.490 --> 34:11.950]  We need to make the lie of Snapchat true.
[34:13.390 --> 34:15.810]  Because the lie is a really useful goal.
[34:16.890 --> 34:20.590]  And we need to bear that in mind when we go on our Twitter tirades about it.
[34:21.890 --> 34:22.990]  So, what do we need?
[34:23.090 --> 34:29.070]  What do we really need to make this world a better place for most of the people who are struggling against small adversaries?
[34:29.070 --> 34:30.390]  A huge amount of the time.
[34:32.430 --> 34:34.430]  We need more two-factor authentication.
[34:34.790 --> 34:36.070]  We need more tools for it.
[34:37.390 --> 34:40.950]  So that they can be deployed all over services and not just the big ones.
[34:42.250 --> 34:44.610]  And they need to not just be bound to big players.
[34:44.970 --> 34:47.030]  We need more small tools that way.
[34:47.030 --> 34:48.470]  We need more auditing.
[34:49.370 --> 34:55.130]  I'm going to go ahead and say one of the things that has gotten me into trouble recently.
[34:55.350 --> 35:01.350]  Which is that your unaudited open-source software is no better than somebody else's audited closed source software.
[35:01.510 --> 35:02.750]  In fact, it's probably worse.
[35:03.650 --> 35:07.450]  If no one... I know that sufficient eyes make all bugs shallow.
[35:07.630 --> 35:10.730]  But you don't have sufficient eyes if no one's looking.
[35:11.650 --> 35:13.470]  And we've just been living through this.
[35:13.470 --> 35:17.210]  This is a much less controversial contention than it was before Heartbleed.
[35:18.810 --> 35:23.350]  We all did have a collective moment of going, Oh, yes, we probably should have done that.
[35:26.450 --> 35:28.350]  So we need more auditing.
[35:28.890 --> 35:30.570]  We need more open-source auditing.
[35:30.790 --> 35:32.350]  And we need more closed source auditing.
[35:32.470 --> 35:34.870]  I mean, ultimately, my goal is to keep my friends alive.
[35:35.090 --> 35:37.850]  Not to win one particular faction in the software war.
[35:38.170 --> 35:39.930]  I actually prefer open-source.
[35:40.110 --> 35:42.330]  But it's secondary to keeping my friends alive.
[35:47.350 --> 35:48.910]  We need more bad tools.
[35:49.350 --> 35:50.650]  And then we need to fix them.
[35:51.270 --> 35:53.590]  We need to get more things in front of more people.
[35:54.350 --> 35:55.750]  Get more feedback on them.
[35:55.890 --> 35:57.090]  See how people want to use them.
[35:57.530 --> 35:59.170]  Get people using things.
[35:59.330 --> 36:02.630]  That's the great thing about WhatsApp and Snapchat and all these other things.
[36:02.770 --> 36:05.950]  Is that people are using these tools and they're teaching us what they want.
[36:05.950 --> 36:07.870]  And we need to bring the encryption to them.
[36:08.070 --> 36:14.990]  Which is one of the reasons I want to call out real quick the great work Nadeem did with Cryptocat plugging into Facebook chat.
[36:15.970 --> 36:18.710]  That was potentially a million person win there.
[36:22.980 --> 36:24.580]  Facebook saw that coming.
[36:25.820 --> 36:28.020]  But you know, big ups for trying.
[36:29.840 --> 36:32.320]  We need more in-app user education.
[36:32.680 --> 36:37.720]  We need applications to teach users what's happening and give them agency.
[36:37.980 --> 36:40.560]  We need to give them the choice to not click on phishing links.
[36:40.560 --> 36:43.360]  We need a way to say, hey, this link goes here.
[36:43.480 --> 36:44.140]  Is that what you want?
[36:44.660 --> 36:47.040]  We need to involve the user in the process more.
[36:47.240 --> 36:56.320]  We need to involve users in security, not just in their consumption choices, but also as an agent of incredible knowledge.
[36:56.760 --> 37:02.180]  You know the thing that knows whether or not this computer should be streaming video right now?
[37:02.380 --> 37:03.540]  It's not the router.
[37:03.760 --> 37:04.680]  It's not the network.
[37:04.700 --> 37:06.680]  It's not a cloud service.
[37:06.940 --> 37:08.060]  It's not anything on here.
[37:08.160 --> 37:08.540]  It's me.
[37:09.660 --> 37:15.420]  We need to start using the amazing complex pattern matchers attached to all these computers.
[37:18.120 --> 37:23.080]  We need ultimately to teach users that they are powerful.
[37:23.660 --> 37:25.560]  And we haven't done that.
[37:26.140 --> 37:31.300]  And that's really, really what's going to help us against small adversaries.
[37:31.520 --> 37:33.220]  Is empowering our users.
[37:33.480 --> 37:36.440]  Giving them choices and giving them agency.
[37:36.440 --> 37:39.520]  Giving them knowledge and bringing all these things to them.
[37:40.020 --> 37:42.640]  And letting them make the choices that are right for their situations.
[37:43.000 --> 37:47.980]  Because you don't know if I need to resist the NSA or get to a safe house in 20 minutes.
[37:48.360 --> 37:49.240]  I know that.
[37:50.240 --> 37:53.080]  I just need the tools that let me make those choices better.
[37:54.000 --> 37:57.800]  And ultimately, this is going to go back to the big adversaries.
[37:58.060 --> 38:07.480]  Because if you want to fight Voldemort slash NSA, you're going to need the users to feel that they are powerful.
[38:08.880 --> 38:12.620]  You're going to need all of them to feel powerful enough to fight back.
[38:12.900 --> 38:15.080]  And not the way people feel now.
[38:15.280 --> 38:16.860]  Which is scared of their computers.
[38:17.540 --> 38:19.540]  And scared of small adversaries.
[38:19.800 --> 38:22.340]  And helpless and hopeless in the face of this.
[38:23.020 --> 38:27.080]  Once they are empowered, Voldemort's going to go down like a little bitch.
[38:29.280 --> 38:33.200]  Until then, it's you versus the dark lord of the NSA.
[38:33.740 --> 38:35.380]  And the odds don't look great.
[38:36.360 --> 38:36.740]  Alright.
[38:37.060 --> 38:38.200]  Thank you very much.
[38:38.340 --> 38:39.560]  And I'm happy to take questions.
[38:49.830 --> 38:51.610]  I'd love to have a little light...
[38:51.610 --> 38:52.170]  Oh, thank you.
[38:52.830 --> 38:54.230]  Oh god, there's so many of you.
[38:55.130 --> 38:57.390]  I only saw like four people here.
[38:57.830 --> 38:59.010]  And I thought I was alone.
[38:59.190 --> 39:01.090]  Except for like that one guy laughing really loudly.
[39:05.670 --> 39:06.870]  Is it hazy in here?
[39:07.050 --> 39:07.970]  Or am I just going blind?
[39:09.730 --> 39:11.650]  Okay, I think it's just staring into the spotlights.
[39:11.810 --> 39:13.010]  Okay, that was my question to you.
[39:13.250 --> 39:14.190]  Now I'm taking questions.
[39:15.950 --> 39:18.010]  If you would like to ask a question, come right up to this mic.
[39:26.650 --> 39:29.170]  I was like really careful to leave room for questions.
[39:29.450 --> 39:30.470]  But I can babble more.
[39:30.550 --> 39:31.310]  And I can talk about Harry Potter.
[39:32.190 --> 39:33.970]  Yeah, I'm kind of surprised nobody has any questions.
[39:34.130 --> 39:35.150]  Quinn, thanks so much for your time.
[39:35.290 --> 39:35.870]  Awesome talk.
[39:36.250 --> 39:37.550]  I feel very much the same way.
[39:37.550 --> 39:40.670]  Like the real problems we have are the abusive husbands.
[39:40.670 --> 39:43.370]  They are the vindictive teachers, dot, dot, dot.
[39:43.610 --> 39:43.690]  Right?
[39:44.310 --> 39:45.950]  And I actually don't have a question.
[39:46.130 --> 39:52.530]  I just wanted to make the point that there's a nice follow-on effect to getting everyone to use crappy tools that do anything.
[39:53.850 --> 39:56.590]  A rising tide raises all boats, right?
[39:56.790 --> 40:07.690]  The more expensive, the more time it takes to deal with any of the communication on the network, the more time the chuckleheads at the top who want to read everything have to spend doing their day job.
[40:08.010 --> 40:08.090]  Right?
[40:08.290 --> 40:09.230]  It only helps.
[40:09.450 --> 40:11.850]  Even if we get everybody on Snapchat, that's a win.
[40:12.090 --> 40:12.210]  Right?
[40:12.590 --> 40:15.990]  So, you didn't call that out explicitly, but it was all over the edges of your talk.
[40:15.990 --> 40:17.130]  And I wanted to say it that way.
[40:17.310 --> 40:18.270]  So, thanks for letting me hit the mic.
[40:20.990 --> 40:27.630]  I did say one time, years ago, that if we wanted to shut down the NSA, we should send them all their data one day in different formats, including post-it notes.
[40:31.350 --> 40:31.970]  Great talk.
[40:33.530 --> 40:38.250]  A suggestion for all of you, and I hope you haven't...
[40:38.250 --> 40:41.490]  I came in halfway through the talk, so you may have already said this.
[40:42.210 --> 40:49.310]  But in relation to small adversaries, sometimes asking the user for a password is the last thing you want to do.
[40:49.470 --> 40:55.430]  So, we need more creativity around security that looks really normal.
[40:55.750 --> 41:06.210]  Security should be something that doesn't look scary and doesn't look like the user is trying to give the authority the middle finger.
[41:06.670 --> 41:07.850]  So, that's my thought.
[41:07.930 --> 41:10.950]  Yeah, I do think... and one of the big wins historically from this was SSL.
[41:11.270 --> 41:13.270]  Like, that's how we got everyone using security one day.
[41:13.450 --> 41:17.670]  And I know we all have some problems with SSL, but it's also been great cover.
[41:18.250 --> 41:22.950]  Like, if you can make anything look like SSL traffic, you can make it look kind of boring almost instantaneously.
[41:23.650 --> 41:26.410]  Then we need metadata to know whether we're chasing you.
[41:28.090 --> 41:31.890]  But I do want to say, like, that thing about everybody using crappy tools to do whatever they want all over the place.
[41:32.030 --> 41:33.990]  Like, you do enough of that and then you get an Internet.
[41:35.990 --> 41:38.350]  And it's a beautiful generative environment.
[41:38.690 --> 41:46.050]  I don't think... I think if everybody had to use exactly the meme generator tools that were, you know, produced by exactly the right people, we wouldn't have quite so many awesome lolcats.
[41:46.270 --> 41:47.370]  And that would make me sad.
[41:49.270 --> 42:03.330]  So, I'm just curious, since you've obviously spent a lot of time thinking about this, what your idea is for getting wider spread implementation and adoption of secure tools among normal people.
[42:03.730 --> 42:08.450]  I mean, this has been a pet peeve of mine for a long, long time, too.
[42:08.450 --> 42:13.450]  And I see it more in this conference than I can ever remember seeing it.
[42:13.710 --> 42:17.210]  That a lot of people are saying, like, you know, email is a problem.
[42:18.070 --> 42:18.810]  Encrypt email.
[42:18.870 --> 42:29.230]  I started using PGP a long time ago and I use it less today than I did when I first started, because I just can't get everybody else who isn't a geek on board with me.
[42:29.230 --> 42:32.450]  It's also that relief you get when you stop banging your head against a wall.
[42:33.810 --> 42:42.350]  But in general, I mean, I see a lot of people, they say, oh, I'm creating a system, I'm creating a system for this, I'm creating a system for that, but, get it adopted, you know?
[42:42.470 --> 42:48.550]  This is actually one of the reasons why I say we need to bring the encryption to the users and we need to bring the better security practices to the users.
[42:48.690 --> 42:51.370]  We don't need to make a secure Snapchat.
[42:51.790 --> 42:56.450]  We need to start, we may, but we need to start by saying, like, how do we make Snapchat secure?
[42:56.990 --> 42:59.630]  We don't need to make all these secure things.
[43:00.210 --> 43:02.690]  We need to figure out how to make the things we have more secure.
[43:03.110 --> 43:04.510]  And more educating to the user.
[43:04.630 --> 43:06.950]  This is one of the things I really liked about Nadim's project.
[43:07.170 --> 43:08.870]  He brought encryption to Facebook.
[43:09.730 --> 43:11.270]  They took care of it.
[43:11.510 --> 43:13.570]  But it was in the right spirit.
[43:14.310 --> 43:16.890]  And I do think that's one of the things we get more adoption with.
[43:17.010 --> 43:23.030]  We get more adoption with tools that mimic the tools people want to use and tools that add on to the things people want to use.
[43:23.030 --> 43:26.810]  And we should be taking clues from what people are freaking using.
[43:28.230 --> 43:33.610]  Instead of going, I have invented a perfect... I have invented a perfect little Maltese falcon.
[43:34.090 --> 43:35.870]  And everyone shall chase it now.
[43:37.570 --> 43:39.870]  So I don't think that we get users.
[43:39.970 --> 43:45.710]  Now, I do want to say that on the other end of this, I spend a lot of time speaking to people who are your users.
[43:45.830 --> 43:49.910]  And I spend a lot of time talking about how we can raise digital literacies.
[43:49.930 --> 43:52.670]  How we can create technical literacies that are more useful for this.
[43:52.670 --> 43:55.250]  And I think that effort is making progress, too.
[43:55.610 --> 43:58.070]  I do think we need more technical literacies.
[43:58.210 --> 43:59.690]  And I don't think it will be solved without more.
[44:00.610 --> 44:06.070]  But right now, there's a lot of effort in other parts of the world going to those technical literacies.
[44:06.110 --> 44:07.410]  And they're not connected to you.
[44:07.790 --> 44:14.210]  The digital literacy in education thing is hot all over the world right now.
[44:14.450 --> 44:15.890]  How many of you knew that?
[44:17.470 --> 44:20.130]  That is a very small number of people in this room.
[44:20.130 --> 44:24.890]  How many of you are in communication with educators over digital literacy issues?
[44:25.610 --> 44:27.990]  One, two, three, four, five, six...
[44:27.990 --> 44:28.850]  Now, hold on a second.
[44:28.970 --> 44:30.590]  Some of you didn't raise your hands last time.
[44:33.690 --> 44:36.610]  Anyway, it is much less than 10% of this room.
[44:36.610 --> 44:50.150]  And if you sincerely want these issues to be solved on the literacy scale, you should be connected to the communities that are actually in a position to do that and are desperate for people to help them because they don't have the knowledge now.
[44:50.470 --> 44:52.030]  We need more cross-connections.
[44:52.290 --> 44:56.570]  Which, I have to say, means that the security community needs to learn more manners.
[44:57.750 --> 44:59.090]  There's no other way to put it.
[45:04.590 --> 45:08.430]  So, one thing that you said was that we need more of these tools.
[45:08.910 --> 45:12.270]  We need to make a lot of them, even if they suck, and then fix them.
[45:12.470 --> 45:21.410]  And that's great, and I hear where you're coming from, but in my experience working with users, once there's more than one tool that accomplishes a specific task, they get really confused.
[45:21.650 --> 45:23.750]  They're like, which one of these things do I use?
[45:23.810 --> 45:26.170]  And the answer may change over time.
[45:26.230 --> 45:37.090]  So, what are your thoughts on keeping people up to date with what tool they should be using and the expense of teaching them potentially a new interface if a new tool becomes better than the old one?
[45:37.330 --> 45:39.310]  A lot of this has to do with communities.
[45:39.750 --> 45:42.030]  Tools get adopted by communities, not people.
[45:42.610 --> 45:48.570]  Especially communication tools, because if you've got that one magic communication tool and no one else has, thank you, Pond users.
[45:50.070 --> 45:51.230]  You know, congrats...
[45:54.010 --> 45:57.690]  You know, you are in a perfect world of talking to yourself.
[45:57.690 --> 46:05.590]  So, it has that property of language, which is the value of a piece of software, communicative software, rises with the number of people using it.
[46:05.710 --> 46:15.270]  Not with the interface, not with the security, not with how bug-free it is, not with any of the things that we optimize, but with how many other people are using it.
[46:15.450 --> 46:19.850]  How many people in this room have a Facebook account strictly so they can talk to their family?
[46:21.350 --> 46:23.150]  More than are currently talking to educators.
[46:26.130 --> 46:27.610]  So, you know, this is...
[46:27.610 --> 46:28.710]  Okay, I have five minutes.
[46:29.210 --> 46:34.890]  So, yeah, this is where we're at with this, is that we need to kind of liaison with communities and see how communities are using this.
[46:35.010 --> 46:40.290]  Because ultimately, whatever we say people should use and however we train them, they're actually just going to get training from their communities.
[46:40.790 --> 46:53.830]  So, one of the things that we find with some tools, you know, when I go through different communities and different cultures and travel around, is I find that tools will be adopted by a community not because they are better, but because they are internationalized better.
[46:54.850 --> 47:03.610]  And, you know, at that point, I can't tell them to switch off of Skype and use something else because it just is nothing else works for them, for instance.
[47:04.070 --> 47:04.830]  Thank you.
[47:07.090 --> 47:07.650]  Hello.
[47:08.330 --> 47:14.310]  You spoke about social coding measures as an adjunct to technological measures for personal security.
[47:14.510 --> 47:19.630]  Are there any resources that you would recommend especially for non-technical people to get started with that?
[47:20.790 --> 47:24.170]  Ooh, that is incredibly community-specific.
[47:24.630 --> 47:28.510]  So, where I start, if I'm trying to learn about that, is I look in a community.
[47:28.510 --> 47:30.770]  I look for the people who are prominent in that community.
[47:31.330 --> 47:36.330]  And, being a journalist, I will often just interview them to try and understand what those things do.
[47:36.710 --> 47:42.610]  One of the reasons why I can't point you to an online resource is that many of these communities are trying to stay subrosa.
[47:43.070 --> 47:53.530]  So, you know, if you are, you know, a gay Lebanese kid, there isn't like a wiki for the language that you use to talk about being gay in Lebanon, right?
[47:53.670 --> 47:55.430]  Because that would kind of defeat the point.
[47:56.950 --> 48:02.990]  So, all I can say is when I do it, there may be better resources for this, but when I do it, I do it by connecting with people.
[48:03.610 --> 48:22.590]  But I would actually, I think probably the book I would recommend right now, and I am somewhat plugging a friend's book that I helped work on, but is Dana Boyd's book, It's Complicated, on the social lives of networked kids, which goes into a lot of these things and kind of,
[48:22.610 --> 48:25.730]  like, discusses the architecture of these sorts of measures.
[48:25.950 --> 48:31.070]  And it's focused on America, but it's, I think, a really great start to understanding how communities and networks interact.
[48:31.650 --> 48:32.170]  Thank you.
[48:33.850 --> 48:35.650]  Hi, thank you for the wonderful talk.
[48:36.050 --> 48:45.350]  So, one of your key assertions about cryptography is that if it is unbreakable for the amount of time that it's deployed, then that's a success.
[48:45.590 --> 48:46.370]  What do we...
[48:46.370 --> 48:48.270]  No, for the amount of time that it's needed.
[48:48.490 --> 48:48.750]  Right.
[48:49.250 --> 48:56.630]  What happens when a cryptographic system gets adopted and then, due to network effects, becomes completely entrenched?
[48:56.830 --> 49:04.570]  Examples include things like Seed or SSL2 or perhaps, in certain context, things like RC4.
[49:05.010 --> 49:14.290]  Things that are used to build tools and then simply fail to go away when they are no longer needed, even after they get broken.
[49:14.550 --> 49:17.270]  What should we do as a security community about that?
[49:17.570 --> 49:21.010]  I mean, you know, there's a lot of people trying to fix this.
[49:21.270 --> 49:23.590]  Sometimes you just have to kind of come to a...
[49:23.590 --> 49:26.950]  build a consensus that these things get replaced and sometimes you can fix them.
[49:27.150 --> 49:31.930]  And I think that's true of kind of all the problems with engineering, even non-software engineering.
[49:32.310 --> 49:36.030]  Like, there's a point where you realize the bridge really sucks and we have to shut it down and replace it.
[49:36.190 --> 49:40.150]  But until then, we're going to keep tacking more pieces of metal on it and hope it doesn't fall down.
[49:40.610 --> 49:43.310]  Like, this is one of the great problems of engineering.
[49:44.410 --> 49:50.010]  So I think when it comes to these security tools, this brings me weirdly back to the digital literacy part.
[49:50.170 --> 49:59.150]  We need to be educating communities, educators, communities of concern into supporting, into a consensus to support replacing really bad pieces of Internet infrastructure.
[49:59.510 --> 50:01.970]  So they need to understand why they need to do that.
[50:02.130 --> 50:17.290]  And that means we who have that knowledge need to get better at communicating that to them and bring that message to people and help them join our consensus to replace SSL2 and to fix the CERT system or something like that.
[50:17.690 --> 50:18.130]  Okay.
[50:18.330 --> 50:18.890]  Thank you very much.
[50:21.210 --> 50:21.690]  Okay.
[50:21.690 --> 50:22.850]  I had a question.
[50:23.230 --> 50:27.690]  You talk about how we have to try and drive adoption.
[50:28.110 --> 50:32.030]  The problem is there's a lot of people who feel, oh, well, it's not my problem.
[50:32.090 --> 50:32.790]  Why should I care?
[50:33.850 --> 50:34.330]  So...
[50:34.330 --> 50:36.470]  I actually specifically don't want us to drive adoption.
[50:36.470 --> 50:39.830]  I want us to take the software that's been adopted and work on it.
[50:40.110 --> 50:40.490]  Okay.
[50:41.470 --> 50:59.190]  But the follow-up I have to that is with having it adopted and trying to improve existing software, how would you go ahead and say, okay, you should use the improved version rather than the version you're normally comfortable with?
[50:59.650 --> 51:11.170]  Well, I do want to say really quickly, and I think we all need to admit this, that this community has had almost no successes with adoption except maybe SSL.
[51:13.270 --> 51:14.150]  Like, none.
[51:15.250 --> 51:18.910]  So we need to work with other people who are better at that, in short.
[51:19.070 --> 51:21.350]  Which, again, means a lot more cross-connecting.
[51:21.430 --> 51:22.270]  I've got one minute left.
[51:22.350 --> 51:23.690]  Let me take this one last question real quick.
[51:24.530 --> 51:24.930]  Hi.
[51:25.350 --> 51:29.510]  You were talking about schools and or education and security.
[51:30.230 --> 51:38.810]  And what it made me think of is, how can a school teach security to children when it seems like one of their main goals is to not allow children any privacy whatsoever?
[51:39.370 --> 51:40.830]  That is a great question.
[51:41.070 --> 51:44.630]  And I think that's something that we need to be doing more to talk about kids' security.
[51:44.770 --> 51:47.630]  I really appreciate what people like Dana Boyd have done around this.
[51:47.750 --> 51:56.250]  But I think actually one of the reasons, one of the ways we teach them security and one of the ways we sneak under the radar with this is that we teach them what the network is and how the network sees them.
[51:56.730 --> 52:03.530]  And once people understand what the network is, I didn't teach my daughter that Google, you know, was bad and violated her privacy.
[52:03.730 --> 52:06.610]  I said, so they do this thing called a cookie.
[52:07.590 --> 52:08.670]  And here's what it does.
[52:08.850 --> 52:19.510]  My 11-year-old daughter, after I explained how cookies and JavaScript work, decided that if she was going to be logged into her YouTube account, she was going to do it on a browser that she didn't use for anything else.
[52:19.670 --> 52:22.730]  She came up with that idea after I explained how it worked to her.
[52:23.210 --> 52:25.770]  So kids are incredibly privacy-seeking.
[52:27.510 --> 52:27.950]  Incredibly.
[52:28.350 --> 52:30.430]  They don't lack the desire for privacy.
[52:30.430 --> 52:32.710]  They lack the education and the means to get it.
[52:33.150 --> 52:42.950]  So I think teaching about the network and not just kids, but communities at risk, communities of interest, we need to get out there and teach about this thing we've built before it kills more people.
[52:43.430 --> 52:43.490]  Thank you.
[52:43.490 --> 52:43.770]  Thank you.