Re: [Secdispatch] [saag] The Mathematical Mesh

[Phillip Hallam-Baker <[e-mail]>]

On Wed, Apr 24, 2019 at 4:53 AM Ben Laurie <[e-mail]> wrote:

> If we are using QR codes to connect devices, we can transmit the necessary
>> information without the user needing to notice that is what we are doing.
>> Otherwise, there are many existing protocols that make comparison of 15-30
>> character base 32 encoded strings as the basis for mutual authentication
>> and these have proved effective and acceptable.
>>
>
> Oh really? Evidence?
>

We Chat has a billion accounts and is conservatively estimated to serve
about 50% of the population of China. They use QR codes for contact
exchange.

https://en.wikipedia.org/wiki/WeChat

One of the biggest problems that we have made for ourselves is making the
perfect be the enemy of the good. We insisted on end-to-end secure email
and got 0.1% of the mail user population enrolled for credentials of which
less than 1% use end-to-end email regularly.

If you want to offer security usability testing resources to improve on the
schemes I am proposing, I would be more than happy to make any changes they
suggest.

But right now the situation is that it took me over 15 minutes to configure
Thunderbird to use S/MIME. And I know what I am doing. It is a 17 step
process that requires use of a Web browser and email client and multiple
switches between the two. It took me another ten minutes to find the
instructions.

When the current situation is that users are required to poke themselves in
the eye with a sharp stick to get end-to-end security, it doesn't take very
much to improve on that.