Schneier on Security

Julien Couvreur • August 7, 2012 7:17 PM

So we have a former government bureaucrat in charge of privacy policy claiming that there is insufficient privacy (in his opinion) and therefore we need more policy. Surprise!

Nowhere does he actually explain how he is able to decide what are the proper trade-offs that consumers and the industry should make, or why such trade-offs should be centralized and monopolized (a single approach forced on all).
The truth is that competitive forces and consumer choice allow features to evolve and better trade-offs to emerge. Privacy is just another feature which services compete on to respond to consumer preferences and demand. But central planners are eager to apply their own views and preferences, at the point of a gun if necessary (but it's for your own good).

I had a laugh at his first point "The threat of government regulation spurs the adoption of self-regulation."
Nobody would call industry regulation under threat of government action "self-regulation". It has nothing voluntary, the gun is simply in the back-pocket. I have experienced it firsthand on a few occasions and it is very clear that the decisions are geared towards would-be-regulators, not towards consumers (which is usually the focus).

Julien Couvreur • August 9, 2012 4:20 PM

@abc says "I do not know whether the business keeps my password in a plaintext or not. There is no way to know."

True, just like I don't know whether a business encrypts my credit card on their server.

That is foreseeable and consumers can decide that they are not getting enough guarantees to earn their trust, and so abstain from using the product.
This is a problem for the producer to solve, as opposed to consumers.

As a business, you therefore have to come up with ways to signal that you are indeed doing the right thing. For example, you can offer guarantees (contract), commit publicly (put your reputation on the line), submit yourself to audits (trustEE, Underwriters Laboratory), or rely on other well-known provider (VISA certification).
If you want to give consumers confidence that you offer a high-security product, pay Schneier's company to do penetration testing, or offer a bounty for hackers to try and breach your systems.