Privacy technology everyone can use would make us all more secure

Simply Secure aims to revamp the user interface of the internet’s favorite privacy tools. Photograph: ANDREA COMAS/Reuters

Internet privacy tools have an unfortunate but well-deserved reputation for being technically difficult and bothersome. There’s a persistent story that says that there is an intrinsic, irreducible complexity to the problem of keeping your communications from being snooped on and keeping your data from leaking that makes it the exclusive domain of spies and the professionally paranoid.

I don’t believe it. I think that the real reason that privacy is so user-unfriendly is that the case for privacy is intensely technical. The privacy risks presented by everyday internet use involve subtle and esoteric principles – understanding the risks of having your computer turned into a node in a botnet; or having its passwords harvested; or having your search- and browser-history logged and used against you (either to compromise you directly, or in use for attacks on your password-recovery questions); and having your metadata mined and joined up in ways that reveal your deepest secrets or result in false, incriminating, and hard-to-refute accusations being made against you, potentially costing you the ability to get credit, board an airplane, or even walk around freely.

You don’t need to be a technical expert to understand privacy risks anymore. From the Snowden revelations to the daily parade of internet security horrors around the world – like Syrian and Egyptian checkpoints where your Facebook logins are required in order to weigh your political allegiances (sometimes with fatal consequences) or celebrities having their most intimate photos splashed all over the web.

The time has come to create privacy tools for normal people – people with a normal level of technical competence. That is, all of us, no matter what our level of technical expertise, need privacy. Some privacy measures do require extraordinary technical competence; if you’re Edward Snowden, with the entire NSA bearing down on your communications, you will need to be a real expert to keep your information secure. But the kind of privacy that makes you immune to mass surveillance and attacks-of-opportunity from voyeurs, identity thieves and other bad guys is attainable by anyone.

I’m a volunteer on the advisory board for a nonprofit that’s aiming to do just that: Simply Secure (which launches Thursday at simplysecure.org) collects together some very bright usability and cryptography experts with the aim of revamping the user interface of the internet’s favorite privacy tools, starting with OTR, the extremely secure chat system whose best-known feature is “perfect forward secrecy” which gives each conversation its own unique keys, so a breach of one conversation’s keys can’t be used to snoop on others.

More importantly, Simply Secure’s process for attaining, testing and refining usability is the main product of its work. This process will be documented and published as a set of best practices for other organisations, whether they are for-profits or non-profits, creating a framework that anyone can use to make secure products easier for everyone.

Technical people need our non-technical friends to adopt good privacy practices. Every communications session has at least two parties, the sender and the recipient(s), and your privacy can leak out of either end of the wire. It doesn’t matter if I keep all my email offline, encrypted on my laptop, if it all ends up in the inboxes of people who leave it sitting on Gmail’s servers.

So this is critical, and not just for “normal people”. Even technically sophisticated people often find it difficult to follow security protocol in their own communications and computing. Things that aren’t usable just don’t get used. Making crypto as easy as your favourite websites and apps is the only way to make privacy a reality for everyone.

This is also critical, even for people who aren’t worried about their private lives spilling over into the databases of big corporations, spies, voyeurs and identity thieves. If you were lucky enough to be born with the unearned privilege of having “nothing to hide”, then you owe it to your children, brothers, sisters, parents, and friends who don’t have your good fortune to help provide cover for them: if the only people maintaining their privacy are the people with “something to hide”, then figuring out whose health, political beliefs, sexual orientation or other personal details are sensitive is just a matter of presuming the guilt of anyone who tries to protect her privacy.

In the days before the desktop publishing revolution, all the tools for setting type assumed a huge body of highly technical knowledge and skill. It’s true that beautiful, high-spec typesetting still requires this knowledge and skill. But between beautiful, professional-grade design and hand-written scribbled notes are a huge range of typesetting possibilities, things that were once the domain of skilled experts are now possible for virtually anyone to attain. Making privacy technology usable by anyone makes everyone more secure.

Bottom line: your computer should do what you ask of it. Asking it to keep your private information private is a reasonable request.

View the original article here