So, encryption. Why?
Is it…
In the discussion here before,
the… One of the common points is that it’s, well, hiding my big one secret.
I’ve been trying to find a big fun image here, but you have to input it yourself.
So, is it hiding my big secret?
No,
it’s not about hiding your big secret,
it’s actually about control.
You,
every people have, you know,
what they call “private” information,
and “public” information.
People have public information
which they actually try to, you know, keep
secret from the public’s eye,
and
I think it’s actually not good to talk about “hiding” when you talk encryption,
because “hiding” is not about the same thing as “private”.
I have a lot of things that are private,
but I don’t try to actually hide them.
I mean,
I don’t have web cams in my room always
looking at me,
Observing every move I make.
That’s not because I’m trying to hide what I do
at my own home,
it’s simply because I see my own home as private.
So,
This control you have of all your information;
first of all, how do you lose it? Well, you can lose it in full by giving it away,
and that’s a very wrong way to be giving out information.
So,
Google is
a key example here on Gmail.
You
send your email, or actually other people send their emails to email servers,
They have the email, they actually see the email as theirs.
It’s not your emails, you have the right to read emails,
you have the right to copy the emails,
but the emails are actually not yours, it’s theirs.
So, trying to control,
to keep the emails private, is actually
kind of impossible because they’re not yours anymore.
The same thing goes for most online sites,
Google Docs is a good example, FaceBook, Flickr,
every one of those sites,
or most of those sites, have
a rule that says
“You give information to us,
and you get some free doodads, some free web things.”
Beware of the cloud!
So, what other ways can you
get control away? Well, it can be taken away, of course.
And of course the way we think about it, we can think about either, you know, thieves in the dark,
you know, airports and laptops and all that.
And we have also
industrial espionage or, you know…
I’ve actually heard a few times about a university losing information because people actually go in and steal briefcases and stuff like that from researchers
You know, my own university in a
small
town called Ronneby,
have actually people from another country
actually spying on researchers there.
It’s not that common, but it’s not that uncommon either.
And of course you have this nice thing called “shared space”, you know,
in a data center, university computer lab,
or when you actually, you know, buy or rent a VM computer somewhere.
From your hosting provider or similar.
A common expression is, or people say that “Oh, my hosting provider is completely utterly secure, because they’re in a nuclear bunker” (or
a room in a mountain or…) “and they’re completely secure from all kinds of penetration and espionage!” and
all that stuff.
So where’s the mouse?
There’s a small movie here,
relevant to this discussion.
So yeah,
if you share a space,
the shared space will, can be seen as one entity.
And if anyone can see something as “Oh, it’s this group of people.”,
then you actually,
you know,
you don’t have any rights beyond
what they think is “the group”, OK. It could be
a data center, it could be a house,
it could be an apartment
— it all depends on who is looking and who is saying what.
So,
what is the common answer when not encrypting?
OK,
one
very common answer that I see online and
on surveys done on this subject is,
they say
“But my computer will be slow! Doesn’t encryption with all those
math and these bits going
from one side to another –
doesn’t that slow down everything?”.
And the real answer is “Not really.”.
And
if you need to move, like, I don’t know, 100 Megabytes per second
to the server
regularly, like every day, and have web servers depending on what those 100 Megabytes writing all the time,
yeah, you might get a bit slower computer.
That’s not really common.
Maybe movie makers need to do that, but they don’t have web
tools that need to access that quickly, so I don’t really know.
It’s…
The big
thing
in performance is CPU, and CPU don’t have to be a big issue nowadays.
If you have really slow CPU
and that is your biggest problem,
OK,
encryption won’t help it,
but if you buy a, if you have a new computer or,
you know, CPU is not the biggest problem in the world,
this is not going to slow it down.
So, is it hard to install?
One step.
And that’s it!
That is the base install. OK, this is a simple version, but
it doesn’t need to get much harder than this.
So, passwords.
Aren’t they a little bit boring? “I don’t like to type in my password too often!”
Well, are you doing it once already?
Like, you know, logging in to my computer already?
Then you can just replace that step with encryption,
so you get the same thing, you need to log in, you need to type in the password to log in, and it works the same way as,
you know, Windows login or whatever you use.
Servers have long been a problem because you want to reboot them,
and then you don’t have to go in and climb into the server room which might be cold or might not have all the keyboards plugged in.
And typing in all those passwords on all the servers is not fun, after a power outage or something similar.
That is actually why we started this project.
So.
Just a quick notice:
If you have a web
or mail server in your home
I actually think you should encrypt it.
It should never be unencrypted, because you are actually responsible for your users, even if you’re just yourself or if you’re responsible…
Yeah,
well, if it’s only yourself, then you should
actually think about your own privacy a little bit, but otherwise
you should always try to protect your users.
That is, you’re not responsible for what they do, but you are responsible for keeping their data safe,
because you’ve taken on that responsibility.
And if somebody takes your server, for whatever reason,
you should be able to confidently say that
your users’ data has not been compromisd.
You owe it to them.