How Do You Explain Crypto Well Enough for People to Use It?

« Encrypted Hard Drives Can Fall to RAM-Based Attack | Main | Three Ways to Mitigate the Risk of a "Cold-Boot" Attack »

February 22, 2008

How Do You Explain Crypto Well Enough for People to Use It?

I wrote an introductory article on IM encryption for Instant Messaging Planet. There are a number of options, but once you narrow it down to things casual users might entertain doing, the list gets a little more slim. Especially when you think in terms of people wanting to stay on their existing network, or at least stay in the realm of the more common public networks.

I included OTR, but in the process of including it realized my powers of description for both OTR and PGP aren't as strong as I'd like them to be.

For OTR, I'm not sure that's such a huge problem because the implementation is so simple. Here's a screen from Adium that shows the generation of an OTR key:

It comes close to "just works." And I can certainly see the average "dude in the cube down the row" immediately grasping and using something presented to him as "click this button, then when I IM you, click this one and nobody can read our stuff."

PGP? It's a hassle to explain on any practical level, because there is no "just do x, then do y" that doesn't involve "Oh ... right ... pick 1024 bits ... and remember to add me to your keychain ... and ... and ..." And on the description side, it gets pretty cumbersome, too.

So there's my resolution for next week: Write a working explanation of both OTR and PGP I can put in a file somewhere. Or get Vangie to put in Webo.

(Link)