From: smb@research.att.com
Date: Wed, 6 Jul 94 04:16:16 PDT
To: tcmay@netcom.com (Timothy C. May)
Subject: Re: Most People don't Think about Security
Message-ID: <9407061116.AA23110@toad.com>
MIME-Version: 1.0
Content-Type: text/plain


	 Safe manufacturers have said that improvements in safes (the metal
	 kind) were driven by insurance rates. A direct incentive to spend more
	 money to improve security (cost of better safe < cost of higher
	 insurance rate).

Have a look at Ross Anderson's paper ``Why Cryptosystems Fail'' from
the Fairfax conference.  He points out that one reason U.S. banks use
better security for their ATM cards than do U.K. banks is a difference
in the law:  in the U.S., the banks are (generally) liable for disputed
charges.  Again -- if you pay for failures, you worry about the security.

	 Personally, my main interests is in ensuring the Feds don't tell me I
	 can't have as much security as I want to buy. I don't share the
	 concern quoted above that we have to find ways to give other people
	 security.

We have to find ways to make strong security usable.  As you pointed out in
the part of your note that I deleted, banks couldn't deploy 10-digit
PINs even if they wanted to.  And if a bank can't deploy a strong security
system, then we -- who care about it -- can't use it.