From: stewarts@ix.netcom.com (Bill Stewart)
Date: Thu, 20 Jul 95 00:38:42 PDT
To: "Robert A. Hayden" <cypherpunks@toad.com>
Subject: Re: "Hey Phil! Stop telling people *not* to use PGP!"
Message-ID: <199507200737.AAA05005@ix6.ix.netcom.com>
MIME-Version: 1.0
Content-Type: text/plain


-----BEGIN PGP SIGNED MESSAGE-----

At 02:00 PM 7/19/95 -0500, Robert A. Hayden wrote:
>> I am fond of saying that we PGP enthusiasts have two choices ahead of us
>> within a couple of years:  either 5,000 enthusiasts using PGP with
>> MAXIMAL SECURITY at all times, or 5,000 enthusiasts with MAXIMAL
>> SECURITY and 10,000,000 computer-illiterate e-mail users using PGP with
>> push-button interfaces and multi-user remote systems.

>I said it last week, and I'll say it again.  From a sociological
>standpoint, it's those 10,000,000 computer-illiterate e-mail users that we
>need to focus all of our efforts towards.  Those 5,000 literate people we 
>really don't have to care about.

But there are two different classes of issues here - the convenience-only
issues,
which can be fixed with bells and whistles and GUIs and
audio-enhanced-RTFM-buttons,
and the security-related issues.  For security, there are three classes of
users:
        1 - folks with standalone systems and dial-up mail - no problem
                This is a _lot_ of users - AOL, Compuserve, etc.
        2 - folks with single-user systems on networks - they need to make
                sure they've got PGP installed right (relatively easy,
                with local disks, but fancy install widgets may help), 
                but beyond that they've got to know that PGP is only as
secure as
                their machine and network configuration.  Mostly ok,
                and to the extent it's not, they've got other serious problems.
                This is also a lot of users.
        3 - folks with shared machines - these folks (mostly Unix users and
                college students, plus people who have web-space they need
                to telnet to, like me) do need to know their limitations,
                and currently have the most problems with convenience,
                having to haul files back to a secure machine to encrypt
securely.

                The first step is education - manuals that say "Don't Panic
                Unless You Need To Be Paranoid" instead of "Panic Immediately",
                that can make them aware of the risks and tradeoffs.  It's about
                two pages of well-written stuff, if someone wants to write it.
                The next step is either building convenient tools to help
                them with encryption, or building convenient installation
scripts
                for the tools that already exist (e.g. mail, or scriptable
                terminal emulators which can automate a lot of the hauling
around.)

The big payoffs are for groups 1 and 2, but a lot of the technically savvy
people
who read manuals and have to convince system administrators to install stuff
are in group 3.  So this is basically a writing job, plus talking the PGP 3.0
people and maybe Phil into including the discussion with the manuals.
Remailers, btw, are in this class, since they need to leave their
passphrases out
in relatively unprotected shell scripts.

I used to run PGP on a diskless workstation (at least I was one
of the people with the root password :-), but I was aware of the risks.
I'm now using it both on my Netcom+Eudora+PrivateIdaho system and on the
machine where I have web space, which I have to telnet to across Netcom.
I take care of the trust problem there by using a short key with a big ugly
"untrustable" string in the user name, and using S/Key to log in;
if I had an encrypted telnet to run on both ends I'd probably want to use it,
so I'm watching the Stel and other new stuff coming out.

                                    Bill Stewart


-----BEGIN PGP SIGNATURE-----
Version: 2.6.2
Comment: You can get PGP by anonymous ftp from ftp.ox.ac.uk

iQBVAwUBMA4HvfthU5e7emAFAQFrMwH9Hh1oYQKvsuV/IyVUskv2aZbmuh8fXQgK
XpSpucrJV27tlFbjIDVqmapMR77arZVOm2Hs0/NTB2uT2jDG1r5+Lw==
=fRtS
-----END PGP SIGNATURE-----
#                                Thanks;  Bill
# Bill Stewart, Freelance Information Architect, stewarts@ix.netcom.com