Why I won’t talk to you about security again

After some field testing these notes are ready to meet the general public. While most of these ideas are somehow related to my work with(in) Telecomix, they are not an official standpoint. As if we could ever have one, anyway.

First off, security is for webserver admins, programmers, consultants and all those people for whom it is either a part of the job or a cash cow. Now, you can argue that as a citizen journalist, whistleblower or political activist security _is_ a part of your job. But I hope to prove you mistaken. You see, it’s not really about security. Security is about tools, practices, neat tricks and so on. And it is great, really great, but it’s not something people in general have an easy time getting into. Sure there are useful graphical frontends to GPG. OTR is mighty easy to set up and use. And proxies, tunnels and stuff like Tor is really not that complicated either.

But it’s all about tools. In the end, good programming practices and even physical security is all tools. This is why I won’t talk to you about security again: I am not a programmer, nor a hacker, nor a security consultant. And chances are that most of the people I speak to as a Telecomix agent or a freelance educator are even less skilled than I am. So I’ll shut up about security and talk about more useful stuff. Namely, secrecy.

Why secrecy? First and foremost, when you talk about security, and therefore tools, you give people a bunch of stuff to learn and work with. The methods are the framework, the tools become the point. And people might end up misconfiguring stuff, using weak passwords and leaking info all over the place. Or they will take a look at the tools, realize that ”gpg –recv-keys 64E476C6” is a bunch of gibberish (it is!) and either stop caring or get depressed. It’s hard to get the point of using secure tools across when security feels that hard to acheive. But secrecy, not so much. We’re used to keeping stuff secret. Most of us are pretty damn good at it, especially those of us who are hunted by some of the most ruthless intelligence agencies in the world, like a lot of people I’ve met recently.

So in order to make people actually use the damn tools, in the future I will talk about secrecy rather than security. I will tell people about iPhones storing your location in the EXIF data of the pictures you take. And about how encrypted VoIP streams can be analyzed to extract phoneme data. How data from Skype always passes through Skype’s servers and how your Gmail account is a weak point if it has a weak password and you send important information unencrypted. But — and this is the really important part — I will also spend lots of time talking to you about how secrecy is a way of thinking. It’s about not trusting your own computer, your internet connection nor the services you use. It’s about risk minimization in that environment, and being a hard target. It’s about shutting your mobile phone off before you leave for a meeting, and talking about important stuff face to face.
What I find really important about moving from security to secrecy is that it allows us to think about what we actually want to keep secret, and from whom. Because of this, thinking about secrecy is just as valuable for people like me who do most of what I do more or less openly as for the aforementioned people who are hunted by intelligence agencies. While security is often an all-or-nothing affair, since a weak spot can crack the whole system open, secrecy is about managing what information someone can gather about you. Depending on your situation and what you do, that someone might be Google and Tradedoubler, who can gather lots of info without actually trying. Or they might be someone like the belarusian KGB, that try pretty damn hard. You have to ask yoursef what secrets you want to keep. Your name? Your political affiliations? Your online habits, or your network of friends? Once you have those answers you can begin looking at tools and practices. Not the other way around — that’s for server admins and programmers.

The question of moving from security to secrecy is still a work in progress, but I do hope that this can spark some great ideas in other people. How would you go about changing your thinking from ”being secure” to ”being secret”?