Privacy tools? Don’t believe the hype

Christopher Soghoian, security en privacy researcher, waarschuwt op zijn blog Slight paranoia voor de manier waarop tech media bepaalde privacy tools de hemel in prijzen. Don’t believe the hype, is het eerste deel van de boodschap van Soghoian. Maar hij richt zijn boodschap vooral naar de media zelf, met de waarschuwing dat hype en security een heel ongelukkige combinatie zijn.

Secure communications tools are difficult to create, even by teams of skilled cryptographers. The Tor Project is nearly ten years old, yet bugs and design flaws are still found and fixed every year by other researchers. Using Tor for your private communications is by no means 100% safe (although, compared to many of the alternatives, it is often better). However, Tor has had years to mature. Tools like Haystack and Cryptocat have not. No matter how good you may think they are, they’re simply not ready for prime time.

Although human interest stories sell papers and lead to page clicks, the media needs to take some responsibility for its ignorant hyping of new security tools and services. When a PR person retained by a new hot security startup pitches you, consider approaching an independent security researcher or two for their thoughts. Even if it sounds great, please refrain from showering the tool with unqualified praise.

By all means, feel free to continue hyping the latest social-photo-geo-camera-dating app, but before you tell your readers that a new security tool will lead to the next Arab Spring or prevent the NSA from reading peoples’ emails, step back, take a deep breath, and pull the power cord from your computer.