zlacker

One topic I find missing from the privacy and security debate following Snowden's revelations is an explicit consideration of the adequate threat model.

If the public thinks that the most prominent attackers on their privacy, security or identify are the best founded intelligence agencies on the planet, then the likely outcome will be grumpy resignation and consequent failure to protect against more mundane (and more likely) threats. Security and encryption are considered difficult and tricky. Even for software engineers. Raising the bar by highlighting the scale of resources of the most competent attackers is counterproductive.

I think a practical threat model for an average internet user should highlight cyber-criminals, accidental misconfiguration, and careless handling of private information. Not NSA or GCHQ.

Edit: The discussion of mischief by NSA and GCHQ belongs to the debate on public oversight of government agencies. The article above is about using encryption on the internet.