A case against security nihilism

Matthew Green · 20 Jul 2021 · blog.cryptographyengineering.com ↗

2 korrents from this piece

Matthew Green did not write this page.

Every claim below was made in this piece, quoted word for word and numbered in the order the piece makes them, so you can read it there rather than take our word for it. The sentence above each quote is our reading of the claim, not their wording. Each quote was checked against a stored copy of the page at build time; where the two differ, the quote is the fact.

Our reading
Shrugging that perfect security is impossible is the wrong lesson: the achievable goal is to wreck the economics of mass exploitation.

Their wordsThe problem that companies like Apple need to solve is not preventing exploits forever, but a much simpler one: they need to screw up the economics of NSO-style mass exploitation.

Interesting
Our reading
What made NSO different was not its exploits but its scale: it turned state-grade surveillance into something any government could buy.

Their wordsRather: NSO’s genius is that they’ve done something that attackers were never incentivized to do in this past: democratize access to exploit technology.

Interesting