Blog's control panel: | Home | Tags | Index | Rss 2.0

Saying something that isn't false isn't lying: security and customers.

Fri, 16 Feb 2007 | Permalink | Tags:

Especially when talking about technical matters, any statement should be completely transparent and adhere to details and limits of the technology it refers to. Unfortunately this isn't always possible, and not necessarily because of evil businessmen trying to cash as much as possible from unsuspecting customers. Sometimes it's just impossible to get customers to understand or even accept that technically speaking, given a certain problem, there's no silver bullet or 100% secure solution. And one, at least me, would expect this to be easy to accept since it's pretty much the same in real life, you know, the lovely next door mate which turned out to be a serial killer; some stuff is just out of our reach, no matter how many locks, alarms and precautions we take. But for some reason this seems to not apply to computers.
I got into a discussion a few days ago about content protection. Assume this scenario: the business B runs a website where content provided by customers (C1 and C2) is distributed via secure and private channels to users U1 and U2. At this point friends of U1, F1 and F2 come into the play, and given necessary credentials by U1 access the protected content. And here things blow up, with C1 and C2 phoning B because their precious content had been distributed to non-authorised users. They found out because access to those resources is logged and two concurrent connections from different IPs has been spotted (U1, if you're reading, get yourself some smarter friends!).
If you're reading this probably you already know what I'm gonna say, but I'll say it anyway: if you can see/watch/read/listen to it, you can copy it. That seems to be as given for me as alien for C1 and C2. And it's true for any other form of security: there's no definitive protection, take even the strongest cryptography techniques, it's not a matter of making it impossible, it's a matter of making it so hard that it's not worth it. I'm not saying we should just give up and don't even try to protect what we value, simply calling for more awareness and realism.
Bottom line, there isn't much to do about it, you won't ever get the customer to accept reality and if you wanna keep your business going you gotta deal with it. How? well, personally avoiding blatant lies, stuff like "the ultimate solution" and similar punchline evil corporates like so much (and unfortunately also big clueless customers); but at the same time do not even try to be 100% transparent, do the best you can behind the scenes, and reassure the customer at your best (without promising something you won't be able to hold onto). Because the trust is, probably as human beings rather than customers, they would rather believe a lie than a truth they have no control on.




SpikeLab.org is a Filippo Spike Morelli copyright 2005-2008
This work is licensed under Creative Commons Att-SA License.