2017: The year of encryption

Starting this month, Chrome users are going to start seeing a lot more sites flagged as insecure. Google is firmly on the technologist side of the encryption war, and it wants to make encryption something regular people care about. Why?
Not using encryption is like sending everything you visit/everything you do, scrawled upon postcards, with stops in all sorts of places, passing by people you would not want seeing everything.
Google is going to start by complaining (loudly) when you visit an unencrypted page that has a credit card field or a password. While most e-commerce sites that collect credit cards are using SSL, a huge number of sites running Drupal or WordPress or Joomla do not. Including yours?
Google has decided for us all, that in 2017 it's just not safe to use a password on an unencrypted site, and starting next week you will know about it.
In another 6 months to a year or so, Google plans to mark all unencrypted websites as insecure.
We've already turned on encryption for all of our maintenance and hosted clients, if you need some assistance with SSL feel free to reach out!

So what's all this about a back door?

We're in the midst of an encryption arms race. On one side, technologists are creating stronger encryption systems, while on the other side, politicians and governments are trying to outlaw strong encryption, or at least put in back doors. What does this have to do with a padlock on my browser?
Other than some of the math involved in the underlying cryptography, back doors don't have much to do with SSL certificates and your browser. What they are really after are secret messages sent between groups or individuals. Many among law enforcement see strong encryption as a big threat, a way of hiding illegal activity that is very hard to decipher.

What about terrorists/the bad guys?

The thing about encryption is, it's already out there, and the bad guys know how to use it. And so do the good guys. The battle over encryption is really one about privacy. Do you want a world where everyone knows everything about everyone else, or do you want a world where people can be left alone, with some sense of privacy?
I'm of two minds about this fundamental question. I really don't care if people can see everything I'm doing -- I'm just not that interesting, and don't have anything to hide. I certainly don't want to become a victim of fraud, though, so while our social security numbers and credit card numbers remain sensitive information and should be protected, I don't necessarily care about the rest.
I do care about transparency, especially when it comes to holding people in power accountable for their actions. Exposing the secrets of despots and incoming presidents may not be that effective, but certainly identifying conflicts of interest and exposing back-room deals is on the whole a good thing.
And yet, the cat's already out of the bag. We have strong encryption now, and people with something to hide will use it. And if we use strong encryption, we can regain some privacy, carve out safe spaces for people who are discriminated against to gather, and more.
Strong encryption protects child pornographers and terrorists. But it also protects children. And minorities. And people living in oppressive regimes. And whistleblowers who have important secrets to share. And your identity.
On the whole, as a society we've been moving more and more towards an open, transparent place. Sadly, that's the kind of environment where miscreants can do a lot of damage to a lot of people. Encryption is a tool that at the moment, can guarantee you're connected with the person or group you think you're talking to, and it can make your conversation entirely private. If we didn't have this strong protection in place, we'd have far more cybercrime than we do now -- and nobody could trust the Internet enough to conduct any kind of e-commerce.
The biggest concern technologists have around putting any kind of "back door" into strong encryption, is that it makes it, well, weak. There's really only a couple ways this can be done: weaken the algorithm with some sort of secret way to defuse it -- which will surely be discovered sooner rather than later -- or have all private keys also encrypt to a law-enforcement's key, so that law-enforcement can decrypt it. But what if your law enforcement is corrupt? Or you're a whistleblower trying to report on a corrupt law enforcement entity? Or if your law enforcement is a large bureacracy that can be easily attacked via social engineering, and these secret keys revealed?
Having a skeleton key like this becomes a much bigger target than there was before. If every iPhone had a skeleton key built in so the NSA could decrypt it, do you really think the NSA can keep that key out of a crack Russian hacking team, when the payoff is the ability to decrypt hundreds of millions of phones?
And any other sort of algorithmic weakening will lead to exploit toolkits that your neighbor teenager might pick up, and next thing you know, your identity is up for sale on the dark web. Oh wait, it already is.
This is why we need strong encryption.
This is why we can't have any back doors in it.
Strong encryption is subject to United States export regulation, because it is considered a weapon... apparently there is some illusion that they can keep it out of the hands of hostile countries. I wonder... does this make it subject to the 2nd Amendment? "You can pry my strong encryption out of my cold dead hands."
Want to learn more about encryption? Read our primer: