why aren't all 6 resolved? a statement only gets an assessment when the public
record can support or contradict it. opinions and what-ifs never can, and 0 checkable
ones are still open, waiting for their date. predictions held up or didn't;
assertions are supported or contradicted. on every card:
▮▮▮▮▮ certainty ·
▮▮▮▮▮ debate potential. speakers are clickable
Insight
Niels Provos: Computer security is an incentive problem, not a tech problem
“It's probably not really a technology problem, it's an incentive problem.”
Assertion Not checkable as stated
Provos: Google experienced zero successful employee phishing attacks after mandating hardware keys
“We have mandated a hardware second factor for everybody at Google since 2009. You know, everybody is using a security key nowadays. We have not had a single successful phishing attack against a Google employee since then.”
Prediction Not checkable as stated
Provos: Everyone will rely on managed cloud providers for security by 2028
“In 10 years, everybody is going to be on a professionally run cloud that takes care of all of your security needs.”
Assertion Not checkable as stated
Provos: Google cannot offer mandatory hardware security key protection to billions
“Google rolled out this advanced protection program where you are forced to associate a security key with your account. That's the only way that you can get into your account. But that is not something that we can offer to billions of users.”
Assertion Contradicted
Niels Provos: Chromebooks with security keys create uncompromisable endpoints
“I continue to be a big proponent of something like a Chromebook with a security key, right? Essentially, you have an endpoint that cannot be compromised, even if you try. Because the weak point in all of this continues to be the human.”
Insight
Provos: Security doesn't need to be perfect, just better than peers
“Well, another thing that remains true is, adversaries often go to the place where the bar is lower. Right? So you oftentimes don't need to achieve perfect security, as long as security is mostly higher than somebody else.”