My favorite oversimplifier, Jakob Nielsen is At It Again. This time it’s computer security.

As usual, there’s some meat in the soup. Computer security should be easier for normal people to set up. He uses the analogy of locking a car. That level of security for a computer should be trivially easy for a user to set up. And while it’s not enough to keep out a crack team of agents, neither is locking your car. He should carry the analogy further.

Why is it that simply locking the car door is considered sufficient security, when any determined thief can still steal the car if it’s locked? Because insurance will replace what’s lost, and because your loss is limited to the car itself and what was in it.

So, following the analogy through to the end, if we want lock-the-car-door security on our computers, we should so arrange our computers that anyone breaking in to them will only be able to damage the computer itself, and we should be insured against the loss of whatever can be gained by breaking in. If those two factors hold, then computer security on the level of a locked car door is a realistic step to take.

On the other hand, if what you’re wanting to do is store the minutia of your life in the box, you should treat the box as if that is indeed what it’s holding. If you’re the type who would leave every dolloar you possess in an open shopping bag sitting on the seat of the car in plain sight, then yes, I suppose once again you should use the locked car door level of security. If you wouldn’t, then why are you doing even less than that to protect it simply because it’s on your computer?

And user education does factor into the equation. If a man walked up to you on the street and said he needed your banking information in order to transfer 85 gazillion dollars from point A to point B, how many of you would instantly hand over the information? I thought not. Yet a surprising number of people do so in the computer equivalent; they have this knee-jerk reaction to believe every single thing that floats into their mailbox.

If you received a letter that had the return address of someone you knew, yet contained an ad for viagra and breast enhancing pills, would you automatically assume your friend had sent the information to you? Or would you check the postmark to see if it came from a place your friend would be sending from? Yet how many people always believe the “From” field on an email, which is no harder to fake than the return address on a letter?

Ordinary people with loads of common sense suddenly lose touch with all that sense when reading an email or a web page. They wouldn’t believe it if someone said it to their face, but This Is On A Computer, So It Must Be True?

Computer security should be easier, at least for moderate levels of security. It can’t be made simple to lock a computer down to the point of impenetrability; the only computer impossible to break into is turned off, unplugged, encased in concrete and buried at the bottom of the Marianas Trench. And even then I’m not 100% sure it’s safe.

Following all of Nielsen’s suggestions doesn’t get you to safe, either. Encryption can be broken, and is being broken every day. Digital signatures can be faked or fooled (remember the company that obtained a specious MS signature?) so are not foolproof. It’s not possible to open a hole to get trusted things done without at the same time opening a hole for exploits. If you let one kind of traffic through, anyone who successfully pretends to be that sort of traffic can also come through. And let’s face it, fooling computers really isn’t hard; fooling people is much harder. A human shop clerk would never accept that this 6’8″ 300-lb body building he-man in front of her is actually Hermoine Havealot; a computer would, and does every day.

And automatic updating? Yep, that’s really a foolproof system. All an attacker needs to do is compromise one domain resolver, and you’re automatically downloading and installing a fake update. A simple redirection of your access. Oh, you thought the Internet’s domain system was foolproof?

Sure I’m paranoid. But am I paranoid enough?

Bottom line: you, not Bill Gates, not Steve Jobs, not even Linus Torvalds, are responsible for what is happening in your own computer. Act like it. Stop believing that everything you see on a computer is true. No computer ever created is better at knowing how much you want to risk, and what you want to protect, than the one between your ears. Turn it on, feed it good information, and use it. Those silicon counterfeits laying around on desks can’t hold a candle to it.