Why Are Digital-Privacy Apps So Hard to Use?
Nuk2013/Shutterstock.com
Protecting your data usually means navigating a miserable user experience.
Unless two people are in the same room, it’s hard for them to communicate information securely. Phone calls, emails, and text messages could be open to eavesdropping from governments, companies, or hackers—and even paper mail is subject to tracking.
Truly private online communications have been available for some time, but most require a high level of technology know-how. Those uncomfortable setting up a PGP key to encrypt their emails, for example, have for decades been left without an option to communicate securely.
But since Edward Snowden’s trove of leaked government documents revealed the extent of the National Security Agency’s domestic spying apparatus, digital privacy has begun to enter the consciousness of average consumers, and a small group of apps has sprung up to them. A few companies—most notably, Signal, Telegram, and WhatsApp—have created simple apps for private communication, their pleasant interfaces masking complex security systems built to withstand intense attacks.
Another digital-security software company is trying to make straightforward privacy tools accessible to more app developers—and by extension, to more consumers. SpiderOak has been in the business of protecting data for years, with a Dropbox-like backup service that allows users to save mountains of data on the company’s servers, but in such a way that even the company itself can’t decrypt the information it holds.
The backup service is built on an open-source platform called Crypton, developed by SpiderOak but available for anyone to use. Crypton is a code library that’s meant for other developers to lean on when creating their own apps: It handles privacy protections, allowing less crypto-savvy programmers to focus on other details.
David Dahl, Crypton’s director, says privacy is a user-experience problem.
“There has historically been very little interaction between [user-experience] designers who love to create very pretty and functional things and computer scientists who specialize in cryptography,” Dahl wrote in an email.
That disconnect, he said, has prevented encrypted communication from “looking and acting like everyday software.” Sending a PGP-encrypted email, for example, is a many-step process that involves a lengthy initial setup, finding and verifying the public key of the intended recipient, using software to encrypt a message with that public key, and later decrypting the response.
As a proof-of-concept for simple privacy software, SpiderOak built a basic social-networking app called Kloak on the Crypton platform. Like Twitter, Kloak allows users to broadcast short status messages—but unlike Twitter’s emphasis on public engagement, it only allows sharing between users who have agreed to follow one another, encrypting the messages and photos as they travel between users’ devices.
Still in beta and rough around the edges, Kloak is more an experiment than a viable product.
“It’s an easy way for us to encourage other people to build other zero-knowledge applications,” said Alan Fairless, SpiderOak’s co-founder and CEO. “Here’s a nice example of one: It was built without using any fancy tools, no advanced JavaScript frameworks—just very vanilla, approachable by new developers.”
One of the privacy capabilities that Kloak demonstrates is a simple key-verification process, an essential part of most encrypted communications.
When sending and receiving encrypted messages, each participant in a conversation must make certain that the person on the other end is indeed who they say they are. Many modern encryption services use a system of public and private keys, allowing users to verify their partners’ identities by comparing computer-generated passcodes or images.
One of the ways user-experience-focused apps are making secure messaging more friendly is by making this verification process easier. Telegram, for example, creates a pattern of blue squares based on the public keys of the participants in an encrypted chat, which both ends can view and compare: They should be identical. And an encrypted call made through Signal displays two words on the participants’ devices, which they can compare to verify that their conversation is secure.
Kloak uses a system more akin to Telegram’s, generating a QR code that allows users to add others to their network by scanning it. But SpiderOak says it’s developing a “stylish” replacement for Kloak’s tired-looking QR code that will involve an animated pattern.
“If you’ve ever used a product like PGP, the key-verification process is just a disaster for most people,” Fairless said. “How can we make it feel private, and be effective, and unobtrusive enough that people will actually do it?”
The animated key-verification system will feature in a product SpiderOak plans to launch in the next few months, a team-collaboration application that will compete with tools like Microsoft SharePoint. Derived from the company’s Crypton framework, the software will allow teams to exchange messages and files that will remain encrypted and inaccessible even to SpiderOak employees.
Although Kloak is a bare-bones experiment with little marketing behind it, it’s already attracted some early adopters. Andrew Mitry, a cloud-computing engineer at Walmart, said he was drawn in by Kloak’s privacy focus. Acknowledging that he runs in “pretty tech-savvy circles,” he said many in his network would only participate in social networking “in a private/secure environment.”
Another early Kloak user, Brazil-based beta tester David Nielsen, said he ran into several early usability problems, but was also enticed the app’s approach to privacy.
“At least Kloak offers something unique and hopefully valuable to users in this post-NSA-data-addiction world: the freedom to make an informed decision on privacy,” Nielsen said. “Provided everybody they care about make the same choice.”
Indeed, the greatest obstacle to any privacy-first software is uptake. Security-conscious early adopters aside, many consumers aren’t willing to give up features they consider essential in exchange for encryption, a little-understood and often-vilified tool. And newer privacy-first apps are up against entrenched rivals like Facebook and Gmail, which have built enormous user bases, and survive by profiting from those users’ data.
But as the compounded effect of Snowden’s NSA secrets and the ballooning list of hacks at major companies and government agencies seeps into the public consciousness, there is more of a chance that consumers will demand more privacy from their everyday software.
To meet that demand, developers will need to invest in making the complexities of digital privacy accessible and user-friendly, extending the option of online security to even the least tech-savvy Internet users.
(Image via Nuk2013/Shutterstock.com)
NEXT STORY: Patent office restores service