Exactly. Ethics is just the wrong way to think about it.
It's like the people emptying weak brainwallets. Is it unethical to empty the brainwallet for "password123"? Is it unethical to pick up a quarter lying on the sidewalk? No and no.
Saying that strangers on the internet are bound by ethics is unrealistic.
Instead, we should build systems that are resilient.
For example:
* A brainwallet generator should estimate passphrase complexity and warn if it's too low
* Tor Browser should show a red lock icon for plain HTTP and warn users clearly that their traffic may be read
Blame the program, not the person. Calling the inevitable attacker "unethical" just isn't useful. Saying the user is dumb or Doing It Wrong isn't useful either.
Good crypto software should be resistant to both misuse (by Adam) and abuse (by Eve)
It's like the people emptying weak brainwallets. Is it unethical to empty the brainwallet for "password123"? Is it unethical to pick up a quarter lying on the sidewalk? No and no.
Saying that strangers on the internet are bound by ethics is unrealistic.
Instead, we should build systems that are resilient.
For example:
* A brainwallet generator should estimate passphrase complexity and warn if it's too low
* Tor Browser should show a red lock icon for plain HTTP and warn users clearly that their traffic may be read
Blame the program, not the person. Calling the inevitable attacker "unethical" just isn't useful. Saying the user is dumb or Doing It Wrong isn't useful either.
Good crypto software should be resistant to both misuse (by Adam) and abuse (by Eve)