<body><pre>
Security and Society
Ed Felten     Princeton 

Two Mysteries
 -- Our tools are good, why is our security so bad?
 -- Our tools are getting better, why isn't our security
    getting better?

Economics point of view
 - self is decentralized, selfish
 - how to get global optimum 

Alice World
 - the only user in the world
 - goal: make money, maximize profit
 - security is a means, measures of it deployed
   only if benefits outweight costs
    1. enable new business practices
    2. rule out existing business practices
 - efficient level of security
    lousy might be the right choice, not necessarily
    caused by dumb consumers or dump operators
 - if new tools (better tools) come
    1. adopting new tools
    2. adlopting new riskier business practices
    3. no reduction in security bleaches
 - goal: optimal level of insecurity, but not "minimum"

Multiple-User World
 optimal: maximize total wealth
 "size of the pie vs. how the pie is divided"

 Consumer's choice affect others, others benefits from
 Alice's security investment. Without interadctioons,
 consumer's choices can lead to an optimal result. With
 interactions, it's not.

 So alice will inveset to the extent it benefits her.
 result in under-investment in security. Also no deal possible
 in large network as incentive is to withdraw from the deal
 and free-ride on the investment of deal participants.

 Externality: theory predicts user will under-invest in security
 and yet there are zombie machines left to be used as attacking
 machines.

Let's add vendors to our model
 Vendors compete to provide products that users will buy.
 - maybe hard for users to tell how much vendors have invested
 - dishonest vendors invest less, claim more
 - users react by discounting vendor claims
 - honest vendors have less to gain by investing in security
 - resulst: under-investment in security by vendors

Branding
 - vendor has incentive to build reputation for truthfulness
   and high security
 - users trust vendors whose claims have turned out to be true
 - what for vendors? and how much incentive it got?

Theory predicts vendors will under-invest and over-promise, users
will discount vendor claims, and established vendors will try
to build reputation by investing into security.
</pre></body>
