I&#x27;ve respected Moxie Marlinspike ever since he made sslstrip, a simple illustration of the fundamental insecurity of browser-based HTTPS.<p>However I do question his premise that criminals already have the wherewithal to opt in to &quot;clunky&quot; strong encryption before engaging in criminal activity.<p>In fact there are many scenarios where criminals simply go with the default security configuration in consumer devices, either because they (a) did not plan the crime in advance or (b) aren&#x27;t as smart about opsec as you might expect.<p>There are many good arguments to make strong encryption the default for consumer devices, but here I feel he was attempting to take an easy way out by pretending it&#x27;s orthogonal to investigating crimes. In fact it is a tradeoff, granting us security from cybercriminals and bad state actors (if there&#x27;s even a difference), while making it harder for law enforcement in some scenarios.