Hacker News Reader

Comment by ewzimm | Hacker News Reader

It's even more absurd than that. The premise is that we can have a public worldwide debate that emphasizes how important encryption is to successfully carrying out terrorist attacks, convince the world to give up their privacy for the sake of safety, and after the majority of the protestors have been defeated by public awareness that encryption and terrorism go hand-in-hand, the terrorists will go back to using phone calls and unencrypted email.

View on HN

My thought is that if we implement a back door policy, the public will have communication links which are much easier to compromise by any party, while terrorists can still easily use encryption and/or steganography to secure their communications.

All the back doors accomplish in the end is harming the general public.

Indeed. Also, combine your steganography argument with this image

http://www.friendmosaic.com/images/example-mosaic.jpg

and it's pretty easy to see that this avenue of thought --- that we will put our efforts toward finding a way to ban encryption --- is totally ridiculous.

It's not just that federally-mandated backdoors increase the chance of compromise (although they certainly do). If the U.S. government can mandate that technology companies provide access through encryption, then so can other countries. Sovereignty is still a powerful concept under international law.

So imagine if Apple, upon condition of selling iPhones within China, must provide the Chinese government with a backdoor through Apple's encryption. Do you know how many federal employees use Apple technology? Including the President himself, who totes an iPad everywhere?

I don't think that federal intelligence and law enforcement officials calling for backdoors have fully thought through the consequences.

> I don't think that federal intelligence and law enforcement officials calling for backdoors have fully thought through the consequences

I think assuming that level of incompetence is a big claim.

It's simply much more likely that the actual plans/goals and the talking points and press releases about the plans/goals are mostly unrelated, as usual. You can infer that those calling for backdoors have decided that calling for backdoors is the best thing to say, inferring anything more requires more information.

> I think assuming that level of incompetence is a big claim.

Not really. Have you listened to the average member of Congress lately? Incompetence runs deep throughout all levels of government.

I think largely politicians are very intelligent and competent. What they're not though, is open about their own thoughts. That's not their job. Their job is to reflect what their supporters (financially and votingly) want. If their supporters have wild nonsense ideas, they have to promote those ideas to keep their job. That's why they were elected. We don't choose politicians because they're smart and have good ideas. We choose them because they tell us our own foolish ideas back to us.

The best salesman is someone who believes in the product. I'm willing to take them at their word.

They key point here though is that their "supporters" are NOT the American public. They are private corporations and banks with their own agendas, usually contrary to the public's well being.

It's not fair to say incompetent; I didn't say that.

Instead, look at it this way: everyone has their area of responsibility. The head of the CIA is charged with providing the best possible situational awareness for the U.S. government. He's going to make proposals and requests that will help him do that.

He's not charged with balancing all possible consequences from his requests, and he's not going to do so.

> He's not charged with balancing all possible consequences from his requests, and he's not going to do so.

But ... that seems like quite a level of incompetence for someone trusted with the position of Head of the CIA?

By which I mean, not charging him with that responsibility is a mistake (in gov structure), but him actually not doing so is his own incompetence, is it not?

> You can infer that those calling for backdoors have decided that calling for backdoors is the best thing to say, inferring anything more requires more information.

How is calling for a really bad idea because it's the best thing to say different from the level of incompetence you say is too big to assume?

It sounds like the implication is that the politicians are smart enough to know that the backdoors are ultimately not going to happen but that calling for them is a way to appease voters who haven't followed this through to its logical conclusion.

edit: "not going to happen" could be read as "not going to be effective." I wouldn't actually be surprised if the US ended up passing some law restricting crypto to an approved list of backdoored schemes (surprised: no, dismayed: yes), forcing people into hiding their crypto in deniable ways. What some people don't seem to grasp is that no matter how much you outlaw certain math operations, whether or not the end users comply with those laws is ultimately up to them, and the terrorists simply won't comply.

I think assuming that level of _competence_, at least in fields other than diplomacy and public speaking, is a big claim. It's not reasonable to assume that every single ancient senator that's pushing for this is fully aware of the consequences, but it is reasonable to think they simply haven't thought any further than "I need to make it look like I'm doing something, or I'll look bad".

To a man with a hammer, everything looks like a nail. To a man who only has words, everything looks like a soapbox.

It would help conventional law enforcement. Most violent criminals probably don't put enough forethought into their spontaneous attacks to properly avoid notice by the NSA. Unfortunately the NSA doesn't seem to use their resources to secure the nation, and just ignores all the large scale violent crime that goes on daily.

It's largely outside of the NSA mandate to monitor the communications of US citizen criminals. It is not the fault of the NSA that Congress has not passed a law telling them to spy on domestic criminals.

I get that some of the controversy lately is about how well they stick to their mandate, but that doesn't change what the mandate is.

> Unfortunately the NSA doesn't seem to use their resources to secure the nation, and just ignores all the large scale violent crime that goes on daily.

The NSA is part of the Department of Defense charged with foreign signals intelligence for national security purposes, its not a law enforcement agency. (And many of the tools it uses would be flagrantly unconstitutional if used for domestic law enforcement.)

Generally, blurring of the military and law enforcement roles is not a healthy thing; it may be good for order, but rarely for liberty.

One of the reports on the Osama Bin Laden raid stated that he had a porn stash, I wondered at the time if this was for use as a starting point for steganographic communications.

Many regulations do. The real trick is giving even the terrorists reasons to behave.

It sounds impossible, of course, but that's just because we're not sure where these guys put their goals; some may be fighting for lack of another purpose in their life, while others may be motivated by personal loss or a thorough belief in the violent interpretation of Islam.

So what we really need to do is find a common thread among all the terrorists, and pull on it.

The State is far more efficient and effective at instilling terror than any loose organization of dissidents could ever hope to be.

Read pretty much anything Amnesty International publishes, or even the right history books and you'll have all the evidence you ever need as to why privacy is important even when you think it isn't.

Once bad things start happening it's too late to change your mind. They already have what they need.

If (almost) everyone who is not a terrorist were to give up encryption, then it would be much easier to track down/narrow down the terrorists if they keep using it, no?

I don't think so, as far as I know encrypted data doesn't really have a signature that can be easily spotted

It does, it looks random (hight entropy).

Yes, measured data and unmarked compressed data have this same property, as do actual random data. But is does not look like 9 nines of false positive rate are a concern to those people.

You can set the entropy to any amount you want. You need to consider encryption methods that put in at least a bit of effort to hide themselves. It could select random phrases and pretend to be a spambot.

Or it could look like the output of a Markov chain sentence generator on the topic of religion and post the messages in some well-known forum.

Well, where's the boundary between cryptography that hides itself and stenography? Is there one?

If you include stenography, yes, it's certainly not easily recognizable. I don't think good stenography can be recognized at all, but that's not my area and I've got people contradict me at this (without further info), thus I'm not sure.

There's not much of a boundary, but that wasn't exactly the point I meant to make. You can do something like encode as ASCII 0s and 1s and have low entropy without that hiding anything.

No because they're not using it in the first place. It's a totally unrelated issue, dear to some for reasons entirely their own. The fear of terrorism is just a convenient little button to press to get their cookie.

Indulging this fantasy, it begs the question of whether those (enencrypted) communications would have been targeted and flagged for analysis

How does it beg the question?

There is no truth being asserted in the premise causing the conclusion to be true. It's fairly clear that it was a statement from an original source, that source being trustworthy is where we would find (or not find) the information which would show the conclusion to be true, not the premise of the 'fantasy.'

Give it up. In 30+ years of learning English, the only times I've ever seen it used in that sense has been when someone is being a pedant on forums and illustrating the now rapidly outmoded meaning of the phrase.

In 20+ years of learning English I've heard it used several times to refer to an obvious question or lack of information

"$noun did $verb which resulted in $result and $result is $something interest which begs the question $question."

well, your confusion of tenses kinda colors your knowledge about grammar rather questionable and i say that as a foreign speaker

Until it changes meaning, I cannot give it up. A curse I tell you!

Maybe, but I'd rather not send my financial information over the Internet in cleartext every time I buy something from a web site.

You wouldn't.

The government would just have the private keys so they could decrypt traffic easily.

Kind of like the TSA approved locks for your baggage. Those are very secure and can be opened only by the government officials, last I heard. The only downside is that those TSA master keys might become available to the third party somehow, but I don't see that happening anytime soon, since we can always trust the government to keep such information secure.

Not "might become available", they already are - https://github.com/Xyl2k/TSA-Travel-Sentry-master-keys

Someone posted a photo of master keys and Internet was, as usual, the Internet.

Call me crazy, but I think that may have been the joke.

No lock is secure, ever.

If there was some way to learn the identity of said terrorist simply by observing the origin and destination of an encrypted message, then perhaps. It would possible for them to coordinate and avoid this outcome. And there are still plenty of secure crypto systems out there so we wouldn't be able to decrypt their messages (unless quantum computers turn into an actual thing).

Not really, because the proposals aren't to go to no encryption but to go to government-backdoored encryption. To an observer you've still just a random stream of bits until someone tries to decrypt it with the backdoor key. Pretty easy to hide in unless we're monitoring every message.

And terrorists would be smart - they'd employ non-backdoored encryption, hide that in "legit" communications, and encrypt that with the proper back-doored government encryption. They'd appear to be a totally normal snapchat user, or whatever.

If we actually meant to give up all encryption, card-kiddies would destroy civilization in three weeks.

And when the next Snowden publishes the global decryption keys we'll all just update our software together.

Surely you mean "the next Impact Team" (those behind the Ashley-Madison breaches) because Snowden actually went through painstaking lengths to not reveal stuff that would put the public at danger like that.

Then the terrorists would just use non-encrypted communications and blend in with the massive flow of everyday data...

...Unless you're intercepting and sniffing everything that's unencrypted. Then we're back to square one.

> It's even more absurd than that... after the majority of the protestors have been defeated by public awareness that encryption and terrorism go hand-in-hand, the terrorists will go back to using phone calls and unencrypted email.

I think you're straw-manning their position here.

The opponents of encryption aren't claiming terrorists will start using unencrypted communication, they're advocating for legally-mandated "back doors" to be built into supposedly-secure communication systems.

It's not a straw-men. It's not of the problems with the rationale.

Terrorisms won't use legally-mandated software for they illegal operations.

You're right, but I didn't mean only phone calls and unencrypted email. I considered adding "or their equivalent back-doored technologies," but I hoped it would be clear. Using a compromised technology is the equivalent of unencrypted email and phone calls to whoever has the key. All it does is draw attention to how important it is to communicate in secret. This will be the Streisand effect of crypto.

How would they know, though? For all we know, OpenSSL has been backdoored in some subtle way.

Reply on news.ycombinator.com