Hacker News Reader

Comment by ecdavis | Hacker News Reader

Is it really worth leaving a thoughtful comment about such an ignorant statement?

It's clear to me that these people have no idea what encryption actually is and only have a cursory understanding of what it does. They're aware that criminals and terrorists can use encryption to communicate covertly. That's why they want to ban it. Are they also aware that the exact same technology is used to protect their online banking? To protect against attacks like the Sony hack? Do they know that there is a huge segment of the economy that relies on strong encryption to do business?

It's pretty clear at this point that they don't care about privacy. Perhaps if the ramifications are explained to them in a different way they would be more open to dissenting points of view.

EDIT: The recent news stories have motivated me to renew my support for the EFF. I'd encourage anyone with disposable income to do the same.

View on HN

> Are they also aware that the exact same technology is used to protect their online banking? To protect against attacks like the Sony hack? Do they know that there is a huge segment of the economy that relies on strong encryption to do business?

I'm sure they are.

The problem is, I suspect, more the delusion that if there are backdoors, only MURICA will be able to exploit them because GODDAMN GREATEST COUNTRY IN THE WORLD! They would find the idea that there are talented individuals and groups, outside the US, who are capable of exploiting these facilities, absolutely incomprehensible.

Moreover, the civil servants who they should be able to rely on to provide accurate information about why it doesn't work that way (e.g. the NSA) will be actively encouraging that ignorance for their own benefits.

Your statement is bleak, but probably so true that it's scary.

The movie companies and the record companies wanted DRM -- they were under the delusion that they could both control digital information while sharing digital information.

So now Washington is suffering from a similar delusion: you can build encryption to keep criminals out of your banking website, but still allow the feds access to whatever they choose.

So then if a federal agent is/becomes a criminal does that mean they won't be able to access the back door then?

You know the answer to this, but that's not the point. The old system did not prevent crooked agent to have access as well.

The problem here is much bigger, because they assume that no one in the world (including foreign governments) would be able to figure out how to exploit backdoor(s).

Imagine a foreign government eventually would discover it. Such knowledge would be extremely powerful weapon in cyber warfare. What McCain is suggesting is extremely dumb, even if he's not concerned about our privacy.

> The problem is, I suspect, more the delusion that if there are backdoors, only MURICA will be able to exploit them because GODDAMN GREATEST COUNTRY IN THE WORLD! They would find the idea that there are talented individuals and groups, outside the US, who are capable of exploiting these facilities, absolutely incomprehensible.

I don't think that's it at all. I think it's because they expect everything to work the way the phone system did. For a long time, tapping a phone was just a warrant away. And it really was significantly harder for anyone except the government to listen in on phone conversations. Now, the world has moved on from POTS to connections that allow arbitrary data to be sent instead of just sound. In that world, the control in the system shifts to the endpoints and away from the network. We (the kind that reads HN) understand why that has to be the case, but lawmakers and law enforcement are struggling with that paradigm shift.

I see it as being very similar to the problems encountered by the record companies in the late 90s/early 00s. They were comfortable selling CDs and understood CD copying well enough to deal with what little piracy there was. But then Napster came along and showed that their product was just bits that could easily be transferred freely across the globe. We all understood this reality, but the industry spent the better part of a decade trying to make uncopyable bits (DRM) and to stamp out piracy in a torrent of lawsuits. At this point, they've mostly come to terms with the new reality and are adjusting.

Government is going to need to come to terms with that same new reality and adjust.

> And it really was significantly harder for anyone except the government to listen in on phone conversations.

This is absolutely not true. Outside everyone's house was a box, and by hooking two wires there you could easily monitor phone calls. There was similar security every where else along the way.

When wireless (not cellular) phones became common, you could get a scanner to listen them (I'm not sure they were legal to sell listening at that frequency but they were easily modified).

The POTS was simply not secure at all.

I think Congress needs their own dedicated ELI5 hotline :)

r/ELIaEO - Explain like I'm an elected official

"if you do this then I'll give you this campaign donation", is that the kind of explanation it would provide? Otherwise I don't see it getting very far.

This makes me think we need to implement a cryptographic protocol to revoke donations when politicians go back on the words that solicited the donation.

An escrow system for political donations!

They have one - their favorite lobbyist. Who is probably paid to explain things in a way that suits the agenda of someone with money.

That's true, it would probably be tough to guarantee something like that would be non-partisan or without prejudice.

These are simply power hungry politicians trying to control our lives. The only way to solve this is to create a strong voter base that cares. What I really love about the 2nd amendment is the kind of public support it enjoys and the politicians are forced to support it in either letter or spirit.

A friend of mine told me that politics is the art of getting uninformed people to decide what you want. With that in mind I'd say it's maybe worth having a thoughtful debate about this, probably not about whether or not this law is correct but about how to get politicians to understand the ramifications of this decision even if they have no idea what encryption actually is.

I've got no idea how to do that though so I'll let you guys start...

> It's clear to me that these people have no idea what encryption actually is and only have a cursory understanding of what it does.

I'm not so sure. Even if McCain (and other politicians) have a perfect understanding of encryption, I would expect some of them to make statements like this. I interpret it as pandering to their audience in an attempt to look tough on terrorism. It is unfortunate that if this pandering becomes a reality that it will do real harm to our security and economy.

> Are they also aware that the exact same technology is used to protect their online banking?

Yes they are -- that's why it's not a matter of passing a one-page bill overnight, but rather a more complex piece of legislation that in order to be done right, need time and bi-partisan involvement.

And I found it hard to believe you don't see a difference between encrypting your bank transaction, and encrypting your online conversation.

Disclosure: I'm against all type of bans on any encryption.

You don't think it is feasible develop a messaging system that employs bank transactions?

> don't see a difference between encrypting your bank transaction, and encrypting your online conversation.

How is my online conversation with the bank any different than my other online conversations? Sure the content is different, but it's all the same medium, using the same sort of technology.

> How is my online conversation with the bank any different than my other online conversations?

It happened between you and your legitimate bank. Its definitely not like 2 terrorist exchanging information online. Unless of course your are HSBC bank.

Banking doesn't strike me as a use-case that the government needs to worry about, since a mandate already exists to report financial information and suspicious banking activity to law enforcement. A backdoor would be more convenient for them, but encryption of your communications between you and the bank does not mean the bank is encrypting your financial and demographic information in such a way that they themselves will not be able to retrieve it.

What's being discussed here is the Apple strategy, where the service provider can provide a service to the public without the ability to retrieve information generated by the service.

The desire for companies to provide such services was likely spurred by the government's insistence that they provide private encryption keys, even in the event that they provide access to encrypted information not limited to the direct subject of a warrant, and the federal courts' repeated confirmation of the government's power to enforce such requests. See the demise of Lavabit [1].

There are numerous technical workarounds to this problem; for example, a private-key infrastructure that generates one key pair per message, or per customer. However, none of those workarounds allow a service provider to market products that are end-to-end secure from eavesdropping or the later revelation of the customer's information to empowered third parties.

So in essence, the argument I'm making is that it doesn't matter if there is a fundamental difference between banking and a chat application, because in either case the government either already has or is actively seeking the power to obtain the information you generate.

As it's hard to imagine a world where malicious parties would not be able to obtain encrypted communication mechanisms (unless you ban open-source, computers, pens, and the human brain), it's difficult to reconcile the above with the proposed effect this law would have, and it's very difficult to imagine the government restricting the application of these new powers to terrorist organizations only. See the history of the Patriot Act, for example [2].

[1] https://en.wikipedia.org/wiki/Lavabit

[2] https://www.washingtonpost.com/news/the-watch/wp/2014/10/29/...

It shouldn't be hard to believe because there is no difference whatsoever. You could do bank transactions over chat, you could run chat over bank transactions. Both are fundamentally the same thing. The mathematical model that says that Alice exchanges information with Bob is not a simplification, it's fundamentally how it works. Content is arbitrary and doesn't matter.

Put more simply. If the terrorist wants to stay safe they would exploit any loophole. If conversation is backdoored but banking is not, they could use online banking and code word type messages in transaction descriptions that move trivial amounts of money back and forth between multiple accounts.

You are ignoring the bandwidth differences between protocols.

You don't need much bandwidth. The Internet is creating a false sense of data size because nowadays even a simple hello world seems to require a multi-megabyte download. But actual communication for practical purposes can be done in just bytes. There's more than enough space in transfer title to communicate a lot of stuff, even without a pre-arranged set of shortcuts, and in planning stages, you don't need real-time communication anyway.

(Note, this comment would fit in one or two bank tranfers).

Keep in mind that McCain is up for re-election next year. Some of this is overstated, although I figure he probably does believe the government should have a backdoor and doesn't fully understand the implications of that.

It's true that the title is somewhat overstated, however the statement that really motivated my comment was the one from the head of the NYPD.

> We have a huge operation in New York City working closely with the Joint Terrorism Task Force where we’re monitoring and they go dark, because basically they go onto an encrypted app, they’re going onto sites that we can’t access.

The problem is not awareness of privacy and financial sec issues.

The problem is how do you prevent the next Boston Bombing or Paris.

Since we don't have a good answer to that, what else do expect them to do?

We have an answer, but it's a political no-go. The answer is: you can't, really.

You can do the obvious things like stop bombing the living shit out of Middle East, etc. but that would only reduce the amount of radicalized people. The best you can do is to push it down below the "crazy noise floor" - because you ultimately can't prevent random people with a particularly destructive mental condition or an axe to grind from shooting people up. Not even if you turn the country into a police state.

You are saying what I am saying. There are no good answers. Doesn't mean we stop looking for answers. Which is what the focus of these debates should be.

It's easy when there are no good answers, to take a dump on the decisions people in positions of responsibility take. It just distracts and complicates the story.

What is encryption for? Why even have it at all? Devil's advocate.

Reply on news.ycombinator.com