Hacker News Reader

Comment by theandrewbailey | Hacker News Reader

Kinda clickbait-y, and ignores the fact that encrypted communications were able to be used (with some effort) before Snowden, but his last point is solid:

> The only way to retain any amount of electronic privacy is through political engagement.

View on HN

No its not. The reality is the biggest threat to privacy is due to political engagement. Stronger encryption that no one can break is really the only viable option.

Political engagement is a very good tool to keep political engagement in check. Political engagement can make strong crypto illegal to use, or mandate a state MITM[0]; neither are viable or effective at anything, but those inconveniences aren't going to stop their implementation.

[0] Almost happened in the USA: https://en.wikipedia.org/wiki/Clipper_chip

That won't solve the problem

> Slapping unbreakable crypto onto more and more packets is just going to make matters worse > > The IT and networking communities overlooked a wise saying from soldiers and police officers: "Make sure the other side has an easier way out than destroying you."

Who is developing this stronger encryption? The development of encryption has a huge incentive to build backdoors for payouts by government or corporate or worse groups. Then you have the people implementing the encryption that could also introduce backdoors (who knows if heartbleed was intentional or not). Then you have lots of other ways to backdoor the system, from default software installs, viruses, or even compiler or CPU backdooring. There is no such thing as a system that has perfect security. Even if you build everything yourself and are perfect at doing so, the tools you use could easily have backdoors.

By increasing usage of encryption for more and more mundane things all we're doing is increasing the incentive to break that encryption.

I totally disagree. Political and social solutions prevailed in our physical space during the 60s and 70s with the expansion of rights related to search and seizure and the statement of rights to those who are unaware of them. There is precedent for social engagement here.

And remember, all encryption is susceptible to rubber hose cryptography. There needs to be a two pronged approach here.

Not all encryption. There is such a thing as self-destructing data/keys. Once it's gone, it cannot be recovered, even if your life is threatened and you really don't want to die.

Whether you're willing to go that far for your data or not is up to you, though.

You don't need to break the strong encryption, when you can break the kneecaps of people using strong encryption.

Breaking kneecaps is expensive though. You can't just set up a ring of roadblocks around a city that kneecaps everyone passing through as a matter of course.

> Breaking kneecaps is expensive though. You can't just set up a ring of roadblocks around a city that kneecaps everyone passing through as a matter of course.

Once you establish the willingness to break kneecaps, the number of kneecaps you actually need to break is fairly small.

That's true if determining whose kneecaps you need to break is either trivial (e.g. open dissidents and protesters) or can be easily achieved using social engineering (e.g. anonymous print pamphleteers). If doing so is a /technical/ rather than social task, and your technical cryptanalysis isn't up to par, breaking kneecaps is much less powerful of a deterrent because your hit rate will be very low. Breaking kneecaps to deter the use of encryption itself is another matter though.

Broken kneecaps speak for themselves, "I was tased, and it REALLY hurt! I was terrified and alone in the cold and dark, naked, for hours, I thought I was going to die many times!" is... harder to understand and harder to prove.

If you break someones kneecaps, you may get the information they have, but you will never get anything more. After that they and their whole network will take precautions, even going as far as never communicating electronically if required. Such bullying may also easily backfire, which limits its use.

A broken communication channel in contrast is the gift that keep giving. You can get up to date information that the opponent think is confidential as it happens, and they will not take precautions, and you can continue to use the information against them, giving you the upper hand. This is why NSA was so determined to keep their actions hidden.

You fail to grasp the key point here:

If the state cannot break your encryption, they will break you instead.

Which makes your whole argument sound like:

"I'm such a coward! Please take my private data, just don't hurt me!"

Belive it or not, but some people actually have balls to fight evil governments.

Really, it struck me as escalating to an implicit threat. Don't do anything that would actually undermine efforts at mass surveillance, like promote mass use of encryption, or something will happen to you.

In other words: https://www.xkcd.com/538/

Reply on news.ycombinator.com