Hacker News Reader

> they will have to outlaw inability to decrypt.

The UK's already done that - the Regulation of Investigatory Powers Act 2000 already made it an offence not to divulge encryption keys when asked. [1]

1 https://wiki.openrightsgroup.org/wiki/Regulation_of_Investig...

Yes, that's a step towards it. But at least the person has to be a "suspect" in another crime (however low the bar for that is) and an explicit demand has to be made for the key. Not that it does a lot of good since anybody can become a suspect and the demand for the key is retrospective to when you weren't a suspect.

I really don't think that having to be a suspect is in ANY way meaningful, since there is absolutely no bar to being a suspect. It is perfectly reasonable to state "we have no idea who did this so every UK resident is a possible suspect".

https://www.youtube.com/watch?v=BO8EpfyCG2Y (Constable Savage)

Suspect of being Muslim, wearing a beard and using an ISP that the public hasn't heard of that isn't price competitive is more than enough for a media hatchet job. How low does the bar have to be?

This should be the preserve of Uganda and N Korea.

> Software development, already dominated by tech behemoths, will become completely out of reach of small development teams simply because the regulatory burden is so high.

It might sound OT to bring up TPP in a discussion like this, but please hear me out: It's important to block broad international agreements like TPP because it creates competition among nations that would protect us from the dystopia you describe.

Let's say one nation, Uruguay, says "you know what ? Encryption is fine. And btw we're funding 1gb cheap fiber to everyone in our biggest city". Something like that could attract swarms of techies. Which would cause larger nations to think twice before their valued tech talent packs up and moves to escape their surveillance state.

I know not everyone can pack up and go, but the competition and fear of just how many might leave would be enough to keep even rich nations in check. But if something like TPP goes though, they can point to all its provisions and say "boo hoo, you're shitting on trade deals by allowing encryption, now we're going to bully your whole nation with economic sanctions"

Let's say one nation, Uruguay, says "you know what ? Encryption is fine. And btw we're funding 1gb cheap fiber to everyone in our biggest city". Something like that could attract swarms of techies.

It could, but it probably won't, because hardly anyone is going to move to a new country just so they can enjoy encryption and fast web browsing...and I say that as someone who has moved internationally 6 times.

Look, your argument is fundamentally weak - we can generalize and say big countries are bad because it eliminates competition between smaller jurisdictions, therefore federalism is bad. And indeed, the notion that federalism is bad (or at least damn risky) is partly why the USA has ~3000 county governments despite the manifest inefficiency involved.

Your error is in assuming that competition is always beneficial. As we can see in the US, counties and states frequently pass laws that reduce rather than enhance freedom. So while I wouldn't want you to construe this as an endorsement of the TPP in particular, I reject your claim that any kind of trade agreement is necessarily destructive of freedom.

Besides, your notion of comeptition as unalloyed good is easy enough to subvert. Uruguay sets up the world's freest internet? Denounce Uruguay as a haven for cyber-criminals and impose penalties on unverified connections from there. Despite the fact that it makes the digiterati uncomfortable, things like child porn and terrorism are genuine problems that impact the lives of real people when allowed to operate unchecked. This isn't a 'think of the children' argument; I personally know people who were trafficked for sex and child porn as small children and who suffer from serious dysfunction as adults because of this. Their liberty and safety shouldn't be considered acceptable sacrifices on the altar of your liberty and safety; there are valid reasons to delegitimize some kinds of commercial traffic.

While it is true that people (besides the very rich and very desperate) usually don't try and migrate to escape laws, corporations do it all the time and think about it proactively. It is particularly easy for technology companies to say, great I'll do all my hosting in Uruguay instead of Britain, make my terms of service under Uruguayan law, etc.

If Uruguay becomes a criminal sanctuary--then sure maybe it will be ostracized internationally--but as long as law abiding, upright business people have legitimate business there its more enlightened policy will make others think twice about enacting less enlightened ones and give companies some options. Moreover, it gives companies tied to Britain a strong incentive to advocate for a reasonable policy so they are not placed at a competitive disadvantage.

This doesn't mean that lawmaking has to be a false choice between anarchy and totalitarian surveillance, just that the OP's point that more variance in jurisdictions, the higher the pressure on the least permissive to mitigate the worst excesses is a real phenomenon.

I agree in principle but in practice this doesn't seem to be working out terribly well lately. Money generally trumps scruples on any even slightly complex issue that can't be reduced to slogans.

> things like child porn and terrorism

Good thing there are laws against rape and mass murder.

> hardly anyone is going to move to a new country just so they can enjoy encryption and fast web browsing

You can't know that, not until we live in an age where the mere act of communicating is a crime. Thats taking surveillance state to a new level. I'm sure some people wont even care, just like how many Britons dont apparently care about their new big brother laws, but there will always be people who care about their natural rights.

Laws against rape and murder facilitate the prosecution of those crimes, but not necessarily the investigation. Furthermore, the trade in child porn is not legally the same as the crime of rape, but does have measurable negative effects.

As for people moving, I certainly can know that if we're talking about existing and imminently foreseeable conditions. That you need to posit a completely alternative reality where the act of communicating is a crime suggests your argument is fundamentally weak. I'm pointing out the demonstrable lack of interest under current and historical conditions. Available evidence suggests that people are pretty attached to places and prefer to undertake clandestine activity rather than just up and go somewhere else short of a stark existential risk.

Do I know this to be true in the epistemological sense, of course not. Am I pretty damn sure about it in an empirical sense, yes I am. I've moved repeatedly and feel little or no emotional attachment to my birth family - in fact the farther away from them the better I like it. But this is really really unusual. the vast majority of people are intensely concerned with maintaining their family ties even at significant economic/political cost. Just because I don't share that mindset doesn't mean I can blind myself to it.

The US has at least one mechanism against that: the first amendment. Content and format are both matters of speech, so the choice of format and the decision to broadcast noise as a statement are both protected.

I expect that will come under attack, but it's a very fundamental part of US law used unambiguously. So we might also see civil war 2 before they get that legally changed.

I don't believe enough people would care enough about it to start a civil war. I think what needs to happen is, instead of going into IT management at 40, where we do more harm than good anyway, we start running for office until the government is full of experienced tech people.

This! And talk to your representative / MP / whatever and tell them how important this is. Often they just don't know and they hear <SCARY THINGS> from people who have control+profit based agendas.

> the first amendment

It took great effort to get crypto even recognized under the first amendment -- the USGov kept insisting that source code was not speech. In the 1990s it was against the law to let foreign nationals have access to the source code to DES. If you had folks from overseas in your organization, technically you couldn't let them see the source for crypto in your product (e.g., you had to wall off pieces of your repositories, and many companies did).

We could see a return to this. Don't take it for granted.

This can be partially fixed by printing the code on a tshirt.

https://www.wired.com/2000/08/court-to-address-decss-t-shirt...

Or by printing it in a book. There's LOTS of reluctance to ban actual, physical books in the US (and plenty of reasons that any ban would be struck down).

That said, up to the mid 90s it was theoretically against the law to show a foreign national a printed-out copy of DES. Crazy. I think it was published in magazines . . .

The first amendment itself won't be overturned, but they very well may try to exclude cryptography as a form of protected speech. The federal government never wanted to allow it in the first place, they just realized how difficult it would be to put the genie back in the bottle. A Trump-chosen Supreme Court could very well make rulings that weaken or even entirely do away with this protection.

They'll get around it on a technicality. Just like NSA did with the 4th Amendment. "Yeah, sure we capture US citizens' data, but we don't do it on US soil and use another moniker (GCHQ) so its ok. Not our fault AT&T routed your call outside of constitutional jurisdiction!".

I'm expecting something like, "Yeah, sure you can have your 1st amendment, you just have to give us the keys if we ask or you get charged with destroying evidence/obstruction of justice which together carry more time than almost whatever possible illegal activity your encrypted traffic could have been concealing.

An we will arrest you for obstructing arrest.

There was a round of this fought in the US over the "clipper chip" technology in the 90s.

I've been wondering about the interaction of technologies like this with DRM technologies; what if I send HDCP-over-TCP? What if ISIS start using Macrovision on their jihadi videos?

> Transmission of undecryptable data will be a crime, in and of itself.

I agree with you, but I am a bit afraid you are giving them ideas.

>.>

Do you think that browser makers could come under attack? Will Chrome and Firefox be required to add back doors to their "service".

I don't think that there's any public actor you can say is definitely not at risk of attack.

Edit: this is probably a good opportunity to remind people to donate to the Open Rights Group, who are the UK counterpart to the EFF and already actively opposing this and other bad laws.

I'm sure they will, but it's too easily answerable - open source browsers without the back doors will be trivial for end users to build. So again, it'll come back to criminalising what end users do, because in the end only restrictions on the end user can stop them using their own resources to build things.

Historically browsers for distribution outside the USA were required to be limited to 40-bit crypto.

"(About Netscape) The "International Edition" had its effective key lengths reduced to 512 bits and 40 bits respectively (RSA_EXPORT with 40-bit RC2 or RC4 in SSL 3.0 and TLS 1.0). Acquiring the 'U.S. domestic' version turned out to be sufficient hassle that most computer users, even in the U.S., ended up with the 'International' version, whose weak 40-bit encryption could be broken in a matter of days using a single personal computer." (Wikipedia - https://en.wikipedia.org/wiki/Export_of_cryptography_from_th...)

In fact, strong crypto was only allowed in 2000. Only 16 years ago!

> Software development, already dominated by tech behemoths, will become completely out of reach of small development teams simply because the regulatory burden is so high.

I think what will prevent the above from happening is inability of government to enforce laws on the books, people disregard for those laws and the fact that technology experiments are often positive sums games where Google, Microsoft and Oracle stand to lose more by blocking entry to small players through regulatory mechanisms.

If we look at the majority of tech law suites we can easily observe that there is no clear winner and either parties seem to have achieved only small term gains.

But I most certainly see that government will successfully kill innovation when it comes to heavily regulated industries such as education, drugs, medicine and biotech.

This may be a stupid question but I've got to ask because I'm not 100% sure. Is there no practical way data can be sent and received anonymously? If no one, except the people trying to communicate, knows who encrypted or decrypted anything, how could they enforce such a law? Since a well encrypted message should be safe to broadcast, it can be sent to the whole world with only the intended recipients being able to decrypt it. Even if it's inconvenient to coordinate such a thing, I'm sure the perverts and terrorists would deal with it if they had to.

Once upon a time, we imagined a cypherpunk future, where speech was free and the internet was the great frontier of autonomous anonymity.

It turns out, though, that we leave fingerprints on everything we touch. And many of the conveniences and indeed basic user experience we've come to expect leave plenty of markers of who we are for anyone who might be listening. This makes it easy for hacker news to remember who I am, and easy for advertisers to target ads, and governments to track individuals.

So yeah, tools exist, sort of, but require a lot of inconvenience. We've seen instances of ISPs inserting their own cookies on headers of outgoing customer traffic, meaning there are still times when your precautions don't matter at all. When I've thought about totally anonymous internet usage, my guess is that you need to go buy a fresh laptop with cash, and then only use it on large public networks, with good encryption...

because when you send messages, they go from your computer to your ISP, then to the internet. so anyone watching you at the ISP level sees you sent something.

Then, it depends where you sent it. Email goes to one person, so receipt of the message is seen on their ISP's side.

Yes the encrypted message is safe to be sent to the whole world, but there is no single public folder for "the whole world". That would be too many files. In order for the receiver to find what they wanted, they would have to browse the public folder to find what they needed, and this act of browsing strips the anonymity away.

The other problem is that you have to exchange the decryption keys with the person you intend to communicate with. You either need to physically give/mail them to the recipient (loss of anonymity in the case of mail), or else you need to exchange them electronically, which usually requires an A<->B exchange, or you can post your public key and let the recipient find it.

Basically, if you are a government watching all the communication from above, you can usually tell what path information takes, even if its posted publicly.

Yes the encrypted message is safe to be sent to the whole world, but there is no single public folder for "the whole world". That would be too many files.

I think USENET and nntp came really close to fulfilling most of "single public folder for the whole world", but unfortunately has fallen out of popular use (and it needs to be popular enough to increase the anonymity) because it wasn't walled-garden enough to make money from.

Couldn't bad players just send and receive through other peoples connections, maybe even pretend to be someone else on purpose, in order to get them arrested? It's pretty trivial to jump on someone's wi-fi, and use throw away emails.

I think it depends on what you do with someone else's connection. A criminal could definitely get an innocent person's house raided, but cops aren't stupid either. If they do their homework first and see Aunt Mildred only goes to facebook and cooking-network.com, and suddenly she's sending death threats to public officials, they might knock on her door and politely ask to put a wifi surveillance device in her home to pinpoint the intruder's signal.

Sure you could steal signals or go to starbucks (which has cameras of course ) a few times and maybe get away with it, but to do it reliably, on demand, is very difficult.

Yes, it is possible, if your attacker isn't too powerful. However, there will be a lot of tradeoffs and the software is not quite finished yet.

The software which is currently closest to this is ricochet [0] which communicates directly between Tor hidden services. Since there is no central server, there is no one to record metadata (at least in a trivial fashion). However there is still a lot of work left to do before ricochet is something that could be mainstream. Also, some metadata can be leaked, such as when one is online, and (until proposal 224 is out) how much people are communicating based on the number of lookups on the hidden service directories corresponding to the service (since there is no randomness in the system yet, afaik, you can brute force values to get into the right place in the ring. I haven't read the Tor specifications in a while tho, so I may be wrong)

You could also use some sort of mixnet system, although you would probably end up leaking who is sending messages to their ISP. To stop the ISP from determining when, you could send o constant stream of encrypted traffic, although that would be inefficient. (I need to read more research on this)

However, weather people will actually use these systems is in entirely different problem.

[0] https://ricochet.im

There's stuff there about cryptography too, but the logging is about metadata.

For metadata things are the opposite of your logic. It is always accessible. Whatever protocol you create to hide it, will have holes; Math dictates it.

Is that true though? I thought the point of protocols like Tor was that it makes gathering the metadata very very expensive.

Yes, expensive. That means it's perfectly doable (and was already done a few times).