FBI drives for encryption backdoors | Hacker News Reader

FBI drives for encryption backdoors

arstechnica.com

120 pointsGoronmon105 comments

With Twitter, Facebook, Foursquare, GPS transmitters, satellites, Google, upcoming facial recognition queries, DNA, fingerprint databases, and more law enforcement has more tools at their disposal than any other time in history.

It seems rather lazy and short-sighted of them to be pushing to compromise the security of all forms of encrypted communication just to make one aspect of their job a little easier. Besides, the Internet is global, so even if they succeeded, they'd simply push the innovative technology to other countries where it's still easily accessible to everybody except U.S. based businesses. How does that make our country more secure?

In the New York Times story that unveiled the drive, the FBI cited a case where a mobster was using encrypted communication, and the FBI had to sneak into his office to plant a bug.

Why is this referred to in a way that suggests it is somehow not a routine part of serious police detective work?

Yes, exactly. There are ways of communicating such that no one can possibly hear it but the intended parties. In those cases law enforcement has to "get to" someone. Why not just stick with this approach instead of punishing certain forms of communication for being convenient?

Good question. What's wrong with serious police, detective, or spy work in these extreme edge cases where encrypted communication is a crucial piece of evidence?

This seems incredibly lazy and irresponsible.

That's what they're trying to avoid needing to do.

The same way as marketing "experts" could become used to use sophisticated computer analysis and isolate their selves in their computers, forgetting to walk the street and ask customers, those people could isolate from the real criminals.

And criminals use codes when talking on the phone, thinks like "making the bed" could be the code to steal something, "drink soda" putting a bomb, so you need the serious work anyway.

This is so lame. It means the end of encryption for honest people. This is dumb for 2 reasons.

#1 the backdoor secret will FAIL, as it has for every DVD, BLU-RAY, XBOX, PS3, etc... DRM device. So criminals will be able to read all encrypted (obfuscated) data.

#2 people who want to hide illegal data will.... use real encryption.

This is like banning guns. Which oddly has the opposite effect in reducing crime. I wish Lawyers and Politicizations had to pass engineering school first. I swear, passing the LSTAT doesn't seem to prove anything about ones actual logic skills.

Are you sure about the guns? Britain doesn't seem too bad in terms of crime to me, despite not having a lot of guns around here.

The same argument could be made for the reverse side and against your proposal. For instance, Canada and Switzerland have a liberal gun policy, and Brazil has a somewhat restricting policy. [1]

[1] http://en.wikipedia.org/wiki/Gun_politics

Indeed. So maybe there's no correlation whatsoever? I guess it does not matter to the argument about encryption, though.

Guns are also a social issue, where in the United States it is our right to own guns and nothing can take that away, except using them as a tool in illegal acts. Queue the downward spiral where non-felon criminals already use guns excessively, so felon criminals obtain guns illegally to use excessively.

Guns aren't the problem. It is how us Americans perceive guns and our rights to own and use them that makes an issue out of owning them.

There might be a loose connection with crypto, where if all schemes have backdoors, only the criminals and "bad guys" who wish to send messages securely without government eavesdropping will implement or obtain ways to do so without backdoors.

But they don't call it "Knifecrime Island" for nothing.

What? People get stabbed on public (videoed!) buses for asking someone to stop throwing trash at them.

I think you're confusing HDCP with Blu-Ray. There is no "backdoor secret" for Blu-Ray. Technically, there isn't for the X360 either, and to the extent the X360, PS3, and BluRay platforms are fundamentally vulnerable to breaks, we're all vulnerable to breaks --- our banks, credit cards, personal computers, email, all of it --- because there are platforms where the fundamental security decision was to rely on platform integrity instead of e.g. broadcast cryptography.

He's obviously talking about AACS and BD+. Which have also been cracked.

AACS, yes. BD+, no. People like to say BD+ has been cracked because most BD+ disks have been ripped by now, but that's the whole point of BD+; whenever Rovi wants, they can renew the scheme and force people to painstakingly re-break it.

And it's done frequently, and keys are cracked in anywhere from a week to a couple months for each disc. That, to me, is a sign of a broken scheme, semantic arguments notwithstanding.

This is about as bad an analysis of a DVD content protection scheme as can be offered. Publishers are trying to protect the release window, immediately after the publication of a disk, where they make the majority of their money. A scheme that costs rippers weeks-to-months to crack a disk is a spectacular success for them.

The "break" in BD+ will be when someone finds a way to write a ripper that seamlessly handles BD+ refreshes, just like the players do. It'll happen eventually, but it hasn't happened yet.

Then apparently it was a bad analogue to encryption schemes by jdavid, since the incentives behind each are clearly very different.

Backdoors for the government into all encrypted services required by law? I don't see what could possibly go wrong.

Here's the outcome that I see happening:

The general public won't notice/know about a difference; the people who use encryption and those who have something to hide will switch to something that doesn't have a back door, thus defeating the entire purpose of the law; and black hats everywhere will smile like it's Christmas morning.

This, unfortunately, is a losing war. With no mechanism in place for the "winning" side to stop the "losing" side from trying again, often with the same arguments but different ears, eventually the "loser" will turn into the "winner." More to the point, even if the larger picture remains the same, the losing side will continue to attempt to chip away piece by piece any such protections.

Don't believe me? Look at our park system. We've come out and said time and again that the trees in our parks are important. That is, until we sell 30 acres here to pay for this. Then 30 acres there to sell to pay for that. Eventually some of the parks are half the size they used to be. God help the redwood trees.

Which side is the winning side and which is the losing side?

Cryptographers won this argument in 1996 with the Clipper chip. They are the first "winners". The agencies that want the backdoors were the "losers", but the premise is that the agencies will just keep trying until they succeed. It's asymmetric because the agencies' eventual win cannot be undone, but the cryptographer's win will be.

> It's asymmetric because the agencies' eventual win cannot be undone, but the cryptographer's win will be.

How can the agencies prevent crypto without backdoors being implemented on top of their crypto with backdoors?

It's asymmetric also because those advocating backdoors have, essentially, unlimited budget to attain their goals (or at least the resources are so lopsided as to be impossible to compare).

I apologize in advance since I don't know the current state of things on this in the US, but is it different than the EU? As far as I know, lawful interception systems are widely in use here (EU) even today (in ISPs, banks, major mobile telephony providers, etc).

Yes, this is true of many things in our society.

One likes to think of the politics as a pendulum, swinging back and forth. Sometimes things are in the hands of one party, sometimes another. But when one side of the discussion is at "0", that biases the swings. It can't go into "negative" legislation, so the site championing the "0" can never win, and in the long term, the changes keep creeping away from the 0.

I think regardless of the laws that the government passes, people will still be able to use secure crypto. Look at the war on drugs -- anyone that wants drugs can easily get them, they just cost more than they would otherwise, and the taxpayers have to pay billions of dollars a year to provide free room and board for anyone that keeps too many drugs in one place.

If you are committing treason, or something, the price of going to prison for using PGP is much less than the death sentence you'd get if you sent the messages in the clear.

I also don't see laws against crypto (and steganography) really being effective. A law is one thing, convicting people for violating them is another.

Think about what a tough time the government has in bringing cases against criminals. It's 50/50 as to whether or not they can convince a jury to convict when they have a security videotape of the accused gunning someone down. "And here we see the defendant discharging his handgun into Ms. Smith."

Do you really think they're going to be able to get convictions for people alleged to be hiding encrypted data in normal streams? "It's clear from the noise pattern in this image that there is a hidden bitstream in the low-order bits. This means that anyone exchanging this image is probably forwarding on encrypted terrorist communications. We can't actually prove this beyond a reasonable doubt... it is possible that they used a buggy version of Photoshop when they were resizing it for their lolcat blog. But probably terrorism!!"

I am not losing much sleep over this.

If you posses drugs, you're following illegal conduct, and you can be fined or imprisoned. Similarly, if we end up with a government OK'd list of crypto schemes, those of us who use strong crypto legitimately will be criminals. Also, in the UK, you can get charged for not handing over encryption keys.

Well, yeah. But you have a right to be tried by a jury of your peers... who probably won't understand crypto. (The "drugs are bad... except coffee and cigarettes and high fructose corn syrup" propaganda caught on pretty well, so you are probably stuck there. But there is no "strong cryptography is bad" rhetoric out there, and it will be hard to argue for -- the opposite is "the government is trying to steal your credit card number".)

Anyway, the whole point of the Constitution was to allow people to do things that the government didn't want them to do. Using strong cryptography is the modern way to for one to "be secure in their persons, papers, and effects, against unreasonable searches and seizures".

Finally, it seems that this round of laws is directed at service providers that store encrypted messages; the government wants you to be able to read everything passing through your network. Of course, you do not control the P2P network that your movies and phone calls pass through, so this law has limited effect. Even then, if end users provide their own encryption, that's out of the scope of this law.

The government cannot read every packet that passes over the Internet.

But there is no "strong cryptography is bad" rhetoric out there...

How about Tor being used for CP? That's a pretty prevalent and well known argument. Any competent lawyer is going to be able to spin the same argument for strong crypto.

And competent lawyer on the other side is going to say, "online banking".

I mean, guns are still legal right, despite the fact that people murder each other with them.

I agree with you on a logical level, I just don't think that's how it plays out in the average voter's/politician's mind. The logical leap between guns and Tor just isn't made in practice.

I feel that this is an issue for the courts rather than the representatives, and the courts are less influenced by Joe Gun-nut than the elected officials he directly elects.

So while surely there will be some new law censoring the Internets, the courts will probably strike it down.

(I mean, are we really going to send people to prison for not upgrading their ssh servers? I doubt it.)

I just want to be clear: you're not arguing about the merits, just that you shouldn't care? Is that an efficient use of time?

I agree with the sentiment here, but it should just be not illegal. It's sort of like how in China and Iran or Turkey (my home country) certain web sites are banned but people find ways to get around that anyway. Is that how it should be? The banning should not be there in the first place.

Unlike drugs, crypto is something you can make in your own home with freely available materials... at least until they outlaw debuggers... (inserting obligatory right-to-read reference).

I hope the internet wins this "government vs. internet" fight. This kind of thing is so ignorant as to be insulting. The best DRM the industry has been able to come up with so far was broken before it was even released. Does the FBI seriously think that if they put in back doors that people wont get them? At that point all internet communications may as well be plain text.

Unfortunately most people don't care or don't care to know.

On a side note, why not to have our own separate internet? I've been thinking about OpenVPN tunnels between dedicated servers and letting users connect to them over vpn links, of course. This would form a closed network with services inside. It's a sad commentary, but having privacy friendly network sounds like a breath of fresh air just 20 years after the Internet took off.

What you're proposing there sounds a lot like the Xnet in Cory Doctorow's book Little Brother [1]. But I do agree with your comment that it's a sad commentary about the state of government and regulation, that a private network like this sounds like a pretty good idea.

[1] Available for free straight from Cory Doctorow: http://craphound.com/littlebrother/download/

Thank you for the link. Looks like a good read.

My idea of the network like this is more about privacy than anonymity. And it shouldn't be too hard to set it up. I am just bouncing the idea around to see what others think of it.

>Unfortunately most people don't care or don't care to know.

Hackers on the internet care. Pandora's "free and instant information" box has been opened, I don't think you'll ever be able to close it again.

"Joe Plumber" on the internet will also care the first time someone hacks his bank account because his bank was using one of these backdoorable encryption schemes for online banking.

It is simply not true that "the best DRM the industry has come up with was broken before it was released". Examples of DRM schemes that remain unbroken, and continue to support their owners business objectives:

* The content protection scheme that binds DirecTV cards to paying accounts.

* The VM-based BD+ scheme that protects each wave of Blu-Ray releases, requiring disks to be cracked individually.

* The current incarnation of the iTunes video rental protection scheme.

This doesn't change my point. The things you list, if indeed they haven't been cracked, have a smaller amount of effected people than "all US encrypted traffic" and there is a lot more money at stack (e.g. all online banking). If there is a back door it will absolutely be cracked.

Does this include whatever communications systems the government uses? Wikileaks' job could get even easier.

Here's what I really think

-----BEGIN PGP MESSAGE----- Version: GnuPG v1.4.10 (GNU/Linux)

hQQOA1epHOklxC8KEBAAgPQJPDfmOM2CuU0aOXwRRmwejm/5zYGK4dhyh0B6W6/J 0KQ3trcF1O0MvLFAWtOJAS9WweGD/nvpBRWtyXKQh/xdP0uHtbLQExLPuSRffkhR /oldEh5kkqroIXF5w2cEmEjnOv3VdVHeJRo2mMx4kwMwy8P7nUdut2fj77njVfVF MVy0p0svdzSRVx+NIrbS9+dTVoQPXt4HBFmSb+kPoKTsc2KlobKSKC3J/VeVvtJE KHWVbh48fqJkfcxgY7C6B2PH+N1PwnfmlPKgORII0jv5CZDdJWuw37lip8SbVtzo 7B5QSTHrRZqw/lcB+kPkny9cPhNbvN7lYKUUxpmPh4IKT6zD5EGex64Uq2uAxk7K MdIwIz6nkzAbLWJl2CEr4wj1bVB3cp2Il5AvCHWo0eTbNeG1rrK1NqBPwh0X3ySy jJl81q7x8huuo1lykPu4SMEazCHvQLgLcFRE8lTYyHMi96zuT/vQI2aXWlg2Ttjx 9Vnmk/iObd+aRpAHrtRWO3jpOelhdEcHzYe0Uyao2Itc/h4JKOkqQAq/V/ijbL2U 12Upb230DIgpL1N0pbtAtGkulGMPOkMQ3Exe8CIaey3Ofp+awB4Q0jdQEkI86XX8 cOdpMV8vN5Oqf+yXPblYlUpoJIOiuly9Caj7/pN+zG1MRSO14F2mCdAReJyAg7kP /0/g/flbC9AO5qwfw+yKbN+G8FmqCPX7JUrUbkfGtNUb/kwPHTyDh1U7XF8D06z8 11NxMNUMOcTEFHS1OQrFh/oIAy37dz6MbNkdzHPoLOG8FS/s+RBH2YoODKSjECyE Mh56cesofNt47wIimz1Z/TRag2zr0A7gOgdM3Kh9Sd3rlEU7WEJTCisXJkYqVREi HTnMXfPcNxC9U/UxubeDVY1AGavDQDYrqSDk8ZRljZ3VfvFUYBx0AKPp1mkAPVAS vVe6YpPvxoKttgcmFG6Fe7X2JJvkbE2KhXraG8I4kxACzhPy0ENFA//hyxIIz+en fvKYxDIufYYvOiPbnTwBsWXFbS8JXXdAecML/loIy0DYWTq13yiKOz4ahzxWBZGP 4JrZnCsFxvjdmopxSQ6WZbHGWcdOFdv3lecVeybp8Aq40ViMf6NYO1wdG3u4Krrx uX6J2nlU50utl9P03VofuWLTL5909b86g8lhdTFtn7pOBsVDD0WPmYI7Xf3zFDav qWcF+kbwOTFMaa1UDIIbBtpBQBoEpLDn8ajDhrfuhPUzN6Qwlu6vQhIJFPwCj4VY rUiUIo5oXi72OEB0jWOVvPS43JVHSyrzuEAdSMcoYp7Iwd22gILOe0saf/VOIgCX TLNtgqEK07eUdiucS2wFXKYVbHDKDR+2Wsckcn5BGQX00kMB6CFmhwAQs8n3Fep+ BtizYTn+IFWSP7gkTpYuOA4ap+QBlx1bXssBHfrFzsEZu4i3yU64GyxeejIKyfjE JWSAkytZ =uUi8 -----END PGP MESSAGE-----

Can I borrow the private key for the public key that was used to create this message?

As cliche as it is, the old saying "If X is illegal, only law-breakers will use X" applies here.

That's a tautology. And the set of law-breakers is neither a subset nor a superset of the set of immoral/unethical/bad/evil people.

I totally agree, and there's no implication the law-breakers have any specific morality.

That may be, but I think most would agree that law-abiders should not be, ipso facto, barred from activity that is not necessarily immoral/unethical/bad/evil.

I have implemented RSA encryption and key generation in DrScheme while sitting in my computer science class in high school. (Well, probably I did some of the work at home.) Please don't tell me that's supposed to be illegal.

On the other hand, if the article is to be interpreted strictly, as only making it illegal for online service providers (is that supposed to mean ISPs, or anyone who provides a service online?) to offer encrypted communication, then it will make it more inconvenient but by no means impossible to encrypt everything that you do. In other words, it'll be totally ineffective against serious criminals; but I thought stopping them was supposed to be the justification for a law like this.

I am mad.

Don't they simultaneously also have to ban all forms of encryption without backdoors?

There is some value in just forcing a backdoor on manufacturers without a ban. Plenty of people only get the benefits of encryption because it is on by default.

However, to be truly effective, yes they would have to ban other forms on encryption - this obvious inference was totally ignored in all news I read or saw of the clipper chip in the 90s. A sad illustration of the prevalent shallowness in mainstream tech reporting.

The real problem with the clipper chips was the start of international communication - which meant the USA had to agree with Europe, Japan, China etc to share the keys.

Same thing here, if the US has a backdoor into https/ssh, then the Eu will also want one, and Russia, and China, and India and the middle east. How long is your online shopping going to be secure when Nigeria or Somalia has the official government backdoor into your bank login.

SO we can thank Amazon/Visa/Apple for quashing this one.

According to the nytimes article, the proposal will likely include the requirement that you MUST have a backdoor in your encryption scheme. That effectively bans schemes without backdoors.

So the theory is that the mafia guys they're trying to take down for extortion and murder will meekly submit to government mandated encryption? Sounds plausible to me!

I think the theory is that mafia guys will download stuff off the web, which presumably has backdoors they don't know about or understand, instead of hiring coders to write custom chat and email applications...

Not that this will ever pass as a law.

I suppose if they make using non-backdoored encryption a felony, they can convict them of that, even if they don't know the contents of their communications.

Of course, if there is a back door in all encryption between, say, businesses or minority political groups or anyone else who has legitimate reason to encrypt stuff, 1) there's the chance (very likely) that others will discover the back door, and 2) the government (or some of their employees) will probably abuse it at some point.

See, the whole point of encryption is to make your communications SAFE and eliminate these sorts of unknowns. It's a legitimate need, and just because it can be misused doesn't mean it shouldn't exist.

That's a good point that I hadn't realized. If this were to pass, they can get you on using encryption without actually charging you with any other crime. That's scary.

In the UK they can imprison you for 5years for refusing to hand over the key.

You did log the key for that https session when you used amazon checkout didn't you?

You don't come to HN just to hear what you already think, so in that spirit here's what I think.

First, from what I can see, everything we know about this proposal was filtered through an NYTimes reporter. In other words, we have no idea what the specifics of the proposal are. The issue that's lighting everyone up is the "likely" requirement that "Developers of software that enables peer-to-peer communication must redesign their service to allow interception."

This, to my eyes, could mean one of two things: either (a) the DoJ expects independent developers to backdoor any voice app implemented with encryption, or (b) the DoJ wants a lever to use to get Skype to comply with law enforcement investigations.

Option (a) is crazy-talk and won't happen, if only because there's already judicial precedent for the idea that source code is a protected form of speech; you can't ban encryption in the US, and we're epsilon from overturning the idea that you can even restrict its realization in an actual product from international commerce. A more pragmatic reason this could never happen is that industry wouldn't allow it, and contrary to the notion of the government as a big clumsy untethered gorilla that can run wild, it actually is difficult to pass and enforce laws that incur 8-figure costs at Fortune 500 companies. It's also too easy to lobby against.

Option (b) is where I will annoy the hell out of you, because I don't think this is a totally unreasonable thing for the DoJ to pursue (whether they should actually get it is a separate issue).

In the United States, we don't actually have a right to be free from investigation. We don't even have an enumerated right to privacy! We're free from unreasonable searches and seizures of property, and court-authorized wiretaps simply aren't unreasonable in our jurisprudence (or even our common sense understanding of the law).

My crypto-fan acquaintances on Twitter are fond of pointing out that this proposal would do nothing to catch Bin Laden, which is of course true (no law will). But I don't think this is about Bin Laden; I think it's about garden-variety prostitution rings, racketeering investigations, drug and weapons smuggling, and other day-to-day law enforcement issues. As I understand it, wiretaps are an integral part of these kinds of criminal investigations, and it is a bona fide problem for LEO's that voice communication is moving to encrypted IP networks.

The reality, again as I understand it, is that 80% of criminals are simply too stupid to migrate from Skype to something more secure to avoid wiretaps. So if this is a law that basically says "people should not be immune from wiretaps by technological default", well, that seems sensible. If you care about the security of your voice comms, set something more secure up.

It's hard for me to get too up-in-arms about the idea that the FBI wants to tap Skype, since they can already tap GSM and they can already tap my land-line phone.

Some people, I think, feel intruded upon since this represents the FBI treading on their own personal technology. But remember, with a court order, the FBI is already capable of backdooring your machine with surreptitious keyloggers and all manner of other doohickeys. This rather moots any "P2P encryption" you might be relying on.

But remember, with a court order, the FBI is already capable of backdooring your machine with surreptitious keyloggers and all manner of other doohickeys. This rather moots any "P2P encryption" you might be relying on.

Au contraire, they'll never get my encrypted FrogPad that lives in my pocket and sleeps under my pillow!

The only way I can find it at all feasible is if the government supplied crypto binaries that you could / should / etc link against. If that has a backdoor which gets broken, you're not at fault. If your code has a backdoor because someone made you put one in, it'll end up being your fault if someone gets spied on illegally.

We don't even have an enumerated right to privacy!

The right to privacy is made explicit in many places, especially judicial precedent. It just isn't explicitly stated in the constitution.

http://en.wikipedia.org/wiki/Griswold_v._Connecticut

"While the opinion in Lawrence was framed in terms of the right to liberty, Kennedy described the 'right to privacy' found in Griswold as the 'most pertinent beginning point' in the evolution of the concepts embodied in Lawrence..."

That would qualify as "enumerated" to me.

Let's avoid a rathole, stipulate that privacy is a Constitutional objective recognized by the Supreme Court, and re-focus on the fact that you clearly don't have a right to be free from wire taps.

Well... in the process of investigating and punishing people, the justice system pretty much inherently must negate many otherwise recognized rights.

You do have the right to be free of wiretaps - except in the course of a court-ordered investigation. You have a right to not be a slave - except when you violate the law and the state forces you to work, etc..

This is why its important to limit the purview of government, why even if we allow prosecutors to spy on people, we might not want them to easily spy on people, etc.

We don't want them easily spying on people, but we might not want it to be virtually impossible for them to spy on people by default. I use the word "might" because I myself am not sure. But I definitely see the dilemma they face, and my reaction to it is not knee-jerk.

The level of difficulty the government has in spying on people should be inflicted through the judiciary - obtaining a warrant and the like with appropriate punishments for setting aside this process.

I have not looked deeply in to this though, so apart from that point I have no position on this proposal.

It used to be the case that the police couldn't tap your land line without a warrant. How long did phones even exist before the government was already abusing this power? The government can't be trusted to have a mechanism like this and not abuse it (setting aside the fact that the existence of such back doors means once someone cracks it, anyone can tap you).

Bad idea. CALEA mandates this with normal telephony. This, in part, led to Israel getting the power to wiretap US calls as they sold America intercept gear:

http://www.antiwar.com/orig/ketcham.php

This will just push the encryption down from the service provider to the application layer.

true, but from the phrasing in the story, it appears any company encrypting data will be required to provide the FBI a backdoor, including the application layer.

What I find interesting / related is Google, Yahoo and other internet companies and ISPs are pushing for less invasive probes from the DOJ (http://news.cnet.com/8301-13578_3-20002423-38.html), maybe the Feds need some draconian laws to bargin with.

How would this affect SSH? SSH is a great tool for encrypted communication - using tunnelling, obviously - but I can also SSH in to a server and edit a text file there, then tell my friend to SSH in and read it.

Even greater is the use of VPN. VPN tunnels your entire Internet connection to the gateway of the VPN gateway/server.

I was at meeting of the White House and the very same officials backing this were talking about the rollout of DNSSEC.

Of course they were. DNSSEC has a centralized key and therefore already has the proposed backdoor.

DNSSEC is signed, not encrypted.

I'd support an encryption backdoors if they implement it similar to the backdoors in the existing telephony system. They must get a warrant to tap your telephone line and by law, the telecom company must comply. That's why all telephony switch have these "features" that can "copy/record" telephony packets for law enforcement purposes. If people don't have a problem with the existing system, I don't see why they would have a problem with data encryption backdoors.

"Lawful intercept" backdoors like the one you described have been abused in countless cases (google it, you'll see - the example that comes to mind is the Greek olympics scandal). People are fighting this because the existing system is rife with potential for abuse, and anything else that opens up more potential for abuse/intimidation/corruption is a bad idea.

I wonder what implications this could have for PKI systems. Forcing OS vendors to include trusted FBI CA certificate to enable forging SSL certificates on the fly would seem like a logical thing to do... if it's not being done already.

Considering that vendors already include Chinese government CAs voluntarily, I don't think they'll have to be forced into much.

Check me on this, but isn't encryption basically a solved problem? In which case, isn't it a little late for this? We have the encryption, there is no backdoor, and legislation won't make it so.

Someone should organize a viewing of this film in DC: http://www.imdb.com/title/tt0427461/ Maybe then they would get the point.

After reading the Times article, I don't see how TOR would be affected. Tor ensures Annonimity not Privacy. Tor just obfuscates who you are talking to, not what you are saying. A warrant to your ISP will get everything you say over TOR (assuming you aren't then encapsulating inside one of the other encryption mechanisms listed).

Wrong. Tor encrypts the channel from point to point. ISP doesn't know what you're saying.

Data passed between TOR nodes is encrypted. It should be painfully obvious that this encryption is essential for TOR to function properly.

Correct me if I am wrong but I think all communication between the TOR nodes is encrypted. So if you run a node locally (as you should) nothing is revealed. However if you just configure your browser's proxy settings to use outside node all bets are off. Everything should be encrypted from entry node to exit node.

It depends on how many nodes the listener has ownership of. Just as a point, the Military started TOR. So how many TOR nodes do they have?

At DEFCON I have seen several man in the middle attacks on TOR, the most successful of which required only 50% of the nodes.

If you own and operate a node of which someone is using to route their packets through, you can effectively listen in on that communications. TOR does encrypt its communication between nodes, but it is decrypted, inspected, then encrypted in order to pass through a node, so any packet on a node is for a moment, unencrypted, if the original communication did not have any secondary encryption applied to it.

I am not sure it works like this. You can only listen on communication if you are the first node (you will know the contents, where traffic comes from and the destination) or the last node (you will know the contents and the destination but not the source). And onion routing should mean that encryption layers are peeled off as communication travels through the nodes.

https://svn.torproject.org/svn/projects/design-paper/tor-des...

You are correct about the last node. But the first node knows neither the contents nor the destination.

This is partially true, but this (and other replies) are all somewhat wrong/light on actual information.

You're correct in saying that Tor assures anonymity and not privacy: if you don't want other people to know what you're sending over Tor, it needs to be encrypted separately, because the communication between the Tor exit node you're using and the computer you're communicating with is unencrypted.

However, Tor still relies on encryption in order to provide anonymity, and messages are still encrypted when you first send them out (whether or not you're running a Tor router yourself).

Tor does onion encryption: when you send out a message, that message is wrapped in three layers of encryption. The first router you send it through can take off the outer layer to see who it send it to next, the second router you send it through can take off the second layer, and the third (exit) router you send it through can take off the final layer of encryption and see the actual message you sent (and where you want it sent). This encryption is very important, because it assures that each router can only see its immediate neighbors in the chain. If the encryption is broken, then whoever breaks it can see the entire circuit the message is traveling along (which will include the source and destination) and so anonymity is compromised.

Sure, as long as all government encryption has to use the same setup.

The enumerated powers clause of the constitution does not give the government the power to mandate standards for communication. Further, the first amendment makes it clear that such a law is a violatiin of rights.

Finally, it is worth noting that the fourth amendment requires a warrant, and existing wiretaps are done without warrants, just with "court orders" because getting a warrant was too much of a burden.

The inclusion from all of this is that the act of enforcing this law, if passed, would be itself a crime as there exists a federal law against violating constitutional rights under color of law. Further, passing the law jugs shows who illegal our government has become. If the government is not in comolaince with the document that authorizes it's existence, then it is not a legitimate government.

"The inclusion from all of this...", I think you meant "The conclusion to be drawn from this...".

And while I do think the proposed law is shockingly broad and overreaching; I find your grasp of american jurisprudence to be lacking in several important respects.

Which important respects?

For one, at least since the New Deal, the strict constructionist interpretation of enumerated powers doesn't hold water. The federal government has a pretty broad interpretation of 'interstate commerce' which supersedes the list of 'enumerated powers' Since the internet crosses state lines, it's interstate commerce.

For example, it the government can't constitutionally control communications, the FCC is illegal. And yet it hasn't been shut down by the Supreme Court or Congress.

Perhaps it should be.

Mine is lacking further still. Can you expand upon the specific errors made in his reasoning, if you would?

My uninformed guess is that if it went to court the justification would probably be the (interstate) commerce clause. Its what they used for the war on drugs.

It's interesting that in the 1920s they recognized that a Constitutional amendment was required to prohibit a given substance (alcohol).

You're right, it seems these days anything the Feds want to do can be justified by an allusion to "the Commerce Clause".

I rarely get outraged by political news anymore because I'm so jaded, but THIS story makes my blood boil!!!! GGGRRR

If we outlaw encryption then only criminals will be able to talk covertly, while good citizens will be abused. EPIC FAIL!

Reply on news.ycombinator.com