Hacker News Reader

Comment by seorphates | Hacker News Reader

Is it? You kind of lost me. Isn't the actual issue math?

The issue is laws.

A country that's going to mandate backdoors/access to such communications, are going to outlaw communication methods they can't backdoor.

Say Apple makes a federated end-to-end encrypted messenger app, the government will still go to Apple and say "let us read all the messages, otherwise you can't sell your devices". THAT is the problem, and it can't be solved by more technology and shouting "BLOCKCHAIN!"

Laws are an issue and enforceability is an issue.

If a largish group of users could create end-to-end encryption not with a single company but with "readily available materials", then stopping it could be harder.

So it's a combination of state dictate and the practical ability of users to defy that. This isn't saying I'm optimistic, I'm rather pessimistic on any ability of a wide home-grown encrypted-messaging milieu to appear - if few are aiming for this, those few can easily be picked-off. But I don't think we should just give up on any part of this.

And who would use that system, if it were so closely associated with status as a federal criminal?

You're forgetting that the average user doesn't care enough to sacrifice ease of use for greater political benefit.

There's a difference between running a Tor exit node and encrypting a personal conversation.

At least in the US, if a US citizen is part of a potentially incriminating conversation, the government's going to have a hard time forcing a court to force the citizen to decrypt the conversation.

Lawyers, correct me if I'm wrong, but it seems like a conversation wouldn't be subject to the vagaries of "combination to a safe"-production loopholes.

Possession of encryption software could be treated the same as possession of drugs. On the next stop and search you would only had to handover your phone. If police password will not work it will be confiscated. If encryption software is found you go in the dock. It is the future. Society accepted ridiculous laws to jail people for having a plant, they'll accept jailing for programs. Only terrorists, thieves and adulterers encrypt their messages ;-)

Possession of encryption software could be treated the same as possession of drugs.

Well, then clearly it would quickly become ubiquitous. I mean, if a war on encryption that was just like the war on drugs were to be launched, why my local stream bed might "place burned passwords here" on the tin-can that currently reads "used needles here." (put there by the other homeless people).

> Possession of encryption software could be treated the same as possession of drugs

It's too late for that, every machine, every browser, every user is using encryption software all the time.

"It's too late to criminalize prostitution, every is already having sex"

"It's too late to criminalize possession of drugs. Half the country takes pharmaceuticals!"

I fail to see the point, without encryption, there's no modern web, no e-commerce, no smartphones, absolutely everything relies on it like water. Unless you want to go back to pre-2000's technology of course.

Of course e-commerce will be fine, because browser vendors will obtain licenses to ship TLS modules and as a condition of such will include the .gov root cert.

It's trivial when you can pass arbitrary legislation.

Back in the 90s we had to deal with US gov restrictions on encryption export. Software companies and organisations fell into line. It was a big deal when 128-bit keyed Netscape became available globally in 1997, per State Dept approval, but even then the full-strength server-side SSL was still restricted to 'approved' entities.

And even 56-bit server SSL was only exportable with us.gov key escrow.

I used to use Apache with the 40-bit SSL option. Pathetic strength but no-one was going to risk jail-time by breaking laws.

< no one was going to risk jail time

I did at that time, it was just another law to ignore.

The difference being that there's way too much necessary legitimate use of cryptography to stop now, and as the traffic is encrypted, you can't tell what traffic isn't legitimate. Plus steganography and plenty of places accessible on the net that aren't the United States.

This isn't meatspace, the dynamics are quite different.

There is nothing you cannot legislate for. For example use of encryption could be licensed, just as drugs are. If you don't have prescription, you go down.

The War on Drugs is considered a failure and in parts of the world like NSW, Australia made prostituion legal in 1979 in both cases because criminalising things most people use generally doesn't work and all you do is randomly jail people for doing the exact same thing as a large proportion of the population.

Sure, it's a failure. But you can still be jailed over it.

Its not laws since the US government and probably others have already shown with the NSA and the like that they have no respect whatsoever for the existing laws and nobody actually seemed to care one bit about that.

The issue is the government wanting to strip the encryption going forward. In other words, even the most decentralized & encrypted app can still have NSA_RemoteConn.Log(dat) written into it's source code

Stripping encryption is one thing, sure. But for the backdoor, you'd have to have the clients phone nsaserv.spy/writeremoteconnlog then or sure, write some record on the client's device. You can't "tap" encrypted communications unless you can figure out how to factor integers then you'd get a Field's medal.

Or, ofc, get people to adopt insecure protocols. That we know (or have good suspicion) they've tried.

It's this: https://xkcd.com/538/

This actually feels more like what I would expect police work to be like given the situation.

They most certainly do not have cause to demand access to swaths of comms no matter whose comms they're after and most assuredly when that access actually entails enabling access to all of the comms.

I posit there is no authority that should be able to demand this as a matter of the right to human existence. Law, order, society and government should not have ultimate authority on private communications no matter what the tech is capable of. We, as humans in a modern world, can speak and if desired do so in private. This is our right as individuals and if encryption helps us accomplish and enforce that right then so be it.

If they have probable cause then they need to beat feet or beat heads but either way they need to get to work. And by work I do not mean trying to impose a different reality than the one that we currently have - where math is fact, compute is cheap and source is open.

What's it going to be? 100 go free or six lines from everyone?

set up the device to wipe itself after $x number of incorrect attempts. keep giving the wrong password after every whack from the wrench. then you have plausible deniability. "how can i possibly think straight when you keep hitting me with that wrench?" just need to make $x a value small enough that you can survive the wrench.

No good, it is already standard for forensic teams to clone and checksum a hardrive before attempting to look through files. The clone is sent to evidence and any password attempts will be made on a copy. The "original" copy will be kept safe and any number of passwords can be used against nth iteration of copying the clone.

Isn't this the purpose of the secure enclave on iPhones? Taking the drive away from the secure enclave makes the drive useless and the enclave only allows a few password attempts.

This is exactly this. It also allows a weak password (4 digits PIN) to de ok. The enclave which holds the actual encryption keyd will refuse to hand them over if the right trigger is hit (too many attempts, too high a rate,...)

Reply on news.ycombinator.com