Comment by bediger4000 | Hacker News Reader

Comment by bediger4000 | Hacker News Reader

Parent Full thread

There's quite a bit of fallout from banning end-to-end encryption. First, it means snooping communication channels to ensure that they're either unencrypted, or encrypted with the officially approved backdoored algorithm. That's the obvious first step, remember the Clipper Chip's LEAF field, and the LEAF blower attack? Once some heinous crime is committed using encrypted-via-another-algorithm data carried in the officially encryption algorithm, you've got to start occasionally decrypting a communication channel to ensure that a 2nd level of encryption isn't present. The logic of official encryption algorithms almost inevitably leads to all comms channels being checked for decryptability.

The second major side effect will be essentially making writing software into a completely corporate thing. Either the official algorithm is a secret (Remember the Clipper Chip and/or Skipjack?), or writing implementations becomes work that only a very trusted few are allowed to do (see inevitability of snooping above). Currently it's very difficult for medium to small companies to do the paperwork for security clearances. It's not going to be any easier to get programmers certified or bonded or whatever to work on official algorithm implementations. This means slower introduction of any innovations, and any buggy implementations will be in use for a long time before getting fixed.

Yeah, your comment makes the tacit (and correct) assumption that "end to end" doesn't mean anything in the phrase "ban end-to-end encryption".

"Banning end-to-end encryption" implies banning/backdooring all serious encryption, reviving the long lines of failed attempts but in the context where serious encryption has wide, wide, wide adoption.

Earlier plan have quickly shown to be entirely impractical/counter-productive/corrosive. If you somehow enforced that, you can count on someone else besides the NSA getting the key. You would have to agree among all the world's states who gets the key or just create a "great US firewall" plus discarding all the infrastructure large companies have spent billions creating. You'd create a situation where "only outlaws have encryption", etc.

What other plans can we come up with? Maybe put software engineers in camps along with the refugees?

Is there stenographic encoding for binary sort of like Base64 that outputs full human-readable sentences?

So much bad prose on the internet, it seems feasible to make this hard to distinguish from human-written text. Plus you could have multiple codings for values, allowing non-deterministic encoding but deterministic decoding.

How do you prove that the giant integer which represents this text is a random result of my thoughts rather than encoded information?

Well, the US has handled other difficult issues with super-vague laws, like the Computer Fraud and Abuse Act (CFAA) of 1984, which appears to have been used at least as recently as 2011. If you have a weird law like the CFAA, a nation can also do the Chinese Government's "One eye open, one eye shut" vaguely vague policy, where unpredictably, the CFAA is enforced very harshly, usually on someone totally unlikeable. This makes everyone else very wary of stepping over some boundary, never mind that nobody knows where that boundary is, so everyone is very conservative in approaching issues with the law. By applying such a law infrequently, and on unlikeable defendants, the government makes it very difficult to challenge the law itself.

It is much easier to hide information masqueraded as image or video compression artifacts. Imagine how much you can hide in a single Youtube video.

Sure, take your binary, use some markov-chain expansion to yield a human-text seeming expansion and then compress that with standard efficient compression. The results shouldn't be that much larger than the original compressed then encrypted binary. Most large text gets sent compressed around the net anyway.

Something like using a book cipher[1]? But a binary equivalent maybe?

[1] https://en.wikipedia.org/wiki/Book_cipher

Reply on news.ycombinator.com