Hacker News Reader

Comment by octosphere | Hacker News Reader

Yeah but what's to stop a bad actor simply switching to a provably secure cryptographic system or app? Don't forget there's an arms race going on, where bad actors consistently try to outpace law enforcement by switching to provably secure and private systems. Take for example when 3DES[0] was discovered as insecure and all the criminals switched to AES[1]. And don't forget the old adage: If you outlaw encryption, then only outlaws will use encryption

[0] https://en.wikipedia.org/wiki/Triple_DES

[1] https://en.wikipedia.org/wiki/Advanced_Encryption_Standard

View on HN

The bureaucrats and politicians who espouse the same opinions as Barr all live in a very old-school world. They believe that encryption is a product solely "built" by companies with Wall Street headquarters open 9-4 M-F. They think that stopping these companies from "building" their encryption is a matter of talking about it with a director of the company in question over 18 holes, or failing that, sending a strongly-worded letter to the legal department of the company in question. Barr&co. do not live in the real world.

I don't think that's really an accurate portrayal of what happened with AES and 3DES. NIST (aka the US government) were the ones that introduced AES and recommended everyone switch over to it.

3DES was kind of a quick hacky extension to DES after it was found vulnerable to brute forcing in the late 90s to have something 'good enough' until a more suitable replacement was developed (which was AES). By the time any practical attacks had been developed against 3DES (Sweet32 from 2016 was probably the earliest) almost everyone had long since stopped using it other than in old legacy systems.

Firefox still uses 3DES to encrypt its password database though... it's probably not a major issue because all of the publicly known attacks on 3DES require gigabytes of ciphertext. Wikipedia has a 'citation needed' claim that "the whole 3DES keyspace can be searched thoroughly by affordable consumer hardware as of 2017" but good luck searching a 112 bit keyspace.

I certainly agree with your general point though.

> then only outlaws will use encryption

Which makes them easy to find in a dragnet unless they're also using stenography.

Steganography, not stenography.

Which is exactly what would happen. Low-effort E2E encryption (Signal, iMessage) primarily benefits lawful users; but bad actors are sufficiently motivated to invest the effort in getting around encryption restrictions by disguising communications as legitimate data.

You conflate unlawful with bad. Everyone is unlawful.

They don't want to catch intelligent bad actors. They want to intimidate their powerless enemies.

Reply on news.ycombinator.com