Scaring People into Supporting Backdoors
schneier.com
schneier.com
That would explain why even when people distrust the government they approve of the police, simply because they are not the government from far away imposing an alien law, they are the local posse keeping order.
It's little surprise people want to keep at least some sovereignty local.
Religion is the same, pick a team and throw critical thinking out the window.
Supporting police vs. the criminals, there's an implicit dichotomy: who do you support? if you're not with us, you're against us. You don't support the criminal team, do you? Go blue! Blue lives matter!
Employment: which company is your team? You must be employed, now go choose one, and let your employer even define talking points for defending its poor behavior at family gatherings. [0]
Politics: Red or Blue, pick one and always vote your color no matter what the consequences.
Once people are engaging in teams, they're largely no longer thinking critically about the substance anymore. It's no longer relevant, the priority is being aligned with their peers.
It's quite dangerous, like mob mentality.
[0] https://www.forbes.com/sites/krisholt/2019/12/02/facebook-ma...
What's he building in there...?
The practicalities and cost of putting cameras in every room then monitoring them are clearly absurd, so it undermines your case.
As for the absurdity of placing monitors in every room, I'm surprised someone on HN would raise that objection. IoT devices are dirt cheap, and whats more, many people voluntarily install them. The government could easily choose to subsidize Nest/Amazon/Google devices - for the low low price of free access for your protection. Maybe you would get insurance premium discounts. Many would jump on that deal.
Then you use a straw-man yourself, implying that this system would require constant human monitoring to be effective. It wouldn't. The data would be used in the same way security camera footage is used now, to be used as evidence after-the-fact, and so, as a deterrent.
So, rather than reflexively attack me, how about engaging with the thought behind it?
Yes, it would be a massive privacy violation but given the kind of power they wield the checks in place must be equally massive. Trying to bypass these measures in any way could even be treated as a national security threat.
There is an alternative approach to mitigating this problem which is easier, cheaper and more effective. We need to reduce the concentration of political power by making politicians and beaurocrats less powerful. Since the benefits of political power tend to amplify over time, we should limit all such positions of power to single terms. Once elected to any state-wide or national public office, you can never be elected to another. One and done. If there are no 30-year career politicians, the value of influencing them is greatly diminished.
The next step is to reduce the amount of power centralized within government. Much as bank robbers target banks "because that's where the money is", crony capitalists and lobbyists seeking regulatory capture target politicians because we've allowed too much power to pool in one place.
- Random ordinary citizen? Leave me alone. - Someone in a law enforcement agency? Jail time if their mandatory badge came stop functionioning, with all the footage being public data. A powerful politician? Billionaire CEO? Board members of a massive international corporation? 24/7 livestreamed public surveillance.
After all, the worst the average person can do is shoot some people, but those who hold power can ruin the lives of millions with a word, and often do. They shouldn't be allowed to get away with it, and if they don't like it, they can simply step away from power.
I honestly believe this, but even if you don't, it's worth considering why it's always a discussion of the powerful privately and secretly monitoring the weakest in society, rather then the other way around. Almost like its purely a reinforcement of the existing hierarchy.
Also: law enforcement assumes criminals and others are stupid and cannot not apply encryption and information hiding themselves. Plus creating your own chat app is extremely easy, so why even rely on the big and obvious ones, just DIY.
Backdooring mainstream encryption will substantially decrease security for criminals. What is often brushed over by proponents is that it will weaken security for all of us.
Because there are criminals in the government.
This is an easy problem to solve with a proper whistleblower program. There are people adjacent to these criminals and they may be dependent or fearful of repercussions for coming forward. Treat them with witness protection and appropriate and large (millions) in monetary incentives. Like most things in life, you get what you incentivize. But this issue is about total surveillance not about protecting children.
In several countries (Brazil, where I am from included), the law is that possession of child porn, for ANY reason, is a crime.
It means that trying to give evidence to the police, will get you in jail, even if the police doesn't want to arrest you, they have to, because that is what the law says.
Things get worse in certain countries that went along US child porn laws and ignored local culture and laws regarding related areas (for example, in Brazil age of consent is 14, and in some Brazillian regions marriage at that age still makes sense, usually due to harsh geography of the area that make it necessary, cue lots of young couples surprised when their personal photos are considered a crime...)
They were also never able to learn what was said in the van before the London Bridge attack [1]. Are we okay with Renault providing a law-free space inside their vehicles? All cars should be equipped with always-on microphones. But don't worry! The audio will be encrypted, and only accessible with a warrant.
[1] https://en.wikipedia.org/wiki/2017_London_Bridge_attack
Edit: Just to make sure - this is satire, and the logical extension of believing people shouldn't be allowed to keep any secrets.
Responding in edit due to posting limit (way to make sure downvoted comments can't explain or defend themselves):
They can also record the person typing in their password, or recording the screen with cameras, or hardware or software bugs once they have a password to access the phone.
The analogy works perfectly, and while they may say the will not "treat an encryption backdoor like a universal bug", that's exactly what it is.
Most law enforcement agencies argue (with varying degrees of believability) that they will not treat an encryption backdoor like a universal bug they can just listen in on whenever.
When you get a Judge to agree that their is adequate reason and gain a warrant, you use your resources to surveil the target in public/private, using your considerable means as a law enforcement agency. Drones, bugs, malware, other espionage techniques.
This is nothing more or less than these agencies complaining that free peoples are making their jobs harder.
One big problem is cowardice: it is easier and safer to attack the liberties of law abiding citizens (because they won't shoot you in the face), in the hopes that, by sacrificing your citizen's liberties you might pick up a few more incompetent bad guys. Its way more dangerous to actually go out, do your job, and surveil a dangerous bad guy, who will shoot you in the face.
If that's a problem -- then the law enforcement complainers need to go get a new, safer job, and leave the heavy lifting to their braver counterparts.
You don't have a general right to keep secrets from law enforcement. With a warrant, they can spy on you to try and get your secrets in ways that would otherwise be scandalous or downright illegal. If you don't think law enforcement should be allowed to steal people's secrets at all, fair enough, but that's a very radical view and I don't think most people supporting E2E encryption share it.
More to your point, I do think law enforcement should be allowed to spy on people when necessary (by whatever definition of 'necessary'). But that's a far cry from saying that people should be compelled to assist in the spying.
There's no warrant to compel someone to knowingly carry a bug.
Schneier does conclude his post with a general "weakening encryption does more harm than good", but the title still uses the term backdoor. No one who's learned a bit about crypto (omitting Lindsey Graham here https://www.politico.com/news/2019/12/10/tech-companies-bipa...) is advocating for a "master key," short key lengths or backdoors that use obscurity to keep bad actors from exploiting them.
Key escrow is real & already deployed in things like FileVault's Institutional Recovery Key https://support.apple.com/en-us/HT202385
All institutions don't use the same key and the vendor doesn't have to have a copy.
[Microsoft offers companies a recovery mechanism too https://docs.microsoft.com/en-us/windows/security/informatio...]
My guess to how key escrow weakens protections is through implementation mistakes. Are there also mathematical weaknesses that effectively shorten the key length making brute force more feasible??? Why is the discourse on the anti-lawful-intercept side so imprecise?
> The third party should be permitted access only under carefully controlled conditions, as for instance, a court order. Thus far, no system design has been shown to meet this requirement fully on a technical basis alone. All proposed systems also require correct functioning of some social linkage, as for instance the process of request for access, examination of request for 'legitimacy' (as by a court), and granting of access by technical personnel charged with access control.
The social issue is a significant problem. How do you make sure court officials are not bribed? Who has access to the key escrow service, and what sort of checks make them trusted? Employees snoop on things all the time [2, 3, 4]: how are you going to ensure this does not happen with all communications for an individual?
[1]: https://en.wikipedia.org/wiki/Key_escrow
[2]: https://www.wired.com/2008/05/five-irs-employ/
[3]: https://reason.com/2015/05/20/more-irs-employees-abuse-acces...
[4]: https://www.accountingtoday.com/news/irs-celebrity-snoop-get...
- What's the best case for this tool to be used? - What's the worst case for this tool to be used in?
and then the disparity between the two must be examined. In most cases, I would say it's not worth giving many of these tools to cops.
Thanks to the poor state of U.S. education, inscrutable nature of encryption, and the failure of secure software developers to protect nearly anything at all, this sentence remains unintelligible to most Americans.
- God is all powerful
- God created the universe
Given the above three, God created the universe knowing he was creating it in a way that said sex traffickers would come into being, and that they would get access to said phones/encryption.
It is literally impossible for the first three items to be true and the consequence to be false. As such, "this gift to sex traffickers" did, indeed, come for God (and Apple).
All academic anyway, there is no God.