The battle to outlaw end-to-end encryption in the U.S. is heating up | Hacker News Reader

The battle to outlaw end-to-end encryption in the U.S. is heating up

expressvpn.com

195 pointsspking75 comments

A few years back someone was writing software that did potentially illegal things, like more than 40 bits of crypto, which was illegal when distributed outside of the US (maybe still is).

Their response was:

"It's completely legal as distributed. Look at the header and you'll see:

    #define CRYPTO_LENGTH 40

I believe it was something to this affect that prevented us from implementing decent crypto for vehicles. There was some rule about export (possibly to the US or out of the US) that meant there was a limitation on how secure we could make the software. As a result, everybody ended up getting the same shitty low-security version of the product worldwide (they wanted to limit the number of variations for test coverage).

That sounds like a win for vehicle owners, honestly, given that encryption is often used for locking owners out of the ability to change things about their car without paying the manufacturer more money.

You might think so, but the encryption used at the time was such that only somebody with quite a few resources (such as a government actor) could reasonably break the encryption. It wasn't a win for owners or tinkerers.

What's more worrying is that there are a bunch of vehicles out there with security that is going to age * very * fast compared to that used every day (SSH, certs, etc). Consider that the automotive industry might be under similar constraints with regards to autonomous vehicles, something a bad actor could really cause some damage with.

"If you outlaw encryption, only outlaws will have encryption."

While a variation of that statement is used in defense of the Second Amendment of the US Constitution, some people have thought of how the second amendment might apply to cryptography[1]

[1] https://repository.uchastings.edu/cgi/viewcontent.cgi?articl...

I used to view steganography as a viable mitigation strategy for the outlawing of encryption.

Over the years, I've come to consider steganography as inadequate as a means of mass communication, as the more people know about how to receive a stegonographic message the less effective it is at hiding the content.

Steganography is most useful in one-on-one communication where the means to read the message is exchanged in a secondary secure channel of communication. Sadly, this just does not scale well.

For this and other reasons, I've kind of become pessimistic about the security and privacy of communication using computers, and even more so towards such security and privacy being available to the masses.

The US is giving up it's supremacy in most areas, but that doesn't mean the world won't have viable encryption. It will just come from a more reasonable country.

> To make things worse, the Act proposes the creation of a hybrid bounty program, giving third-parties financial incentives to extract encrypted data following a request from U.S. agencies. In short, if the tech companies won’t build a backdoor, the U.S. government will pay hackers top dollar to use whatever means necessary to get the data for them.

Is that worse?

I think it's a better solution. Far safer for the government to employ expert lock picks than to outlaw locks.

I thought that was the current status quo?

Only if the government tells us when they find a back door, which they obviously would not do.

Even if they don't, I think it's still better.

> the U.S. government will pay hackers top dollar to use whatever means necessary to get the data for them.

Probably the current state of affair anyway.

Probably for some operations. This would allow more of the intercepted and decrypted messages to become evidence in court. This would encourage more law enforcement agencies to use more backdoors.

IANAL

Except out in the open with plausible ... stuff.

Kind of like how woods hole "finds" a lot of stuff in the ocean.

I mean, if this means bounty hunters sell their exploits to the US Government instead of selling it to a financial fraud ring, that seems like a good thing.

Could you elaborate on the "stuff" that is found in the ocean for the purposes of this analogy?

I suspect other arms of the government that can put a man far underwater find things in the ocean and pass it on.

so if woods hole finds something, or a hacker finds something, who knows if they got a hint from elsewhere.

Second that, please - the analogy went over my head, but sounds interesting

Could you elaborate on that?

It will probably turn out that the most cost effective way of getting around encryption is bribing employees, whether through a contracting firm or directly. Great for trust...

Reminds me of Australia.

https://www.wired.com/story/australia-encryption-law-global-...

No, because if data that was encrypted is used in court, at least you know that the encryption scheme has been cracked. Even if they don't show how they cracked it, you can at least know it has likely been compromised (unless, of course, they somehow installed spyware on your device to intercept the data before encryption). I believe that people trying to break encryption leads to better encryption.

Of course it's worse, at least if it is successful. You already start out with two entities with access to your data instead of just the government. And one of them has already proven to be financially motivated and morally flexible, making it likely they will be willing to share their knowledge with any number of additional bidders.

If they were just paying hackers to build the backdoor, it might be better. Requiring a US agency request is basically a loyalty oath though, as their work violates the DMCA if that request is rescinded.

Yeah. Tax dollars at work.

From a cynical perspective, this is a market opportunity for VPN services. As were Snowdon's leaks, which hugely expanded the VPN service industry.

And indeed, using VPN services (let alone nested VPN chains and Tor) largely obviates risks from these bills. Without cooperation from the VPN service, gathering sufficient information for a warrant is problematic.

But I wonder. Might the US regulate using VPN services, as authoritarian regimes already do?

Doesn’t the language of this bill mean that US based VPN services will be forced to provide their encryption keys to the government to allow to decrypt their traffic ?

Perhaps so. But then, nobody who seriously cares would ever use a US-based VPN service ;) And even for US-based VPN services, I gather that a warrant would be required, and that'd be hard with no information about what the VPN link had been used for.

Presumably a warrant can be obtained if criminal activity is traced back to a specific VPN provider.

Of course that's already the case as far as I understand (ex LavaBit). I also don't see how VPNs would be affected since they already have access to all your traffic anyway - no backdoor is necessary.

It depends who you mean by "they". VPN services certainly have access to users' data. But it'd be commercial suicide to cooperate with authorities. HideMyAss lost considerable market share after it came it that they had pwned someone from LulzSec.

Still, it's prudent to assume that any VPN provider will give you up. And that's why I recommend using nested VPN chains. With three different VPN services, it'd be nontrvial for adversaries to obtain enough data.

What is the best way to create the chains? Do you recommend spinning up some Vbox images?

Most secure would be Qubes VMs. I use pfSense VMs in VBox. So nested VBox internal networks (yes, multiple NAT) leads produces nested VPN chains.

Also, you can include a Debian VM running Tor and OpenVPN in a chain. You configure OpenVPN in TCP mode with "socks-proxy 127.0.0.1 9050". So you can route through 2-3 VPNs, then Tor, and then 1-2 more VPNs.

Or you can include a Debian VM that crudely emulates Tor (very crudely) by periodically switching among random chains of multiple VPNs.[0]

0) https://github.com/mirimir/vpnchains/

Thanks for the reply. Just a few questions:

It is necessary to connect to the VPN before Tor, correct?

Also, is your script essentially the same thing as multihop that some of the better providers offer?

The issue with multihop is that it's all from the same provider. In the event that they were legally forced to log their network by an abusive local government it wouldn't help you. It might be sufficient to frustrate an adversary that only managed to compromise their operations at a single data center though.

I question the wisdom of placing Tor in the middle of a VPN chain. By routing your traffic back into a VPN account that's linked to you it seems like you would lose most of the benefits that Tor provides.

* A single VPN means that the provider could link your primary ISP provided IP to your browsing history if they so chose.

* Chaining two VPNs means that neither provider can correlate your IP to your browsing history on their own. However the terminating VPN can obviously link your traffic to your payment details. Also obviously a criminal investigation involving warrants is still a serious threat.

* Chaining one or more VPNs into Tor means that you can rely on the above guarantees as a fallback in the highly unlikely event that an adversary manages to directly compromise Tor. It also hides the fact that you are using Tor from anyone that snoops your traffic at the ISP level. The latter might be very important in some jurisdictions.

* In the end, even if you only use Tor without a VPN the biggest threat to your anonymity is probably your own OpSec (or lack thereof). Ross Ulbricht is a prime example of the fact that you only have to slip up once. Related to that, it's important to be aware of all the ways that modern software and hardware leaks potentially identifying information (ie fingerprinting).

Hey, that's pretty much exactly what I would have said :) And the language is similar enough that we could be the same person ;) Except that I use sentence fragments. And of course, the fact that we aren't.

That's a good point about using Tor in VPN chains. If you want to do that, you must ensure that you're anonymized as well as possible from those VPN services. When I do that, I use Tor (Whonix) via nested VPN chains. And I pay with Bitcoin that's been mixed multiple times, using different mixing services, and with each mix in a different Whonix instance. And I start with Bitcoin that's not linked to my meatspace identity.

I use a VPN first because it arguably attracts less attention than Tor does.

As Reelin notes, the difference is using multiple VPN providers, so you distribute trust.

Looking at the other comments in here, I have to say Americans still seem way too optimistic that the USA could not become a totalitarian state along the lines of Russia or China.

Idiotic legislation is proposed all the time. I can still call it idiotic and say we need a new president. Can’t say that in either of those countries. Just because our elected leaders suck doesn’t mean they’re totalitarian.

If government backdoors are really necessary, the government should be able to provide an explanation without using the words 'terrorism' or 'child pornography'.

end-to-end encryption is the only way that you can keep democracy alive/healthy

Democracy has existed for hundreds of years without it.

Encryption is an interesting development. There has never been a time in history when anything could be truly secured. Safes could always be defeated. Communication was never provably secure.

I'm opposed to any mandated weaknesses in encryption, but I also think a lot of the arguments opposing them are dogmatic and unconvincing.

Communication used to be provably secure when you could meet with the person you want to communicate with without being afraid of ubiquitous surveillance tracking your every move and hidden listening devices (or just your phones) recording your conversation. Until a few decades ago it was never possible to do surveillance at scale. You had to first identify suspects and then start surveillance.

I do all my business naked in a sound proof faraday cage.

But how do you meet people without security cameras tracking your movement?

Democracy also existed without ubiquitous surveillance technology during the same time period, so I don't consider that point refuted.

See, I don't view encrypted data as a technological improvement over safes, I view it as a technological improvement over human memory. They're both primarily vulnerable to rubber-hose cryptanalysis.

Mandating weaknesses in encryption effectively makes the technology less useful by fundamentally shifting it from an improvement over human memory to an improvement over a safe.

But hundreds of years ago, the government wasn't logging everyone's communications. If they could read everything we transmit, then they could micro-target all opposing views, like they did on facebook.

Do you mind sharing which arguments you do find convincing?

These garbage attempts resurface periodically. Some just never learn.

They have learned just fine, but the lesson is the opposite of what you want. If the people don't want something, bring it up again and again and you can still eventually make it law, despite the people's desires.

Then they should be defeated again and again.

It only takes winning once. It doesn't help that public opinion holds little to no sway, and that it takes money from big players to fight it off every time.

Corrupt laws can be repealed. Something like DMCA 1201 looks set in stone, but I have no doubt it will eventually be scrapped.

But I agree, if such kind of junk becomes law it's much harder to repeal it, than to prevent it from becoming law in the first place.

These bills are self-defeating. I suffer no affections for narcotics dealers and human traffickers seeking anonymity, but I also suffer no affections for "Western" bankers fixing LIBOR and NSA tapping phones of our NATO "allies." As is, our USA "cloud" is already a Trojan Horse. At this point, Open Source and strong encryption are already prerequisites of any imaginable national sovereignty. If we can't "export" strong encryption, we'll just "export" strong encryption engineers.

Everyone should actually just go read the bill rather than just get news from a bunch of sources that stand to gain or lose from aspects of it.

A ton of these claims are unsubstantiated if you look in the latest versions. There is so much Fear slinging going on around the web it’s seriously just bizarre to me after actually reading the bill.

Which bill? The Lawful Access to Encrypted Data Act bill (https://www.judiciary.senate.gov/imo/media/doc/S.4051%20Lawf...) is on its face every security engineer's worst nightmare. It explicitly mandates that large service providers and device manufacturers implement backdoors. Full stop. Not only would that suck for Apple and Signal, it would probably suck for AWS (i.e. AWS KMS), too, presuming AWS doesn't already provide those backdoors.

I agree that there seems to be more hyperbole (slippery slope, parade of horribles hand wringing) surrounding the EARN IT bill (https://www.congress.gov/bill/116th-congress/senate-bill/339...). It would make CDA Section 230 Safe Harbor protections contingent on complying with "best practices", but only for civil suits related to child sexual exploitation. In practice I assume this would mean the only exposure for, e.g., Facebook if they failed to comply with "best practices" would be suits from those victimized over the platform. Theoretically large social media platforms could probably absorb whatever minimal liability that creates for them, notwithstanding the uncertainty that would exist until the first few cases exposed the contours of when and how they'd be liable. OTOH, from a PR perspective it might be difficult to remain intransigent. But in any event Section 230 Safe Harbor is a rather novel immunity and most other industries have no such protections, so it's not like it would be the end of the world. Heck, plenty of people worried about EARN IT also argue in other contexts (e.g. fake news culpability) for the removal of Section 230 protections altogether.

Also, it's really not clear how EARN IT would effect end-to-end encryption. I can't see how it'd effect Signal, period. They have no real need for Section 230. Facebook might need to spin off WhatsApp (assuming it's not already separate), but creating complex corporate ownership structures to limit liability is well trodden ground.

That said, half of the language in EARN IT is geared toward creating a fast-track legislative mechanism in the House and Senate that would circumvent debate and, as a practical matter, accountability. Perhaps it's possible that mechanism could also be used to sneak through broader encryption-related legislation.

> But in any event Section 230 Safe Harbor is a rather novel immunity and most other industries have no such protections, so it's not like it would be the end of the world.

I have to disagree here. What other industry revolves around distributing user generated content in such unmanageable quantity, and for free? Without liability protection, who in their right mind would operate a site like Reddit without charging users a membership fee?

> plenty of people worried about EARN IT also argue in other contexts (e.g. fake news culpability) for the removal of Section 230 protections altogether

I seriously doubt that a well informed person concerned about the effect of EARN IT on Section 230 would turn around and speak favorably of stripping Section 230 protections for failing to moderate user content regarding current events. (Unless I've misunderstood you?)

(On the other hand, the recent drama surrounding Twitter was because by adding their own annotations to certain posts they were arguably behaving as a publisher instead of as a mere host for user content.)

> I can't see how it'd effect Signal, period. They have no real need for Section 230.

Honest question - I have no idea how liability works for encrypted content. Even thought their user content is encrypted, could they be held liable under EARN IT if their platform was used for sexual exploitation of children? I'm assuming that strong end-to-end encryption with no backdoor wouldn't qualify as a "best practice" under that bill.

More generally, I'm not clear to what extent intent is required in these cases. Consider pinning an IPFS object whose content is encrypted or operating a Tor exit node. Is plausible deniability alone enough to protect you from civil proceedings? What about criminal ones?

Lawmakers proposed a law that would allow them to eat babies. Since lawmaking is a process eventually this eventually morphs into a law that only allows the eating of teenagers and then only those who also have red hair or blue eyes.

Without infinite time lots of people only know that the bill allows eating people and aren't entirely clear on the exact criteria of people allowed to be eaten.

A process that starts in extremely bad faith is unlikely to be negotiated into something reasonable. The best solution is to keep threatening lawmakers who pass stuff like this with replacement in hopes that nothing lands because there is no universe in which they are capable of producing good legislation on a topic they know less than nothing about.

The way things are set up, one can only vote and debate for people who routinely get "persuaded" by K street when elected

And I would say that in response to `salawat`:

>> This would include exposure to well funded lobbyists as well.

(Also including organizations like CFR/Sunlight Foundation/etc) Largely determines:

>> the political realities at the National level

If people want to pretend that engaging in more of the same that got us to this point is actually a solution, that's fine by me since I moved out of the US almost a half decade ago; I read enough of history to see how things like this eventually end up and I don't want to be near it. My labor, knowledge and time is better spent elsewhere until things change, for better or for worse.

My fellow citizens stateside can vote and debate on people untill kingdom come

How is E2EE related to cannibalistic eating of humans?

It’s called an Analogy. https://www.merriam-webster.com/dictionary/analogy

Tell me how anything can be done about encryption (especially E2E encryption) that won't be abused. US considered encryption arms less than 30 years ago. We're living in the best possible time for it. Genuine open-source end-to-end encryption, that can only be seen by your recipient. No one can do anything about it. In the current world where privacy feels like it's non-existent, you have these islands of hope and even these are being eroded.

Yes, I agree you should always read first-hand rather than second-hand reports but is there literally anything the government would do that I would want them to do to the current state of encryption?

"can only be seen by your recipient"

Both endpoints are DRM'd and controlled and recorded by big brother, you don't have root on either although uncountable exploits and viruses do, and often at least one of the endpoints is big brother himself so obtaining logs will be quite easy.

But, isn’t the argument that access this way is cumbersome and only available economically to priority targets?

Also, if you need you can run Linux as end points.

Run Linux ... on a device whose CPU has an unauditable security coprocessor? A CPU whose microcode is implemented in encrypted firmware? A device whose physical hardware can't be meaningfully audited without state actor level resources?

I don't really think such approaches are used or even viable currently. But if it ever were a concern, "run Linux" doesn't even begin to address it. (Anyway you can't run Linux if your endpoint is a phone with a locked bootloader.)

The only way that I can see this being actually safe is if you make the hardware to encrypt and decrypt the data yourself.

> A ton of these claims are unsubstantiated if you look in the latest versions.

Could you be more specific? And which claims remain valid?

I actually read it.

It's actually really terrible.

Reply on news.ycombinator.com