Hacker News Reader

Comment by smlckz | Hacker News Reader

oh god, please teach these people about encryption: what they're trying to do - it does not work like they think it works (as it seems to be).

> Locking the door of your house (with near impossible to break locks) prevents us to find out what you're doing/keeping in your house, so we can't know whether you're doing/keeping something illegal in your house. So we are going to ban the making and using of unbreakable (or infeasable to break open) locks for locking the door of your house.

< The law-enforcement people as well as the criminals will be able to break into my house. What about that?

Do you like this analogy?

View on HN

It seems like what they want is not so much breakable locks, but for you to have locks that can all be opened by a common master key. And they pinky swear that the master key will be kept totally safe and all the thousands of law enforcement officers they share it with will also keep it totally safe, and they will never ever use it except for intended purposes, and no bad guys will ever be able to get a copy of it.

I wouldn't trust my government with these keys.

The point is we couldn't trust anyone with that kind of a key; it's fundamentally unsafe.

Fun fact, they did this with luggage locks. Long story short, TSA master keys are readily available on the internet.

This is the Common Master Key (CMK) theory. How are they going to keep CMK secret (using encryption? which encryption?) and they can make sure the holders of CMK are honest (that they can't be forced/bribed/etc.) about their usage?

> Do you like this analogy?

Not especially - 99.9% of people have doors that are adequate to keep burglars out, but the cops can kick them down or break a window if they need to, in an emergency.

Which is exactly what encryption backdoor advocates want.

Note, the police does not have the key to my front door. And yet, the police can get into my house if they need to. In the world of locks and doors, there is almost nothing I can feasibly do to totally make it impossible for the police to get into my house if I want to keep them out.

Encryption is different. Making encryption that is nigh impossible to break is almost trivial these days. And the police has no recourse.

Whether that is an acceptable change from before is very much up for discussion, but we should be clear that something did change.

Let's say that it's possible to create a lock and doors for your house that are impossible to defeat. The security forces would instead find another way into your property; the window, the chimney, blowing a hole in the wall, etc.

If the security forces don't have a master key for E2E encryption they should instead find another way to find evidence of a crime if they suspect one has taken place. The analogy does fall down somewhat when thinking about completely digital crimes when there is no physical evidence, one that comes to mind is child abuse, though this could be detected by teachers/care givers or analyzing videos/pictures from users which didn't practice good OPSEC.

I forget which group it was (Lizard Squad? LulzSec?) where one of the members was identified by analyzing internet usage and monitoring the suspects coming and going.

Honestly, if the police get into my house because of another way, I think that counts as 'defeating my lock'. Indeed, the fact that police can blow a hole in my wall is part of why I say they can defeat the lock.

Change the analogy to a safe. No matter how good the safe, if police want, they can read the contents of the documents in my safe. The same can not be said for contents of encrypted documents.

Now, it might be possible for the police to persecute someone without access to those documents. Certainly, I am not arguing 'the police need this access because they used to have it'. All I am arguing is that encryption came with a meaningful change in what law enforcement can and cannot access without cooperation.

Claiming that we don't even need to consider the question because nothing meaningful changed is wrong. I don't believe we need to make that claim to argue against banning e2e encryption though.

Reply on news.ycombinator.com