Hacker News Reader

Comment by michae2 | Hacker News Reader

I have been wondering if there is a way to satisfy law enforcement without breaking encryption or adding backdoors. An idea: what if platforms allowed law enforcement (with a warrant) to conduct rainbow table attacks against encrypted content of a specific user? In other words, what if platforms allowed law enforcement to determine whether a specific known object (e.g. a known photo or video) was sent / stored by a user rather than decrypting all sent or stored objects?

This would allow law enforcement to track the spread of a known piece of content while avoiding breaking encryption. Perhaps it could be a compromise.

View on HN

>I have been wondering if there is a way to satisfy law enforcement without breaking encryption or adding backdoors

I'd say "how about having law enforcement do, you know, police work to catch the bad guys?"

Police can already get warrants for just about anything -- as long as they can convince a judge they have probable cause[0] -- without too much of a hassle already.

Giving them keys to unlock everything is the wrong way to go about it.

Get enough evidence to convince a judge (not that hard) and you can get a warrant.

However, that doesn't mean anyone, even criminals, should be forced to make it easy for them.

Law enforcement obviously has way too much time on their hands, with the amount of lobbying they do to increase their ability to chip away at civil liberties and privacy.

Crazy thought: maybe they should use those resources to do real police work instead.

[0] https://www.law.cornell.edu/wex/probable_cause

There is no situation in which the spread of "content" should be a crime. Any encryption that allows LE to track content is broken.

Good points.

Remembering back to the PRISM disclosures, metadata alone is enough to build a surveillance apparatus. So I guess even without decryption of all objects, confirmation of the existence of known objects could still be enough to conduct mass surveillance or enable other kinds of abuse.

>to determine whether a specific known object (e.g. a known photo or video) was sent / stored by a user rather than decrypting all sent or stored objects?

It is standard practice to make it so that it is impossible to detect identical plaintext. What you are describing would count as a backdoor. So you might as well instead make it explicit and save any sort of brute forcing (rainbow tables?).

Maybe this is possible instead with homomorphic encryption.

Reply on news.ycombinator.com