Doomed to repeat history? Lessons from the crypto wars of the 1990s (2015) [pdf]
static.newamerica.org
static.newamerica.org
http://www.shub-internet.org/brad/cacm92nov.html
I was a member of DC CypherPunks, with Declan McCullagh. I got to meet Whitfield Diffie. I saw EFF and EPIC and other such organizations get created.
I was just a tiny fly on that wall, but it was clear what we were up against at the time, and how things have just gotten worse since then.
Back then, the crazies were worried about these things called RFID strips that were supposedly embedded in all the money, so that the government could track you wherever they wanted.
Today, we all carry around phones broadcasting Bluetooth or wifi MAC addresses or RFID tags to tell us where we lost our keys, and we give them so much more information than could ever have been gathered by the claimed RFID strips.
I remember his Politech mailing list back in the day:
https://www.mail-archive.com/politech@politechbot.com/mail9....
- he was alert to the risks of today’s technology decades before they began to be realised.
I find the 180 degree shift in meaning of many words, phrases, and even political positions over the last 7 years to be fascinating.
https://youtu.be/sKOk4Y4inVY?t=518 [1]
1. "In 1995, there was a debate at Harvard Law School – four of us discussing the future of public key encryption and its control. I was on the side, I suppose, of freedom. It’s where I try to be. With me at that debate was a man called Daniel Weitzner who now works in the White House making Internet policy for the Obama administration.
On the other side was the then Deputy Attorney General of the United States and a lawyer in private practice named Stewart Baker who had been chief council to the National Security Agency, our listeners, and who was then in private life helping businesses to deal with the listeners. He then became, later on, the deputy for policy planning in the Department of Homeland Security in the United States and has much to do with what happened in our network after 2001.
At any rate, the four of us spent two pleasant hours debating the right to encrypt and at the end there was a little dinner party at the Harvard faculty club, and at the end, after all the food had been taken away and just the port and the walnuts were left on the table, Stuart said, “All right, among us now that we are all in private, just us girls, I’ll let our hair down.”
He didn’t have much hair even then, but he let it down.
“We are not going to prosecute your client, Mr. Zimmermann," he said. “Public key encryption will become available. We fought a long, losing battle against it, but it was just a delaying tactic.” And then he looked around the room and he said, ”But nobody cares about anonymity, do they?"
And a cold chill went up my spine and I thought, all right, Stuart, and now I know you’re going to spend the next twenty years trying to eliminate anonymity in human society and I am going to try to stop you and we’ll see how it goes.
And it’s going badly. We didn’t build the net with anonymity built in. That was a mistake. Now we are paying for it." -Eben Moglen
Given how prevalent quiet aquisence is in the tech community about mass surveillance, I think the mistake is going to be anonymity, and other user rights and freedoms foundations, including crypto. We already see it happening with crypto, but please remember the real war is on computing freedom. These other things are a subset.
I'd say the Internet is pretty dang anonymous compared to, say, X.25 or PSTN.
I'm curious what kind of anonymity Eben Moglen had in mind.
> but please remember the real war is on computing freedom.
Excepting the MPAA and their fixation on encrypted HDMI, what computing freedoms are at risk of being lost, and to whom, exactly? (well, within the OECD - yes, things are bad in the PRC and in other autocratic regimes - but those are hardly new threats).
Riding the current of valid security concerns, all platforms are moving towards all code being signed and attributable and most code operating only within abstract/virtual environments that only provide mediated access to the hardware or the host system.
* Rule number 1 in Distributed systems fight-club is never trust the client.
* Rule number 2 in Distributed systems fight-club is never trust the client.
...so why do they trust their client in a little-snitch OEMs soldered to the motherboard?
we're one "cyber pandemic" away from all new consumer hardware being turned into locked down plastic toys for our own safety. and the seeds are already being planted in the minds of the public https://duckduckgo.com/?q=cyber+pandemic
I was building an e2e app at the time, and let me tell you i had a real existential crisis as to why i cared so much about people's privacy against their own will
https://news.ycombinator.com/item?id=28105138 (Aug 2021)
https://news.ycombinator.com/item?id=25098136 (Nov 2020)
If you want to refer to something you posted before, that's great, but please use the tool for the job: a link.
https://hn.algolia.com/?dateRange=all&page=0&prefix=false&qu...
Disclaimer: It seems I am breaking the rules here, too: https://hn.algolia.com/?dateRange=all&page=0&prefix=true&que.... And I disagree with such rules of course.
Speak for yourself: I get upvotes every time (up to 22).
> You don't have to stamp 'incorrect' on every comment you think is wrong
New people often make the same mistake about privacy and I choose to correct them, because I think it's very important. It never was about "keeping the discussion going" for me. Quite the opposite, actually.
It's mostly a classical "nothing to hide argument" (https://en.wikipedia.org/wiki/Nothing_to_hide_argument), which is unbelievably popular, sadly. There are hundreds of threads trying to explain it to someone every month, with all the same arguments, reworded. My posts stop this repeated discussions, because nobody found a counterpoint (yet?). From this reasoning, I believe it's worth to copy-paste instead of ignoring (and letting the discussion go the same way again), or linking (and loosing the attention of most observers who, quite reasonably, don't want to click a lot).
People upvote things that are bad for the forum all the time, hence the rules and the moderation.
https://hn.algolia.com/?dateRange=all&page=0&prefix=false&so...
It's mostly a classical "nothing to hide argument"
It's still a thing you classically shouldn't do here.
I don't believe so. I'm not dismissing your arguments, it's just that here, this argument has been argued and settled. Your particular approach has been found not to improve discussion (as explained in exhaustive detail) so to participate meaningfully, you gotta avoid it for reasons that go well beyond just the act of pasting:
https://hn.algolia.com/?dateRange=all&page=0&prefix=true&que...
You can mail the mods and ask if you want to be quintuple sure, they're plenty responsive.
Meanwhile, I will assume that I'm doing a good thing. I don't see how your link provides an explanation "in exhaustive detail". What are "canned response" even are? When someone says "I have nothing to hide", any response might be considered as canned - so is it better to let people be unaware?
I do think the importance of what Eben said stands on its own though. It cuts to the very heart of the crypto-wars.
One new tool that didn't exist in the original crypto-war: national security letters.
The principle we're going for is good conversation. If you sense into what would make sense in a good in-person conversation, that's probably about right. Even when it's natural for the same material to come up in a series of conversations over time, people don't repeat identical boilerplate to each other; that would be weird.
Quotes are a special case because by definition one is repeating them rather than generating them.
I'm saying that in the future (given this trend), in order to get "the computer" to do anything at all, the interface won't be a CLI or a programming language, but a giant searchable marketplace where you can buy (pay for) each specific action that you want your computer to do.
this sounds a bit ridiculous now, but it's not. it's a super appstore. it's the API economy taken to an extreme level. its all the functionality of your computer as a service with a small transactional fee for every meaningful action.
instead of teaching more people to program (and making an effort to keep computing simple), we have been collectively making computers easier to use and harder to understand.
It's only a matter of time before opening browser developer tools requires a cyrptographically signed government issued authorization (to give a crude example of my worry); of course this could be promised to keep children safe (or whatever convenient political excuse).
More realistically, I don't think it would work to straight up enforce this; instead I suppose making it unfeasible or otherwise really annoying to open browser dev tools is the way to do it. I have reasonable suspicions that this is the main driving impulse behind WASM.
“debugger vendors in 2047 distributed numbered copies only, and only to officially licensed and bonded programmers. The debugger Dan used in software class was kept behind a special firewall so that it could be used only for class exercises.”