Hacker News Reader

Comment by silvestrov | Hacker News Reader

Cryptography doesn't help at all when your government will require you by law to provide them with a decrypted dump.

That's what they did with Verizon. Verizon could not provide you with privacy no matter how much they wanted.

There's no expectation of privacy at the service provider level in this case. If Verizon, or any service provider, has access to the unencrypted data or the decryption mechanism, the system is insecure.

However, cryptography does help you as an individual user of a service. There's no reason we can't build systems which are provably secure and retain strict end-user data privacy.

There is one reason: the government will make sure there are laws which enables them to require providers to give them decypted dumps. If the provider says "can't do", they will be shut down.

In the end the government can force the OS vendors to install keyloggers.

The ones who make the law always win.

End-to-end encryption and p2p networks help in that respect.

And, above all, end-to-end cryptography doesn't protect you against traffic analysis, which is what the NSA is doing with this metadata (which allows them to choose targets subject to a full blown surveillance).

That is why you should put your servers in iceland or similar places. With asymetric encription there is no need; Only the user knows and not the service provider.

Why in Iceland ?

Google: Deniable Cryptography and Rubberhose(update: Waterboarding) Cryptanalysis

Reply on news.ycombinator.com