Hacker News Reader

Comment by asciimo | Hacker News Reader

Here's a provocative gem:

> The purpose of cryptography is to force the US government to torture you.

It's pretty simple -- if the US government really really wants your secrets, they can kidnap you and torture you until you tell them what they want to know. Cryptography can protect data, but it doesn't protect humans; all it can do is make sure that humans are the only remaining point of attack.

That's not entirely true.

Proper cryptography can keep them from learning that it's you they'll need to kidnap to get the secret, or even keep them from learning that there is a secret they might care about in the first place.

Also, there are plenty of bad guys in the world that can't kidnap and torture you that it's still quite worthwhile to keep your secrets from.

You're over-thinking this. The point is simply that no matter how good the cryptography in a system is, if there are humans involved then you need to worry about human factors as well.

The easiest way to avoid the human factor is to get a scapegoat. You make it seem like someone else is responsible for, or knows about, the crypto or its data payload. They will then torture that individual indefinitely until they confess to something. It's better if they don't know you or anything about your scheme as that way it'll look like they're holding out a really long time on important information.

Then the only thing you need to worry about is that person dying, in which case the investigation continues. So similar to upping the number of rounds on PBKDF2 every year, you need a new scapegoat every year, or however long it takes them to break either the crypto or the scapegoat.

As in the $5 wrench xkcd:

http://xkcd.com/538/

or Rubber-hose Cryptanalysis

http://en.wikipedia.org/wiki/Rubber-hose_cryptanalysis

Reply on news.ycombinator.com