Comment by malgorithms | Hacker News Reader

Comment by malgorithms | Hacker News Reader

Author of the post here. (Thanks, Jeremy.)

There are many details I avoided in the essay that people will get sidetracked on. Such as whether Apple is actually doing it right or not. This is discussed and speculated on elsewhere. And right now I'm far more worried about a world in which they're legally prevented from trying. When the FBI starts talking about our kids getting kidnapped, I think bills start getting drafted.

There are tangents I think HN would've cared about, but which would've been a distraction. For related controversy, Keybase - which I work on - lets users symmetrically encrypt their asymmetric keys, and store that data on our servers. We also let you do crypto in JS. Many hate this! Many love it! But I want to be legally allowed to write this kind of software and release it without a backdoor.

It's hard enough when we all fight about implementation details and security vs. convenience. It'll be a real crap show when we know for certain that security has lost. I'll go program video games or something. Or just play them.

> I'll go program video games or something. Or just play them.

[post-post-edit[[The funny thing is, I wrote this before reading the last portion of your post. No joke. I'm pretty sure the more our privacy is invaded, the more singular an entity a collective mind becomes. (half joke).]]]

It still doesn't fix that I feel like we are one step away from the complete loss of thought privacy. I'm 28. I grew up essentially connected to a computer. Half of my personality exists always, in a computer. My entire social life is on the computer, for the entire history of my history. The image I see my existence as is literally half mechanical (I study a lot of math and computer science and code a lot) and half physically organic, and potentially half abstract mental 'thought idea stuff' (extra halves for pointing out that the world is a wibbly, world place).

Should the government have been allowed in the past, to have meticulously documented my childhood, my adolescence, my adulthood? Should they have access to my baby photographs? To my first boyfriend? To our first conversations?

How does that affect who I choose (or chose) to grow into? Is every step I take a step out of a fear of not conforming to both the present ideal of 'lawful person' but also to all worlds of the potential future ideal? When did I become aware of this, as a child? When did I decide I was cognizant enough to have made this decision? Was it when I turned 18, or was it when technology reached a certain age for the entire population?

Do I have to think about every possible way that people can perceive my actions, in order to make sure I stay the way I see myself - which is fundamentally on the basis that I am a good person?

Interesting questions. I think that if you try to answer those questions, you've got an interesting essay right there.

And if you get carried away with that essay, it'd probably make an interesting dystopian near-future science fiction story...

> Do I have to think about every possible way that people can perceive my actions, in order to make sure I stay the way I see myself - which is fundamentally on the basis that I am a good person?

This is the money quote for me. No matter how hard I try, I can't seem to get this through to people: No, I'm not a criminal now. I don't plan to become a criminal in the future. I control my own actions, but I don't control the how my actions are perceived by other people.

Should I be arrested because some combination of my purchases today and words written when I was 17 point to me committing a terrorist act? More to the point, should I have to worry about what someone is going to think if a computer flags my metadata as "worth investigation" and they start trawling through the entirety of my online life? What effect does that have on general conversation on the internet?

I think the thing I'm most afraid of is how do I explain this to my kids? In 10 years when they start forging their own life online, how do I sit down and explain that everything they do is monitored, and they need to be careful about everything they say and do on the internet? How do I explain that it didn't used to be like that, but we failed to stop it? It sounds melodramatic to type it out, but we've had an unprecedented amount of freedom to communicate with people around the world, and now that's being taken away.

> we've had an unprecedented amount of freedom to communicate with people around the world

No we have not. We thought we did, but authorities knew better. Remember the cipherpunk crackdown, the crypto wars, NSA tampering with standards etc. They were watching us quietly enough.

The real "freedom" existed for a very tiny period between email/news/irc existing and them registering on The Man's radar, which happened fairly quickly (and no thanks to pop media like War Games for popularizing the idea of hordes of teenagers intent on vandalizing essential network infrastructure). The standards developed to respond (PGP, SSL etc) took 15 years to actually get traction (and I bet you're still not using PGP), and as soon as they hit the mainstream, they were attacked and subverted from inside the organizations trying to implement them on a large scale.

The freedom we thought we had was a myth. I think this is an important concept to keep in mind, going in this inevitable political negotiation with authorities. They lied when they told us we were free, and they will lie when they'll tell us that "golden" keys will only be used for good. Like you don't talk to the police without a lawyer, you shouldn't hand your encryption to them without a Schneier in the room.

It's really sad that this is the case. It's hard to not be pessimistic about the situation when it's put like this. It's also really hard to explain to people why trying to protect this sort of freedom and privacy is important.

> What does a scanner see? he asked himself. I mean, really see? Into the head? Down into the heart? Does a passive infrared scanner like they used to use or a cube-type holo-scanner like they use these days, the latest thing, see into me - into us - clearly or darkly?

The Powers that Be are conducting a coordinated disinformation campaign to keep and expand their backdoor access by scaring the bejesus out of the public.

Apple will become the phone of choice for the pedophile.

What happens when they blame strong cryptography for the next gut-wrenching tragedy involving innocent kids and a bombing / school shooting / kidnapping / pedophile?

Your arguments will be swept away by a tsunami of grief, hatred and blind patriotism. Is it possible to make an equally emotional argument in favor of the freedom to be secure?

Secure information deserves the same prestige and protection as the Four Freedoms.

https://en.wikipedia.org/wiki/Four_Freedoms

That is likely the tragedy of freedom: There are no emotional arguments for it.

It seems to me, politicians and other people have long sought for the most emotional arguments to wipe away the wings of freedom -- and thus making the victims of pedophiles, bombing and kidnapping victims again!

(BTW: In Germany, pedophiles where also used as argument for internet censorship. Organisations of those victims protested against these attempts, because they clearly saw, that this legislation did not help (and where never intended to) those victims or help to prevent anything.)

"What happens when they blame strong cryptography for the next gut-wrenching tragedy"

The topic changes but the story never does. We still have rock music, teenagers, acid, dungeons and dragons, hippies, video games, atheism, firearms, meth, Islam, gays, texting while driving, basically all the good things in life, and we'll always have thousands of things in the future that are not cool with the conformist old people and will be blamed for everything bad whenever possible, and aside from a lot of journalist click bait nobody will really care.

Also worth noting that in the case of cryptography, virtually no one "blaming strong cryptography" for anything actually understands much about complex cryptographic protocols aside from what they know from watching television.

It's even more of a whitewashed canard than those other things you listed.

Uh, is it just me, or does "texting while driving" not belong in that list? Do you really think people care about it because they're "conformist old people"?

Man that brings back fond memories of being a teenager driving down the highway blasted on meth. Thankfully texting hadn't been invented yet.

I hate to make this kind of argument but it isn't hard:

If a hacker gets access to this golden key, they can use data gleaned from your child's phone to stalk or hurt them.

The problem is that the general public is going to take "unbreakable encryption" at face value. So don't worry, unbreakable encryption prevents the hacker from getting access to the golden key, because without the golden key even the government can't break into things. The whole thing feeds on itself.

So here's what we do guys: put the golden key in the black box!

I was about to say almost exactly this. A country in which encryption requires a golden key is the country all pedophiles will want to move to.

Also, I agree that it's shitty, but sometimes you can only fight fear tactics with scarier fear tactics.

Aren't there already documented cases of domestic abuse enabled by Find My iPhone? How much would you bet that whoever knew about and exploited the bug that leaked all those private celeb pictures didn't also have access to all the power of Find My iPhone as well?

Yes - either that, or naked photos of you on the internet. Imagine hackers taking every picture in your camera roll and posting it to the internet.

...the next gut-wrenching tragedy involving innocent kids and a bombing / school shooting / kidnapping / pedophile?

It's frustrating that TPTB don't actually care about these cases at all, apart from their political potential. Amber alerts are usually issued in response to non-custodial parent custody disagreements, which phenomenon is 95% driven by divorce lawyers, and involves very little risk that isn't created by the police themselves. In the rare actual stranger-danger case, "authorities" routinely allow multiple hours to pass between the kidnapping and issuing the alert. Of course by that time the child is beyond help.

http://www.kansascity.com/news/government-politics/article34...

Complete nonsense - you're equating imperfections that result in failure of a system with complete disinterest. For each anecdotal example of failure, as you cite here, it is equally easy to find anecdotal examples of success, eg: http://edition.cnn.com/2013/08/13/justice/amber-alert-hannah... I don't see any evidence here for your contention about the proportion of alerts issued in divorce proceedings, or a systemic pattern of indifference on the part of law enforcement.

Also, the government spends quite a lot of effort on the investigation and prosecution of child pornography, as documented here, for example: http://www.justice.gov/usao/waw/press/categories/childporn.h... To what degree this should be a factor in encryption policy is open to debate, but your charge that 'TPTB don't actually care about these cases at all' is baseless and does a disservice to the people who investigate such crimes.

Encryption doesn't kill people, people kill people.

What happens when they blame strong cryptography for the next gut-wrenching tragedy involving innocent kids and a bombing / school shooting / kidnapping / pedophile?

Pedophiles (or more specifically: child pornographers) routinely use strong cryptography and effectively nobody cares.

The point the OP is making is that nobody cares because nobody has been told to care. All it takes is a well-timed news article on how some Bad Guy used Irresponsible Unbreakable Crypto to change that.

Do you believe that your beliefs are dictated by single "well-timed news articles" directed by "the powers that be"?

They can be, thats what the whole concept of memes is all about. It happens.

Dictated? No. Profoundly influenced? Yes, yes I do.

I think that I'm more than capable of detecting most forms of propaganda, but I hold no illusions as to my ability to judge _everything_ that comes my way in a fully informed manner.

I can look back and see cases where too little information, bad information, or even just a misunderstanding lead me to believe in things that just weren't true. And I'm pretty sure I'm not the only one.

It's not about the technically educated minority (though even they are vulnerable to falsehoods perpetrated via propaganda), but the vast majority of people who aren't aware of how computer security works and believe that the government is always working only in their interests.

99% of all terrorists and rapists use shoes.

Do the math. Shoes = Evil.

Don't be alarmed, we have an entire agency devoted to that now.

Some feedback for you: Thanks for conveying this in an easy-to-read style with simple examples.

This makes it far easier to send to our non-technical friends, who struggle to understand what this is all about.

Unfortunately, it always seems like these kinds of tricky technical issues are communicated by the mainstream media using oversimplified, easy-to-understand language (often, in support of government entities) and, on the other end of the spectrum, us nerds end up talking about it, by default, in unapproachable language and format.

Fantastic article, and a case well made. Thank you for writing it. I have one small criticism: "On June 20, 2011 Dropbox let anyone on the site login as any other user". This can easily be misconstrued as though it were a malicious free-for-all open-access day sponsored by Dropbox, which would be an unfair perspective upon what was obviously a very nasty security bug.

Thanks for your comprehensive response to a genuinely chilling editorial. The way WaPo used a synonym to dismiss the whole issue doesn't inspire confidence. Surely the closest analogies, though, for this mythical "golden key" are the many cracked DRM technologies. These weren't weakened by government fiat, but were still rendered worse-than-useless quickly.

Your article didn't address this argument in favour of a 'secure golden key': If the user forgets their password, they can still recover their data.

My guess is that the vast majority of the general public trust Google to keep their data secure more then they trust themselves to remember a password.

Reply on news.ycombinator.com