3 ms·

Why do people flip out? Could it be that there are hard sub-problems to implementing it that might not be worth the cost or increased risk? A lot of connections

by andreyf 11y ago

Why do people flip out? Could it be that there are hard sub-problems to implementing it that might not be worth the cost or increased risk? A lot of connections are encrypted with https now, why is that not enough? How do you imagine it being implemented? Would it replace the need for https?

CyberDildonics 11y ago
What are those hard sub problems? There has been an encrypted IP standard since the early 90s. Https is not enough. Not everything goes through http, not all http is https, and there is a lot questionable about certificate based encryption schemes.
- andreyf 11y ago
  I'm no expert, but one hard sub-problem seems to be authentication, the thing that certificate authorities aim to solve. Which encrypted IP standard are you thinking of, and how does it provide authentication? Not everything needs encryption and there is a real cost to maintaining encryption infrastructure. As those costs decrease, we get more encryption, and perhaps we'll get to a place where everything is encrypted, but I don't think it's especially outrageous that we're not there now.
  - CyberDildonics 11y ago
    Public private encryption doesn't need authentication. > Not everything needs encryption Fair enough, but the attitude of opt-in/insecure by default is an enormous problem. Countries are running undersea fiber lines to avoid the NSA. This could be avoided by encryption by default. > there is a real cost to maintaining encryption infrastructure I would like to see the numbers. Dealing with network traffic is generally lightweight and encryption is generally lightweight. It could be done, it just isn't for some reason.
    - andreyf 11y ago
      Could you expound on what the use of asymmetric crypto if not for authentication? https actually uses symmetric encryption for content and public/private for authentication, iirc. I don't think undersea fiber lines alone would stop a nation state like the US from intercepting them. Undersea fibers need maintenance and repairs done on them, and I imagine putting in a prism to splice off a connection during a maintenance window is within most nation state's capabilities. I don't think the exact numbers are all that important, just that it's non-negligible. When the implementation and maintenance costs become negligible, turning it on by default makes sense. Until then, opt-in makes sense. Authentication is the toughest part that I don't think is yet solved in a mass deployable way.
      - dragonwriter 11y ago
        > https actually uses symmetric encryption for content and public/private for authentication, iirc. It uses public key crypto to exchange the keys for symmetric encryption; symmetric encryption relies on having a secure channel for exchanging a shared secret.

by andreyf 11y ago

CyberDildonics 11y ago

What are those hard sub problems? There has been an encrypted IP standard since the early 90s. Https is not enough. Not everything goes through http, not all http is https, and there is a lot questionable about certificate based encryption schemes.

andreyf 11y ago
I'm no expert, but one hard sub-problem seems to be authentication, the thing that certificate authorities aim to solve. Which encrypted IP standard are you thinking of, and how does it provide authentication? Not everything needs encryption and there is a real cost to maintaining encryption infrastructure. As those costs decrease, we get more encryption, and perhaps we'll get to a place where everything is encrypted, but I don't think it's especially outrageous that we're not there now.
- CyberDildonics 11y ago
  Public private encryption doesn't need authentication. > Not everything needs encryption Fair enough, but the attitude of opt-in/insecure by default is an enormous problem. Countries are running undersea fiber lines to avoid the NSA. This could be avoided by encryption by default. > there is a real cost to maintaining encryption infrastructure I would like to see the numbers. Dealing with network traffic is generally lightweight and encryption is generally lightweight. It could be done, it just isn't for some reason.
  - andreyf 11y ago
    Could you expound on what the use of asymmetric crypto if not for authentication? https actually uses symmetric encryption for content and public/private for authentication, iirc. I don't think undersea fiber lines alone would stop a nation state like the US from intercepting them. Undersea fibers need maintenance and repairs done on them, and I imagine putting in a prism to splice off a connection during a maintenance window is within most nation state's capabilities. I don't think the exact numbers are all that important, just that it's non-negligible. When the implementation and maintenance costs become negligible, turning it on by default makes sense. Until then, opt-in makes sense. Authentication is the toughest part that I don't think is yet solved in a mass deployable way.
    - dragonwriter 11y ago
      > https actually uses symmetric encryption for content and public/private for authentication, iirc. It uses public key crypto to exchange the keys for symmetric encryption; symmetric encryption relies on having a secure channel for exchanging a shared secret.