5 ms·

It doesn't matter what politicians think, really. Secure end-to-end encryption is going to happen one way or another. It's a global phenomenon, no single count

It doesn't matter what politicians think, really. Secure end-to-end encryption is going to happen one way or another. It's a global phenomenon, no single country can stop it. Sure, our government likes to think it controls the world, but really all it can do is threaten the world with violence. Mathematics knows no such fear.

giaour 11y ago
And yet, similar policies have given us "export-grade" encryption and funded projects like the clipper chip. There's no way a single country can block secure, end-to-end encryption forever, but they can sure make things hard for a while.
- sarciszewski 11y ago
  > but they can sure make things hard for a while Only for their own citizens and trade partners that cooperate with their unrealistic demands.
  - TeMPOraL 11y ago
    Which unfortunately probably means almost everyone. Companies will cooperate, because it's unprofitable for them not to. The GenPop will cooperate because they don't understand any of it anyway.
- bmelton 11y ago
  They don't have to block every user using unlawful encryption -- they just have to have a law that lets the penalty be enough that a few high profile convictions will deter enough law-abiding people that it isn't worth the risk. At that point, they can simply listen to all traffic and, if there are packets that aren't listenable due to encryption, assume ill intent, then be free to react appropriately. Assuming high enough signal ratios in detecting encryption, it might actually prove that encoded messages, or steganography proves to be more effective at preventing state-level eavesdropping... they won't prevent a determined state from getting your secret content, but it could be enough that, if the messages looked unencrypted, they would be passed over for the more obviously encrypted messages -- hiding in plain sight, as it were. Note, this is not an endorsement of any privacy invasions whatsoever, but musings on what a post-4th-amendment-obliteration world might look like for the privacy-minded.
  - rikkus 11y ago
    Coming soon: 'Strong' encryption is illegal in the UK without a licence. Banks and other institutions will pay for licences for their websites and their behind-the-scenes comms but also be required to use backdoored crypto where the govt and police and govt agencies hold keys. An inter-country agreement makes us interoperable. All comms are monitored for anything looking encrypted but not decryptable by the state using their keys. It will be an easy sell because those who want full personal privacy will be seen as suspect. It will also make money from licensing.
  - giaour 11y ago
    Steganography has frequently been a target of similar fear mongering, so they might apply similar scrutiny to all photos in this nightmare scenario and assume ill intent for all photos with a large number of layers.
mc32 11y ago
Large enough growth markets can tell the Apples etc. that they can either allow interception for surveillance or abandon their market [not too dissimilarly from what Saudi Arabia did with BB] see [1]. I don't think Apple and Google would simply give up on the biggest two markets to take a stand and allow local counterparts eager to comply to take their growth markets away. It's possible of course they take a stand, but I don't think they would. If not the local operators, then BlackBerry would comply. [1]http://www.brighthand.com/news/rim-vs-india-and-saudi-arabia-lets-make-a-deal-on-encrypted-data/ http://www.brighthand.com/news/rim-vs-india-and-saudi-arabia...
- aianus 11y ago
  That's an argument against centralized encryption with corporate sponsors. Says nothing about government ability to control distributed applications of open-source crypto.
  - mc32 11y ago
    But now you are asking terrorists to be good at encryption meanwhile even encryption vendors/developers get sloppy and wrong. It's one thing to ask a cell member, hey, here's a phone, it only has this app on it. Don't mod it, don't do anything but use this app. Versus, hey, please implement a secure encryption protocol and make sure there are no exploitable bugs. Also, if the government controls the carriers, they ultimately control what can run on the handset [if they choose to be draconian]. Also, for a big enough growth market, I think they'd be willing to centralize encryption. They'll outwardly say, no impossible, can't be done. Host country will say, sorry, you can't sell here, can't be done. Secret high-level talks happen and mysteriously the handsets are available again.
    - sarciszewski 11y ago
      > meanwhile even encryption vendors get sloppy and wrong. What is an encryption vendor, exactly? Is Open Whisper Systems an encryption vendor? They're pioneers in secure messaging, and they give it away for free. https://itunes.apple.com/us/app/signal-private-messenger/id874139669?mt=8 https://itunes.apple.com/us/app/signal-private-messenger/id8... Is Paragon Initiative Enterprises an encryption vendor? We published Halite, a PHP library to wrap libsodium and make it even harder to use incorrectly. (Users don't even have to know what a nonce is.) https://paragonie.com/project/halite https://paragonie.com/project/halite Or are you speaking about software vendors that erroneously implement their own cryptography features? If so, I totally agree. They do sloopy work.
deleted 11y ago
[deleted]
inopinatus 11y ago
Aye, reading these articles is a salient reminder of how disconnected journalists are from reality, and thus how easily hoodwinked by authority (when they are not simply complicit with it). We've been able to send end-to-end encrypted messages to multiple simultaneous recipients, via arbitrary de-centralized transports, using standardised protocols & open-source tools, for decades.
deleted 11y ago
[deleted]

giaour 11y ago

And yet, similar policies have given us "export-grade" encryption and funded projects like the clipper chip. There's no way a single country can block secure, end-to-end encryption forever, but they can sure make things hard for a while.

sarciszewski 11y ago
> but they can sure make things hard for a while Only for their own citizens and trade partners that cooperate with their unrealistic demands.
- TeMPOraL 11y ago
  Which unfortunately probably means almost everyone. Companies will cooperate, because it's unprofitable for them not to. The GenPop will cooperate because they don't understand any of it anyway.
bmelton 11y ago
They don't have to block every user using unlawful encryption -- they just have to have a law that lets the penalty be enough that a few high profile convictions will deter enough law-abiding people that it isn't worth the risk. At that point, they can simply listen to all traffic and, if there are packets that aren't listenable due to encryption, assume ill intent, then be free to react appropriately. Assuming high enough signal ratios in detecting encryption, it might actually prove that encoded messages, or steganography proves to be more effective at preventing state-level eavesdropping... they won't prevent a determined state from getting your secret content, but it could be enough that, if the messages looked unencrypted, they would be passed over for the more obviously encrypted messages -- hiding in plain sight, as it were. Note, this is not an endorsement of any privacy invasions whatsoever, but musings on what a post-4th-amendment-obliteration world might look like for the privacy-minded.
- rikkus 11y ago
  Coming soon: 'Strong' encryption is illegal in the UK without a licence. Banks and other institutions will pay for licences for their websites and their behind-the-scenes comms but also be required to use backdoored crypto where the govt and police and govt agencies hold keys. An inter-country agreement makes us interoperable. All comms are monitored for anything looking encrypted but not decryptable by the state using their keys. It will be an easy sell because those who want full personal privacy will be seen as suspect. It will also make money from licensing.
- giaour 11y ago
  Steganography has frequently been a target of similar fear mongering, so they might apply similar scrutiny to all photos in this nightmare scenario and assume ill intent for all photos with a large number of layers.

mc32 11y ago

Large enough growth markets can tell the Apples etc. that they can either allow interception for surveillance or abandon their market [not too dissimilarly from what Saudi Arabia did with BB] see [1]. I don't think Apple and Google would simply give up on the biggest two markets to take a stand and allow local counterparts eager to comply to take their growth markets away. It's possible of course they take a stand, but I don't think they would. If not the local operators, then BlackBerry would comply. [1]http://www.brighthand.com/news/rim-vs-india-and-saudi-arabia-lets-make-a-deal-on-encrypted-data/ http://www.brighthand.com/news/rim-vs-india-and-saudi-arabia...

aianus 11y ago
That's an argument against centralized encryption with corporate sponsors. Says nothing about government ability to control distributed applications of open-source crypto.
- mc32 11y ago
  But now you are asking terrorists to be good at encryption meanwhile even encryption vendors/developers get sloppy and wrong. It's one thing to ask a cell member, hey, here's a phone, it only has this app on it. Don't mod it, don't do anything but use this app. Versus, hey, please implement a secure encryption protocol and make sure there are no exploitable bugs. Also, if the government controls the carriers, they ultimately control what can run on the handset [if they choose to be draconian]. Also, for a big enough growth market, I think they'd be willing to centralize encryption. They'll outwardly say, no impossible, can't be done. Host country will say, sorry, you can't sell here, can't be done. Secret high-level talks happen and mysteriously the handsets are available again.
  - sarciszewski 11y ago
    > meanwhile even encryption vendors get sloppy and wrong. What is an encryption vendor, exactly? Is Open Whisper Systems an encryption vendor? They're pioneers in secure messaging, and they give it away for free. https://itunes.apple.com/us/app/signal-private-messenger/id874139669?mt=8 https://itunes.apple.com/us/app/signal-private-messenger/id8... Is Paragon Initiative Enterprises an encryption vendor? We published Halite, a PHP library to wrap libsodium and make it even harder to use incorrectly. (Users don't even have to know what a nonce is.) https://paragonie.com/project/halite https://paragonie.com/project/halite Or are you speaking about software vendors that erroneously implement their own cryptography features? If so, I totally agree. They do sloopy work.

deleted 11y ago

[deleted]

inopinatus 11y ago

Aye, reading these articles is a salient reminder of how disconnected journalists are from reality, and thus how easily hoodwinked by authority (when they are not simply complicit with it). We've been able to send end-to-end encrypted messages to multiple simultaneous recipients, via arbitrary de-centralized transports, using standardised protocols & open-source tools, for decades.

deleted 11y ago

[deleted]