8 ms·

Increasingly we're seeing 'encryption' discussed in mainstream media as a tool that can only be used for nefarious ends. Kind of like how they talked about "coo

Increasingly we're seeing 'encryption' discussed in mainstream media as a tool that can only be used for nefarious ends. Kind of like how they talked about "cookies" in the late 90s and early 00s. It's unfortunate that there's no way [without a lot of money] to launch a campaign that highlights the fact that most sensitive online transactions rely on encryption - banking, purchasing, etc - to protect you from The Bad People who want to steal your critical financial information. That would also highlight that it's not just about keeping secrets from the government - in fact, that's the smallest fraction of it.

fukusa 11y ago
We have to get rid of this narrative of bad versus good people while we're at it. It removes every bit of nuance from the discussion.
- TazeTSchnitzel 11y ago
  Unfortunately this is a very widespread notion in culture and is helped by major religions.
  - TrevorJ 11y ago
    I wonder how true that is. For Christianity at least, most dominant theology takes the view that the things that exist in the world can be used for good or for ill and aren't inherently one or the other in and of themselves.
    - dhimes 11y ago
      Same with Buddhism
- copperred 11y ago
  That's the point. What the Paris attackers did makes them bad people. It's not up for debate.
  - bitslayer 11y ago
    Surely you can see that they think the exact opposite. In order to do something like that, they have to convince themselves that they the good guys, and it has to be done to "purify the evil in the world" or something. The truth is that people are not inherently bad. Evil feeds on itself; if you insist on calling them bad, then you are falling into the same trap that they did. Hopefully you wouldn't act in such a heinous manner, but Western societies kill thousands of innocents all the time, and it is masked with the same rationalizations; if a drone strike kills someone, we define them as a bad guy.
    - pavel_lishin 11y ago
      > The truth is that people are not inherently bad. I don't know about that. I'd argue that most people don't think of themselves as bad, but it doesn't make them not-bad. And humanity definitely has base instincts - if we didn't, we wouldn't need governments and police.
      - delish 11y ago
        > but it doesn't make them not-bad. I disagree. I've never found a coherent absolute ethical framework. Not even "Don't kill people." When anyone is arguing that something is bad, that person has to appeal an authority or belief. Often the reasoning leads to utilitarianism: "If we want society to continue, we should ban murder." But that's still an if/then statement. Beneath the if/then is an appeal that society is good or desired. > And humanity definitely has base instincts - if we didn't, we wouldn't need governments and police. This viewpoint becomes popular with Hobbes in the 1600s. I disagree with the term "base instincts," which negatively connotes those things. I'll change it to "randomness"; i.e. in a society of nondeterministic people, some will try to kill the others. Government and police try to reduce that kind of randomness. But from that same randomness we get music, science, justice. I'm speaking loosely of course. I think of my American government as social contract, not as protective parent.
        johncolanduoni 11y ago
- TrevorJ 11y ago
  It doesn't just remove nuance, the entire framework of the discussion is built on untruths when we start there.
- allemagne 11y ago
  I don't see the point to inserting a philosophical debate about good and evil here. What nuance are you trying to keep?
themartorana 11y ago
Unfortunately, it's without a hint of irony, as the same media companies deploy SSL/TLS on their websites for - at least - login and signup, taking payments, and more. I'm not sure if it's simply that no one has explained that SSL/TLS is encryption, and the nefarious things that could be done (stealing identity, credit cards) if certain communications aren't encrypted. In the end, it's more education, isn't it? Most things are. But in some cases, like this, it's a race between general education and political (and spy agency) advantage-taking. That's Snowden's greatest legacy - a few more people became educated, and the public frustration and pouting spy agencies are doing regarding encrypted communications are a bit more transparent than once they were.
- eblanshey 11y ago
  I'm pretty sure they are trying to push for encryption with government backdoor access. SSL certificates are issued by centralized authorities that can easily provide access to governments (if they don't do so already). Not that I agree with what they're trying to do.
  - sliverstorm 11y ago
    Do they want attackable weaknesses in crypto, or a "master" key?
  - alextgordon 11y ago
    CAs do not have backdoor access. The most a rogue CA can do is possibly enable a MITM against a website that has taken no protections. Google pins their public key fingerprints right into Chrome, and this feature is open: https://hstspreload.appspot.com/ https://hstspreload.appspot.com/
    - enlightenedfool 11y ago
      I don't understand. How can you be sure that they haven't shared their keys to the government?
smcl 11y ago
Funny how politicians twist reason to suit their own ends. Bad guys use guns, but apparently were not allowed to ban them because they'll somehow find a way to get them no matter what. So the solution is to legalise them. However when it comes to encryption, bad guys use it so it needs to be banned! It's like they have it completely backwards.
- PKop 11y ago
  Who are "they"? Many politicians are on the same side of each debate, wanting to restrict the rights of free people in the name of safety and security. I'm curious, do you see a distinction between the two issues? Sounds like you're on opposite sides for each of them.
  - grhino 11y ago
    I think the argument is that if bad guys didn't have guns, then there would be no reason for good guys to have guns except to fend off wildlife. However, even if the bad guys didn't have encryption, we would still want good guys to have encryption to prevent the bad guys from intercepting private and sensitive communications.
    - Lawtonfogle 11y ago
      >then there would be no reason for good guys to have guns except to fend off wildlife. Ignoring the issues such as fending off bad guys (so what if they only have a knife, I'd rather bring a gun to a knife fight), hunting wild life, shooting for fun, owning collections, any many other reasons. Outright dismissing all of those is like just dismissing the need to protect private electronic communications.
- CamperBob2 11y ago
  Some would argue that banning tools of any kind is a stupid and feckless way to address cultural problems.
  - 11y ago
smcl 11y ago
Funny how these guys twist reason to suit their own ends. Bad guys use guns, but apparently were not allowed to ban them because they'll somehow find a way to get them. So the best way is to legalise them. However when it comes to encryption, bad guys use it so it needs to be banned! It's like they have it completely backwards.
drzaiusapelord 11y ago
The EU is still losing its mind over cookies. Every Euro site now has a big disclaimer about cookies. The hysteria, at least for Europeans, never ended. Which is amusing considering how much local storage HTML5 can do and how easily it is to track people via their unique browser fingerprints, even with cookies and no plugins enabled. The reality is, of course, encryption was used in these attacks. These terrorists aren't stupid. That doesn't mean it needs to be banned the say way a randoms stabbing don't mean knives need to be banned. I think the people saying "No way, never no encryption has every been used for nefarious purposes" are just as bad as the other side. Having a sophisticated view of this stuff makes a lot more sense. Encryption will be like the gun debate. It will flare up from time to time. Its an easy horse to beat because its too technical for the layperson to really have a good understanding of and clearly there are political elements that would love Clinton-era laws limiting key size and such. The reality is that this ship has long sailed away. The genie is long out of the bottle to control encryption like its 1993.
- GrinningFool 11y ago
  Yes. And (as someone pro-gun) the unconnected statistical arguments ("More people die from X every year..." and the hyperbolic arguments along the lines of, "You could kill someone with a knife, let's ban them!" are offensive to me. Unfortunately, I'm already seeing similar hyperbolic arguments about cryptography - "let's outlaw math", etc. As you implied, I'd like to see a rational discussion. Yes, cryptography can and will be used for nefarious purpose -- but it's used in much greater capacity for legitimate purposes. That's what needs to be emphasized - it's the only logical, supportable argument to make.
- wintermute306 11y ago
  I know, it's hilarious and annoying to be honest. It shows how behind the EU really is. Pretty much all the British digital policies are silly. I think the simple thing they seem to not understand is that the Internet is smarter and moves fast than policy.
PKop 11y ago
Or guns today.
pachydermic 11y ago
To be fair, I bet a lot of agencies would be ok with just having the keys at all times so that they can do surveillance. You could still have encryption for logins, financial transactions, etc. I don't think that's a good idea either, but there are people who would probably see that as a reasonable middle ground.
JustSomeNobody 11y ago
Hmmm... i wonder if this would be a good use of Facebook and Twitter. #FightForEncryption
keithpeter 11y ago
"Home and mobile working, including use of personal devices for work: ensure that sensitive data is encrypted when stored or transmitted online so that data can only be accessed by authorised users." Quote from UK government advice to small business people, see https://www.gov.uk/government/uploads/system/uploads/attachment_data/file/412017/BIS-15-147-small-businesses-cyber-guide-March-2015.pdf https://www.gov.uk/government/uploads/system/uploads/attachm... I suspect that GCHQ people want people using encryption but encryption that they have a feasible way of breaking if needed. Yes, I know, no way of stopping back-doors being used by other agencies/bad actors.

fukusa 11y ago

We have to get rid of this narrative of bad versus good people while we're at it. It removes every bit of nuance from the discussion.

TazeTSchnitzel 11y ago
Unfortunately this is a very widespread notion in culture and is helped by major religions.
- TrevorJ 11y ago
  I wonder how true that is. For Christianity at least, most dominant theology takes the view that the things that exist in the world can be used for good or for ill and aren't inherently one or the other in and of themselves.
  - dhimes 11y ago
    Same with Buddhism
copperred 11y ago
That's the point. What the Paris attackers did makes them bad people. It's not up for debate.
- bitslayer 11y ago
  Surely you can see that they think the exact opposite. In order to do something like that, they have to convince themselves that they the good guys, and it has to be done to "purify the evil in the world" or something. The truth is that people are not inherently bad. Evil feeds on itself; if you insist on calling them bad, then you are falling into the same trap that they did. Hopefully you wouldn't act in such a heinous manner, but Western societies kill thousands of innocents all the time, and it is masked with the same rationalizations; if a drone strike kills someone, we define them as a bad guy.
  - pavel_lishin 11y ago
    > The truth is that people are not inherently bad. I don't know about that. I'd argue that most people don't think of themselves as bad, but it doesn't make them not-bad. And humanity definitely has base instincts - if we didn't, we wouldn't need governments and police.
    - delish 11y ago
      > but it doesn't make them not-bad. I disagree. I've never found a coherent absolute ethical framework. Not even "Don't kill people." When anyone is arguing that something is bad, that person has to appeal an authority or belief. Often the reasoning leads to utilitarianism: "If we want society to continue, we should ban murder." But that's still an if/then statement. Beneath the if/then is an appeal that society is good or desired. > And humanity definitely has base instincts - if we didn't, we wouldn't need governments and police. This viewpoint becomes popular with Hobbes in the 1600s. I disagree with the term "base instincts," which negatively connotes those things. I'll change it to "randomness"; i.e. in a society of nondeterministic people, some will try to kill the others. Government and police try to reduce that kind of randomness. But from that same randomness we get music, science, justice. I'm speaking loosely of course. I think of my American government as social contract, not as protective parent.
      - johncolanduoni 11y ago
TrevorJ 11y ago
It doesn't just remove nuance, the entire framework of the discussion is built on untruths when we start there.
allemagne 11y ago
I don't see the point to inserting a philosophical debate about good and evil here. What nuance are you trying to keep?

themartorana 11y ago

Unfortunately, it's without a hint of irony, as the same media companies deploy SSL/TLS on their websites for - at least - login and signup, taking payments, and more. I'm not sure if it's simply that no one has explained that SSL/TLS is encryption, and the nefarious things that could be done (stealing identity, credit cards) if certain communications aren't encrypted. In the end, it's more education, isn't it? Most things are. But in some cases, like this, it's a race between general education and political (and spy agency) advantage-taking. That's Snowden's greatest legacy - a few more people became educated, and the public frustration and pouting spy agencies are doing regarding encrypted communications are a bit more transparent than once they were.

eblanshey 11y ago
I'm pretty sure they are trying to push for encryption with government backdoor access. SSL certificates are issued by centralized authorities that can easily provide access to governments (if they don't do so already). Not that I agree with what they're trying to do.
- sliverstorm 11y ago
  Do they want attackable weaknesses in crypto, or a "master" key?
- alextgordon 11y ago
  CAs do not have backdoor access. The most a rogue CA can do is possibly enable a MITM against a website that has taken no protections. Google pins their public key fingerprints right into Chrome, and this feature is open: https://hstspreload.appspot.com/ https://hstspreload.appspot.com/
  - enlightenedfool 11y ago
    I don't understand. How can you be sure that they haven't shared their keys to the government?

smcl 11y ago

Funny how politicians twist reason to suit their own ends. Bad guys use guns, but apparently were not allowed to ban them because they'll somehow find a way to get them no matter what. So the solution is to legalise them. However when it comes to encryption, bad guys use it so it needs to be banned! It's like they have it completely backwards.

PKop 11y ago
Who are "they"? Many politicians are on the same side of each debate, wanting to restrict the rights of free people in the name of safety and security. I'm curious, do you see a distinction between the two issues? Sounds like you're on opposite sides for each of them.
- grhino 11y ago
  I think the argument is that if bad guys didn't have guns, then there would be no reason for good guys to have guns except to fend off wildlife. However, even if the bad guys didn't have encryption, we would still want good guys to have encryption to prevent the bad guys from intercepting private and sensitive communications.
  - Lawtonfogle 11y ago
    >then there would be no reason for good guys to have guns except to fend off wildlife. Ignoring the issues such as fending off bad guys (so what if they only have a knife, I'd rather bring a gun to a knife fight), hunting wild life, shooting for fun, owning collections, any many other reasons. Outright dismissing all of those is like just dismissing the need to protect private electronic communications.
CamperBob2 11y ago
Some would argue that banning tools of any kind is a stupid and feckless way to address cultural problems.
- 11y ago

smcl 11y ago

Funny how these guys twist reason to suit their own ends. Bad guys use guns, but apparently were not allowed to ban them because they'll somehow find a way to get them. So the best way is to legalise them. However when it comes to encryption, bad guys use it so it needs to be banned! It's like they have it completely backwards.

drzaiusapelord 11y ago

The EU is still losing its mind over cookies. Every Euro site now has a big disclaimer about cookies. The hysteria, at least for Europeans, never ended. Which is amusing considering how much local storage HTML5 can do and how easily it is to track people via their unique browser fingerprints, even with cookies and no plugins enabled. The reality is, of course, encryption was used in these attacks. These terrorists aren't stupid. That doesn't mean it needs to be banned the say way a randoms stabbing don't mean knives need to be banned. I think the people saying "No way, never no encryption has every been used for nefarious purposes" are just as bad as the other side. Having a sophisticated view of this stuff makes a lot more sense. Encryption will be like the gun debate. It will flare up from time to time. Its an easy horse to beat because its too technical for the layperson to really have a good understanding of and clearly there are political elements that would love Clinton-era laws limiting key size and such. The reality is that this ship has long sailed away. The genie is long out of the bottle to control encryption like its 1993.

GrinningFool 11y ago
Yes. And (as someone pro-gun) the unconnected statistical arguments ("More people die from X every year..." and the hyperbolic arguments along the lines of, "You could kill someone with a knife, let's ban them!" are offensive to me. Unfortunately, I'm already seeing similar hyperbolic arguments about cryptography - "let's outlaw math", etc. As you implied, I'd like to see a rational discussion. Yes, cryptography can and will be used for nefarious purpose -- but it's used in much greater capacity for legitimate purposes. That's what needs to be emphasized - it's the only logical, supportable argument to make.
wintermute306 11y ago
I know, it's hilarious and annoying to be honest. It shows how behind the EU really is. Pretty much all the British digital policies are silly. I think the simple thing they seem to not understand is that the Internet is smarter and moves fast than policy.

PKop 11y ago

Or guns today.

pachydermic 11y ago

To be fair, I bet a lot of agencies would be ok with just having the keys at all times so that they can do surveillance. You could still have encryption for logins, financial transactions, etc. I don't think that's a good idea either, but there are people who would probably see that as a reasonable middle ground.

JustSomeNobody 11y ago

Hmmm... i wonder if this would be a good use of Facebook and Twitter. #FightForEncryption

keithpeter 11y ago

"Home and mobile working, including use of personal devices for work: ensure that sensitive data is encrypted when stored or transmitted online so that data can only be accessed by authorised users." Quote from UK government advice to small business people, see https://www.gov.uk/government/uploads/system/uploads/attachment_data/file/412017/BIS-15-147-small-businesses-cyber-guide-March-2015.pdf https://www.gov.uk/government/uploads/system/uploads/attachm... I suspect that GCHQ people want people using encryption but encryption that they have a feasible way of breaking if needed. Yes, I know, no way of stopping back-doors being used by other agencies/bad actors.