8 ms·

Encryption backdoors are a lightning-rod topic on HN, but instead of repeating all the common-talking points, I'd suggest the following: Think through somethin

• deleted 11y ago
  [deleted]
• lholden 11y ago
  The best backdoor to encryption has always been social. Talk the right way to the right people... and it doesn't matter what type of security you have. Isn't that the entire purpose of agencies like the CIA? It just bothers me when privacy is treated as a negative thing, for the greater good or not. Encryption is a tool to create privacy. The ability to create privacy should be a point of pride as not everyone has that luxury. It should be a human right. This is the primary reason why I feel things like CISA/CISPA/etc take society in the wrong direction. It doesn't matter if the intentions are good or bad when everyone loses.
  • A_Beer_Clinked 11y ago
    >The ability to create privacy should be a point of pride as not everyone has that luxury. It should be a human right. I agree; so does the UN in The Universal Declaration of Human Rights: Article 12. No one shall be subjected to arbitrary interference with his privacy, family, home or correspondence, nor to attacks upon his honour and reputation. Everyone has the right to the protection of the law against such interference or attacks. Article 18. Everyone has the right to freedom of thought, conscience and religion; this right includes freedom to change his religion or belief, and freedom, either alone or in community with others and in public or private, to manifest his religion or belief in teaching, practice, worship and observance. http://www.un.org/en/universal-declaration-human-rights/ http://www.un.org/en/universal-declaration-human-rights/
    • refurb 11y ago
      Who exactly enforces the UN's Declaration of Human Rights? Without power to back it up it means nothing.
      • deleted 11y ago
        [deleted]
      • jacquesm 11y ago
        Technically, each and every one of the UN member states should back these up.
        • serge2k 11y ago
          Didn't they put the Saudi's in charge of that?
    • Torgo 11y ago
      The universal declaration of human rights doesn't grant you an unqualified right to privacy. Article 29, part 2: "In the exercise of his rights and freedoms, everyone shall be subject only to such limitations as are determined by law solely for the purpose of securing due recognition and respect for the rights and freedoms of others and of meeting the just requirements of morality, public order and the general welfare in a democratic society."
    • lholden 11y ago
      In addition to what torgo said, there are a few countries that have only upheld UN directives and treaties when it suits them. The US is a example of this.
  • slg 11y ago
    Except encryption provides a level of privacy that has never before been possible. Could you imagine a physical padlock that was unable to be cracked, cut, or circumvented in any way? It is easy to see how that would scare law enforcement. Imagine your job is to keep people safe. Now envision a kid strapped to a bomb inside a shack and the only thing preventing you from breaking in and saving that kid's life is that magical and unbreakable padlock. That is how many laypeople view encryption. It is hard to tell that person that you won't consider introducing any weakness into that lock.
    • lholden 11y ago
      But those are not the same thing. Encryption in this case would be like the location of the kid and bomb being kept secret. The bad guy may have told someone in person where the location is... or sent an encrypted email. But unless you were involved in either conversation, you are still in the dark.
    • richdougherty 11y ago
      That's a good analogy, but the padlock has already bolted! Information about the uncrackable padlock is widely available. Bad guys will always be able to get these padlocks from the black market. The question is whether we want the good guys (i.e. us) to have the padlocks too.
      • slg 11y ago
        This is a fair counter, but I feel like we already have examples of how the government would respond there. We might have to switch analogies, but wouldn't encryption then be like a weapon. The goal would then shift to being about deproliferation. The fact that nuclear weapons or AK47s already exist doesn't prevent the government from preventing regular people from acquiring or using them. Maybe preventing new products from entering the market and flooding the market with faulty products (encryption with backdoors) is a good way of combating what is already out there.
        • dplgk 11y ago
  • jacquesm 11y ago
    > It should be a human right. It actually is a human right. The right to privacy is one of the most fundamental ones that we have.
    • serge2k 11y ago
      Not in the constitution, and the founding fathers clearly envisioned the modern world in perfect clarity so we'll just go with their words verbatim.
  • gukov 11y ago
    So, like the Tel Aviv airport where the main security measure for departing flights is a short chat with every passenger. The agents are trained to recognize red flags.
• danieltillett 11y ago
  You are making a rather large logic leap in assuming what politicians and intelligence services want. It is extremely unlikely to be only "keeping people safe".
  • BinaryIdiot 11y ago
    > It is extremely unlikely to be only "keeping people safe". Why do you say this? It seems you are accusing parent of making a big leap in logic and then doing the same type of leap yourself. Do you have any evidence that they want to do more than keeping people safe? I've worked with and talked to many who work in the DoD space and while there were some who didn't seem to understand how technology worked I never met one who didn't seem genuine in wanting to keep people safe. Sure plenty of contractors just want the money and don't give two shits either way and sure this is only anecdotal but do you have anything better? Seems the easiest, least complex reasoning is people who are not well enough versed in the technology but have good intensions are trying to do what they think is most correct when it may not be.
    • mike_hearn 11y ago
      There is certainly such evidence, you don't even need it really as it's literally in the mission statement of some of these intelligence agencies: they do anything that is "in the national interest". Yes, keeping people safe is clearly in the national interest, but many other things are too, hence the fact that GCHQ has spied on climate change talks, trade deals, attempted to influence online discussions, the NSA has hacked oil companies, etc. They are in no way limited to a mission of 'keeping people safe'. This is one reason I tend to think intelligence agencies should be disbanded and their best people merged into police forces. The police have a clear and (relatively) focused mission: fight crime. Most of those criminal investigations are about keeping people safe in one form or another. Police forces aren't tasked with economic wellbeing or "cyber defence" or any of the other crap that the intelligence community has tried to take on for itslf.
      • nickpsecurity 11y ago
• kabdib 11y ago
  > So politicians and intelligence services calling for encryption want, institutionally, to keep people safe. That's the public face. The underlying motives are much more closely aligned to the power structure and the flow of money and votes than keeping folks in suburbs "safe".
• iamsohungry 11y ago
  > So politicians and intelligence services calling for encryption want, institutionally, to keep people safe. How can tech companies do that without breaking or backdooring encryption? That's the real problem to solve, and the first person to figure out how to do that will be way ahead. I don't think this is a technical problem, and I don't think it's our responsibility to solve it. If the US wants to stop terrorism they need to stop creating terrorists. The US created terrorists by starting economic wars, supporting violent dictators, creating economic that harm the common people and not the national leaders they purport to, providing conditional and earmarked aid that is sometimes actually harmful, and a wide variety of other internationally sociopathic behaviors. If we want to stop being attacked by people from other countries, we need to stop harming other countries.
  • iamsohungry 11y ago
    Anyone care to enlighten me as to why I'm being downvoted?
    • marcosdumay 11y ago
      No idea. Also no idea why the GP isn't being downvoted. Just because some politician claimed that it's tech's people responsibility to fix their flaws, it does not make it true. It's repetitive, but the police did have all the information they needed to go after such people even before the murdering. What does the GP want? A machine that queries the news from the day after tomorrow? (Because tomorrow won't do - the police had warning that it would happen at the previous day.)
      • russnewcomer 11y ago
        Clearly I didn't get my point across. If the Paris police had all the information they needed to go after such people, but didn't, that's the technical problem that really needs solved, not an encryption backdoor.
        • marcosdumay 11y ago
• bobcostas55 11y ago
  >So politicians and intelligence services calling for encryption want, institutionally, to keep people safe. Why are they knowingly allowing people who fought for ISIS to return to Europe?
  • jpapon 11y ago
    It's kind of a tricky legal situation. If they're European citizens, can you really stop them from coming back from Syria? What if they claim they didn't do anything illegal there? People don't lose their rights just because they travel to the Middle East...
    • CM30 11y ago
      Well, the UK government are trying to cancel people's citizenship if they go to Syria to fight for IS. But you're right, it's questionable, and it might be a legal hassle to do anything about this.
  • serge2k 11y ago
    Because stripping a person's right to citizenship is monstrous and shouldn't be done? Toss them in jail when they get home, but they still get to come back.
• fweespeech 11y ago
  > So politicians and intelligence services calling for encryption want, institutionally, to keep people safe. How can tech companies do that without breaking or backdooring encryption? That's the real problem to solve, and the first person to figure out how to do that will be way ahead. Its not a tech problem or a solvable problem in the way you imply. It sounds reasonable but it is like solving lightning strikes. You can't actually "solve" lightning. You can reduce the causalities through reasonable precautions but people are still going to die. Its frankly irrational to talk about this problem as an actual problem. Terrorism is less dangerous to me than preventable medical errors for fuck's sake. http://www.propublica.org/article/how-many-die-from-medical-mistakes-in-us-hospitals http://www.propublica.org/article/how-many-die-from-medical-... > In 1999, the Institute of Medicine published the famous “To Err Is Human” report, which dropped a bombshell on the medical community by reporting that up to 98,000 people a year die because of mistakes in hospitals. The number was initially disputed, but is now widely accepted by doctors and hospital officials — and quoted ubiquitously in the media. > In 2010, the Office of Inspector General for Health and Human Services said that bad hospital care contributed to the deaths of 180,000 patients in Medicare alone in a given year. > Now comes a study in the current issue of the Journal of Patient Safety that says the numbers may be much higher — between 210,000 and 440,000 patients each year who go to the hospital for care suffer some type of preventable harm that contributes to their death, the study says. Shaving 1% off 98,000 deaths a year will save more people than preventing the Paris attack. How the fuck is it rational to be focusing on anything other than major causes of preventable deaths? Sorry, honestly, at this point I'm just disgusted with anyone who suggests terrorism is a threat worth throwing billions of dollars and lives away on while they casually ignore far more dangerous sources of human deaths. Get back to me when funding preventable harm in medical care is worth hundreds of billions of government funding.
  • alkonaut 11y ago
    I don't think it's entirely irrational to throw money at counterterrorism that could have saved more lives elsewhere. However I do think that the money is better spent on prevention (integration, aid, ...) than on war. People aren't scared of dying in traffic or by a preventable medical error. Maybe they should, but they aren't. Those risks are real, but they don't affect how people go about their lives. Terrorism is a tiny risk of death but an enormous cost in terms of percieved safety. Its a cliché to say "defend our way of life", but throwing money at creating the illusion of safety so I dare go to the football stadium is just that. I wish we didn't have to spend millions securing a football match, but one can't dismiss it as a waste without assigning a zero value to the idea of going to watch the match. Times many thousand spectators.
• erikpukinskis 11y ago
  I generally agree with your tack... I just want to grow out there that I'm a little concerned about our use of the word shrill. It means high pitched and piercing, and is typically used for women's voices for obvious reasons. There's nothing actually bad about being shrill... That just means you are a woman (high pitched) whose message is getting through (piercing). There's no similar word for men who are being heard and the listener is uncomfortable with it, that I know of. It's often used as code for "a woman is speaking, plz ignore" the same way bitch is. I would just politely suggest you use a more descriptive word for what you were alluding to.
  • ATsch 11y ago
    I've never heard shrill used to describe a voice, I for one mostly associate it with mechanical noise ("The machine errupted to life with a shrill screch"). In any case, in the above comment it is used to refer to the way the pitch of male and female voices rises when frightened or exited and is far from being a gender-specific slur.
• woah 11y ago
  The problem with what you are saying is that even if a backdoor could work technically, and it was actually used effectively by the authorities (the Paris attackers communicated over unencrypted media), it STILL would not do anything to "keep people safe". 130 people were killed in those attacks. 361 people died in automobile accidents in Minnesota in 2014, to find a random statistic. Terrorism is simply not a real threat, and eliminating it will not make anyone any safer.
  • serge2k 11y ago
    While not a "we should live in fear" level threat (or even a "take off your shoes at the airport" level threat) terrorism is certainly a real threat. I do want the government investigating and dealing with that threat. That being said, the threat is not immediate enough to warrant the infringement of our basic rights.
• nickpsecurity 11y ago
  "So politicians and intelligence services calling for encryption want, institutionally, to keep people safe. How can tech companies do that without breaking or backdooring encryption? That's the real problem to solve, and the first person to figure out how to do that will be way ahead." That's the problem: they can't. The tech just moves information around in ways that are visible and can be invisible. Even the subtle timing of the signal can be used to communicate. What you're asking is that tech companies do two things: (a) Ensure every tech with communication mechanisms can only work in a way known perfectly ahead of time and controlled to prevent all leaks. (b) Ensure that every message, regardless of its words or properties, isn't aiding evil somewhere. (c) Ensure that it's impossible for a user to put obstacles between their identity and a communication tech so we know exactly who the evil-doer was. That's simply impossible. It can't be done at all. Talking about lay terms, North Korea has the most totally controlled Internet and country locked down by both technology and terror. Possession of a cell phone can get you locked up and leaving can get them after your family. Yet, there's regularly communication from small numbers of courageous people coming out of that country. If that ideal surveillance setup won't work, how on Earth could any tech accomplish the same thing with the diversity of sites, language, interactions, and tech that exist in Western countries like America? It just can't because it can see bits and read the minds/hearts of those that create them. That's what the government wants. It's not possible. Otherwise, they'd probably have eliminated most crime already looking at people's homework in school or text messages divining their character. ;) Also, the problem's been known so long there's even a meme for it: https://en.wikipedia.org/wiki/Evil_bit https://en.wikipedia.org/wiki/Evil_bit
• Futurebot 11y ago
  I'd love to see what a detailed version of security policies and infrastructure look like in a world of backdoor-less strong encryption from Schneier, the EFF, the Hopkins crew, etc. Something that can be used to persuade, or at least influence policymakers by allowing them to see that another way is possible, one that allows security services to do their job in a way that allows them to feel that their work isn't futile, while simultaneously respecting privacy rights. I think the need for strong encryption and no backdoors (which has Schneier explains, are always a double-edged sword) are very important and I support them, but that those on the side of it who also have in-depth knowledge about the finer details don't deign to articulate just what exactly the policy looks like without resorting to just a list of what we shouldn't do and vague allusions to "just go old-school" or "utilize human assets more." A coherently articulated, normative counterfactual security platform would be a better place to argue from. It's a cousin to the negative liberty arguments: they only list what not to do to in order to avoid hurting people, rather than what we can do to help them (positive liberty.) Maybe we could frame the question as "If we let the EFF and Bruce Schneier redesign the United States security apparatus from scratch, what would it look like?"
  • etherael 11y ago
    I see where you're coming from, but at the same time, one does not need to formulate an alternate strategy to point out that the emperor has no clothes. Strong encryption cannot be back doored in an effective way, this is just a fact. Ignoring that fact because we wish it were otherwise, or asking the people that point out that fact what we're supposed to do in light of that fact, doesn't change that fact. The group constantly pushing for backdoored strong encryption fails to realise that they are asking for regulations to ensure that all water is only ever sold in ice form. This does not, and cannot, mean that all water will only be available as ice. This needs to be realised, accepted and moved on from. Only then we can start actually trying to formulate a coherent asymmetric warfare strategy, cognisant of the actual facts on the ground rather than wishful thinking and ignorance.
    • Futurebot 11y ago
      I agree that we don't need to formulate a strategy to criticize. What I'm saying is that we're already fantastically good at that, and have articulated the negatives very well; I just don't think we've presented a credible, compelling vision that will get those in power to say "Ok, there's an alternative that might work. Let's try that instead of going down this other road that is only making people angry and/or probably won't have the desired outcomes anyway."