6 ms·

> I would say that getting a Gun in the US or even in Europe (especially since the eastern European and Balkan states have joined (officially or unofficially Sc

> I would say that getting a Gun in the US or even in Europe (especially since the eastern European and Balkan states have joined (officially or unofficially Schengen) is by far easier than setting up your own secure crypto from scratch. No, it is far easier to download an openbsd cd image from canada than it is to physically carry a gun.

dogma1138 11y ago
OpenBSD cd image would give you absolutely nothing when it comes to defending against state level actors sorry. And you are assuming that in their proposed reality that would be as easily achievable as it is today, you'll be surprised how effective can a crackdown be once a government sets its mind to it.
- 0x0 11y ago
  So nothing in the current OpenBSD images would be banned then?
  - imron 11y ago
    Hence 'download from Canada'.
- andrewchambers 11y ago
  You are living in a delusion, they can't crack the standard encryption that comes with openssh, and that is the type of thing they want to ban. People can easily hide data streams inside video-streams/ text-files/images to circumvent trivial screening. The government won't be able to do anything effective without massive costs and draconian measures. Not to mention people outside the US can carry on however they like anyway.
  - dogma1138 11y ago
    You've missed the 2nd half of my post I see, I said that if any even half arsed measures are going to be in place the crackdown will become more effective with time. If you can stall or slow down the evolution of open encryption sufficiently so state actors can catch up then that's effectively makes that encryption useless. Today for example the NSA can break weak DSA configurations, and factor weak RSA keys in 2-3 years they'll gain other capabilities. What will happen if say we do wake up to a post quantum world with much of our asymmetric cryptography being worthless. Do you really see people being able to develop a new RSA level family of algorithms at a hackaton? If you can't increase the work that needed to be done to break your encryption at the same rate as your adversary increases their capabilities you are going to lose and lose badly. And draconian measures and extreme costs is just what they are proposing, I'm not advocating that it's going to be effective at first or cheap, but dismissing it as even if they want too they will never be able too is just as foolish as voting for Trump ironically to give him a sympathy vote. Go ask people from East Germany, pre-Glasnost Russia and even some countries that exist today how easy it is going to be to evade surveillance enmass. You should never be dismissive of threats no matter how far fetched or unlikely they are or how incapable your opponent at executing them might be, this is probably one of the more important lessons one can take from history.
    - strayptr 11y ago
      There are a variety of algorithms which are safe in a post-quantum crypto world. Developing and deploying them will take time, but they exist. Making them safe will take longer, but it will happen. The threat you describe sounds like a race. But in fact, it's more like a switch. Right now the world is pre-quantum. When the switch is flipped, to post-quantum, a lot of algorithms will break. But not all of them. See http://pqcrypto.org/ http://pqcrypto.org/ for some interesting reading. Post-Quantum Cryptography, Bernstein, 2009: http://www.e-reading.club/bookreader.php/135832/Post_Quantum_Cryptography.pdf http://www.e-reading.club/bookreader.php/135832/Post_Quantum... Regarding your point, I don't think that people here are being dismissive of your ideas. You're quite right. But there are reasons to be positive about the future, while highlighting the negatives. Isn't it so interesting that certain algorithms can be safe in a pqcrypto world? Notice where the algorithms spring up from. You mention a hackathon, but that's not where these algorithms root. They're from universities. And universities are interesting. If the legislation will face resistance, it will probably be from academics, like in the last crypto war.
      - dogma1138 11y ago
        Today there won't be much issues, I'm talking about a reality in which your Government (doesn't matter if it's the US, UK, Germany or China) is not only not helping you to build strong crypto (which they always done so in the past), but actually is working against you. How easy would it to work on open encryption software if we'll have to revert to the Pre Bernstein V. United States era (which wasn't so long ago) and one that might actually be more heavily regulated than (restriction on actual work on encryption and related field rather than exporting software) before? Heck Phil Zimmermann almost ended up going to jail when PGP was "leaked" outside of the US, and this isn't East Germany, this is the US in the mid 90's. https://en.wikipedia.org/wiki/Bernstein_v._United_States https://en.wikipedia.org/wiki/Bernstein_v._United_States
        strayptr 11y ago
        And I'm saying, yes, you're right. But have hope. That's something to watch out for going forward, but we can go forward. This thread's article is interesting, because it's the first step toward a world you describe. But reason has a way of prevailing. Not always, but usually. One thing that's missing now, that someone here might want to cook up, is a good explanation. The topic of crypto is difficult. Not just because it's hard like calculus, but because there are a lot of subtleties. Old analogies to locks and doors aren't really applicable. What we need is a way of highlighting what's going on, why people should care, and what they can do.
- andrewchambers 11y ago
  > you'll be surprised how effective can a crackdown be once a government sets its mind to it. Effective like prohibition was? Or the war on drugs? All that will happen is people will stop using macOS and Windows because that is all the US government can pressure.
  - dogma1138 11y ago
    Are you trying to compare the amount of people that can distill moonshine or smuggle drugs to the amount of people capable of writing secure encryption software? The effectiveness of limiting proliferation is tied directly to the difficulty and the scarcity of the human capital involved, this is why restricting the proliferation of small arms which can be build by anyone with some machining experience is near impossible, but limiting the proliferation of say nuclear arms and technology is quite possible. It would surprise me if the NSA (or any other agency) doesn't have a list of all or most software engineers and mathematicians which are capable of designing crypto, that mailing list isn't that big.
    - andrewchambers 11y ago
      No, the number of people who can copy a file.
- linkregister 11y ago
  I've yet to hear anything about state level actors surreptitiously accessing an OpenBSD system.
  - dogma1138 11y ago
    Are you claiming that OpenBSD never had or has exploits that the NSA could or can use to access systems running it? Because if so that would be a heck of a lofty claim.
    - andrewchambers 11y ago
      Given the context, he probably meant cracking a private key given just the public key and accessing servers at will.
      - dogma1138 11y ago
        Give that context as well then, what type of private key? because quite a few they did managed....

dogma1138 11y ago

OpenBSD cd image would give you absolutely nothing when it comes to defending against state level actors sorry. And you are assuming that in their proposed reality that would be as easily achievable as it is today, you'll be surprised how effective can a crackdown be once a government sets its mind to it.

0x0 11y ago
So nothing in the current OpenBSD images would be banned then?
- imron 11y ago
  Hence 'download from Canada'.
andrewchambers 11y ago
You are living in a delusion, they can't crack the standard encryption that comes with openssh, and that is the type of thing they want to ban. People can easily hide data streams inside video-streams/ text-files/images to circumvent trivial screening. The government won't be able to do anything effective without massive costs and draconian measures. Not to mention people outside the US can carry on however they like anyway.
- dogma1138 11y ago
  You've missed the 2nd half of my post I see, I said that if any even half arsed measures are going to be in place the crackdown will become more effective with time. If you can stall or slow down the evolution of open encryption sufficiently so state actors can catch up then that's effectively makes that encryption useless. Today for example the NSA can break weak DSA configurations, and factor weak RSA keys in 2-3 years they'll gain other capabilities. What will happen if say we do wake up to a post quantum world with much of our asymmetric cryptography being worthless. Do you really see people being able to develop a new RSA level family of algorithms at a hackaton? If you can't increase the work that needed to be done to break your encryption at the same rate as your adversary increases their capabilities you are going to lose and lose badly. And draconian measures and extreme costs is just what they are proposing, I'm not advocating that it's going to be effective at first or cheap, but dismissing it as even if they want too they will never be able too is just as foolish as voting for Trump ironically to give him a sympathy vote. Go ask people from East Germany, pre-Glasnost Russia and even some countries that exist today how easy it is going to be to evade surveillance enmass. You should never be dismissive of threats no matter how far fetched or unlikely they are or how incapable your opponent at executing them might be, this is probably one of the more important lessons one can take from history.
  - strayptr 11y ago
    There are a variety of algorithms which are safe in a post-quantum crypto world. Developing and deploying them will take time, but they exist. Making them safe will take longer, but it will happen. The threat you describe sounds like a race. But in fact, it's more like a switch. Right now the world is pre-quantum. When the switch is flipped, to post-quantum, a lot of algorithms will break. But not all of them. See http://pqcrypto.org/ http://pqcrypto.org/ for some interesting reading. Post-Quantum Cryptography, Bernstein, 2009: http://www.e-reading.club/bookreader.php/135832/Post_Quantum_Cryptography.pdf http://www.e-reading.club/bookreader.php/135832/Post_Quantum... Regarding your point, I don't think that people here are being dismissive of your ideas. You're quite right. But there are reasons to be positive about the future, while highlighting the negatives. Isn't it so interesting that certain algorithms can be safe in a pqcrypto world? Notice where the algorithms spring up from. You mention a hackathon, but that's not where these algorithms root. They're from universities. And universities are interesting. If the legislation will face resistance, it will probably be from academics, like in the last crypto war.
    - dogma1138 11y ago
      Today there won't be much issues, I'm talking about a reality in which your Government (doesn't matter if it's the US, UK, Germany or China) is not only not helping you to build strong crypto (which they always done so in the past), but actually is working against you. How easy would it to work on open encryption software if we'll have to revert to the Pre Bernstein V. United States era (which wasn't so long ago) and one that might actually be more heavily regulated than (restriction on actual work on encryption and related field rather than exporting software) before? Heck Phil Zimmermann almost ended up going to jail when PGP was "leaked" outside of the US, and this isn't East Germany, this is the US in the mid 90's. https://en.wikipedia.org/wiki/Bernstein_v._United_States https://en.wikipedia.org/wiki/Bernstein_v._United_States
      - strayptr 11y ago
        And I'm saying, yes, you're right. But have hope. That's something to watch out for going forward, but we can go forward. This thread's article is interesting, because it's the first step toward a world you describe. But reason has a way of prevailing. Not always, but usually. One thing that's missing now, that someone here might want to cook up, is a good explanation. The topic of crypto is difficult. Not just because it's hard like calculus, but because there are a lot of subtleties. Old analogies to locks and doors aren't really applicable. What we need is a way of highlighting what's going on, why people should care, and what they can do.
andrewchambers 11y ago
> you'll be surprised how effective can a crackdown be once a government sets its mind to it. Effective like prohibition was? Or the war on drugs? All that will happen is people will stop using macOS and Windows because that is all the US government can pressure.
- dogma1138 11y ago
  Are you trying to compare the amount of people that can distill moonshine or smuggle drugs to the amount of people capable of writing secure encryption software? The effectiveness of limiting proliferation is tied directly to the difficulty and the scarcity of the human capital involved, this is why restricting the proliferation of small arms which can be build by anyone with some machining experience is near impossible, but limiting the proliferation of say nuclear arms and technology is quite possible. It would surprise me if the NSA (or any other agency) doesn't have a list of all or most software engineers and mathematicians which are capable of designing crypto, that mailing list isn't that big.
  - andrewchambers 11y ago
    No, the number of people who can copy a file.
linkregister 11y ago
I've yet to hear anything about state level actors surreptitiously accessing an OpenBSD system.
- dogma1138 11y ago
  Are you claiming that OpenBSD never had or has exploits that the NSA could or can use to access systems running it? Because if so that would be a heck of a lofty claim.
  - andrewchambers 11y ago
    Given the context, he probably meant cracking a private key given just the public key and accessing servers at will.
    - dogma1138 11y ago
      Give that context as well then, what type of private key? because quite a few they did managed....