4 ms·

This kind of thing doesn't matter. Encryption simply can't be stopped by governments.

ipsin 11y ago
I think these lies absolutely matter. It's a war of propaganda that can lead to real legislation. I think the "PATRIOT Act" (and the "USA Freedom Act", for that matter) show that the surveillance state has a way of turning its will into law. To borrow a cliche, if encryption is outlawed, only outlaws will have encryption. I don't think encryption can be outlawed, but it can be hamstrung by weakened implementations and requirements to decrypt for "lawful requests".
dahart 11y ago
It certainly does matter to me, and your comment makes me wonder if it might matter to you and you don't know it. If you read it, the articles's thrust isn't largely about encryption, it's about mass surveillance. The reasons it matters to me: - The government shouldn't have the right to wire-tap all citizens at once. We already established that for analog telephones, but digital has become an excuse to undo the annoying requirement of establishing probable cause. If they have the right to listen to you through mass means, no encryption will help you. - They are spending our tax dollars doing this. The money matters, and they basically taking our money and using it against us. At best it's a waste of that money. - If they establish the right to curb strong encryption, you may be right in the sense that it doesn't matter to the criminals who use illegal and strong encryption. But it does matter to the vast majority of the law abiding world who get stuck with "encryption" that is readily readable by anyone who expresses an interest, and allows the govt to keep collecting mass surveillance unhindered.
- alextgordon 11y ago
  Many websites require HTTPS and many of those are hosted in foreign countries. Banning encryption is like banning breathing. Yeah, they can, but we all still have to do it.
celticninja 11y ago
It can be outlawed and as a result prevent access to encryption for a large part of the population. Then only technically capable people and motivated criminals would be in a position to use it. The govt would then conflate all encryption with terrorism. If you were found with encrypted communications you would be compelled to give up the key or face prosecution as a terrorist. In front of a jury with no knowledge of encryption other than what they heard on Fox news would guarantee a long sentence or the usual tactic of forcing you to take a plea regardless of your guilt.
riskable 11y ago
It won't stop encryption but it does matter because it has the potential to stifle speech and cause serious harm to the innocent.
pdkl95 11y ago
> Encryption simply can't be stopped by governments. They can try, and they can make your life hell for using it. It won't work, of course, but that has never stopped frightened people or those with an agenda. This is why it is incredibly important that we not only use encryption pervasively, but that we also educate[1] the general public about encryption. Unless encryption is normalized into the popular culture, it will always be possible to harass "those troublemakers" that use encryption and the general public won't care. This crap will end only after people understand that "banning encryption" is as stupid as "banning envelopes/locks". > This kind of thing doesn't matter. Encryption doesn't protect you from traffic analysis. It is important to remember that so-called metadata is often more revealing[2] than the content, especially when you 0wn3d the backbone and can map[3] who everybody you talk to. [1] specifically, we need to educate people to a similar level that people understand physical locks: "what is does" and "when/how it should be used" are key; the details can be left to professionals (i.e. like locksmiths). [2] http://labs.rs/en/metadata/ http://labs.rs/en/metadata/ [3] https://www.washingtonpost.com/apps/g/page/world/how-the-nsa-is-tracking-people-right-now/634/ https://www.washingtonpost.com/apps/g/page/world/how-the-nsa...
venomsnake 11y ago
> Encryption simply can't be stopped by governments. Try spending couple of hours being beaten by government thugs just because you encrypted something (they won't even bother asking you decrypt) and you will sing another tune. Lets assume that the relative physical safety that a person enjoys in the west in the hands of the LEO is the exception and not the norm worldwide. Governments can stop anything they want if they are strong or desperate enough.
nly 11y ago
While true, moving the entire web to HTTPS with PFS-enabled configurations, secure cipher suites, and key-pinning is a huge challenge. In any case, the strategy lately has been to force consumer ISPs to keep logs of who is connecting where (The UK government wants ISPs to log the URI of every plaintext page you visit, and will no doubt eventually want DNS logs and TLS SNI and TCP connection logs for other kinds of connectivity). The best you can do today is ensure your TLS deployment is A+ rated at SSL Labs[0] and offer a Tor hidden service for your visitors. That said, if governments and ISPs legislate/cooperate to do active MITM attacks, then there's nothing we can really do to help Joe Public that wouldn't constitute a crime or get you put on a watchlist yourself. [0] https://www.ssllabs.com/ssltest/ https://www.ssllabs.com/ssltest/
api 11y ago
No it can't, but laws against crypto can be used to mandate that only certain crypto be used in "professional" settings. That crypto will of course have to be certified, which will lock anyone but Fortune 500 companies and products certified by expensive consultants out of essentially all enterprise markets. Your browser will have to be certified to talk to certified SSL servers, etc. So forget about open source, open platforms, open standards, and startups competing with big companies in the enterprise. That may well be the real objective. I wouldn't be terribly surprised if big players are lobbying behind the scenes for the government to mandate a new kind of FIPS for all consumer crypto, which would lock smaller players out of the market and of course make us all safer from 'terr (right?). Remember how SOPA was lobbied for by GoDaddy so they could sell a new expensive premium class of domain registration? Using bloody crimes and tragedies to lobby for unfair market advantage. It's how business is done in Washington (and probably other capitols too).
knodi123 11y ago
It can't be totally stopped. But plenty of encryption-enabled apps can be subverted. I think it should be treated as a given that 1. a sufficiently clever and malicious person can implement broken encryption in a virtually-undetectable, and perhaps even deniable way 2. the government has the capability of exerting enormous pressure on app manufacturers and service providers Given 1 & 2, it's reasonable to assume that an unknown and possibly great number of encrypted chat and encrypted email and encrypted etc are all subverted.

ipsin 11y ago

I think these lies absolutely matter. It's a war of propaganda that can lead to real legislation. I think the "PATRIOT Act" (and the "USA Freedom Act", for that matter) show that the surveillance state has a way of turning its will into law. To borrow a cliche, if encryption is outlawed, only outlaws will have encryption. I don't think encryption can be outlawed, but it can be hamstrung by weakened implementations and requirements to decrypt for "lawful requests".

dahart 11y ago

It certainly does matter to me, and your comment makes me wonder if it might matter to you and you don't know it. If you read it, the articles's thrust isn't largely about encryption, it's about mass surveillance. The reasons it matters to me: - The government shouldn't have the right to wire-tap all citizens at once. We already established that for analog telephones, but digital has become an excuse to undo the annoying requirement of establishing probable cause. If they have the right to listen to you through mass means, no encryption will help you. - They are spending our tax dollars doing this. The money matters, and they basically taking our money and using it against us. At best it's a waste of that money. - If they establish the right to curb strong encryption, you may be right in the sense that it doesn't matter to the criminals who use illegal and strong encryption. But it does matter to the vast majority of the law abiding world who get stuck with "encryption" that is readily readable by anyone who expresses an interest, and allows the govt to keep collecting mass surveillance unhindered.

alextgordon 11y ago
Many websites require HTTPS and many of those are hosted in foreign countries. Banning encryption is like banning breathing. Yeah, they can, but we all still have to do it.

celticninja 11y ago

It can be outlawed and as a result prevent access to encryption for a large part of the population. Then only technically capable people and motivated criminals would be in a position to use it. The govt would then conflate all encryption with terrorism. If you were found with encrypted communications you would be compelled to give up the key or face prosecution as a terrorist. In front of a jury with no knowledge of encryption other than what they heard on Fox news would guarantee a long sentence or the usual tactic of forcing you to take a plea regardless of your guilt.

riskable 11y ago

It won't stop encryption but it does matter because it has the potential to stifle speech and cause serious harm to the innocent.

pdkl95 11y ago

> Encryption simply can't be stopped by governments. They can try, and they can make your life hell for using it. It won't work, of course, but that has never stopped frightened people or those with an agenda. This is why it is incredibly important that we not only use encryption pervasively, but that we also educate[1] the general public about encryption. Unless encryption is normalized into the popular culture, it will always be possible to harass "those troublemakers" that use encryption and the general public won't care. This crap will end only after people understand that "banning encryption" is as stupid as "banning envelopes/locks". > This kind of thing doesn't matter. Encryption doesn't protect you from traffic analysis. It is important to remember that so-called metadata is often more revealing[2] than the content, especially when you 0wn3d the backbone and can map[3] who everybody you talk to. [1] specifically, we need to educate people to a similar level that people understand physical locks: "what is does" and "when/how it should be used" are key; the details can be left to professionals (i.e. like locksmiths). [2] http://labs.rs/en/metadata/ http://labs.rs/en/metadata/ [3] https://www.washingtonpost.com/apps/g/page/world/how-the-nsa-is-tracking-people-right-now/634/ https://www.washingtonpost.com/apps/g/page/world/how-the-nsa...

venomsnake 11y ago

> Encryption simply can't be stopped by governments. Try spending couple of hours being beaten by government thugs just because you encrypted something (they won't even bother asking you decrypt) and you will sing another tune. Lets assume that the relative physical safety that a person enjoys in the west in the hands of the LEO is the exception and not the norm worldwide. Governments can stop anything they want if they are strong or desperate enough.

nly 11y ago

While true, moving the entire web to HTTPS with PFS-enabled configurations, secure cipher suites, and key-pinning is a huge challenge. In any case, the strategy lately has been to force consumer ISPs to keep logs of who is connecting where (The UK government wants ISPs to log the URI of every plaintext page you visit, and will no doubt eventually want DNS logs and TLS SNI and TCP connection logs for other kinds of connectivity). The best you can do today is ensure your TLS deployment is A+ rated at SSL Labs[0] and offer a Tor hidden service for your visitors. That said, if governments and ISPs legislate/cooperate to do active MITM attacks, then there's nothing we can really do to help Joe Public that wouldn't constitute a crime or get you put on a watchlist yourself. [0] https://www.ssllabs.com/ssltest/ https://www.ssllabs.com/ssltest/

api 11y ago

No it can't, but laws against crypto can be used to mandate that only certain crypto be used in "professional" settings. That crypto will of course have to be certified, which will lock anyone but Fortune 500 companies and products certified by expensive consultants out of essentially all enterprise markets. Your browser will have to be certified to talk to certified SSL servers, etc. So forget about open source, open platforms, open standards, and startups competing with big companies in the enterprise. That may well be the real objective. I wouldn't be terribly surprised if big players are lobbying behind the scenes for the government to mandate a new kind of FIPS for all consumer crypto, which would lock smaller players out of the market and of course make us all safer from 'terr (right?). Remember how SOPA was lobbied for by GoDaddy so they could sell a new expensive premium class of domain registration? Using bloody crimes and tragedies to lobby for unfair market advantage. It's how business is done in Washington (and probably other capitols too).

knodi123 11y ago

It can't be totally stopped. But plenty of encryption-enabled apps can be subverted. I think it should be treated as a given that 1. a sufficiently clever and malicious person can implement broken encryption in a virtually-undetectable, and perhaps even deniable way 2. the government has the capability of exerting enormous pressure on app manufacturers and service providers Given 1 & 2, it's reasonable to assume that an unknown and possibly great number of encrypted chat and encrypted email and encrypted etc are all subverted.