5 ms·

That's wrong. The government isn't saying that no one should be able to encrypt data. They just thing that, in some cases, it should be done in such a way that

by harryh 11y ago

That's wrong. The government isn't saying that no one should be able to encrypt data. They just thing that, in some cases, it should be done in such a way that certain data can be read by use of a centralized master key. This, of course, presents certain problems. What if that master key leaks? But it's not binary. Data secured this way is absolutely safer than not encrypting something at all. "Is it safe enough?" is certainly a question that people can disagree on. It's not binary.

andrewfromx 11y ago
no way man. either I have the right to use technology to make something encrypted (my definition of encrypted is cannot be broken) or I don't.
- marcoperaza 11y ago
  There's no award for effort. Apple built a cryptosystem that doesn't work against an adversary that is Apple. "Encrypting" isn't some magical property that makes your data safe. The encryption itself is just one aspect of a whole system that must be designed to protect against certain adversaries with certain capabilities. The government would be totally allowed, for example, to tamper with your wax seals if it had a warrant to read your mail. I lied, there is an award for effort. Wherever you have an "reasonable expectation of privacy", the government must get a warrant or your permission to exercise its search and seizure authority. That's the protection that you're entitled to by our laws. Even the EFF is acknowledging the weakness of your argument when they try to frame it as an issue about Apple's free speech instead.
andrewfromx 11y ago
wow, when you put it that way it's like saying "either I have the right to own a gun or I do not." So I guess if people except limits on gun ownership they should accept limits on encryption cuz it's just as dangerous?
- gambiting 11y ago
  To me personally the concept of even owning a gun is utterly ridiculous, but I guess American people would be incredibly upset if every gun had to come with a built-in remotely controlled switch that could be used by the police to disable it. This is essentially what they are trying to do with encryption - you are free to use it, but we want to be able to manually switch it off if we want to.
- andrewfromx 11y ago
  it's that interesting, people on the LEFT want NO LIMITS on encryption but LOTS OF LIMITS on guns. Is encryption more or less dangerous than guns?
- harryh 11y ago
  Actually no. What I'm saying is that you do have the right to own a gun, but there are limits on gun ownership. * Minors cannot buy guns. * Convicted felons cannot buy guns in most circumstances. * There are numerous locations in which it is illegal to bring a gun. * There are numerous types of guns that you are not allowed to own. It's not binary.
boomlinde 11y ago
Encryption is a measure that prevents unauthorized parties from taking part of what is encrypted. If it fails that on such a basic level that a specific unauthorized party can trivially access it, it's not effective encryption. Whether or not it is effective, then, is just a matter of whether you agree that who ever holds the master key is authorized to access whatever it is that you encrypted. It's still not broken in any technical sense, but if I don't want a third party to read my data and they are still able to do so, it's a stretch to call it encryption.
- harryh 11y ago
  I don't think that's true at all. If you use gmail your data is pretty safe. Unless you tell me your password I'm going to have a pretty hard time reading your mail. It's encrypted at rest on Google's disks. It's encrypted in transmission over the internet. Google's network is protected with various forms of encryption and security that makes it hard for an unauthorized party to get into. But Google itself can access and read your email. It does so in an automated fashion to target ads at you. So is your gmail encrypted? Well...kind of. It's not binary.
  - enraged_camel 11y ago
    The difference is that by using Gmail you agree with Google's terms of service, which state somewhere in them that they can target ads at you. With a government-held master key, there is no such contract.
    - harryh 11y ago
      Sure there is. We have a system of laws and courts that define the contract. And besides, the existence of a contract or not isn't really my point. My point was that encryption isn't an all or nothing situation. You don't either have completely ironclad security where you and only you can access your data or nothing at all. There are degrees of technical protection. That was my point. The black and white thinking about this issue is wrong.
ubernostrum 11y ago
The fundamental issue is that any back door accessible to "the good guys" will also be accessible to sufficiently-technically-advanced "bad guys". And from the perspective of securing the United States' defense infrastructure, major corporations, etc., there are multiple sufficiently-technically-advanced "bad guys" in the world already (i.e., certain major foreign governments and their intelligence/defense complexes). So if you're doing US national security, you cannot accept the Obama position; any technology to which our "good guy" law enforcement could get access is guaranteed to also be a technology to which a "bad guy" foreign enemy combatant could similarly gain access. If you're a major US corporation, you cannot accept the Obama position; any technology to which our "good guy" law enforcement could get access is guaranteed to also be a technology to which a "bad guy" foreign intelligence/espionage agent could similarly gain access. So as far as that is concerned, it is binary. You can either be secure against foreign threats, in which case you are also as a side effect impenetrable to the local "good guys". Or you can be penetrable by the local "good guys" and also as a side effect penetrable by the foreign "bad guys". The argument advanced against Obama's position is that A) it fundamentally fails to acknowledge this reality, and B) seems to argue for deliberately compromising national security in order to... preserve national security? In other words, it is not only unrealistic, it is in fact nonsensical and self-contradictory.
- andrewfromx 11y ago
  wow, that's the best writing on this whole thing I've read. well done. I tweeted it https://twitter.com/andrewarrow/status/709158302127509504 https://twitter.com/andrewarrow/status/709158302127509504
  - jonathanmh 11y ago
    Thank you! I really should have put a lot more into this, because I have a ton of examples. Really need to do a follow up
- harryh 11y ago
  We're talking about iPhones here. Not the nuclear launch codes. Maybe you have information on your phone that KGB is interested in, but most people don't. Again, security & encryption aren't binary. It isn't on or off. Different levels of protection are appropriate for different levels of threats. The lock on my mom's suburban house is a lot weaker than the lock on the vault holding the gold at Fort Knox. Similarly the kind of security appropriate for consumer grade cell phones might be different than the kind appropriate for guarding US national security secrets.
zipwitch 11y ago
It's actually less safe. People will think their data is secure, but it won't be. The government always leaks keys. Sometimes literally. http://www.wired.com/2015/09/lockpickers-3-d-print-tsa-luggage-keys-leaked-photos/ http://www.wired.com/2015/09/lockpickers-3-d-print-tsa-lugga... http://nypost.com/2015/09/20/the-8-key-that-can-open-new-york-city-to-terrorists/ http://nypost.com/2015/09/20/the-8-key-that-can-open-new-yor... Plus, any key that the government can use without your permission, they can illegally abuse. And if there's one thing we've seen proven recently, it's that such abuse will occur.
- harryh 11y ago
  It's worth noting that in this case we're only talking about keys that are useful to someone in physical possession of a phone. So as long as I retain physical possession of my phone no one can get at it, keys or not. That's still pretty safe.
  - unit91 11y ago
    Until you lose it or it's stolen.

by harryh 11y ago

andrewfromx 11y ago

no way man. either I have the right to use technology to make something encrypted (my definition of encrypted is cannot be broken) or I don't.

marcoperaza 11y ago
There's no award for effort. Apple built a cryptosystem that doesn't work against an adversary that is Apple. "Encrypting" isn't some magical property that makes your data safe. The encryption itself is just one aspect of a whole system that must be designed to protect against certain adversaries with certain capabilities. The government would be totally allowed, for example, to tamper with your wax seals if it had a warrant to read your mail. I lied, there is an award for effort. Wherever you have an "reasonable expectation of privacy", the government must get a warrant or your permission to exercise its search and seizure authority. That's the protection that you're entitled to by our laws. Even the EFF is acknowledging the weakness of your argument when they try to frame it as an issue about Apple's free speech instead.

andrewfromx 11y ago

wow, when you put it that way it's like saying "either I have the right to own a gun or I do not." So I guess if people except limits on gun ownership they should accept limits on encryption cuz it's just as dangerous?

gambiting 11y ago
To me personally the concept of even owning a gun is utterly ridiculous, but I guess American people would be incredibly upset if every gun had to come with a built-in remotely controlled switch that could be used by the police to disable it. This is essentially what they are trying to do with encryption - you are free to use it, but we want to be able to manually switch it off if we want to.
andrewfromx 11y ago
it's that interesting, people on the LEFT want NO LIMITS on encryption but LOTS OF LIMITS on guns. Is encryption more or less dangerous than guns?
harryh 11y ago
Actually no. What I'm saying is that you do have the right to own a gun, but there are limits on gun ownership. * Minors cannot buy guns. * Convicted felons cannot buy guns in most circumstances. * There are numerous locations in which it is illegal to bring a gun. * There are numerous types of guns that you are not allowed to own. It's not binary.

boomlinde 11y ago

Encryption is a measure that prevents unauthorized parties from taking part of what is encrypted. If it fails that on such a basic level that a specific unauthorized party can trivially access it, it's not effective encryption. Whether or not it is effective, then, is just a matter of whether you agree that who ever holds the master key is authorized to access whatever it is that you encrypted. It's still not broken in any technical sense, but if I don't want a third party to read my data and they are still able to do so, it's a stretch to call it encryption.

harryh 11y ago
I don't think that's true at all. If you use gmail your data is pretty safe. Unless you tell me your password I'm going to have a pretty hard time reading your mail. It's encrypted at rest on Google's disks. It's encrypted in transmission over the internet. Google's network is protected with various forms of encryption and security that makes it hard for an unauthorized party to get into. But Google itself can access and read your email. It does so in an automated fashion to target ads at you. So is your gmail encrypted? Well...kind of. It's not binary.
- enraged_camel 11y ago
  The difference is that by using Gmail you agree with Google's terms of service, which state somewhere in them that they can target ads at you. With a government-held master key, there is no such contract.
  - harryh 11y ago
    Sure there is. We have a system of laws and courts that define the contract. And besides, the existence of a contract or not isn't really my point. My point was that encryption isn't an all or nothing situation. You don't either have completely ironclad security where you and only you can access your data or nothing at all. There are degrees of technical protection. That was my point. The black and white thinking about this issue is wrong.

ubernostrum 11y ago

The fundamental issue is that any back door accessible to "the good guys" will also be accessible to sufficiently-technically-advanced "bad guys". And from the perspective of securing the United States' defense infrastructure, major corporations, etc., there are multiple sufficiently-technically-advanced "bad guys" in the world already (i.e., certain major foreign governments and their intelligence/defense complexes). So if you're doing US national security, you cannot accept the Obama position; any technology to which our "good guy" law enforcement could get access is guaranteed to also be a technology to which a "bad guy" foreign enemy combatant could similarly gain access. If you're a major US corporation, you cannot accept the Obama position; any technology to which our "good guy" law enforcement could get access is guaranteed to also be a technology to which a "bad guy" foreign intelligence/espionage agent could similarly gain access. So as far as that is concerned, it is binary. You can either be secure against foreign threats, in which case you are also as a side effect impenetrable to the local "good guys". Or you can be penetrable by the local "good guys" and also as a side effect penetrable by the foreign "bad guys". The argument advanced against Obama's position is that A) it fundamentally fails to acknowledge this reality, and B) seems to argue for deliberately compromising national security in order to... preserve national security? In other words, it is not only unrealistic, it is in fact nonsensical and self-contradictory.

andrewfromx 11y ago
wow, that's the best writing on this whole thing I've read. well done. I tweeted it https://twitter.com/andrewarrow/status/709158302127509504 https://twitter.com/andrewarrow/status/709158302127509504
- jonathanmh 11y ago
  Thank you! I really should have put a lot more into this, because I have a ton of examples. Really need to do a follow up
harryh 11y ago
We're talking about iPhones here. Not the nuclear launch codes. Maybe you have information on your phone that KGB is interested in, but most people don't. Again, security & encryption aren't binary. It isn't on or off. Different levels of protection are appropriate for different levels of threats. The lock on my mom's suburban house is a lot weaker than the lock on the vault holding the gold at Fort Knox. Similarly the kind of security appropriate for consumer grade cell phones might be different than the kind appropriate for guarding US national security secrets.

zipwitch 11y ago

It's actually less safe. People will think their data is secure, but it won't be. The government always leaks keys. Sometimes literally. http://www.wired.com/2015/09/lockpickers-3-d-print-tsa-luggage-keys-leaked-photos/ http://www.wired.com/2015/09/lockpickers-3-d-print-tsa-lugga... http://nypost.com/2015/09/20/the-8-key-that-can-open-new-york-city-to-terrorists/ http://nypost.com/2015/09/20/the-8-key-that-can-open-new-yor... Plus, any key that the government can use without your permission, they can illegally abuse. And if there's one thing we've seen proven recently, it's that such abuse will occur.

harryh 11y ago
It's worth noting that in this case we're only talking about keys that are useful to someone in physical possession of a phone. So as long as I retain physical possession of my phone no one can get at it, keys or not. That's still pretty safe.
- unit91 11y ago
  Until you lose it or it's stolen.