8 ms·

Remember how New York’s (physical) master keys became easily accessible[1] despite the fact that they were supposedly so carefully managed? All that effort, al

Remember how New York’s (physical) master keys became easily accessible[1] despite the fact that they were supposedly so carefully managed? All that effort, all that trouble, and now not only is there essentially no security at all but the master keys created a security hole that did not need to exist. The security of encryption is similarly proportional to the security of keys. The fewer things you have to secure, the easier it is to keep them secret. The “master key” concept in New York only served to create something of great value that people wanted to acquire, and massively increased the risk when that fell into the wrong hands. Obviously the same thing could happen with an encryption key, except it is worse because you don’t even have to be in the same country as the source of the key to acquire it or use it. [1] http://www.nydailynews.com/new-york/pols-public-outraged-shocking-master-key-security-breach-subways-article-1.167499 http://www.nydailynews.com/new-york/pols-public-outraged-sho...

krzrak 11y ago
Interesting article. I find amusing this (quite popular) type of argumentation: > "This is a serious security breach," said Councilman Peter Vallone (D-Queens), who heads the Council's Public Safety Committee. "We know terrorists are planning to attack our subways, and the MTA and NYPD better find these magical morons quickly, and then make them disappear for a year in jail." Like the only thing between terrorists and the subway platforms is that they can't afford ticket, so they have to go through the staff gate.
- anexprogrammer 11y ago
  But that is so revealing of the mindset. * We can have strong encryption just for the good guys * We can have master keys that only approved staff will use * We can block all the bad things on the internet and it'll be like they don't exist * If we have a back door into an encrypted device, only the good guys will use it It's like no politician ever read about crime. Staff can't be blackmailed or bribed. No one working for the govt ever used resources for their own ends. No govt agency ever tried to blackmail an inconvenient public figure. Because a terrorist once made a terrible attempt at a bomb in his trainers, quick, we'd better make millions of people remove their shoes at airports. Clearly no terrorist has the wit to try a different approach. The list is so damn long, yet people who really should know better get it wrong with depressing regularity. Are most politicians really that stupid? What are their advisers advising FFS?
  - bowlofstew 11y ago
    Yes, the good guys will use it in many ways that were never intended.... http://www.nytimes.com/2014/07/21/us/politics/edward-snowden-at-nsa-sexually-explicit-photos-often-shared.html http://www.nytimes.com/2014/07/21/us/politics/edward-snowden...
  - lostgame 11y ago
    Change it up: • We can have guns just for the good guys • We can have guns that only approved staff will use • We can block all the bad people from having guns and it'll be like guns don't exist! • If we have guns, only the good guys will use them. Seems like any dangerous technology can follow this mindset. :P
    - qb45 11y ago
      If only good guys used guns, nobody would need them. It actually is "we know bad guys already have guns, so better if good guys have them too". Same with crypto, btw.
      - merpnderp 11y ago
        That's not completely true. If bad guys didn't have guns, we'd still want good guys to have them. I don't want police having to take on a guy with knives and a baseball bat, themselves only armed with knives and a baseball bat.
        ameister14 11y ago
        I do. The police shouldn't have access to weaponry that citizens cannot obtain except in very specialized circumstances, like say a particular unit in a city like Detroit or Chicago.
        crottypeter 11y ago
        Why not? It works. Cops without guns: https://youtu.be/cX5CPx4RKWw https://youtu.be/cX5CPx4RKWw Cop with gun: https://youtu.be/RdoeBXt06Bc https://youtu.be/RdoeBXt06Bc
- derefr 11y ago
  > Like the only thing between terrorists and the subway platforms is that they can't afford ticket, so they have to go through the staff gate. Obviously, terrorists must always break all laws in the process of committing terrorism. They have to illegally park their cars, jaywalk to the location, commit some acts of public indecency on the way, litter at random, and pop their heads into a crowded theatre just to yell "fire!"
saganus 11y ago
And terrifyingly enough, the Council's Public Safety Commitee said to this: "We know terrorists are planning to attack our subways, and the MTA and NYPD better find these magical morons quickly, and then make them disappear for a year in jail." So, clearly the solution is to JAIL the users of the keys, instead of actually replacing this with a better system.
malcolmgreaves 11y ago
Why? They're not a taxi company. Thry
dukenuke 11y ago
> The fewer things you have to secure, the easier it is to keep them secret. Except when this approaches towards zero security. The line is so thin, and actual expertise is needed to discern this sweetspot. I've seen entire corporations use apparently bulletproof security (Think Google's data centres), but fail to use DNSSEC or background check their security guards. Avoid weak links like this, they are bad for business.
hamburglar 11y ago
People challenging this anti-crypto movement should really push this example because it is really perfect. Before we consider key escrow, please explain exactly how physical key escrow was breached in New York and tell us how that will be prevented when the key in question isn't even something you have to physically get.
- JoshTriplett 11y ago
  This should always be presented as an additional argument, though, not the only argument. Because an argument based solely on securing the backdoor implies that if it could be kept secure enough, there's no other reason not to do it. Even if we could somehow guarantee absolutely that the backdoor will only be used by the intended users, backdoors are still not acceptable. For much the same reason that it's not acceptable to put a camera in every home or car, even if the footage were "only" accessible by the government with a warrant.
  - jkyle 11y ago
    The answer to the begged question of the New York key escrow example is that it is impossible to guarantee a backdoor is 100% secured and only accessible by the intended users. I'm not sure the camera analogy will carry weight. It sounds hyperbolic to most people as it tries to equate actually being recorded in your private affairs to the possibility of materials being accessed when a warrant is issued. Most people have no problem with law enforcement accessing evidence when a warrant is issued. The only way to win over the general population is to demonstrate encryption is fundamentally different then simple access.
  - deleted 11y ago
    [deleted]
tzs 11y ago
Although not in favor of key escrow systems, I'm not convinced that they cannot be implemented in a secure fashion. There are fundamental differences between physical keys and digital key that make analogies between the two unconvincing to me. With a physical master key, all it takes is one possessor of a copy of the key to agree in order to get access to what the key is protecting, or compromising one possessor. With digital data, such as an encryption key, an escrow system could be combined with a secret sharing system so that you need to gain access to multiple shares before you can get the underlying encryption key. With a sufficient number of shares required, distributed among a large enough number of independent escrow agents in different legal jurisdictions, the probability of someone getting your key illegitimately via the escrow system can be made arbitrarily small.
- TrevorJ 11y ago
  At best you are only going to be able to patch the security hole that having key escrow has created though. You can never to better than that, and it's quite likely that the system would be less than 100% secure in practice.
bendbro 11y ago
Something similar happened with the playstation 3 and its master key. https://en.wikipedia.org/wiki/PlayStation_3_homebrew https://en.wikipedia.org/wiki/PlayStation_3_homebrew

krzrak 11y ago

Interesting article. I find amusing this (quite popular) type of argumentation: > "This is a serious security breach," said Councilman Peter Vallone (D-Queens), who heads the Council's Public Safety Committee. "We know terrorists are planning to attack our subways, and the MTA and NYPD better find these magical morons quickly, and then make them disappear for a year in jail." Like the only thing between terrorists and the subway platforms is that they can't afford ticket, so they have to go through the staff gate.

anexprogrammer 11y ago
But that is so revealing of the mindset. * We can have strong encryption just for the good guys * We can have master keys that only approved staff will use * We can block all the bad things on the internet and it'll be like they don't exist * If we have a back door into an encrypted device, only the good guys will use it It's like no politician ever read about crime. Staff can't be blackmailed or bribed. No one working for the govt ever used resources for their own ends. No govt agency ever tried to blackmail an inconvenient public figure. Because a terrorist once made a terrible attempt at a bomb in his trainers, quick, we'd better make millions of people remove their shoes at airports. Clearly no terrorist has the wit to try a different approach. The list is so damn long, yet people who really should know better get it wrong with depressing regularity. Are most politicians really that stupid? What are their advisers advising FFS?
- bowlofstew 11y ago
  Yes, the good guys will use it in many ways that were never intended.... http://www.nytimes.com/2014/07/21/us/politics/edward-snowden-at-nsa-sexually-explicit-photos-often-shared.html http://www.nytimes.com/2014/07/21/us/politics/edward-snowden...
- lostgame 11y ago
  Change it up: • We can have guns just for the good guys • We can have guns that only approved staff will use • We can block all the bad people from having guns and it'll be like guns don't exist! • If we have guns, only the good guys will use them. Seems like any dangerous technology can follow this mindset. :P
  - qb45 11y ago
    If only good guys used guns, nobody would need them. It actually is "we know bad guys already have guns, so better if good guys have them too". Same with crypto, btw.
    - merpnderp 11y ago
      That's not completely true. If bad guys didn't have guns, we'd still want good guys to have them. I don't want police having to take on a guy with knives and a baseball bat, themselves only armed with knives and a baseball bat.
      - ameister14 11y ago
        I do. The police shouldn't have access to weaponry that citizens cannot obtain except in very specialized circumstances, like say a particular unit in a city like Detroit or Chicago.
      - crottypeter 11y ago
        Why not? It works. Cops without guns: https://youtu.be/cX5CPx4RKWw https://youtu.be/cX5CPx4RKWw Cop with gun: https://youtu.be/RdoeBXt06Bc https://youtu.be/RdoeBXt06Bc
derefr 11y ago
> Like the only thing between terrorists and the subway platforms is that they can't afford ticket, so they have to go through the staff gate. Obviously, terrorists must always break all laws in the process of committing terrorism. They have to illegally park their cars, jaywalk to the location, commit some acts of public indecency on the way, litter at random, and pop their heads into a crowded theatre just to yell "fire!"

saganus 11y ago

And terrifyingly enough, the Council's Public Safety Commitee said to this: "We know terrorists are planning to attack our subways, and the MTA and NYPD better find these magical morons quickly, and then make them disappear for a year in jail." So, clearly the solution is to JAIL the users of the keys, instead of actually replacing this with a better system.

malcolmgreaves 11y ago

Why? They're not a taxi company. Thry

dukenuke 11y ago

> The fewer things you have to secure, the easier it is to keep them secret. Except when this approaches towards zero security. The line is so thin, and actual expertise is needed to discern this sweetspot. I've seen entire corporations use apparently bulletproof security (Think Google's data centres), but fail to use DNSSEC or background check their security guards. Avoid weak links like this, they are bad for business.

hamburglar 11y ago

People challenging this anti-crypto movement should really push this example because it is really perfect. Before we consider key escrow, please explain exactly how physical key escrow was breached in New York and tell us how that will be prevented when the key in question isn't even something you have to physically get.

JoshTriplett 11y ago
This should always be presented as an additional argument, though, not the only argument. Because an argument based solely on securing the backdoor implies that if it could be kept secure enough, there's no other reason not to do it. Even if we could somehow guarantee absolutely that the backdoor will only be used by the intended users, backdoors are still not acceptable. For much the same reason that it's not acceptable to put a camera in every home or car, even if the footage were "only" accessible by the government with a warrant.
- jkyle 11y ago
  The answer to the begged question of the New York key escrow example is that it is impossible to guarantee a backdoor is 100% secured and only accessible by the intended users. I'm not sure the camera analogy will carry weight. It sounds hyperbolic to most people as it tries to equate actually being recorded in your private affairs to the possibility of materials being accessed when a warrant is issued. Most people have no problem with law enforcement accessing evidence when a warrant is issued. The only way to win over the general population is to demonstrate encryption is fundamentally different then simple access.
- deleted 11y ago
  [deleted]

tzs 11y ago

Although not in favor of key escrow systems, I'm not convinced that they cannot be implemented in a secure fashion. There are fundamental differences between physical keys and digital key that make analogies between the two unconvincing to me. With a physical master key, all it takes is one possessor of a copy of the key to agree in order to get access to what the key is protecting, or compromising one possessor. With digital data, such as an encryption key, an escrow system could be combined with a secret sharing system so that you need to gain access to multiple shares before you can get the underlying encryption key. With a sufficient number of shares required, distributed among a large enough number of independent escrow agents in different legal jurisdictions, the probability of someone getting your key illegitimately via the escrow system can be made arbitrarily small.

TrevorJ 11y ago
At best you are only going to be able to patch the security hole that having key escrow has created though. You can never to better than that, and it's quite likely that the system would be less than 100% secure in practice.

bendbro 11y ago

Something similar happened with the playstation 3 and its master key. https://en.wikipedia.org/wiki/PlayStation_3_homebrew https://en.wikipedia.org/wiki/PlayStation_3_homebrew