5 ms·

And then you get legislation requiring backdoors. People need to get their head around the back that this is a political problem and requires political solutio

by rodgerd 11y ago

And then you get legislation requiring backdoors. People need to get their head around the back that this is a political problem and requires political solutions.

cschep 11y ago
surely you agree that this puts the feds in a much tougher spot though? I think we should try to get from a 4 to 5, even if we can't get all the way to 10 right away. We shouldn't just punt on the problem because it's not possible to have an immediately perfect solution. 4 to 5 might mean using keys that only the customer has access to. 7 through 10 might all be political, sure, but let's keep moving.
- ivl 11y ago
  Had the feds not been so abusive, many of the people who are completely lawful wouldn't be at the point of being okay with the feds having a hard time. I think going tit for tat would be fine, but I totally understand why some people are saying "okay, screw it, we'll just make something no one can get into".
  - cschep 11y ago
    Totally agree! I think we should build impossible to access things AND be actively political. :)
gozur88 11y ago
Well, maybe, but you deal with the legal environment in which you find yourself. Right now, there's no such requirement. You could probably get around one, too, by selling pieces of the system and having the customer use OSS for the rest. That is, sell storage and key dongles while pointing your customer to front end software. The same way they used to sell crushed grapes during prohibition.
- arkadiyt 11y ago
  This is precisely what the Burr-Feinstein bill that was just introduced would require - providing access to the government no matter what, even if you have deployed end-to-end encryption. rodgerd is correct, this is a political problem.
  - meric 11y ago
    If you and your friend have previously exchanged public/private key pairs and used gmail to transfer encrypted messages, (which is what parent is referring to about providing service to only one part of the process) the government cannot impose anything on gmail to hand over your actual message.
    - Spooky23 11y ago
      No, but they will charge you with something.
      - loup-vaillant 11y ago
        The current wording of the bill states that you have to hand over the keys to data you have encrypted. If the provider doesn't encrypt anything (which is the case with end-to-end encryption), then it doesn't have to hand over anything.
        jaegerpicker 11y ago
        Sure but that doesn't stop the government from charging me (the sender/receiver) with illegally encrypting communication which the bill looks like it could provide. It's a political problem because NO ONE should be charged with using math. When you consider how badly all computer crime laws are enforced, I think that fighting the bill via political methods is the only safe way forward.
        meric 11y ago
jfoutz 11y ago
Why host in the US?
- esbranson 11y ago
  Better the devil you know than the devil you don't. The US laws in practice get a lot of exposure and a lot of scrutiny worldwide.
  - gozur88 11y ago
    I wonder how true that is. There seems to be a whole lot of people in recent years who've been ordered, by a judge, not to talk about something a three letter agency is doing. In theory that judge is supposed to make sure the law is being followed. My impression, though, is that some judges have a much more expansive view of government power than I think is warranted.
- rodgerd 11y ago
  Where are you going to host, then? None of the Five Eyes countries, so that rules out the UK, Canada, New Zealand, Australia. (Indeed, New Zealand is ahead of the totalitarian curve here, with proposals to give blanket exemptions to any law broken by the security services as long as they claim they had a good faith belief they needed to). France? Much worse history on encryption than the US. Germany? Officially better, but the intelligence services have been revealed to be essentially ignoring German law when it gets in the way of working with their US counterparts. And so on and so forth.
dredmorbius 11y ago
I say both. Governments can be limited by legal constructs. Non-governmental actors, or government actors from other jurisdictions, cannot. Crypto and legislative reform are mutually reinforcing bulwarks.
thegenius2000 11y ago
Then open source the system from the beginning, so you literally lack the ability to insert secret backdoors.

by rodgerd 11y ago

And then you get legislation requiring backdoors. People need to get their head around the back that this is a political problem and requires political solutions.

cschep 11y ago

surely you agree that this puts the feds in a much tougher spot though? I think we should try to get from a 4 to 5, even if we can't get all the way to 10 right away. We shouldn't just punt on the problem because it's not possible to have an immediately perfect solution. 4 to 5 might mean using keys that only the customer has access to. 7 through 10 might all be political, sure, but let's keep moving.

ivl 11y ago
Had the feds not been so abusive, many of the people who are completely lawful wouldn't be at the point of being okay with the feds having a hard time. I think going tit for tat would be fine, but I totally understand why some people are saying "okay, screw it, we'll just make something no one can get into".
- cschep 11y ago
  Totally agree! I think we should build impossible to access things AND be actively political. :)

gozur88 11y ago

Well, maybe, but you deal with the legal environment in which you find yourself. Right now, there's no such requirement. You could probably get around one, too, by selling pieces of the system and having the customer use OSS for the rest. That is, sell storage and key dongles while pointing your customer to front end software. The same way they used to sell crushed grapes during prohibition.

arkadiyt 11y ago
This is precisely what the Burr-Feinstein bill that was just introduced would require - providing access to the government no matter what, even if you have deployed end-to-end encryption. rodgerd is correct, this is a political problem.
- meric 11y ago
  If you and your friend have previously exchanged public/private key pairs and used gmail to transfer encrypted messages, (which is what parent is referring to about providing service to only one part of the process) the government cannot impose anything on gmail to hand over your actual message.
  - Spooky23 11y ago
    No, but they will charge you with something.
    - loup-vaillant 11y ago
      The current wording of the bill states that you have to hand over the keys to data you have encrypted. If the provider doesn't encrypt anything (which is the case with end-to-end encryption), then it doesn't have to hand over anything.
      - jaegerpicker 11y ago
        Sure but that doesn't stop the government from charging me (the sender/receiver) with illegally encrypting communication which the bill looks like it could provide. It's a political problem because NO ONE should be charged with using math. When you consider how badly all computer crime laws are enforced, I think that fighting the bill via political methods is the only safe way forward.
        meric 11y ago

jfoutz 11y ago

Why host in the US?

esbranson 11y ago
Better the devil you know than the devil you don't. The US laws in practice get a lot of exposure and a lot of scrutiny worldwide.
- gozur88 11y ago
  I wonder how true that is. There seems to be a whole lot of people in recent years who've been ordered, by a judge, not to talk about something a three letter agency is doing. In theory that judge is supposed to make sure the law is being followed. My impression, though, is that some judges have a much more expansive view of government power than I think is warranted.
rodgerd 11y ago
Where are you going to host, then? None of the Five Eyes countries, so that rules out the UK, Canada, New Zealand, Australia. (Indeed, New Zealand is ahead of the totalitarian curve here, with proposals to give blanket exemptions to any law broken by the security services as long as they claim they had a good faith belief they needed to). France? Much worse history on encryption than the US. Germany? Officially better, but the intelligence services have been revealed to be essentially ignoring German law when it gets in the way of working with their US counterparts. And so on and so forth.

dredmorbius 11y ago

I say both. Governments can be limited by legal constructs. Non-governmental actors, or government actors from other jurisdictions, cannot. Crypto and legislative reform are mutually reinforcing bulwarks.

thegenius2000 11y ago

Then open source the system from the beginning, so you literally lack the ability to insert secret backdoors.