4 ms·

No its not. The reality is the biggest threat to privacy is due to political engagement. Stronger encryption that no one can break is really the only viable opt

No its not. The reality is the biggest threat to privacy is due to political engagement. Stronger encryption that no one can break is really the only viable option.

noenpnqnoen 10y ago
- Written by Poul-Henning Kamp - In a section called The Bike Shed This link is related: https://www.freebsd.org/doc/en_US.ISO8859-1/books/faq/misc.html#idp64924272 https://www.freebsd.org/doc/en_US.ISO8859-1/books/faq/misc.h...
theandrewbailey 10y ago
Political engagement is a very good tool to keep political engagement in check. Political engagement can make strong crypto illegal to use, or mandate a state MITM[0]; neither are viable or effective at anything, but those inconveniences aren't going to stop their implementation. [0] Almost happened in the USA: https://en.wikipedia.org/wiki/Clipper_chip https://en.wikipedia.org/wiki/Clipper_chip
mirhagk 10y ago
That won't solve the problem > Slapping unbreakable crypto onto more and more packets is just going to make matters worse > > The IT and networking communities overlooked a wise saying from soldiers and police officers: "Make sure the other side has an easier way out than destroying you." Who is developing this stronger encryption? The development of encryption has a huge incentive to build backdoors for payouts by government or corporate or worse groups. Then you have the people implementing the encryption that could also introduce backdoors (who knows if heartbleed was intentional or not). Then you have lots of other ways to backdoor the system, from default software installs, viruses, or even compiler or CPU backdooring. There is no such thing as a system that has perfect security. Even if you build everything yourself and are perfect at doing so, the tools you use could easily have backdoors. By increasing usage of encryption for more and more mundane things all we're doing is increasing the incentive to break that encryption.
stinkytaco 10y ago
I totally disagree. Political and social solutions prevailed in our physical space during the 60s and 70s with the expansion of rights related to search and seizure and the statement of rights to those who are unaware of them. There is precedent for social engagement here. And remember, all encryption is susceptible to rubber hose cryptography. There needs to be a two pronged approach here.
- nathanlied 10y ago
  Not all encryption. There is such a thing as self-destructing data/keys. Once it's gone, it cannot be recovered, even if your life is threatened and you really don't want to die. Whether you're willing to go that far for your data or not is up to you, though.
venomsnake 10y ago
You don't need to break the strong encryption, when you can break the kneecaps of people using strong encryption.
- hx87 10y ago
  Breaking kneecaps is expensive though. You can't just set up a ring of roadblocks around a city that kneecaps everyone passing through as a matter of course.
  - dragonwriter 10y ago
    > Breaking kneecaps is expensive though. You can't just set up a ring of roadblocks around a city that kneecaps everyone passing through as a matter of course. Once you establish the willingness to break kneecaps, the number of kneecaps you actually need to break is fairly small.
    - hx87 10y ago
      That's true if determining whose kneecaps you need to break is either trivial (e.g. open dissidents and protesters) or can be easily achieved using social engineering (e.g. anonymous print pamphleteers). If doing so is a /technical/ rather than social task, and your technical cryptanalysis isn't up to par, breaking kneecaps is much less powerful of a deterrent because your hit rate will be very low. Breaking kneecaps to deter the use of encryption itself is another matter though.
- Aelinsaar 10y ago
  Broken kneecaps speak for themselves, "I was tased, and it REALLY hurt! I was terrified and alone in the cold and dark, naked, for hours, I thought I was going to die many times!" is... harder to understand and harder to prove.
- alephnil 10y ago
  If you break someones kneecaps, you may get the information they have, but you will never get anything more. After that they and their whole network will take precautions, even going as far as never communicating electronically if required. Such bullying may also easily backfire, which limits its use. A broken communication channel in contrast is the gift that keep giving. You can get up to date information that the opponent think is confidential as it happens, and they will not take precautions, and you can continue to use the information against them, giving you the upper hand. This is why NSA was so determined to keep their actions hidden.
phkamp 10y ago
You fail to grasp the key point here: If the state cannot break your encryption, they will break you instead.
- mamon 10y ago
  Which makes your whole argument sound like: "I'm such a coward! Please take my private data, just don't hurt me!" Belive it or not, but some people actually have balls to fight evil governments.
  - Semiapies 10y ago
    Really, it struck me as escalating to an implicit threat. Don't do anything that would actually undermine efforts at mass surveillance, like promote mass use of encryption, or something will happen to you.
- theandrewbailey 10y ago
  In other words: https://www.xkcd.com/538/ https://www.xkcd.com/538/

No its not. The reality is the biggest threat to privacy is due to political engagement. Stronger encryption that no one can break is really the only viable option.

noenpnqnoen 10y ago

- Written by Poul-Henning Kamp - In a section called The Bike Shed This link is related: https://www.freebsd.org/doc/en_US.ISO8859-1/books/faq/misc.html#idp64924272 https://www.freebsd.org/doc/en_US.ISO8859-1/books/faq/misc.h...

theandrewbailey 10y ago

Political engagement is a very good tool to keep political engagement in check. Political engagement can make strong crypto illegal to use, or mandate a state MITM[0]; neither are viable or effective at anything, but those inconveniences aren't going to stop their implementation. [0] Almost happened in the USA: https://en.wikipedia.org/wiki/Clipper_chip https://en.wikipedia.org/wiki/Clipper_chip

mirhagk 10y ago

That won't solve the problem > Slapping unbreakable crypto onto more and more packets is just going to make matters worse > > The IT and networking communities overlooked a wise saying from soldiers and police officers: "Make sure the other side has an easier way out than destroying you." Who is developing this stronger encryption? The development of encryption has a huge incentive to build backdoors for payouts by government or corporate or worse groups. Then you have the people implementing the encryption that could also introduce backdoors (who knows if heartbleed was intentional or not). Then you have lots of other ways to backdoor the system, from default software installs, viruses, or even compiler or CPU backdooring. There is no such thing as a system that has perfect security. Even if you build everything yourself and are perfect at doing so, the tools you use could easily have backdoors. By increasing usage of encryption for more and more mundane things all we're doing is increasing the incentive to break that encryption.

stinkytaco 10y ago

I totally disagree. Political and social solutions prevailed in our physical space during the 60s and 70s with the expansion of rights related to search and seizure and the statement of rights to those who are unaware of them. There is precedent for social engagement here. And remember, all encryption is susceptible to rubber hose cryptography. There needs to be a two pronged approach here.

nathanlied 10y ago
Not all encryption. There is such a thing as self-destructing data/keys. Once it's gone, it cannot be recovered, even if your life is threatened and you really don't want to die. Whether you're willing to go that far for your data or not is up to you, though.

venomsnake 10y ago

You don't need to break the strong encryption, when you can break the kneecaps of people using strong encryption.

hx87 10y ago
Breaking kneecaps is expensive though. You can't just set up a ring of roadblocks around a city that kneecaps everyone passing through as a matter of course.
- dragonwriter 10y ago
  > Breaking kneecaps is expensive though. You can't just set up a ring of roadblocks around a city that kneecaps everyone passing through as a matter of course. Once you establish the willingness to break kneecaps, the number of kneecaps you actually need to break is fairly small.
  - hx87 10y ago
    That's true if determining whose kneecaps you need to break is either trivial (e.g. open dissidents and protesters) or can be easily achieved using social engineering (e.g. anonymous print pamphleteers). If doing so is a /technical/ rather than social task, and your technical cryptanalysis isn't up to par, breaking kneecaps is much less powerful of a deterrent because your hit rate will be very low. Breaking kneecaps to deter the use of encryption itself is another matter though.
Aelinsaar 10y ago
Broken kneecaps speak for themselves, "I was tased, and it REALLY hurt! I was terrified and alone in the cold and dark, naked, for hours, I thought I was going to die many times!" is... harder to understand and harder to prove.
alephnil 10y ago
If you break someones kneecaps, you may get the information they have, but you will never get anything more. After that they and their whole network will take precautions, even going as far as never communicating electronically if required. Such bullying may also easily backfire, which limits its use. A broken communication channel in contrast is the gift that keep giving. You can get up to date information that the opponent think is confidential as it happens, and they will not take precautions, and you can continue to use the information against them, giving you the upper hand. This is why NSA was so determined to keep their actions hidden.

phkamp 10y ago

You fail to grasp the key point here: If the state cannot break your encryption, they will break you instead.

mamon 10y ago
Which makes your whole argument sound like: "I'm such a coward! Please take my private data, just don't hurt me!" Belive it or not, but some people actually have balls to fight evil governments.
- Semiapies 10y ago
  Really, it struck me as escalating to an implicit threat. Don't do anything that would actually undermine efforts at mass surveillance, like promote mass use of encryption, or something will happen to you.
theandrewbailey 10y ago
In other words: https://www.xkcd.com/538/ https://www.xkcd.com/538/