4 ms·
I think Patrick Gray's essay actually adds more confusion. His effort to clarify the confusion by differentiating the layers between "metadata" vs "encryption"
by jasode 9y ago
I think Patrick Gray's essay actually adds more confusion. His effort to clarify the confusion by differentiating the layers between "metadata" vs "encryption" is technically correct but the extra details ends up obscuring what governments want: cleartext
Yes, I agree with Patrick that framing the arguments on "math of encryption" is misguided. Yes, it leads to thinking that legislators are stupid similar to trying to pass a bill to redefine the value of pi.[1]
Let's be clear.... the lawmakers actually don't care if the most powerful supercomputers at NSA/GCHAQ can't crack WhatsApp's latest 2048-bit-quantum-elliptical-encryption used in conjunction with Apple iOS tamperproof enclave chip.
All that math doesn't matter. It's a mistake to think that government is retarded because "math is irreversible". That smugness makes people lose sight of the ultimate goal: the cleartext.
If getting that cleartext means new laws that require all Android/Apple phones include a software keyboard interceptor (the onscreen keyboard) to log keystrokes and send the cleartext to a government server, then so be it. Such a keystroke logger would then make the "irreversible math" a moot point.
Tldr: Don't frame the policy in terms of "encryption". Instead, focus on the "cleartext".
>The first problem actually has very little to do with end-to-end encryption and a lot more to do with access to messaging metadata.
This is true, but it's misleading because we know that governments eventually want more than the just the metadata.
>Now it’s all very well and good for WhatsApp to argue that it doesn’t have the technical means to do so, which is a response that has lead to all sorts of tangles in Brazil’s courts, but the Australian law will simply say “we don’t care. Get them.”.
This line dances close to what we really should be discussing (the cleartext). If you find yourself grumbling "the government wants to weaken encryption!", it means you're thinking like a computer scientist. On the other hand if you imagine, "if there was a new algorithm for _stronger encryption_ but it didn't matter because all the cleartext was available for monitoring", it means you're thinking like the government.
>Do we believe that law enforcement bodies should have the authority to monitor the communications of people suspected of serious criminal offences?
This question is another way of framing it which is closer to the aims of the government. They want to monitor the cleartext.
[1] https://en.wikipedia.org/wiki/Indiana_Pi_Bill https://en.wikipedia.org/wiki/Indiana_Pi_Bill
- resf 9y agoAnybody who cares about the privacy of their communication can still use an open source stack. So yes it works as a tool for oppression and for catching extremely inept criminals, but it doesn't do much else for national security.
- CJefferson 9y agoWhen using an open source stack to do illegal encryption leads to XX years in prison, not many people will use it.
- ams6110 9y agoThere's something in cryptology called "plausible deniability" that addresses this.
- PeterisP 9y agoPlausible deniability only works if any doubts are actually interpreted in your favor (which, as history shows, isn't guaranteed in practice even in legal systems where it should be in theory), and it's easily possible to make laws that turn most practical options into crimes. Yes, it's plausible that the non-approved software stack on your phone isn't doing any illegal encryption, but that fails if having non-approved OS on your phone a crime by itself. Yes, it's plausible that the TrueCrypt volume you have doesn't contain anything bad, but that fails if mere possession of TrueCrypt tools is a crime by itself. Yes, it's plausible that the encrypted traffic sent to/from your phone didn't contain anything bad, but that fails if having any encrypted traffic not going through state-approved MITM https is a crime by itself. Etc ad infinitum. Don't underestimate the coercive power of gov't if they actually want to restrict something. Technical means can protect you only if you physically live outside of their reach.
- grumio 9y agoThey may as well ban all files of random data of unknown origin. If it passes diehard tests with flying colors, confiscate it and arrest all known possessors of it.