3 ms·

Lets say I grant everything you say about the danger to every Alice and Bob that a master key exists. The question is, can policies be enacted and systems put i

Lets say I grant everything you say about the danger to every Alice and Bob that a master key exists. The question is, can policies be enacted and systems put into place that provide a commensurate amount of security for the risk the backdoor key poses? It seems plausible that it can be. But this is the conversation that needs to happen, not the boneheaded claim that its "mathematically impossible" to have a secure system with a backdoor. It's plausible that a system can be "secure" under appropriate definitions while having such a backdoor mechanism. If the analysis shows its not possible in practice, then that's fine as well. But we have to actually do the analysis.

AnthonyMouse 9y ago
> The question is, can policies be enacted and systems put into place that provide a commensurate amount of security for the risk the backdoor key poses? It seems plausible that it can be. It's plausible that the government can permanently keep a key to every lock secure against every attacker? That is such a ridiculous claim that just skipping right to "no, that's impossible" is a completely reasonable thing to do. But we can do the analysis if you really want to. Look at the other things the government has tried really hard to protect. Nuclear secrets? Nope. https://en.wikipedia.org/wiki/Atomic_spies https://en.wikipedia.org/wiki/Atomic_spies The government has actually lost hydrogen bombs on multiple separate occasions. Not the secrets, the actual live thermonuclear weapons. The things that one of which can turn all of D.C. into radioactive glass. What about all the sensitive information about the people with security clearances? https://en.wikipedia.org/wiki/Office_of_Personnel_Management_data_breach https://en.wikipedia.org/wiki/Office_of_Personnel_Management... Incredibly dangerous biological materials ("arguably the most deadly disease ever to affect mankind")? https://www.npr.org/2014/07/08/329884145/in-a-lab-store-room-an-unsettling-surprise-lost-vials-of-smallpox https://www.npr.org/2014/07/08/329884145/in-a-lab-store-room... Classified information in general? The list of violations is too long to even enumerate. And this is what happens when the thing they're supposed to be protecting doesn't have incomprehensibly large commercial value on the black market. There is no question that they are not capable of doing this.
- hackinthebochs 9y ago
  This is just lazy. A string of bits that only need to be accessed behind closed doors isn't like any of those other things. What's more, that secret room can be secured arbitrarily well.
  - AnthonyMouse 9y ago
    Most of those other things are a string of bits that only needs to be accessed behind closed doors. And it's not like a smallpox lab is open to the public either. You can devise a defense against any attack you can think of, but for a trillion dollar prize someone will find an attack you didn't think of. And that's the problem. You can say the words "secured arbitrarily well" but in practice you've created a room with the keys to the world in it and your first indication that your security was insufficient is an incalculable catastrophe. It's like creating a button that gives anyone who presses it three wishes but destroys North America. "Don't worry, we'll put some guards around it" doesn't cut it. Some things need to just not exist.

AnthonyMouse 9y ago

> The question is, can policies be enacted and systems put into place that provide a commensurate amount of security for the risk the backdoor key poses? It seems plausible that it can be. It's plausible that the government can permanently keep a key to every lock secure against every attacker? That is such a ridiculous claim that just skipping right to "no, that's impossible" is a completely reasonable thing to do. But we can do the analysis if you really want to. Look at the other things the government has tried really hard to protect. Nuclear secrets? Nope. https://en.wikipedia.org/wiki/Atomic_spies https://en.wikipedia.org/wiki/Atomic_spies The government has actually lost hydrogen bombs on multiple separate occasions. Not the secrets, the actual live thermonuclear weapons. The things that one of which can turn all of D.C. into radioactive glass. What about all the sensitive information about the people with security clearances? https://en.wikipedia.org/wiki/Office_of_Personnel_Management_data_breach https://en.wikipedia.org/wiki/Office_of_Personnel_Management... Incredibly dangerous biological materials ("arguably the most deadly disease ever to affect mankind")? https://www.npr.org/2014/07/08/329884145/in-a-lab-store-room-an-unsettling-surprise-lost-vials-of-smallpox https://www.npr.org/2014/07/08/329884145/in-a-lab-store-room... Classified information in general? The list of violations is too long to even enumerate. And this is what happens when the thing they're supposed to be protecting doesn't have incomprehensibly large commercial value on the black market. There is no question that they are not capable of doing this.

hackinthebochs 9y ago
This is just lazy. A string of bits that only need to be accessed behind closed doors isn't like any of those other things. What's more, that secret room can be secured arbitrarily well.
- AnthonyMouse 9y ago
  Most of those other things are a string of bits that only needs to be accessed behind closed doors. And it's not like a smallpox lab is open to the public either. You can devise a defense against any attack you can think of, but for a trillion dollar prize someone will find an attack you didn't think of. And that's the problem. You can say the words "secured arbitrarily well" but in practice you've created a room with the keys to the world in it and your first indication that your security was insufficient is an incalculable catastrophe. It's like creating a button that gives anyone who presses it three wishes but destroys North America. "Don't worry, we'll put some guards around it" doesn't cut it. Some things need to just not exist.