4 ms·

> Just like they control the sale of explosives, for public security, they can also require Microsoft, Apple and Google to put in a master-key. And I don't see

> Just like they control the sale of explosives, for public security, they can also require Microsoft, Apple and Google to put in a master-key. And I don't see a problem with that. The problem is that there's no good way to control that master key. What do you do with it? Lock it on an encrypted USB drive in a fire proof safe bolted to the floor under the google headquarters? That works until a police agency wants to use it. And then another. How many people do you think you can reasonably give this key to before someone who isn't "supposed" to have it gets their hands on it? What happens when a criminal gets his hands on the master key that unlocks every encryption made by apple, google and microsoft?

Asooka 9y ago
Regulate encryption like you regulate heavy weapons. You can carry a gun, but you can't carry an assault rifle. But you can get special permission for special cases. Yes, the master key for your SMSes will be leaked pretty quickly, but every business with a legitimate use for encryption will be able to use it. In the end your bank account will not get hacked, terrorists will continue using strong encryption, but law enforcement will be pacified.
- indymike 9y ago
  Regulating math is not something that usually has a good outcome. See the 1897 Indiana Pi Law for a good lesson in unintended consequences. https://en.wikipedia.org/wiki/Indiana_Pi_Bill https://en.wikipedia.org/wiki/Indiana_Pi_Bill
- andrewaylett 9y ago
  Didn't the US try that one already?
  - berbec 9y ago
    I believe so: https://en.m.wikipedia.org/wiki/Clipper_chip https://en.m.wikipedia.org/wiki/Clipper_chip
    - andrewaylett 9y ago
      I was thinking more of https://en.wikipedia.org/wiki/Pretty_Good_Privacy#Criminal_investigation https://en.wikipedia.org/wiki/Pretty_Good_Privacy#Criminal_i..., actually, but that's a good example too.
- mikeash 9y ago
  You can't take a gun, put it into a machine, push a button, and have the machine make you a million guns. If you could, gun control would go from difficult and incomplete to downright impossible. That's how encryption is now.
  - CrazyPyroLinux 9y ago
    Are you familiar with Defense Distributed, DEFCAD, and the Ghost Gunner? That stuff is already here. Every time I hear someone talk about banning "high capacity magazines" I think how trivial something like that is to 3d print...
    - mikeash 9y ago
      I've heard about them a little. This stuff is definitely getting easier, but there's still a world of difference between the difficulty of replicating a gun and the difficulty of replicating a copy of crypto code.
- Sir_Cmpwn 9y ago
  Until you can kill someone with encryption this is absolute bullshit FUD. Are you a paid shill?
- pjc50 9y ago
  "every business with a legitimate use for encryption" is "every business" (SSL and SSH, remember?). "Every business" is "every person", given sole corporations. > In the end your bank account will not get hacked Equifax are still trying to explain to congress whether or not they are encrypting data: https://www.wsj.com/articles/equifax-ceo-to-congress-not-sure-we-are-encrypting-data-1510180486 https://www.wsj.com/articles/equifax-ceo-to-congress-not-sur... > terrorists will continue using strong encryption Terrorists don't generally use encryption, surprisingly. There have been very few incidents recently where the authorities have found themselves with data they were unable to decrypt that might be relevant. The only one I can think of is https://en.wikipedia.org/wiki/2015_San_Bernardino_attack https://en.wikipedia.org/wiki/2015_San_Bernardino_attack
- revmoo 9y ago
  Hi, this is not how encryption works. Please go read up on the subject before participating in this discussion.
- mediocrejoker 9y ago
  Many banks send 2FA codes via SMS, so I question how my bank account will not get hacked if the master key for SMSes gets leaked "pretty quickly".
- chiph 9y ago
  > Regulate encryption like you regulate heavy weapons. They were at one time. Encryption was regulated under the ITAR laws until 1997. https://en.wikipedia.org/wiki/International_Traffic_in_Arms_Regulations https://en.wikipedia.org/wiki/International_Traffic_in_Arms_...

Asooka 9y ago

Regulate encryption like you regulate heavy weapons. You can carry a gun, but you can't carry an assault rifle. But you can get special permission for special cases. Yes, the master key for your SMSes will be leaked pretty quickly, but every business with a legitimate use for encryption will be able to use it. In the end your bank account will not get hacked, terrorists will continue using strong encryption, but law enforcement will be pacified.

indymike 9y ago
Regulating math is not something that usually has a good outcome. See the 1897 Indiana Pi Law for a good lesson in unintended consequences. https://en.wikipedia.org/wiki/Indiana_Pi_Bill https://en.wikipedia.org/wiki/Indiana_Pi_Bill
andrewaylett 9y ago
Didn't the US try that one already?
- berbec 9y ago
  I believe so: https://en.m.wikipedia.org/wiki/Clipper_chip https://en.m.wikipedia.org/wiki/Clipper_chip
  - andrewaylett 9y ago
    I was thinking more of https://en.wikipedia.org/wiki/Pretty_Good_Privacy#Criminal_investigation https://en.wikipedia.org/wiki/Pretty_Good_Privacy#Criminal_i..., actually, but that's a good example too.
mikeash 9y ago
You can't take a gun, put it into a machine, push a button, and have the machine make you a million guns. If you could, gun control would go from difficult and incomplete to downright impossible. That's how encryption is now.
- CrazyPyroLinux 9y ago
  Are you familiar with Defense Distributed, DEFCAD, and the Ghost Gunner? That stuff is already here. Every time I hear someone talk about banning "high capacity magazines" I think how trivial something like that is to 3d print...
  - mikeash 9y ago
    I've heard about them a little. This stuff is definitely getting easier, but there's still a world of difference between the difficulty of replicating a gun and the difficulty of replicating a copy of crypto code.
Sir_Cmpwn 9y ago
Until you can kill someone with encryption this is absolute bullshit FUD. Are you a paid shill?
pjc50 9y ago
"every business with a legitimate use for encryption" is "every business" (SSL and SSH, remember?). "Every business" is "every person", given sole corporations. > In the end your bank account will not get hacked Equifax are still trying to explain to congress whether or not they are encrypting data: https://www.wsj.com/articles/equifax-ceo-to-congress-not-sure-we-are-encrypting-data-1510180486 https://www.wsj.com/articles/equifax-ceo-to-congress-not-sur... > terrorists will continue using strong encryption Terrorists don't generally use encryption, surprisingly. There have been very few incidents recently where the authorities have found themselves with data they were unable to decrypt that might be relevant. The only one I can think of is https://en.wikipedia.org/wiki/2015_San_Bernardino_attack https://en.wikipedia.org/wiki/2015_San_Bernardino_attack
revmoo 9y ago
Hi, this is not how encryption works. Please go read up on the subject before participating in this discussion.
mediocrejoker 9y ago
Many banks send 2FA codes via SMS, so I question how my bank account will not get hacked if the master key for SMSes gets leaked "pretty quickly".
chiph 9y ago
> Regulate encryption like you regulate heavy weapons. They were at one time. Encryption was regulated under the ITAR laws until 1997. https://en.wikipedia.org/wiki/International_Traffic_in_Arms_Regulations https://en.wikipedia.org/wiki/International_Traffic_in_Arms_...