4 ms·

Your talk was excellent, kudos to you for being willing to present a controversial idea to an audience that is instinctively hostile to any intentional weakenin

Your talk was excellent, kudos to you for being willing to present a controversial idea to an audience that is instinctively hostile to any intentional weakening of crypto. It was certainly a hot topic at lunch. My primary concern and others’ was that strong crypto is already out there and can’t ever be taken away. I understand that you’re choosing to hand-wave over this for the sake of bringing a novel idea to the table, but I’d say it’s a fundamental flaw that can only be addressed by not only outlawing strong crypto in every country, but also finding a way to prevent criminals from implementing and using algorithms that have been known for a while now. That seems, to say the least, quite hard.

cvwright 9y ago
Thanks for the kind words. We're trying to get a productive discussion started, so hopefully we can reduce the risk of ever getting stuck with something truly horrible like mandated backdoors or key escrow. Re: strong crypto can't be taken away - That's very true. I guess it depends on what threat model Wray is hoping to go after. At least until a few years ago, the terrorists weren't even using encryption -- they were posting publicly about their upcoming attacks on Facebook! There was this awkward period of a couple of years where, after every attack, the authorities would claim there was encryption preventing them from stopping the attack. Then some days later, we came to find out that the attacker was already known to them and had been communicating in the clear! So I think if Signal, WhatsApp, Telegram, ..., all moved to some very-very-expensive-but-breakable model, that would cover most of the guys doing knife and gun attacks, truck bombs, etc. in the real world.
- naasking 9y ago
  > So I think if Signal, WhatsApp, Telegram, ..., all moved to some very-very-expensive-but-breakable model, that would cover most of the guys doing knife and gun attacks, truck bombs, etc. in the real world. Doubtful. There are enough privacy obsessed computer scientists that oprn source, secure alternatives would soon crop up. Then you're criminalizing perfectly legal behaviour (programming) just because it indirectly might help some criminals.
  - cvwright 9y ago
    Who said anything about criminalizing it? Most people are going to use whatever is easiest and/or most popular. The same forces that make it hard to get all your friends onto Signal would also make it hard for violent people to use something new. https://en.wikipedia.org/wiki/Nudge_%28book%29 https://en.wikipedia.org/wiki/Nudge_%28book%29 (Not that I think the Signal team would ever go for any kind of weakened security, unless it was an absolutely final last resort.)
    - naasking 9y ago
      > Most people are going to use whatever is easiest and/or most popular Because if these measures were taken, it would become common knowledge, and criminals would just switch to what's safer for their coordination. It may cast suspicion on anyone using these services, but that's not really enough.

cvwright 9y ago

Thanks for the kind words. We're trying to get a productive discussion started, so hopefully we can reduce the risk of ever getting stuck with something truly horrible like mandated backdoors or key escrow. Re: strong crypto can't be taken away - That's very true. I guess it depends on what threat model Wray is hoping to go after. At least until a few years ago, the terrorists weren't even using encryption -- they were posting publicly about their upcoming attacks on Facebook! There was this awkward period of a couple of years where, after every attack, the authorities would claim there was encryption preventing them from stopping the attack. Then some days later, we came to find out that the attacker was already known to them and had been communicating in the clear! So I think if Signal, WhatsApp, Telegram, ..., all moved to some very-very-expensive-but-breakable model, that would cover most of the guys doing knife and gun attacks, truck bombs, etc. in the real world.

naasking 9y ago
> So I think if Signal, WhatsApp, Telegram, ..., all moved to some very-very-expensive-but-breakable model, that would cover most of the guys doing knife and gun attacks, truck bombs, etc. in the real world. Doubtful. There are enough privacy obsessed computer scientists that oprn source, secure alternatives would soon crop up. Then you're criminalizing perfectly legal behaviour (programming) just because it indirectly might help some criminals.
- cvwright 9y ago
  Who said anything about criminalizing it? Most people are going to use whatever is easiest and/or most popular. The same forces that make it hard to get all your friends onto Signal would also make it hard for violent people to use something new. https://en.wikipedia.org/wiki/Nudge_%28book%29 https://en.wikipedia.org/wiki/Nudge_%28book%29 (Not that I think the Signal team would ever go for any kind of weakened security, unless it was an absolutely final last resort.)
  - naasking 9y ago
    > Most people are going to use whatever is easiest and/or most popular Because if these measures were taken, it would become common knowledge, and criminals would just switch to what's safer for their coordination. It may cast suspicion on anyone using these services, but that's not really enough.