8 ms·

OP here, I ran across this from the Cyberlaw Podcast notes[0]. Their brief description of it is why I thought it'd be interesting for the HN crowd: >The Natio

OP here, I ran across this from the Cyberlaw Podcast notes[0]. Their brief description of it is why I thought it'd be interesting for the HN crowd: >The National Academy report on encryption access has demonstrated that access is well within the zone of plausible technology policy, with support from a group of prominent tech experts, such as Ray Ozzie, all of whom know math. I certainly don't agree with that statement, but I'm a long way from a cryptographer or security expert. I'm mostly looking forward to the EFF refutation, though I'm a little surprised it isn't already up... [0] http://reason.com/volokh/2018/04/02/keeper-loser-weeper http://reason.com/volokh/2018/04/02/keeper-loser-weeper

michaelt 9y ago
It's possible to design a system that lets the government decrypt (essentially) everything. The same technology that lets you send a PGP e-mail with two recipients allows you to send a message that can be decrypted by the NSA as well as your recipient. What's not possible is protecting against bad actors within government; preventing the oppressive governments from insisting on the same powers, allowing them to further oppress their citizens; and eliminating the backdoor-free encryption that evildoers will instantly move over to, which has to be eliminated if trained terrorists are the true targets of the back doors. But it's possible legislators don't care about these issues as much as freedom advocates do.
- cesarb 9y ago
  > It's possible to design a system that lets the government decrypt (essentially) everything. The same technology that lets you send a PGP e-mail with two recipients allows you to send a message that can be decrypted by the NSA as well as your recipient. It's not that simple. That "solution" has the government key as a single point of failure: when it leaks, everything is compromised.
  - michaelt 9y ago
    So put it in a Hardware Security Module [1] and store it in Fort Knox. Competent certificate authorities manage to store their private keys and not leak them. And the security community loves SSL, even though it depends on that. [1] https://en.wikipedia.org/wiki/Hardware_security_module https://en.wikipedia.org/wiki/Hardware_security_module
Arnt 9y ago
You don't need crypto or security expertise, just rhetoric. What are they not mentioning? AFAICT "a backdoor" vs. "a backdoor that gives the FBI access while keeping both Putin and El Chapo out, and works on phones bought via mail order from China".
saas_co_de 9y ago
The debate about "technical plausibility" should not even be on the table. Nowhere under US law does the government have any right to mandate that individuals must communicate via mediums that allow for surveillance. The idea that such a government right exists is absurd. Maybe the NSA and CIA should figure out how to secure their own illegal digital operations first and then get back to this when they have less pressing matters on their hands.
_emacsomancer_ 9y ago
The writing style of the Cyberlaw Podcast certainly makes it hard to take them seriously: > ...but by the collapse of the left-lib claim that building law enforcement access into IT devices is impossible because, uh, math. Except no-one is claiming that building law enforcement access into IT devices is impossible because of mathematics. The claim is that there is no way of doing so that doesn't create a general vulnerability.

michaelt 9y ago

It's possible to design a system that lets the government decrypt (essentially) everything. The same technology that lets you send a PGP e-mail with two recipients allows you to send a message that can be decrypted by the NSA as well as your recipient. What's not possible is protecting against bad actors within government; preventing the oppressive governments from insisting on the same powers, allowing them to further oppress their citizens; and eliminating the backdoor-free encryption that evildoers will instantly move over to, which has to be eliminated if trained terrorists are the true targets of the back doors. But it's possible legislators don't care about these issues as much as freedom advocates do.

cesarb 9y ago
> It's possible to design a system that lets the government decrypt (essentially) everything. The same technology that lets you send a PGP e-mail with two recipients allows you to send a message that can be decrypted by the NSA as well as your recipient. It's not that simple. That "solution" has the government key as a single point of failure: when it leaks, everything is compromised.
- michaelt 9y ago
  So put it in a Hardware Security Module [1] and store it in Fort Knox. Competent certificate authorities manage to store their private keys and not leak them. And the security community loves SSL, even though it depends on that. [1] https://en.wikipedia.org/wiki/Hardware_security_module https://en.wikipedia.org/wiki/Hardware_security_module

Arnt 9y ago

You don't need crypto or security expertise, just rhetoric. What are they not mentioning? AFAICT "a backdoor" vs. "a backdoor that gives the FBI access while keeping both Putin and El Chapo out, and works on phones bought via mail order from China".

saas_co_de 9y ago

The debate about "technical plausibility" should not even be on the table. Nowhere under US law does the government have any right to mandate that individuals must communicate via mediums that allow for surveillance. The idea that such a government right exists is absurd. Maybe the NSA and CIA should figure out how to secure their own illegal digital operations first and then get back to this when they have less pressing matters on their hands.

_emacsomancer_ 9y ago

The writing style of the Cyberlaw Podcast certainly makes it hard to take them seriously: > ...but by the collapse of the left-lib claim that building law enforcement access into IT devices is impossible because, uh, math. Except no-one is claiming that building law enforcement access into IT devices is impossible because of mathematics. The claim is that there is no way of doing so that doesn't create a general vulnerability.