7 ms·

I think it has become abundantly clear that a fully peer to peer, encryption required (non-optional), no single central server infrastructure solution is the an

I think it has become abundantly clear that a fully peer to peer, encryption required (non-optional), no single central server infrastructure solution is the answer. No points to tap. No point in tapping the data. If they want to capture conversations it's time to go back to the proper old ways of actually spying on high-value targets.

paulcole 8y ago
Isn’t this what Slack is?
- codemac 8y ago
  It's my recollection that Slack is emphatically not p2p, has that changed?
- fuzzybeard 8y ago
  Slack is multi-tenant hosted SaaS. Single point of failure.
- Arubis 8y ago
  Slack literally stands for Searchable Log of All Content and Knowledge. It’s incredibly useful and transformative for what it is. It’s about the furthest thing possible from private.
  - paulcole 8y ago
    OK, this is all news to me. I have to go delete a bunch of stuff.
- dboreham 8y ago
  You're thinking of Signal.
ribosometronome 8y ago
Moving away from a centralized infrastructure and having fully P2P doesn't necessarily mean there's no points to tap, does it? It's just mildly more difficult than a subpoena to Facebook asking for all messages.
- ethbro 8y ago
  I believe it's substantially more difficult, legally. CALEA for data-in-transit and judicial interpetations for data-at-rest mean it isn't as strictly protected as personally-controlled data. So it's definitely covered by a different legal regime, to set aside the technical bits.
tomatotomato37 8y ago
This is a case of the government trying to force Facebook to essentially strip out their technology; saying technology is the solution here is kinda ignorant of the actual issue
- seorphates 8y ago
  Is it? You kind of lost me. Isn't the actual issue math?
  - tomatotomato37 8y ago
    The issue is the government wanting to strip the encryption going forward. In other words, even the most decentralized & encrypted app can still have NSA_RemoteConn.Log(dat) written into it's source code
    - noobermin 8y ago
      Stripping encryption is one thing, sure. But for the backdoor, you'd have to have the clients phone nsaserv.spy/writeremoteconnlog then or sure, write some record on the client's device. You can't "tap" encrypted communications unless you can figure out how to factor integers then you'd get a Field's medal. Or, ofc, get people to adopt insecure protocols. That we know (or have good suspicion) they've tried.
  - madeofpalk 8y ago
    The issue is laws. A country that's going to mandate backdoors/access to such communications, are going to outlaw communication methods they can't backdoor. Say Apple makes a federated end-to-end encrypted messenger app, the government will still go to Apple and say "let us read all the messages, otherwise you can't sell your devices". THAT is the problem, and it can't be solved by more technology and shouting "BLOCKCHAIN!"
    - joe_the_user 8y ago
      Laws are an issue and enforceability is an issue. If a largish group of users could create end-to-end encryption not with a single company but with "readily available materials", then stopping it could be harder. So it's a combination of state dictate and the practical ability of users to defy that. This isn't saying I'm optimistic, I'm rather pessimistic on any ability of a wide home-grown encrypted-messaging milieu to appear - if few are aiming for this, those few can easily be picked-off. But I don't think we should just give up on any part of this.
wpdev_63 8y ago
Keep in mind they do have the infrastructure in place(carriers and oems) to directly tap on cellphones. While a federated encrypted chat services are a step in the right direction, we won't get truly 'free' communication device until an open source hardware to software solution exists.
joe_the_user 8y ago
Plus a client which is under complete control of the user - a phone could never be and a laptop running Linux with Intel me stripped-out might be if you're lucky.
SN76477 8y ago
Reevaluate the value of the target. I don't know what government is doing snooping on facebook messenger. I would be blindsided if real crime was happening that way.
- javagram 8y ago
  Real crime happens on SMS all the time. Why wouldn’t it happen on Facebook messenger which is one of the most popular SMS replacement apps?
- sergers 8y ago
  BBM was very popular for illicit purposes when it was in its heyday at RIM. People moved onto other messengers like WhatsApp for those purposes. Heck people use snapchat expiring messages to relay info on illicit activities. It is not farfetched at all people are using FB messenger, signal, anything for that purpose.
rootusrootus 8y ago
Or at least something like iMessage, end-to-end encrypted.
- detaro 8y ago
  The article is about the question if the government can force companies to backdoor their end-to-end encrypted apps, so that's not a solution.
deleted 8y ago
[deleted]
partycoder 8y ago
It is not the answer. What are the building blocks for encryption? 1) An cryptographic algorithm 2) Some form of key generation 3) A software implementation of 1) and 2) 4) A binary distribution of 3) 5) A computer that executes 4) In practice, chances are those 5 are all rigged. They are rigged because you have so far trusted: - That there are no tricks in the algorithm or its practical implementation - That there are no tricks in the key generation algorithm or its practical implementation - Hundreds of contributors to the software implementation of those algorithms - The guy that compiled the software into binary form and distributed it - The compiler used to compile the software and all the libraries and dependencies the software has - Hardware manufacturers So, common sense tells me that because you have trusted so many people, in practice, it is very unlikely you can have end-to-end encryption or any real ambition to have privacy. This does not even consider more aspects, like your operating system, your sources of entropy, etc.
- Xcelerate 8y ago
  1-5 have worked so far for Bitcoin.
  - hsienmaneja 8y ago
    What’s stopping those with the capability of subverting bitcoin from choosing not to do so?
    - partycoder 8y ago
      It's a card that they only get to use once per capability, unless it's in a discrete manner.
newnewpdro 8y ago
Even if you got to that level of encryption, the devices themselves forming the Ps in P2P will become the tap points. Nobody has a 100% open smartphone stack from the baseband up to the application.
apatters 8y ago
This discussion should never be framed as a choice between legal solutions and technical solutions. They are complementary. The legal approach is correct and easy for the public to understand. Explained correctly it is also popular. The government used to have to do things like get a warrant and investigate specific crimes. They couldn't listen to everyone's phone conversations all the time and they shouldn't be able to do this on the Internet either. Digital dragnets are illegal and unconstitutional. The technical approach is also correct. If you're building something that makes it harder for criminals inside the government to commit more crimes, you're doing work that is profound and in the best interests of society. Anyone with passion and technical skill can participate in this work. It's the right thing to do. Both efforts help each other. Keep the government in line and accountable to the people. Make it harder for people inside the government to do the wrong thing. All approaches deserve support and should leverage each other's work. They should cooperate with law-abiding, constitutionally empowered government authorities as well. There are good guys in the government too.
- speedplane 8y ago
  Technical and legal solutions are not complementary, they're relatively unrelated. Legal rules addressing behavior are about what we "should" do. Technical rules are about what we "can" do. Technology is about implementation and enforcement, law is about what we consider to be the correct result. But the main place where law and tech come together is enforcement. For law to work at all, it has to be enforced relatively evenly. Technology may make a law's enforcement impossible or easy, but it does not make it more or less "right" in the abstract.
  - drdaeman 8y ago
    > Technical rules are about what we "can" do. And legal is about what recourse we can seek afterwards, when we understand we've messed up the implementation and security had failed. Relying on legal protections alone is absurd. Relying on technology without any legal recourse for failures maybe somewhat less so, but still not suitable for this "real" world we live in. Not without reconsidering our approaches and attitudes to way too many things.
ReverseCold 8y ago
P2P routing is hard (nat bypass only really works on 80-90% of networks which is not good enough and Tor is unviable for mass adoption), and decentralized identifiers are generally not liked by users Other than that, it's doable. Spam protection and censorship (necessary for mobile app stores) can be distributed as opt-out blacklists. If it gets to be a huge problem then a "enter this password to add me" type thing could work too. I've been compiling a bunch of ideas as such for fully P2P decentralized/encrypted chat, but I'm stuck at the two issues I mentioned earlier.
- gmax 8y ago
  Can routing be solved through an intermediary acting like an always-on mailbox? Along the lines of http://cweb-services.com/protocols.html http://cweb-services.com/protocols.html
  - ReverseCold 8y ago
    Using an intermediary would make it not decentralized unfortunately :(
    - gmax 8y ago
      Intermediary is not the best word here. What if you could use a storage infrastructure to implemented a protocol for storing and retrieving packets across NAT and disconnected devices. If the role of storage is similar to the raw networks transport via ISP, then it is not more centralized than using an ISP.

paulcole 8y ago

Isn’t this what Slack is?

codemac 8y ago
It's my recollection that Slack is emphatically not p2p, has that changed?
fuzzybeard 8y ago
Slack is multi-tenant hosted SaaS. Single point of failure.
Arubis 8y ago
Slack literally stands for Searchable Log of All Content and Knowledge. It’s incredibly useful and transformative for what it is. It’s about the furthest thing possible from private.
- paulcole 8y ago
  OK, this is all news to me. I have to go delete a bunch of stuff.
dboreham 8y ago
You're thinking of Signal.

ribosometronome 8y ago

Moving away from a centralized infrastructure and having fully P2P doesn't necessarily mean there's no points to tap, does it? It's just mildly more difficult than a subpoena to Facebook asking for all messages.

ethbro 8y ago
I believe it's substantially more difficult, legally. CALEA for data-in-transit and judicial interpetations for data-at-rest mean it isn't as strictly protected as personally-controlled data. So it's definitely covered by a different legal regime, to set aside the technical bits.

tomatotomato37 8y ago

This is a case of the government trying to force Facebook to essentially strip out their technology; saying technology is the solution here is kinda ignorant of the actual issue

seorphates 8y ago
Is it? You kind of lost me. Isn't the actual issue math?
- tomatotomato37 8y ago
  The issue is the government wanting to strip the encryption going forward. In other words, even the most decentralized & encrypted app can still have NSA_RemoteConn.Log(dat) written into it's source code
  - noobermin 8y ago
    Stripping encryption is one thing, sure. But for the backdoor, you'd have to have the clients phone nsaserv.spy/writeremoteconnlog then or sure, write some record on the client's device. You can't "tap" encrypted communications unless you can figure out how to factor integers then you'd get a Field's medal. Or, ofc, get people to adopt insecure protocols. That we know (or have good suspicion) they've tried.
- madeofpalk 8y ago
  The issue is laws. A country that's going to mandate backdoors/access to such communications, are going to outlaw communication methods they can't backdoor. Say Apple makes a federated end-to-end encrypted messenger app, the government will still go to Apple and say "let us read all the messages, otherwise you can't sell your devices". THAT is the problem, and it can't be solved by more technology and shouting "BLOCKCHAIN!"
  - joe_the_user 8y ago
    Laws are an issue and enforceability is an issue. If a largish group of users could create end-to-end encryption not with a single company but with "readily available materials", then stopping it could be harder. So it's a combination of state dictate and the practical ability of users to defy that. This isn't saying I'm optimistic, I'm rather pessimistic on any ability of a wide home-grown encrypted-messaging milieu to appear - if few are aiming for this, those few can easily be picked-off. But I don't think we should just give up on any part of this.

wpdev_63 8y ago

Keep in mind they do have the infrastructure in place(carriers and oems) to directly tap on cellphones. While a federated encrypted chat services are a step in the right direction, we won't get truly 'free' communication device until an open source hardware to software solution exists.

joe_the_user 8y ago

Plus a client which is under complete control of the user - a phone could never be and a laptop running Linux with Intel me stripped-out might be if you're lucky.

SN76477 8y ago

Reevaluate the value of the target. I don't know what government is doing snooping on facebook messenger. I would be blindsided if real crime was happening that way.

javagram 8y ago
Real crime happens on SMS all the time. Why wouldn’t it happen on Facebook messenger which is one of the most popular SMS replacement apps?
sergers 8y ago
BBM was very popular for illicit purposes when it was in its heyday at RIM. People moved onto other messengers like WhatsApp for those purposes. Heck people use snapchat expiring messages to relay info on illicit activities. It is not farfetched at all people are using FB messenger, signal, anything for that purpose.

rootusrootus 8y ago

Or at least something like iMessage, end-to-end encrypted.

detaro 8y ago
The article is about the question if the government can force companies to backdoor their end-to-end encrypted apps, so that's not a solution.

deleted 8y ago

[deleted]

partycoder 8y ago

It is not the answer. What are the building blocks for encryption? 1) An cryptographic algorithm 2) Some form of key generation 3) A software implementation of 1) and 2) 4) A binary distribution of 3) 5) A computer that executes 4) In practice, chances are those 5 are all rigged. They are rigged because you have so far trusted: - That there are no tricks in the algorithm or its practical implementation - That there are no tricks in the key generation algorithm or its practical implementation - Hundreds of contributors to the software implementation of those algorithms - The guy that compiled the software into binary form and distributed it - The compiler used to compile the software and all the libraries and dependencies the software has - Hardware manufacturers So, common sense tells me that because you have trusted so many people, in practice, it is very unlikely you can have end-to-end encryption or any real ambition to have privacy. This does not even consider more aspects, like your operating system, your sources of entropy, etc.

Xcelerate 8y ago
1-5 have worked so far for Bitcoin.
- hsienmaneja 8y ago
  What’s stopping those with the capability of subverting bitcoin from choosing not to do so?
  - partycoder 8y ago
    It's a card that they only get to use once per capability, unless it's in a discrete manner.

newnewpdro 8y ago

Even if you got to that level of encryption, the devices themselves forming the Ps in P2P will become the tap points. Nobody has a 100% open smartphone stack from the baseband up to the application.

apatters 8y ago

This discussion should never be framed as a choice between legal solutions and technical solutions. They are complementary. The legal approach is correct and easy for the public to understand. Explained correctly it is also popular. The government used to have to do things like get a warrant and investigate specific crimes. They couldn't listen to everyone's phone conversations all the time and they shouldn't be able to do this on the Internet either. Digital dragnets are illegal and unconstitutional. The technical approach is also correct. If you're building something that makes it harder for criminals inside the government to commit more crimes, you're doing work that is profound and in the best interests of society. Anyone with passion and technical skill can participate in this work. It's the right thing to do. Both efforts help each other. Keep the government in line and accountable to the people. Make it harder for people inside the government to do the wrong thing. All approaches deserve support and should leverage each other's work. They should cooperate with law-abiding, constitutionally empowered government authorities as well. There are good guys in the government too.

speedplane 8y ago
Technical and legal solutions are not complementary, they're relatively unrelated. Legal rules addressing behavior are about what we "should" do. Technical rules are about what we "can" do. Technology is about implementation and enforcement, law is about what we consider to be the correct result. But the main place where law and tech come together is enforcement. For law to work at all, it has to be enforced relatively evenly. Technology may make a law's enforcement impossible or easy, but it does not make it more or less "right" in the abstract.
- drdaeman 8y ago
  > Technical rules are about what we "can" do. And legal is about what recourse we can seek afterwards, when we understand we've messed up the implementation and security had failed. Relying on legal protections alone is absurd. Relying on technology without any legal recourse for failures maybe somewhat less so, but still not suitable for this "real" world we live in. Not without reconsidering our approaches and attitudes to way too many things.

ReverseCold 8y ago

P2P routing is hard (nat bypass only really works on 80-90% of networks which is not good enough and Tor is unviable for mass adoption), and decentralized identifiers are generally not liked by users Other than that, it's doable. Spam protection and censorship (necessary for mobile app stores) can be distributed as opt-out blacklists. If it gets to be a huge problem then a "enter this password to add me" type thing could work too. I've been compiling a bunch of ideas as such for fully P2P decentralized/encrypted chat, but I'm stuck at the two issues I mentioned earlier.

gmax 8y ago
Can routing be solved through an intermediary acting like an always-on mailbox? Along the lines of http://cweb-services.com/protocols.html http://cweb-services.com/protocols.html
- ReverseCold 8y ago
  Using an intermediary would make it not decentralized unfortunately :(
  - gmax 8y ago
    Intermediary is not the best word here. What if you could use a storage infrastructure to implemented a protocol for storing and retrieving packets across NAT and disconnected devices. If the role of storage is similar to the raw networks transport via ISP, then it is not more centralized than using an ISP.