3 ms·

No. You can't have backdoors in encryption. What you think is "expensive" today will not be tomorrow, and there's little that would be "difficult to obtain/re

by jki275 7y ago

No. You can't have backdoors in encryption. What you think is "expensive" today will not be tomorrow, and there's little that would be "difficult to obtain/replicate" -- SEMs are not hard to get access to, for instance. There is no security if you leave a backdoor for the government or anyone else.

umvi 7y ago
That's why my proposed system doesn't rely on the difficulty of reading write-only chips alone... You need both: 1. Physical access to the device 2. Physical access to the vendor's key storage (this could be extremely difficult if not impossible if the company were responsible - consider an air gapped storage vault) I still think my system could work if implemented by, say, Apple. You have only shown weaknesses of individual parts, not weaknesses of the entire system.
- jki275 7y ago
  You, like everyone else who has these ideas every few years when this government overreach bubbles up to the surface again, have made the mistake of believing that first the government is responsible enough to manage this kind of program -- they aren't and never will be, and second that engineering can stop engineering. If you can make it, someone can break it, and will. And companies are not responsible, that's not how this works. Also, a "weakness of the individual part" is a break, and the entire system collapses. You're essentially arguing for security by obscurity.
  - umvi 7y ago
    Who says the government has to manage it? Let Apple manage it so their reputation is on the line. Government just specifies that E2E is breakable with warrant; Apple can implement it how they want to preserve privacy. > And companies are not responsible, that's not how this works. Why not? If a company implements a government requirement poorly they are absolutely responsible for the ramifications, just like they are with existing regulations (like if I made a handheld gaming system that jams radios on accident, I'm responsible for not following FCC regulations properly). > Also, a "weakness of the individual part" is a break That's ridiculous. That's like saying you can't build a bridge out of pure rebar and you can't build a bridge out of pure concrete because individually they are too weak, so therefore you can't build a bridge out of rebar-reinforced concrete.
    - jki275 7y ago
      You can argue about "responsibility" all day long, until my credit card information gets stolen, and then you find out it's a meaningless concept with a corporation. Do you have the money to sue Apple? I don't. Or worse, someone gets killed because of their data being stolen. Maybe you live in a privileged world where that doesn't happen, some of the rest the rest of the world doesn't. If you build a bridge out of concrete with weak rebar, guess what? Bridge falls down, people die. If you build a bridge with shit concrete and great rebar, guess what? Bridge falls down, people die. You've made nearly the perfect analogy for me. Privacy from the government is something most people want. If the government wants my data, I'm not going to build a system that makes it easier for them to get it. And finally, you can't ban math. I don't give a fuck who says what, I won't put backdoors in my code, and if someone else does I'll stop using their code and I'll build my own.
      - umvi 7y ago
        Well it's not like you can roll your hardware, software, firmware, etc. You implicitly trust Apple or Google or whoever to keep you secure at some level, so yes, responsibility and reputation matter. Apple pushes back against illegal warrants to keep prying officials from getting into your iPhone. > Privacy from the government is something most people want. If the government wants my data, I'm not going to build a system that makes it easier for them to get it. You won't have a choice; Apple will build the system and it will be transparent to you and they will only let the government into your phone if they have a warrant. > And finally, you can't ban math. No, but you can make it harder for people to use said math. That's like saying "you can't ban physics! If you try to ban my automatic weapons I'll just 3d print a part that makes my semi-auto gun full auto!" Well, yes. You can do that, physics won't stop you. Your average person, however, won't do that and everyone is better off as a result. > I don't give a fuck who says what, I won't put backdoors in my code, and if someone else does I'll stop using their code and I'll build my own. Well you'll spend the rest of your life living like RMS then because you can't control the whole stack of a phone - it takes millions of man hours to develop and maintain.
        jki275 7y ago

by jki275 7y ago

umvi 7y ago

That's why my proposed system doesn't rely on the difficulty of reading write-only chips alone... You need both: 1. Physical access to the device 2. Physical access to the vendor's key storage (this could be extremely difficult if not impossible if the company were responsible - consider an air gapped storage vault) I still think my system could work if implemented by, say, Apple. You have only shown weaknesses of individual parts, not weaknesses of the entire system.

jki275 7y ago
You, like everyone else who has these ideas every few years when this government overreach bubbles up to the surface again, have made the mistake of believing that first the government is responsible enough to manage this kind of program -- they aren't and never will be, and second that engineering can stop engineering. If you can make it, someone can break it, and will. And companies are not responsible, that's not how this works. Also, a "weakness of the individual part" is a break, and the entire system collapses. You're essentially arguing for security by obscurity.
- umvi 7y ago
  Who says the government has to manage it? Let Apple manage it so their reputation is on the line. Government just specifies that E2E is breakable with warrant; Apple can implement it how they want to preserve privacy. > And companies are not responsible, that's not how this works. Why not? If a company implements a government requirement poorly they are absolutely responsible for the ramifications, just like they are with existing regulations (like if I made a handheld gaming system that jams radios on accident, I'm responsible for not following FCC regulations properly). > Also, a "weakness of the individual part" is a break That's ridiculous. That's like saying you can't build a bridge out of pure rebar and you can't build a bridge out of pure concrete because individually they are too weak, so therefore you can't build a bridge out of rebar-reinforced concrete.
  - jki275 7y ago
    You can argue about "responsibility" all day long, until my credit card information gets stolen, and then you find out it's a meaningless concept with a corporation. Do you have the money to sue Apple? I don't. Or worse, someone gets killed because of their data being stolen. Maybe you live in a privileged world where that doesn't happen, some of the rest the rest of the world doesn't. If you build a bridge out of concrete with weak rebar, guess what? Bridge falls down, people die. If you build a bridge with shit concrete and great rebar, guess what? Bridge falls down, people die. You've made nearly the perfect analogy for me. Privacy from the government is something most people want. If the government wants my data, I'm not going to build a system that makes it easier for them to get it. And finally, you can't ban math. I don't give a fuck who says what, I won't put backdoors in my code, and if someone else does I'll stop using their code and I'll build my own.
    - umvi 7y ago
      Well it's not like you can roll your hardware, software, firmware, etc. You implicitly trust Apple or Google or whoever to keep you secure at some level, so yes, responsibility and reputation matter. Apple pushes back against illegal warrants to keep prying officials from getting into your iPhone. > Privacy from the government is something most people want. If the government wants my data, I'm not going to build a system that makes it easier for them to get it. You won't have a choice; Apple will build the system and it will be transparent to you and they will only let the government into your phone if they have a warrant. > And finally, you can't ban math. No, but you can make it harder for people to use said math. That's like saying "you can't ban physics! If you try to ban my automatic weapons I'll just 3d print a part that makes my semi-auto gun full auto!" Well, yes. You can do that, physics won't stop you. Your average person, however, won't do that and everyone is better off as a result. > I don't give a fuck who says what, I won't put backdoors in my code, and if someone else does I'll stop using their code and I'll build my own. Well you'll spend the rest of your life living like RMS then because you can't control the whole stack of a phone - it takes millions of man hours to develop and maintain.
      - jki275 7y ago