16 ms·
Attorney General Barr and Encryption
- wil421 7y agoBarr seems intelligent despite all the news and politics we have going on right now. I agree with Schneier’s assessment about have a policy discussion. Let’s pretend the Big Tech companies build something robust and unbreakable (impossible) for the US govt. Now the EU and former English colonies want the same. Now Syria wants the same access and full history of anyone in Syria. China would like the same for Hong Kong. It’s slippery slope that goes down hill very fast. The line between criminal investigations and persecution are blurred.
- sam0x17 7y agoThat's just the nature of the beast. As long as strong encryption without a backdoor is physically possible, people will use it online regardless of legality. The thought that we could regulate that effectively is laughable. Even if you take down every single project, it's already out there. Heck, it's built into Java, which is installed on "over 2 billion devices" or whatever... It's also built into pretty much every decent programming language out there (Rust, nim, go, crystal, others). Mirrors of old versions of those are everywhere, and tons of people already have them installed. This would be as pointless as deciding to censor all .pdf files. Hell even WinZip has AES built into it. This would require significantly more oppressive censorship and monitoring than even China is capable of. And that's not even touching on SSH and HTTPS and GDPR complications. If we don't laugh at and discredit the idiots pushing this, people are going to take them seriously and we will have to deal with the consequences. Regarding companies (like facebook) that collude with the gov to bypass encryption with MITM snooping, we need to continue to expose them, and major players like Google and Apple need to actively disobey any orders from the gov, and send an army of lawyers at it, and I think that's what will happen.
- mistrial9 7y ago> laughable This is seriously wrong, and that word "laughable" is a key-word for others who share you larger assumptions. Let's assume that protocol enforcement is heaped upon those who can do nothing about it, not "laughing" techies with time and skills; .. until it is. Common access to network infrastructure is clearly being monitored and more and more requirements and restrictions are added each year, not less, in a dizzying number of ways. The ability to find a transaction from a "regulated IP address" used by those who do not have the skills or background to understand what is happening, only increases each year. This cavalier analysis is counter-productive to someone who wants to a) stay our of the security swamp and b) live life somewhat un-monitored with individual choices.
- sam0x17 7y agoYou're missing my point. People should be laughing at Barr, in his face, in his inner circle, every day for this. If we don't facilitate that on the outside, how the hell will it happen on the inside. So laughable as in a call to action, not laughable is in negligible.
- mrkeen 7y agoA government doesn't need to launch an all-out war on encryption to get its way. They only need to lean on relatively few people - the humans who live in the US and who run Facebook, Apple, etc. to put back-doors in their services. Or worse, they put back-doors in their services while denying that they have done so. The fact that strong encryption still exists will be of little use if it's not what the bulk of people actually use.
- sam0x17 7y agoThat is a legitimate concern, which is why we have to fight this.
- AJ007 7y agoThere is also the possibility that using less secure communications hardware and software could be exposing individuals and companies to criminal and civil liabilities due to other legal requirements. In the US this is already the situation with regards to handling classified information. Despite all of the rhetoric and public statements, the legal burden and actual enforcement seems to be going very much the opposite direction in the US and EU. There is good reason to suspect that the monitoring (and centralized censorship) infrastructure built up in other nations could end up producing the opposite desired goals in the long term.
- sam0x17 7y agoYes, I would absolutely love to see a GDPR suit against FB for allowing US gov to see some European person's data. Would be tremendous.
- deleted 7y ago[deleted]
- jancsika 7y ago> Let’s pretend the Big Tech companies build something robust and unbreakable (impossible) for the US govt. Didn't Chaum write up a quick-and-dirty spec specifically to stop that little parenthetical from being repeated? Edit: I guess it was more than a quick-and-dirty spec: https://www.wired.com/2016/01/david-chaum-father-of-online-anonymity-plan-to-end-the-crypto-wars/ https://www.wired.com/2016/01/david-chaum-father-of-online-a...
- rocqua 7y agoAfter a quick scan, I could not find any spec linked in that article. Claims are nice, but an actual spec to confirm those claims would be nicer!
- jancsika 7y agoI think this is it, but I don't have time to read it to confirm: https://eprint.iacr.org/2016/008.pdf https://eprint.iacr.org/2016/008.pdf
- briffle 7y agoWhat is hilarious, is they already do. Apple services in China are not run by Apple, but by Guizhou-Cloud Big Data Industry Co Ltd. [0] https://gizmodo.com/apple-moves-chinese-icloud-encryption-keys-to-china-wo-1823312628 https://gizmodo.com/apple-moves-chinese-icloud-encryption-ke...
- minedwiz 7y agoSame with Azure and AWS
- mfer 7y agoIt's more complicated than that. Let's say the US adds back doors. What is to stop China, Russia, or some other nation state from using it in the US to intercept the communications of lawmakers, CEOs, and others? These are policy implications worth raising and discussing. Do many realize implications like this?
- sq_ 7y agoI think most of us around here on HN and "tech people" in general understand that particular set of issues around encryption backdoors. It seems to me that certain lawmakers and people like Barr either don't put the time in to understand or are willfully ignorant to further their own goals.
- close04 7y ago> communications of lawmakers, CEOs > Nor are we necessarily talking about the customized encryption used by large business enterprises to protect their operations. We are talking about consumer products and services such as messaging, smart phones, e-mail, and voice and data applications. It is AG Barr's suggestion (as far as I can tell from the quote above) that these are not regular consumers so they should get "the real thing". Everyone else would get the "inspectable encryption" version.
- jakelazaroff 7y agoThat's my understanding as well, but it's a pretty insulting suggestion. Why is a business's privacy more important than my own?
- deleted 7y ago[deleted]
- closeparen 7y agoKeep in mind, while you cheer on ending the tech industry's free reign and bringing in adult supervision and regulation, that this is what it means.
- aviraldg 7y agoCan someone help me understand why technologists and entrepreneurs on HN cheer on "ending the tech industry's free reign", when they are part of the very same tech industry?
- deleted 7y ago[deleted]
- rocqua 7y agoBecause those closest to a thing can see the bad things it does. If you then conclude that doing the bad thing is game-theoretically rational, then regulation is needed. Hence, you cheer on adding regulation.
- closeparen 7y agoOne of the problems with the regulation debate framed in terms of "more vs. less" is that it's easy to assume increased regulation will fix what you consider bad and preserve what you consider good, or that deregulation will only cut pointless bureaucracy. It's distressing that the support is for more regulation in general (which can be easily coopted to support stuff like this), rather than specific policies or outcomes.
- rocqua 7y agoIt's a response to the conservative voice saying 'deregulate everything'. You first need to argue for regulation per se before you can argue for specific regulations. The nuanced position of 'regulation isn't inherently good, but this specific policy is' is blown away in the public debate by 'REGULATION BAD'.
- 7y ago
- feanaro 7y ago> Nor are we necessarily talking about the customized encryption used by large business enterprises to protect their operations. We are talking about consumer products and services such as messaging, smart phones, e-mail, and voice and data applications. This very American attitude of separating "business enterprises" from "consumers", which to me sounds like separating the noble and important from peasants or cattle, is utterly sickening. I am not a "consumer", I am a person and I deserve and demand more privacy and freedom than a corporation. We are not consumers, we are people.
- jayd16 7y agoIronic considering corporations are people.
- roywiggins 7y agoThey've always been legal persons, otherwise they couldn't be on either end of a court case. They can even be charged criminally. That's what corporate personhood generally used to mean.
- jayd16 7y agoYou don't find OP's wording ironic in light of that fact? I do.
- roywiggins 7y agoCorporations are legal persons, which is a legal designation and a sort of fiction. Humans are natural persons, which is both a legal reality and an actual reality. If someone says "I'm a person, corporations aren't" they're definitely talking about natural personhood, in which case they're completely correct. "Humans and corporations are both persons" is kind of facile- corporations don't have quite the same set of rights that humans do.
- deleted 7y ago[deleted]
- gesman 7y agoBad guys will certainly know that given phones includes backdoor access and they’ll figure out devices that does not. Law enforcement will end up spying on regular citizens and catching small fish while big fish and bad hackers will laugh watching.
- jacobush 7y agoThey will also catch political trends, which I suspect is the whole point.
- roywiggins 7y ago> they’ll figure out devices that does not Just owning one of them could then become probable cause for a search of everything else you have, and then you'll be held in contempt and jailed until you hand over the password. Or it could just be made illegal to own one at all. Anyone with a secure smartphone could probably be tracked just by traces it leaves when it connects to a cellular network.
- vageli 7y ago> > they’ll figure out devices that does not > Just owning one of them could then become probable cause for a search of everything else you have, and then you'll be held in contempt and jailed until you hand over the password. Could you explain your reasoning? Just owning a safe in my trunk doesn't give people probable cause to search my trunk, so it's not clear how you came to that conclusion.
- sgarman 7y agoCheck this out: https://www.nytimes.com/2019/03/30/us/politics/dea-money-counter-records.html https://www.nytimes.com/2019/03/30/us/politics/dea-money-cou... DEA was looking though records of who bought money counters.
- user9645 7y agoOnde cheep phone per message and criminals are back. But hosest people are now under constant mass surveilence AND the agency only have metadata anyway because the message was encrypted
- oxfordmale 7y ago> Nor are we necessarily talking about the customized encryption used by large business enterprises to protect their operations. We are talking about consumer products and services such as messaging, smart phones, e-mail, and voice and data applications. This is very naive. Just assume the scenario where a CEO or politician has a certain fetish that he/she rather would not like to be splattered over the front page of a national news paper. This person is likely going to use his personal email, phone, voice and data applications to indulge in this fetish. If there is a backdoor, it is almost guaranteed China, Russia or any other country will eventually break it and potentially use it for blackmail to get their hands on corporate or national secrets.
- techntoke 7y agoNot just China, could be any country really.
- AndrewBissell 7y agoCould even be our own country. Given that Barr is the son of a CIA scion I'm sure he wouldn't mind if U.S. intelligence agencies were given the power to pick and choose who is electable.
- wonderwonder 7y agoThis is the greatest threat. Existing administration hacks into their opponents digital devices and then exposes all of their secrets to the world. This ensures that the party in power never loses an election again.
- AnthonyMouse 7y agoForget about parties, it allows them to control who wins the primaries for both parties.
- wonderwonder 7y agoIncluding their own. How soon before the government is utilizing its security apparatus to blackmail its own wealthy and powerful?
- nixpulvis 7y agoI liked this comment from below the article. > I prefer to live in a free but insecure world than in a perfectly safe but not free world. Which I interpret to mean, we're free to use whatever protections we see fit. But institutionally we can't promise security, since bad actors will always exist.
- zAy0LfpBZLC8mAC 7y agoI don't like it because it suggests that freedom and security are somehow at odds with each other, which is already an authoritarian framing of the situation, and really just nonsense. I want to live in a perfectly secure world. I don't think that that is actually achievable, but there is absolutely nothing wrong with that goal. But: There is no such thing as "security" in and off itself, security is always relative to something that you value that you try to protect. So, if you value freedom, you can not achieve security through limiting freedom, because that would mean destroying what you value, supposedly in order to protect it ... but that would obviously be a total failure at achieving that goal. The point is: Part of living in a world that is as close as possible to perfectly secure is that you have to mitigate the risk of concentration of power in the hands of authoritarians and corrupt people. Limiting the power of the state is a security mechanism, and authoritarians who want to obtain more and more power by calling their power "security" are simply lying. If you accept that authoritarians dismantling security mechanisms is somehow an increase in security, you have already fallen for their propaganda.
- sonusario 7y ago> I don't like it because it suggests that freedom and security are somehow at odds with each other, which is already an authoritarian framing of the situation, and really just nonsense. Agreed. I think part of the issue stems from how people define freedom, seemingly thinking that freedom means "no rules". For example: If having rules is intrinsically against freedom, then why would anyone who desires freedom play sports, where rules define the game. If you eliminate the rules, you eliminate the game and your freedom to actually be able to play it.
- 7y ago
- Veelox 7y agoI have found that the best way to educate people on the importance of no government backdoors in encryption is to use the example of TSA approved locks. Everyone knows when they put a TSA lock on their luggage it does almost nothing to improve the security of their luggage. Any serious criminal has a key to TSA locks. Adding backdoors is like putting a TSA lock on your bank password. It keeps honest people from seeing it but doesn't do much else.
- SamuelAdams 7y agoActually you can 3-D print a set of TSA keys now. https://github.com/Xyl2k/TSA-Travel-Sentry-master-keys https://github.com/Xyl2k/TSA-Travel-Sentry-master-keys
- lostlogin 7y ago> Actually you can 3-D print a set of TSA keys now. Unless that repo is backdoored and the code has been altered.
- diminoten 7y agoThe point though is why would anyone even bother, since no one uses TSA locks as anything resembling legitimate security anyway.
- icedchai 7y agoI've never bothered locking my luggage. I figured it would cause more problems than it solves.
- deleted 7y ago[deleted]
- rahimnathwani 7y agoI use TSA-approved locks that have a little red indicator that pops up if the lock is opened with a key. You can reset the indicator only if you know the combination. So, when I collect my bags, I can tell whether they've been opened since I last saw them.
- rosybox 7y agoI actually appreciate Barr's point. Honestly given the cost of not saving lives that could have been saved, abducted children, potential active shooters, terrorist threats all surrendered for the benefit of me getting end to end encryption to ask my wife what kind of drink she wants me to buy from Starbucks. I, speaking only for myself, find lawful access to such personal messaging, given probable cause of a crime being committed and a warrant signed by a judge, tolerable and reasonable. I also get the sentiment that people have more of a problem with the idea of government access to private communications than with weakening the encryption to allow it. I see a lot of the conversation being all about privacy, and not about encryption. In discussion of the latter I don't have a lot to add, but in the former, the courts have decided many times over that law enforcement and the state can access information about you if they have probable cause that you're committing a crime. If you enjoy living in a society governed by laws and don't tend towards libertarian extremes of personal freedom it's something worth accepting and the discussion on the highest level of whether we should or shouldn't do this doesn't even consider this side of the argument, despite it filling up 90% of the user generated discussion about this topic whenever it comes up.
- self-reference 7y agoThis perspective really bothers me— I’m sure I’m not the only one. It seems to presume that the current state of affairs, where the police lack some ability to access some of the evidence which is in principle available, is a novel situation demanding of a novel response. But, like, it’s not like the original ratifiers of the Bill of Rights didn’t understand what they were doing. They _knew_ that by outlawing common law enforcement practices like arbitrary searches and coerced confessions, they would be giving up some of their ability to “punish” certain types of “criminals”. They got that it meant they couldn’t listen in on a man’s conversation with God. That’s the deal they struck to try to form a country governed by laws, not by men. It really seems like it’s not such a new situation, after all; we just have new values.
- rosybox 7y agoThis response is exactly what I'm talking about. The conversation about allowing government access to private conversations is already addressed by court precedence. The weakening of encryption, which may allow bad actors to exploit what the government has access to, is the actual discussion that lawmakers are considering. People have a real hard time with coming to terms with the powers that police have. Those are not in question though. You can get mad about it, downvote me, but powerful law enforcement is a fact of modern life and it's not going away. In the US, you'd need a constitutional amendment, and there's no one calling for it, it's not an issue on any of the major parties platforms.
- danesparza 7y ago" As computers continue to permeate every aspect of our lives, society, and critical infrastructure, it is much more important to ensure that they are secure from everybody -- even at the cost of law enforcement access -- than it is to allow access at the cost of security." This. I love that Schneier weighed in on this.
- DerSaidin 7y agoNice quote.
- shmerl 7y agoWhy would anyone listen to Attorney General Barr regarding information security issues instead of actual experts? > This is exactly the policy debate we should be having Why is this debate needed? It's beating the same dead horse since this debate already happened in the past. It was made clear, that backdoors are not an option.
- SpicyLemonZest 7y agoBecause AG Barr is the expert on law enforcement capability, which is being weighed against security. Nobody including Barr himself denies that his proposal would weaken security.
- shmerl 7y agoI meant in the context of "it's worthwhile to weaken information security". This debate is over and he is just beating the dead horse.
- SamuelAdams 7y ago>If one already has an effective level of security say, by way of illustration, one that protects against 99 percent of foreseeable threats -- is it reasonable to incur massive further costs to move slightly closer to optimality and attain a 99.5 percent level of protection? Except that's not the case. Encryption is mathematically proven to be 100% secure. Assuming the application was coded / implemented correctly, the only thing capable of unlocking encrypted secrets is the secret key. AG Barr wants to move it from 100% secure to "99.5% secure". Not the other way around.
- brandmeyer 7y agoIMO, this almost-but-not-quite-100% attitude is still the right frame of mind. The remaining percentage represents exfiltration by means of hacking the device through its various vulnerabilities. Sometimes that exfiltration takes the form of encryption keys, and sometimes its the user data that the attacker was after in the first place.
- roywiggins 7y ago> Encryption is mathematically proven to be 100% secure Well... no. We're pretty sure that factoring large primes is intractable, but nobody has actually proven it. And we know it's not that hard for a quantum computer. Modern cryptography is certainly not 100% secure for all time.
- gnode 7y ago> mathematically proven to be 100% secure We still don't know how to prove the difficulty of any computing problems which the security of conventional cryptosystems rely on. https://en.wikipedia.org/wiki/Computational_hardness_assumption https://en.wikipedia.org/wiki/Computational_hardness_assumpt... Some systems, like the one time pad and quantum cryptography have security which doesn't rely on computational hardness, however.
- deleted 7y ago[deleted]
- korethr 7y agoAs Schneier says, it's better than the "nerd harder" attitude exhibited previously. However, I take issue with this part: > After all, we are not talking about protecting the Nation's nuclear launch codes. Nor are we necessarily talking about the customized encryption used by large business enterprises to protect their operations. We are talking about consumer products and services such as messaging, smart phones, e-mail, and voice and data applications. I think he is intending to argue that the quality of the encryption should be tiered, that "consumer" comm crypto should be weaker than business operations crypto should be weaker than gov't crypto. If so, I think this is a bad policy. I just got through a security audit by one of our customers at work. One of the points that their security team made was that they want us to do more to protect the mobile devices used at our company. Even though said mobile devices do not, and will never have, access to the customer's sensitive data, the customer argued that a mobile device being breached gives an attacker a foothold, and allows said attacker to move closer to getting access to their data. I think the same principle applies to this notion of lower-tier crypto for the peasants. Lower-security systems interact with higher security ones, and if those lower security systems are breached because their security was artificially lowered, they become threats to the higher security systems with which they interact. I don't doubt that if crypto for Not-Government were kept artificially weak, that China or Russia would leverage that to their advantage, moreso than they already are. I think it would also make things easier for not just state actors, but lower-tier criminals, as well. If Barr wants to have an easier time catching bad guys, he should probably not make it easier for bad guys to do bad things.
- taurath 7y agoIt’s better for the user to assume they’re totally pwned and should act like they’re in the open, than for them for assume the bad encryption works.
- dtech 7y ago> I think he is intending to argue that the quality of the encryption should be tiered, that "consumer" comm crypto should be weaker than business operations crypto should be weaker than gov't crypto. If so, I think this is a bad policy. I don't think this is strange, since this is how it works in physical. A home has a simple lock, a business a few better ones and a security system, and a military base has 24/7 armed soldiers on guard. Impossible to do right now for encryption of course.
- rolltiide 7y agoSubpoena individuals and do investigative work. Identified individuals can choose to comply and reveal their digital artifacts that are specifically identified as being part of a crime or be held in contempt of the court order. If they don't use locks or use easily bypassable biometrics then the court order already allows latitude for that. Just give up on being able to image and examine people's encrypted artifacts, and just give up on trying to tap a firehose of data from the providers now that they have an interest in encrypting what they store. The state had a good 30 years of unprotected digital artifacts being available, and now it is just going back to the heuristic analysis of the days before, a level of accepted intrusion that government is built around.
- nybble41 7y ago> Identified individuals can choose to comply and reveal their digital artifacts that are specifically identified as being part of a crime or be held in contempt of the court order. Abuse of "contempt of court" to compel third parties not accused of any other crime to assist in an investigation is also a problem. The court can ask for the data, of course, but one ought to have the legal right to refuse; refusal to provide the requested data, on its own, should not be considered evidence of guilt or probable cause to conduct a search.
- rolltiide 7y agoAgreed. The point is that is a separate issue and the tools for investigation are already here.
- dbg31415 7y agoRelevant. * Honest Government Ad | Anti Encryption Law - YouTube || https://www.youtube.com/watch?v=eW-OMR-iWOE https://www.youtube.com/watch?v=eW-OMR-iWOE Also worth noting that Australia already went ahead with their anti-encryption laws. Feels inevitable that we'll lose encryption to the nanny state. Really sucks, but I haven't got a clue how to convince the grandmothers out there why the cops shouldn't be trusted here. It's so frustrating. * Government Surveillance: Last Week Tonight with John Oliver (HBO) - YouTube || https://www.youtube.com/watch?v=XEVlyP4_11M https://www.youtube.com/watch?v=XEVlyP4_11M I think it'll be one of those things that society won't wake up to needing until it's long gone. Depressing as fuck.
- fencepost 7y agoMandatory government access to all communications (including saved encrypted communications) is not compatible with systems where the government or control of the government changes. The thing that I don't really see discussed in this is the question of who do you trust to have the keys? Personally I can't imagine entrusting decryption keys to anyone appointed by or simply hired by the Trump Administration given its history of choosing people for sensitive positions. I guarantee that there are a ton of people who think that Hillary should be locked up that would feel exactly the same way about security keys under the control of any Democratic Administration. What's more, unless the policy becomes that all communication must go to the United States government to then be retransmitted onto a final destination then security keys would be vulnerable to disclosure by anyone from a former Administration who had access to them, and it only takes a limited number of compromised or dishonest individuals to compromise the entire system. Don't discuss whether people are comfortable with the FBI or Department of Justice or William Barr having the authority to get to all of their Communications. Discuss whether they'd be fine with Barack Obama or Hillary Clinton or Eric Holder or whoever ends up being the Democratic nominee having that access. Edit: moved last paragraph to first.
- zelon88 7y ago99% is good enough? If 1% of all secure public data transmissions were compromised there would practically be no point in trying to secure anything. And who is Barr to decide what's worth encrypting on a societal level? I'll put my photo album through 5 different algorithms if I want to. Such is my right. Go ahead Barr, make laws for corporations to follow and watch as all that data you're trying to capture disintegrate from the networks where you gave yourself access and reappears on even more secure smaller scale distributed systems. What will happen is instead of Google hosting your data for you they'll just create devices that let you store your data at home, offline while only beaming back the telemetry and meta.
- azinman2 7y ago> “ Here, some argue that, to achieve at best a slight incremental improvement in security, it is worth imposing a massive cost on society in the form of degraded safety. This is untenable.“ I’d suggest if they really want to push this line of reasoning, then we should also abolish the 2nd amendment. It is there in order to revolt against the government. But it’s place also degrades the security of the country, as evidenced by the constant shooting and mass shootings that occur in American life. Encryption is much the same way. It protects individuals against government spying, whatever their situation may be. And these products exist not just for the US, but are made by Americans for export with the American ideal of individual liberty in mind. If we remove that, it’ll get moved for China, Burma, Russia, etc. It’s quite a price to pay for society.
- gowld 7y agoThe 2nd amendment was to defend against Indians.
- velosol 7y agoThe 2A and crypto have been linked for a long time. The original crypto fight in the 90s was over exportable encryption (because it was listed along with munitions and other ITAR-restricted items). One idea I saw floated around the time of the San Bernadino iPhone was arguing that encryption is protected by the second amendment as a means to not having to fight against backdoored encryption every few years. I don't have the case law familiarity with the 2A & encryption to say if it would go well but I did find it a fun idea. Edit: I should add that this would be in addition to the clear 1A protection code and therefore encryption has.
- djsumdog 7y agoI guess it should be illegal for Ransomware providers to generate encryption without government backdoors too, eh? On a side note, with the new Australian laws, is it now illegal to use tools like LUKS and Veracrypt there?
- codesushi42 7y agoDES was built to be brute forced by govt computers. Don't trust any cryptographic standard put forth by the NSA, ever. They have always been about backdoors.
- gowld 7y agoSource? Wikipedia says exactly the opposite: https://en.m.wikipedia.org/wiki/Data_Encryption_Standard https://en.m.wikipedia.org/wiki/Data_Encryption_Standard NSA made DES more resistant.
- velosol 7y agoPerhaps OP was thinking of the criticisms around Dual-EC-DRBG? https://en.wikipedia.org/wiki/Dual_EC_DRBG https://en.wikipedia.org/wiki/Dual_EC_DRBG
- codesushi42 7y agoThat is another example, yes. But the NSA purposely dictated that DES use 56 bit keys (a strange choice of key length to begin with), so that it would be possible for brute force attacks using government mainframes. The original proposal was for 128 bits IIRC. This was way back before many people studied cryptanalysis, which is why no one cared at the time.
- codesushi42 7y agoNo they didn't. They reduced the key space down to 56 bits. Which was small enough for government computers to hack even decades ago. The original proposal by IBM was for 128 bits IIRC. https://en.m.wikipedia.org/wiki/56-bit_encryption https://en.m.wikipedia.org/wiki/56-bit_encryption That is interesting that the Wikipedia page you linked claims the contrary and makes me suspect tampering. Because this story has been told over and over again, even in textbooks. See Springer's Understanding Cryptography chapter on DES for instance. EDIT: In fact, the Wikipedia page you linked states DES, as stated above, is insecure. This is mainly due to the 56-bit key size being too small. So where is this nonsense about the NSA making DES more secure?
- IfOnlyYouKnew 7y agoJust as the government has been pretending that backdoors are possible without a loss of privacy, the tech community has been pretending that backdoors are indistinguishable from a complete loss of the benefits of encryption. Don't get me wrong: I'm totally against backdoors, and I do consider them a significant weakening of any encryption. But it's just disingenuous to insist that, for example, a system with the same sort of requirements as exist for search warrants is entirely equivalent to a system without those. Or that one-out-of-two encryption schemes do not exist. Or that it is totally impossible for an agency to keep a keyfile secure. As but one example for the last: SSL certificate authorities are already entrusted with keys whose loss has just about the same sort of security implications as breaking messaging encryption might have. And that system is working somewhat decently, including in cases where those keys were breached and certificates had to be revoked.
- cesarb 7y ago> SSL certificate authorities are already entrusted with keys whose loss has just about the same sort of security implications as breaking messaging encryption might have. A leak of the private key for a SSL certificate authority (or even for the server itself with modern TLS) doesn't allow decrypting past messages, while these backdoor proposals aim to allow precisely that.
- hedora 7y agoThere is also a false dichotomy based on the idea that law enforcement are the “good guys”. In the Bay Area, traffic officers routinely get caught blackmailing women. Federal prosecutors routinely use “alternative reconstruction” where they keep the real evidence secret, and just lie to courts about the facts. US government computers are routinely breached by government employees, contractors, and foreign governments, and the results are then used to blackmail our politicians, influence elections, etc. Barr should know about that last one, since he’s in the middle of the current impeachment proceedings, and Trump has also been routinely calling for the prosecution of his political opponents for doing some of the things I just listed. It is clear that even Barr is uncomfortable with giving these surveillance powers to the executive branch while a Democrat is serving as president.
- EGreg 7y agoI wanted to write a post about how the encryption would interact with free speech, especially given the leaked memo to censor the Internet. Let me start by stating my views on free speech and rights in general, and then how they are shaped by these events. I think that human rights and freedoms are just that: personal freedoms. Freedom of religion is about personal religious observance without harming others. These freedoms philosophically should not mean entitlement to unlimited exercise thereof. The right to bear arms doesn’t mean you should be able able to stockpile unlimited amounts of ammunition and incendiary devices etc. Similarly, FREEDOM of speech to me is a PERSONAL human freedom. You can say what you want, and not be punished by the government for it. You can say it in a car, you can say it in a bar, you can say it very far, you can wish upon a star. But there are limits to how many people can hear you. Maybe 10 or 100 people at an event. Once you get into situations where 5,000,000 people can hear a tweet, that’s clearly not about FREEDOM of speech in its strict sense. It is about entitlement to use a PLATFORM, maintained by an ORGANIZATION that involves many people, to broadcast arbitrary, unfiltered one-to-many messages to everyone. I think this latter thing is toxic, in both directions. Society listening to tweets of celebrities cheapens public discussion and civic thought. And being reachable by the whole world using email (rather than through networks of shared invited/capabilities) leads to constant spam and papparazzi for celebrities. What happened here is an ORGANIZATION put on a show or movie and catapulted this celebrity into the limelight and carefully maintains their stature, along with their own publicists, social media team on twitter, etc. This is the society we live in, where we have heroes. But entitlement to unlimited unfiltered megaphones is NOT the same as freedom of speech, any more than being a leader if a paramilitary group of unlimited size is the same as the right to bear arms. So, freedoms and rights have limits. Where those limits lie is the heap paradox - as you take away grains, when is a heap no longer a heap? etc. So what is the alternative to this type of misnamed “free speech” aka megaphones run by organizations, super PACs, mainstream media, and so on? It is COLLABORATION. Look at Wikipedia. Look at peer reviewed journals and science. Look at large open source projects There, individual contributions are filtered and often butt up against changes, revisions, etc. The result is that when the general public sees something, it is the result of a collaborative process of filtering and refining the presentation of information, citing sources, etc. There are no heroes on wikipedia, and only a few in science and open source. Most contributions are filtered by a community of experts, not state governments or platforms employing boiler rooms of low paid workers to determine what’s true. I would like to see more of that COLLABORATION and less of COMPETITION. I would like to see a patentleft movement in drug research, instead of big pharma. I would like to see news reported like Wikipedia with footage submitted by everyday people on the ground instead of “intrepid reporters in a warzone”. CNN used to have a motto that they have “no celebrities”. News agencies tried to stay lukewarm and neutral. FOX News changed the game, lots of people copied the model. The Internet eliminated newspapers and classifieds. News had to adapt because capitalism and cutthroat competition for the same ad dollars means MORE clickbait and MORE lockin to one type of audience. For-profit Social networks further use this content to herd us into echo chambers of outrage, because that’s what drives the most engagement, which the social networks need to monetize. They send notifications in an increasingly desperate attempt to grab your attention in a tragedy of the commons where the commons is our attention. This has had a corrosive effect on society. The capitalist (competition based) news has made us more polarized and outraged, while the capitalist (competition based) social networks have made us more addicted to our notification slot machine, with smaller attention spans and self control, responding to that stranger on the internet over that latest outrage. THIS is the culture that leads to more mass shootings. The fact that we have giant platforms instead of peer to peer is another problem. By banning extremist people from platforms, a platform can pop up which attracts the worst extremists, and feeds them. This platform should ABSOLUTELY be a honeypot for the FBI to watch these people. In our world of centralized platforms, Platforms like this should be RUN by the FBI. Instead, our government takes the wrong approach. They shut down the Craigslist and Backpage hookers sections instead of using them to entrap and catch traffickers. Then they threaten large platforms with SESTA (2018) when they should be the ones catching the people who are out there. The platforms should be honeypots! Anyway. So although I feel my stance is correct, and beneficial to society, there are three practical problems with it: 1. First Amendment is not interpreted as I do. In fact Citizens United even allowed our politics to be run by PACs with huge money and megaphones (although nonprofits could have always done that). So legally my literal understanding of limits of freedoms is not matching the traditional ones (slander, yelling fire etc.) 2. This may be the more serious one. As we have more end to end encryption and better personal technology, all well-meaning ideas about limits of freedom of speech and arms melt away. Imagine Alex Jones on SAFE Network with 1,000,000 people subscribed to his encrypted feed. Or imagine 3d printed guns from illegally shared 3d models, stored in 10% of the homes in NYC. Can’t stop people using a turing complete language to turn out banned material. 3. Even with numerical limits on each person’s audience, a hateful message can attract people who make plans to use technology to asymetrically perpetrate criminal acts. And end-to-end encryption means we won’t know what they’re saying. However, I believe that if we took the freedoms in the way I defined them, and moved to collaborative platforms instead of competitive ones, our society’s health would measurably improve.
- glitchc 7y agoAs a security researcher, I would like to present a counterpoint to the general discussion here, unpopular though it may be: Access to the internet is a privilege, not a right. There is nothing in the US Constitution regarding the internet. An individual is not required to use the internet to communicate with another person, this is a matter of convenience, ergo privilege, but not a right. Along with face to face meetings, letters and phone calls, individuals are also, through the power of software, allowed to implement their own encryption over existing communications channels. The internet has been a force of good, but also a force of evil, in this world. Rapid dissemination of personal opinion masquerading as fact has lead to extremism and polarization across the globe, this is undeniable. Some degree of accountability needs to be introduced into the system for the internet to reach the next level of maturity. The government is allowed to access your telephone records. The corporation holds your records to a certain date as mandated by law, and hands them over when a lawful request (warrant) is made. Full-on disk encryption and end-to-end encryption make it impossible for the government to access those records even when a lawful request is made. Note that the Fourth amendment states unreasonable searchs and seizures. That does not mean the individual is allowed to be impervious to searches and seizures. The reasonableness clause protects the interests of the state and allows courts to decide yay or nay on a case by case basis. That is the very intent and spirit of the law. Currently technology, not law, is the gatekeeper, and technology is controlled by corporations. In a lawful society, this is untenable in the long-term. If anything, it enables tyranny by corporations, since they are unelected and not responsible to the public, whereas elected governments, in fact, are. The history of US is replete with cases where corporations have grown too powerful and governments required new laws to counter the threat they presented to society.
- opwieurposiu 7y agoIf we lived in a lawful society, your argument would have some merit. Unfortunately in the case of the USA, agents of the state can literally throw hand grenades into the cribs of sleeping toddlers and face no consequences. We need to minimize the power of the state to harm the people, weakening encryption does not do that. https://www.nbcnews.com/news/us-news/ex-georgia-deputy-acquitted-after-flash-bang-grenade-hurts-toddler-n479361 https://www.nbcnews.com/news/us-news/ex-georgia-deputy-acqui...
- godelski 7y agoI see this as fundamentally un-American. To quote Benjamin Franklin * Those who would give up essential liberty to purchase a little temporary safety, deserve neither liberty nor safety.* Additionally I think there is a fundamental misunderstanding, or lack of understanding, of Pareto[0] and fundamental statistics. At this point we are scraping the bottom of the barrel for safety. We are in the safest time in world history. We are in one of the safest times in American history too^. Certainly in the last couple decades. Yet for some reason we are treating issues of safety as if they are worse than the 90's. And if we can make a statement that is only 99% secure then we're pretty much screwed. 1% of attacks/opponents/people being protected (whatever that measurement of "threats" means) is really low. If it's attacks, well give it a few minutes (that'd be consistent with previous back door implementations). If it's opponents, then really anyone we actually care about is going to happen access (there are far more than 100 countries with computers). If it's people being protected, well there are 350m Americans. That leaves 3m Americans vulnerable. Any of these cases are unacceptably low and I'd argue actually set us back. The other thing is that even implementing mass surveillance wouldn't help us. In many ways it has more potential to harm us. Like many in the thread have said, it isn't just personal privacy at hand. Politicians, high profile business people, etc can easily be blackmailed. It doesn't even have to be some kink (as others have suggested). Just something like sending nudes to a partner or a charged joke that is taken out of context (how many of you have dark humor or use jokes to illustrate a point?). Nation States will definitely gain access to these backdoors. It's highly likely hackers will as well. Additionally everyone does have something to hide. Banking passwords, sensitive information, personal thoughts and feelings^^. So we are going to give up a fair amount of liberty for a minute amount of security? (Possibly negative security!) This does not sound like a good deal for anyone involved. I don't think it even helps law enforcement. They already can't handle the information that they have. We've seen that with data they have, or could easily obtain, that things are obvious in post hoc (like someone on 4chan saying they are going to shoot up a school). How does this help us as American people? That needs to be honestly answered. Otherwise all I see this as a ploy on fear and overreach. We used to fear Big Brother. I'm not sure why or how we have come to embrace him. [0] https://en.m.wikipedia.org/wiki/Pareto_principle https://en.m.wikipedia.org/wiki/Pareto_principle ^ the issues at hand I do not believe would be solved in any way by monitoring because monitoring does not fix the root causes, which are clearly solvable. ^^ lack of being able to share these will only increase our problems.
- duxup 7y agoI feel like it is inevitable that any back door you legislate ... will get more use out of enemies of that given state than the state itself. Any state with strong individual rights and courts will be limited in their usage to some extent. Outside actors, unlimited.
- CryptoPunk 7y ago>>Yes, adding a backdoor increases our collective security because it allows law enforcement to eavesdrop on the bad guys. But adding that backdoor also decreases our collective security because the bad guys can eavesdrop on everyone. And the bad guys can be the state. People need to acknowledge the phenomenon of systemic failure. People at large can know that the system is deeply flawed, yet not be able to fix it, because the problem is too complex to fix. One could argue that situations where members of Congress see their compensation increase by an average of 1,800 percent when they leave office and become lobbyists, where fewer than 3 teachers in an entire state are fired in a year due to sweetheart collective bargaining agreements, where police unions protect officers from facing disciplinary action for miscondict, where the wage gap between federal employees and private sector workers has increased significantly since 1950, where more than half of the 20 wealthiest counties in the US are suburbs of Washington DC, where intelligence agents are known to use the state's surveillance apparatus to spy on lovers and exes through a practiced coined LOVEINT, where there are approximately 1 million federal regulations which hold potential criminal convictions for breaching, and where the prison population is 1 percent of the total population, are all examples of systemic failure, and the frequency of such failures requires us to check government power by enshrining legal principles like the right to privacy. Information is power and centralizing information in the hands of a small government elite through mass surveillance leads to power asymmetry that is dangerous to society.
- jecxjo 7y agoThe thing I have never heard anyone talk about is what the repercussions should be for those asking for a back door when the door is used by malicious actors. We have seen companies like Wells Fargo commit company wide bank fraud...no one goes to jail. We have seen companies like Equifax lose millions of people's worth of personal and financial information...no one goes to jail. When Barr and Trump push through legislation that requires back doors put into all our security, who is going to do jail time when all our personal information is leaked again? I try to put the least amount of info out there but when I do I use crypto that I know works, that I know who and how it was designed, who and how it was audited. When the government comes in and some intern loses a USB stick with keys to the back doors I wanna know who's head is gonna roll for it.
- csours 7y agoLet's not pretend that Law Enforcement (aka The Government) is asking for these powers in a vacuum. Every time a terrorist event happens, or pedophile ring is broken up the public asks why it was not prevented or stopped sooner. The argument of data security vs physical security needs to take place with your neighbors and not just your Senators. Don't get too mad when Law Enforcement does what your neighbors ask.
- stephen_g 7y agoI see this trope a lot around these kinds of discussions, but don't really see this going on as much when such events actually happen. Sure, it happens to some extent but I really wonder whether this claim (saying that large numbers of people basically demand more and more surveillance whenever any major crime happens) is instead hugely exaggerated and pushed by those very people trying to push more and more surveillance...
- deleted 7y ago[deleted]
- kelnos 7y agoI don't like to be the tin-foil hat guy, but I'm getting tired of the gov't rhetoric around how this is "to catch criminals". No, it's not. It's to protect and further enable passive mass surveillance. And nothing good comes from that. I don't trust anyone with that power not to break the rules and do bad things sometimes.
- snarf21 7y agoExactly. So the police and government were never able to catch criminals before 1990? Terrorism or kiddie porn are just red herrings to scale people into giving up control. When someone asks for this kind of backdoor, I want to ask them to hand me their unlocked phone. "But you have nothing to hide, right? You aren't breaking any laws, right? I promise not to share this information with anyone!"
- GordonS 7y agoWe've been bombarded by the same FUD in the UK and across Europe since 9/11. Anyone capable of rational thinking knows it's nonsense, a power-grab by politicians, law enforcement and the security services looking for mass surveillance; overreaching powers that will inevitably be misused, abused and slowly creep into other areas of government. And yet the bombardment continues, banging on about terrorists, paedophiles, the Russians, the Chinese, the bugbear de-jour. Honestly, I fear for what is happening to Western democracies just now - it feels like we're on a slow but steady march to an Orwellian nightmare I don't want to live it.
- beeschlenker 7y agoI think Barr will be busy with something else soon: Obama rapes & kills 2 boys 15Jan in Buffalo. DeBlasio 5, Buttgieg 5, Cuomo 4, Murray 3, Dorsey 3, Thiel 3. Trump $4 billion to cover. Pel!osi $3 billion, Harris $1 billion, Schumer $2 billion, to help bring the boys over the border. Trump: $138 million to bypass 5th amendment See pages 18-23, 8, 11, 12, 35, 45, 61, 62 Having trouble getting traction. Getting censored/banned. Billions in bribes paid to Trump, Pelosi, Schumer, Harris to enable a Soros funded child raping ring to operate in the USA. Please listen to the links below. Turn up the volume and put headphones on. You will hear these people, and many other high profile people, incriminate themselves in unbelievable fashion. Full 74 page document [update 10Aug] filled with red handed evidence like this at the bottom. Go to pages 18-23 of this document and you will hear Dorsey and Thiel raping children. You will hear their screams. They both rape and kill three. Also at the "rape party" of note: Bill DeBlasio, Andrew Cuomo, Bill Murray, Peter Buttgieg, George Soros, Barack Obama. Please copy and paste this post and repost it. I keep getting censored by these people. Peter Thiel and Jack Dorsey raping and killing three boys each. Turn the volume all the way up and put head phones on. https://s3.wasabisys.com/conv1/Overnight_14-17Jan/15JanCh3_100-200.avi https://drive.google.com/file/d/1mzZrjobxhNIEf38M3xk-IeA5SeF4aUtB/view?usp=sharing Obama admits to raping and killing boys he{re, with commentary from Peter Thiel, George Soros, Matt Porter: https://s3.wasabisys.com/out2/Out2/15JanCh3_0545.avi https://drive.google.com/file/d/1LCDoc1kT7cfSeKQ1vniP_sx32_bRsHau/view?usp=sharing Trump demands $4 billion to "take a blind eye" at 1015+ (link missing from report, unsure how). Here's pieces of dialogue: 1015 The President requests four billion and henry Porter agrees to it. Some dialogue below. 1017 Donald Trump: Why don't you think about it. 1017 Henry Porter: I don't need to think about it. I'm ready for you to find out what we're really about. 1017 Gigi Hadid: I don't think it's a good idea Henry. 1017 Henry Porter: ...no shit. Jelena just stop talking about it. 1018 Gigi Hadid: About what? 1018 Henry Porter: The child raping. 1018 Donald Trump: What the fuck are you talking about? 1018 Gigi Hadid: Mr. President we are child rapists. 1018 Donald Trump: You cannot be serious. 1018 Donald Trump: You're gonna need $4 billion for me to take a blind eye. 1019 ?: People are laughing because they think four billion is too much. I think it's not a problem when you have $35 billion. 1022 Donald Trump: You better have that $4 billion or you can kiss this shit goodbye. https://s3.wasabisys.com/conv2/3Jan/3JanCh3_900-1100.avi https://drive.google.com/file/d/1Grdr8xF2psKNsuYlEnl9dIRV-77YG0Vr/view?usp=sharing Trump wants $138 million to ensure smooth outcome for false judgment for a court case: https://s3.wasabisys.com/conv1/10JanCh3/10JanCh3_951-1033.avi https://drive.google.com/file/d/1iSeGHDToFRoRdIht50Wii0i30mlw9INp/view?usp=sharing Obama explains the Illuminati with Jack Dorsey: https://s3.wasabisys.com/conv1/Overnight_14-17Jan/15JanCh3_200-347.avi https://drive.google.com/file/d/1Ok1-9IvANULzKBOwADFgaiYCFi6yszfj/view?usp=sharing At 230 a conversation is occurring on the embedded Porter camera system with Jack Dorsey, Peter Thiel, Barack Obama, Bill Murray, and the Porter's. Jack Dorsey provides a statement defining who their group is: "The Illuminati is an underground organization of child rapists and homosexuals." Matthew Porter: "We have to thin the herd, so Barack is going to explain a few things." At 232 Barack Obama says the following: "You people have to realize we are child rapists. The Illuminati are child rapists. As soon as you figure that out, you can decide what to do. Everybody is freaking out about what just happened [child raping event still going on]. This is who we are." Full 74 page document [updated 10Aug]: https://s3.wasabisys.com/aviewmefirst/FBI_FinalDraft_26Jul2019_BSchlenker.pdf https://drive.google.com/file/d/1dXNjPQdQ8c-hFFLt9LT0GiSY5Vud0TzL/view?usp=sharing Please post this anywhere you can! Each google drive link is a backup to the wasabi link just in case one is "down". A word about the "f@\&&ot" usage: it was a necessary tool. It showed three things: they were not in control, if they were the usage would have be stopped. Everyone out there needed to see t%his. Two, it made it unpleasant for them to be in the headspace, which has obvious advantages. Three, it pointed out impersonators of BS because they would not call each other f@%%ot, thus helping to mitigate the spread of false information. Apologies for those unintentionally offended. Of special interest to the LGBT community, I give you Barack Obama in a foursome with Peter Thiel, Jack Dorsey, and Matthew Porter. It is on page 12 of the document where you can download the video containing audio footage of the "event". Link is just above under "Full 71 page document".
- squirrelicus 7y agoI for one look forward to our federal overlords thinking they have any clue what kinds of transmissions deserve security /s. Seriously though, the legal tradition just hasn't caught up to the idea that somebody can possess information outside their person that can't be forced into the eye of the law. I've thought about this a lot and my best conclusion so far is "give up the encryption keys in exchange for immunity against legal cases that aren't yet open that the secured data might reveal, or you're guilty by default". Seems like the kind of thing prosecutors might think twice about, and it gives them a trump card in extraordinary circumstances. I don't love it, but all the other ideas i can come up with leave one party so heavily favored that either freedom dies or the government won't stop whining.
- iambateman 7y agoTo empathize with Barr, I can see how he doesn’t draw much distinction between his experience at Verizon and the question of encryption. He experienced the pain and consternation of regulation, and now feels erudite calling BS on “his old industry” as the defender of All Things Right. But of course, when Hacker News is called upon to “nerd harder” we always rise to the challenge. Except when the difference is, in fact, fundamental. Back doors have a way of becoming front doors for the wrong people. And absolute power corrupts absolutely. All of that was true before. It’s just that now getting the wrong set of keys could now open a billion locks at once.
- etherealG 7y ago“Yes, adding a backdoor increases our collective security because it allows law enforcement to eavesdrop on the bad guys.“ No it does not. By definition if the backdoor exists the bad guys won’t use it. This is clearly an excuse for monitoring all people not just the bad guys, and has little to do with security and everything to do with control. Please stop accepting the argument that collective security is improved with eavesdropping, it really really isn’t.
- ElijahBenjamin 7y agoI want to tell the worlds, that the illuminati is real because i have see the benefit of being a member of illuminati, i have tried to join the illuminati some many times, i have been scammed alot of money, but i did not give up because i know if i find the real illuminati, my life will be changed forever so i did not stop, on till i find the real illuminati official email and phone number, if you want to join the real illuminati, i want you to know that i can direct you to the really illuminati official email and phone number, brothers/sisters who is interested or who have be scammed so many times like me, that still have interest to join the illuminati because you believed that if you join your life will be changed, you do not have to worry about anything because i am here to show you all the right way to join the real illuminati, i want you all to know that to join the real illuminati it is free, you will not be ask to pay for any fee, all the process is free to join the illuminati, because when i joined the real illuminati i did not pay for any fee, when i was totally initiated to the illuminati, i was given so many benefits as a new member, i can tell you one of the benefits i was give an instant $2,000,000.00 to start a new life, brothers/sisters that have interest to join the illuminati, this is the real illuminati official email: churchofsataninitiationtemple@gmail.com and the illuminati phone call center or WhatsApp number is +1 (508) 819 2672 you can contact the illuminati official email or WhatsApp number of how to join, if is free to join the illuminati.
- Evawillems 7y agoI PUT SOME MONEY IN NORDFX BROKER ONLINE, LATER I REALIZED THAT THEY WAS SWALLOWING ALL MY INVESTMENTS. AVOID DEALING WITH NORDFX BROKER THEY'RE ONLY A FRAUDULENT PLATFORM. I INVESTED OVER $40000 I COULDN’T WITHDRAW MY MONEY, MONTHS PASSED AND STILL NOTHING. Thankfull AFTER STUMBLING UPON REVIEWS I HIRED [BITCOINRECOVERY @ CONSULTANT. COM] WAS ABLE TO RECOVER MY FUNDS THEM FOR HELP TO RECOVER MY FUNDS, NOW BEEN ABLE TO RECOVER OVER $60000 WITH BENEFITS INCLUSIVE. TO GET A FINANCIAL CHARGEBACK IN PROGRESS WRITE AN EMAIL OR CALL +1516341ONE 871 TO EMPLOY BITCOINRECOVERY |AT| CONSULTANT|DOT|COM YOU WILL REALLY BE HAPPY