3 ms·

One problem (among many) is there's no such thing as "the" government. It's a relative term and its meaning depends on context. If we take it to mean all gover

One problem (among many) is there's no such thing as "the" government. It's a relative term and its meaning depends on context. If we take it to mean all governments, then that means China gets a copy of the key and can use it to spy on the communications of the Australian government. If we take it to mean just one government (or a few select governments), then what is the criteria for deciding the government of country X should have a key but country Y should not? Ultimately of course it comes down to a matter of coercive power and jurisdiction, which particularly complicates efforts trying to build products or services that are intended for global usage. I believe we need to push back against anti-encryption laws in the west so we have some ground to stand on when making a case that they shouldn't be accepted elsewhere.

dustinmr 7y ago
The other problem is that even within one government there isn’t really “the” government. There’s office A and task group X and the prosecutor for this area and that special envoy and this law enforcement agency and that law enforcement agency and various courts, etc, etc, etc. If you haven’t worked much with a large government, you don’t tend to realize just how fractured it all is.
- ganeshkrishnan 7y ago
  And as someone that consulted for large government organization, the key will be emailed to anyone who needs access. I had access to ssh keys from the project owner for a government contract and the person did not even ask me to delete the keys after the project was over.
  - DataWorker 7y ago
    You probably signed a form saying you would. As long as they have a signed form and you have the keys, everyone is happy. Nothing is really secure anyway, except the stuff that matters.
    - Smoosh 7y ago
      > Nothing is really secure anyway, except the stuff that matters. This is the key, I feel. Just enough CYA while still doing BAU (which includes security agencies snooping on people). Governments think they will be able to secure their important stuff. Everyone else can have the illusion of security, without actual security. When there is a master key leak, it will be someone else's problem, and can be blamed on bad actors.

dustinmr 7y ago

The other problem is that even within one government there isn’t really “the” government. There’s office A and task group X and the prosecutor for this area and that special envoy and this law enforcement agency and that law enforcement agency and various courts, etc, etc, etc. If you haven’t worked much with a large government, you don’t tend to realize just how fractured it all is.

ganeshkrishnan 7y ago
And as someone that consulted for large government organization, the key will be emailed to anyone who needs access. I had access to ssh keys from the project owner for a government contract and the person did not even ask me to delete the keys after the project was over.
- DataWorker 7y ago
  You probably signed a form saying you would. As long as they have a signed form and you have the keys, everyone is happy. Nothing is really secure anyway, except the stuff that matters.
  - Smoosh 7y ago
    > Nothing is really secure anyway, except the stuff that matters. This is the key, I feel. Just enough CYA while still doing BAU (which includes security agencies snooping on people). Governments think they will be able to secure their important stuff. Everyone else can have the illusion of security, without actual security. When there is a master key leak, it will be someone else's problem, and can be blamed on bad actors.