2 ms·

I don't believe they are making encryption illegal. Rather, they would likely require any org doing TLS for them to provide lawful intercept, logging, audit an

I don't believe they are making encryption illegal. Rather, they would likely require any org doing TLS for them to provide lawful intercept, logging, audit and compliance. If a government org is managing their own network stack, then requiring TLS would be a non issue as they can provide their audit orgs with all the data they want, as they likely do today. From all the bills I have read, there is nothing that makes encryption illegal. They want the ability to access data from the servers after it has been decrypted. This includes a way to intercept what users perceive to be end-to-end encryption. The only problem I have run into with various government orgs is the lack of knowledge around implementing intermediate certificates. They will often try to talk people into installing their certs rather than installing intermediate certs correctly. I always point them to testssl.sh [1] [1] - https://github.com/drwetter/testssl.sh https://github.com/drwetter/testssl.sh

cryptoz 6y ago
I am having trouble parsing your comment. What do you mean by, > I don't believe they are making encryption illegal....They want the ability to access data from the servers after it has been decrypted. This includes a way to intercept what users perceive to be end-to-end encryption. This is contradictory, no? The data is not encrypted between 2 users if a 3rd user can read it. It sounds like every bill you read makes encryption illegal, by your own explanation of the bill? I just don't understand what you mean here. Maybe it's my personal understanding of 'encryption'? If Alice encrypts a message to Bob, and also gives the keys to Eve, but doesn't tell Bob that Eve has the keys, then I do not personally consider that message encrypted at all. Do you? What about the bills? A message encrypted with a key held by a potential attacker is not an encrypted message any more.
- LinuxBender 6y ago
  Perhaps this is a terminology issue. Encryption being illegal implies to me that if someone uses encryption, they are violating a law and will be penalized. Providing lawful intercept (backdoors) does not preclude the use of encryption; but rather, renders it non existent for those with the lawful intercept access. Where this gets really sketchy is if companies give users the perception that they have end-to-end encryption, but also have a way to intercept that traffic. So I think we are in effect saying the same thing, but I am just saying that encryption is not illegal, just rendered non existent for specific parties. This is actually already in place today in many of the big centralized service providers. I believe these proposed laws are just a way to officiate this so that companies are protected and less likely to resist requests for information for fear of legal repercussion.
  - wizzwizz4 6y ago
    > but rather, renders it non existent for those with the lawful intercept access And for plenty of people who don't have the lawful intercept access. This downgrades encryption from "encrypts stuff" to "obfuscates stuff"; while technically incorrect, it's probably better to describe this as "no longer encryption" because it's clearer to non-techies.
    - LinuxBender 6y ago
      No, encryption still encrypts stuff. There is no obfuscation being suggested in these bills. Rather, some groups will have the ability to see data without encryption, as they do today, but with easier access and less red tape and less having to do inside deals and people looking the other way or depending on NSL's. Please don't get me wrong, I am not in support of these bills. I think it is risky to incorrectly describe what is happening, especially for non technical people. I believe the right way to describe this to non technical people would be: "Today, some people can see your traffic even if it is encrypted. If one of these bills (there are a few versions) are approved, then more groups will be able to see your data, easier and quicker." If you want to get people more interested in speaking up, then the best lessons learned would be from the interview between John Oliver and Edward Snowden. John interviewed many people on the street about the NSA having access to all your phone data. Nobody cared until he clarified and said, "So you would be ok with government employees looking at your significant others nude pics / sexting pics". At that point, most of the people interviewed said they would be furious.
rezonant 6y ago
What? No, GP is talking about EARN IT et al which would mandate backdoors in encryption tech
- klyrs 6y ago
  If the government holds the private keys, don't they have that backdoor access to their own https traffic?
  - rezonant 6y ago
    Who watches the watchers?
- president 6y ago
  Where again does EARN IT [1] mention anything about mandating backdoors in encryption tech? [1] https://www.congress.gov/bill/116th-congress/senate-bill/3398/text https://www.congress.gov/bill/116th-congress/senate-bill/339...

cryptoz 6y ago

I am having trouble parsing your comment. What do you mean by, > I don't believe they are making encryption illegal....They want the ability to access data from the servers after it has been decrypted. This includes a way to intercept what users perceive to be end-to-end encryption. This is contradictory, no? The data is not encrypted between 2 users if a 3rd user can read it. It sounds like every bill you read makes encryption illegal, by your own explanation of the bill? I just don't understand what you mean here. Maybe it's my personal understanding of 'encryption'? If Alice encrypts a message to Bob, and also gives the keys to Eve, but doesn't tell Bob that Eve has the keys, then I do not personally consider that message encrypted at all. Do you? What about the bills? A message encrypted with a key held by a potential attacker is not an encrypted message any more.

LinuxBender 6y ago
Perhaps this is a terminology issue. Encryption being illegal implies to me that if someone uses encryption, they are violating a law and will be penalized. Providing lawful intercept (backdoors) does not preclude the use of encryption; but rather, renders it non existent for those with the lawful intercept access. Where this gets really sketchy is if companies give users the perception that they have end-to-end encryption, but also have a way to intercept that traffic. So I think we are in effect saying the same thing, but I am just saying that encryption is not illegal, just rendered non existent for specific parties. This is actually already in place today in many of the big centralized service providers. I believe these proposed laws are just a way to officiate this so that companies are protected and less likely to resist requests for information for fear of legal repercussion.
- wizzwizz4 6y ago
  > but rather, renders it non existent for those with the lawful intercept access And for plenty of people who don't have the lawful intercept access. This downgrades encryption from "encrypts stuff" to "obfuscates stuff"; while technically incorrect, it's probably better to describe this as "no longer encryption" because it's clearer to non-techies.
  - LinuxBender 6y ago
    No, encryption still encrypts stuff. There is no obfuscation being suggested in these bills. Rather, some groups will have the ability to see data without encryption, as they do today, but with easier access and less red tape and less having to do inside deals and people looking the other way or depending on NSL's. Please don't get me wrong, I am not in support of these bills. I think it is risky to incorrectly describe what is happening, especially for non technical people. I believe the right way to describe this to non technical people would be: "Today, some people can see your traffic even if it is encrypted. If one of these bills (there are a few versions) are approved, then more groups will be able to see your data, easier and quicker." If you want to get people more interested in speaking up, then the best lessons learned would be from the interview between John Oliver and Edward Snowden. John interviewed many people on the street about the NSA having access to all your phone data. Nobody cared until he clarified and said, "So you would be ok with government employees looking at your significant others nude pics / sexting pics". At that point, most of the people interviewed said they would be furious.

rezonant 6y ago

What? No, GP is talking about EARN IT et al which would mandate backdoors in encryption tech

klyrs 6y ago
If the government holds the private keys, don't they have that backdoor access to their own https traffic?
- rezonant 6y ago
  Who watches the watchers?
president 6y ago
Where again does EARN IT [1] mention anything about mandating backdoors in encryption tech? [1] https://www.congress.gov/bill/116th-congress/senate-bill/3398/text https://www.congress.gov/bill/116th-congress/senate-bill/339...