10 ms·
The battle to outlaw end-to-end encryption in the U.S. is heating up
- jolmg 6y ago> To make things worse, the Act proposes the creation of a hybrid bounty program, giving third-parties financial incentives to extract encrypted data following a request from U.S. agencies. In short, if the tech companies won’t build a backdoor, the U.S. government will pay hackers top dollar to use whatever means necessary to get the data for them. Is that worse?
- m-p-3 6y ago> the U.S. government will pay hackers top dollar to use whatever means necessary to get the data for them. Probably the current state of affair anyway.
- m463 6y agoExcept out in the open with plausible ... stuff. Kind of like how woods hole "finds" a lot of stuff in the ocean.
- nitrogen 6y agoCould you elaborate on the "stuff" that is found in the ocean for the purposes of this analogy?
- thecoppinger 6y agoSecond that, please - the analogy went over my head, but sounds interesting
- m463 6y agoI suspect other arms of the government that can put a man far underwater find things in the ocean and pass it on. so if woods hole finds something, or a hacker finds something, who knows if they got a hint from elsewhere.
- dannyw 6y agoI mean, if this means bounty hunters sell their exploits to the US Government instead of selling it to a financial fraud ring, that seems like a good thing.
- throwawayway9 6y agoCould you elaborate on that?
- Nbox9 6y agoProbably for some operations. This would allow more of the intercepted and decrypted messages to become evidence in court. This would encourage more law enforcement agencies to use more backdoors. IANAL
- JamesBarney 6y agoI think it's a better solution. Far safer for the government to employ expert lock picks than to outlaw locks.
- markovbot 6y agoOnly if the government tells us when they find a back door, which they obviously would not do.
- jolmg 6y agoEven if they don't, I think it's still better.
- deleted 6y ago[deleted]
- SoylentYellow 6y agoI thought that was the current status quo?
- xkcd-sucks 6y agoIt will probably turn out that the most cost effective way of getting around encryption is bribing employees, whether through a contracting firm or directly. Great for trust...
- Mirioron 6y agoReminds me of Australia. https://www.wired.com/story/australia-encryption-law-global-impact/ https://www.wired.com/story/australia-encryption-law-global-...
- IAmEveryone 6y agoOf course it's worse, at least if it is successful. You already start out with two entities with access to your data instead of just the government. And one of them has already proven to be financially motivated and morally flexible, making it likely they will be willing to share their knowledge with any number of additional bidders.
- dbsmith83 6y agoNo, because if data that was encrypted is used in court, at least you know that the encryption scheme has been cracked. Even if they don't show how they cracked it, you can at least know it has likely been compromised (unless, of course, they somehow installed spyware on your device to intercept the data before encryption). I believe that people trying to break encryption leads to better encryption.
- boomboomsubban 6y agoIf they were just paying hackers to build the backdoor, it might be better. Requiring a US agency request is basically a loyalty oath though, as their work violates the DMCA if that request is rescinded.
- helixhelix 6y agoYeah. Tax dollars at work.
- jjcon 6y agoEveryone should actually just go read the bill rather than just get news from a bunch of sources that stand to gain or lose from aspects of it. A ton of these claims are unsubstantiated if you look in the latest versions. There is so much Fear slinging going on around the web it’s seriously just bizarre to me after actually reading the bill.
- raspyberr 6y agoTell me how anything can be done about encryption (especially E2E encryption) that won't be abused. US considered encryption arms less than 30 years ago. We're living in the best possible time for it. Genuine open-source end-to-end encryption, that can only be seen by your recipient. No one can do anything about it. In the current world where privacy feels like it's non-existent, you have these islands of hope and even these are being eroded. Yes, I agree you should always read first-hand rather than second-hand reports but is there literally anything the government would do that I would want them to do to the current state of encryption?
- VLM 6y ago"can only be seen by your recipient" Both endpoints are DRM'd and controlled and recorded by big brother, you don't have root on either although uncountable exploits and viruses do, and often at least one of the endpoints is big brother himself so obtaining logs will be quite easy.
- bjelkeman-again 6y agoBut, isn’t the argument that access this way is cumbersome and only available economically to priority targets? Also, if you need you can run Linux as end points.
- Reelin 6y agoRun Linux ... on a device whose CPU has an unauditable security coprocessor? A CPU whose microcode is implemented in encrypted firmware? A device whose physical hardware can't be meaningfully audited without state actor level resources? I don't really think such approaches are used or even viable currently. But if it ever were a concern, "run Linux" doesn't even begin to address it. (Anyway you can't run Linux if your endpoint is a phone with a locked bootloader.)
- bb88 6y agoA few years back someone was writing software that did potentially illegal things, like more than 40 bits of crypto, which was illegal when distributed outside of the US (maybe still is). Their response was: "It's completely legal as distributed. Look at the header and you'll see: #define CRYPTO_LENGTH 40 "
- deleted 6y ago[deleted]
- bArray 6y agoI believe it was something to this affect that prevented us from implementing decent crypto for vehicles. There was some rule about export (possibly to the US or out of the US) that meant there was a limitation on how secure we could make the software. As a result, everybody ended up getting the same shitty low-security version of the product worldwide (they wanted to limit the number of variations for test coverage).
- jtbayly 6y agoThat sounds like a win for vehicle owners, honestly, given that encryption is often used for locking owners out of the ability to change things about their car without paying the manufacturer more money.
- bArray 6y agoYou might think so, but the encryption used at the time was such that only somebody with quite a few resources (such as a government actor) could reasonably break the encryption. It wasn't a win for owners or tinkerers. What's more worrying is that there are a bunch of vehicles out there with security that is going to age * very * fast compared to that used every day (SSH, certs, etc). Consider that the automotive industry might be under similar constraints with regards to autonomous vehicles, something a bad actor could really cause some damage with.
- userbinator 6y ago"If you outlaw encryption, only outlaws will have encryption."
- pmoriarty 6y agoI used to view steganography as a viable mitigation strategy for the outlawing of encryption. Over the years, I've come to consider steganography as inadequate as a means of mass communication, as the more people know about how to receive a stegonographic message the less effective it is at hiding the content. Steganography is most useful in one-on-one communication where the means to read the message is exchanged in a secondary secure channel of communication. Sadly, this just does not scale well. For this and other reasons, I've kind of become pessimistic about the security and privacy of communication using computers, and even more so towards such security and privacy being available to the masses.
- behringer 6y agoThe US is giving up it's supremacy in most areas, but that doesn't mean the world won't have viable encryption. It will just come from a more reasonable country.
- stevespang 6y agoE to E encryption will just go offshore - - - and the US Gov't. will claim that if the offshore co's encryption is used inside the US to commit a criminal act and that co refuses to hand over the keys (which they don't have) - - then the US Gov't have the right to arrest offshore co principals using extra territorial rendition if necessary (kidnapping), plus interpol red notice. E to E encryption developers will be forced underground. Signal, Telegram, etc.
- Chiba-City 6y agoThese bills are self-defeating. I suffer no affections for narcotics dealers and human traffickers seeking anonymity, but I also suffer no affections for "Western" bankers fixing LIBOR and NSA tapping phones of our NATO "allies." As is, our USA "cloud" is already a Trojan Horse. At this point, Open Source and strong encryption are already prerequisites of any imaginable national sovereignty. If we can't "export" strong encryption, we'll just "export" strong encryption engineers.
- coronadisaster 6y agoend-to-end encryption is the only way that you can keep democracy alive/healthy
- creato 6y agoDemocracy has existed for hundreds of years without it. Encryption is an interesting development. There has never been a time in history when anything could be truly secured. Safes could always be defeated. Communication was never provably secure. I'm opposed to any mandated weaknesses in encryption, but I also think a lot of the arguments opposing them are dogmatic and unconvincing.
- Marsymars 6y agoSee, I don't view encrypted data as a technological improvement over safes, I view it as a technological improvement over human memory. They're both primarily vulnerable to rubber-hose cryptanalysis. Mandating weaknesses in encryption effectively makes the technology less useful by fundamentally shifting it from an improvement over human memory to an improvement over a safe.
- theonemind 6y agoDemocracy also existed without ubiquitous surveillance technology during the same time period, so I don't consider that point refuted.
- rurp 6y agoDo you mind sharing which arguments you do find convincing?
- adrianN 6y agoCommunication used to be provably secure when you could meet with the person you want to communicate with without being afraid of ubiquitous surveillance tracking your every move and hidden listening devices (or just your phones) recording your conversation. Until a few decades ago it was never possible to do surveillance at scale. You had to first identify suspects and then start surveillance.
- shmerl 6y agoThese garbage attempts resurface periodically. Some just never learn.
- DangitBobby 6y agoThey have learned just fine, but the lesson is the opposite of what you want. If the people don't want something, bring it up again and again and you can still eventually make it law, despite the people's desires.
- shmerl 6y agoThen they should be defeated again and again.
- DangitBobby 6y agoIt only takes winning once. It doesn't help that public opinion holds little to no sway, and that it takes money from big players to fight it off every time.
- shmerl 6y agoCorrupt laws can be repealed. Something like DMCA 1201 looks set in stone, but I have no doubt it will eventually be scrapped. But I agree, if such kind of junk becomes law it's much harder to repeal it, than to prevent it from becoming law in the first place.
- mirimir 6y agoFrom a cynical perspective, this is a market opportunity for VPN services. As were Snowdon's leaks, which hugely expanded the VPN service industry. And indeed, using VPN services (let alone nested VPN chains and Tor) largely obviates risks from these bills. Without cooperation from the VPN service, gathering sufficient information for a warrant is problematic. But I wonder. Might the US regulate using VPN services, as authoritarian regimes already do?
- downvoteme1 6y agoDoesn’t the language of this bill mean that US based VPN services will be forced to provide their encryption keys to the government to allow to decrypt their traffic ?
- mirimir 6y agoPerhaps so. But then, nobody who seriously cares would ever use a US-based VPN service ;) And even for US-based VPN services, I gather that a warrant would be required, and that'd be hard with no information about what the VPN link had been used for.
- Reelin 6y agoPresumably a warrant can be obtained if criminal activity is traced back to a specific VPN provider. Of course that's already the case as far as I understand (ex LavaBit). I also don't see how VPNs would be affected since they already have access to all your traffic anyway - no backdoor is necessary.
- mirimir 6y agoIt depends who you mean by "they". VPN services certainly have access to users' data. But it'd be commercial suicide to cooperate with authorities. HideMyAss lost considerable market share after it came it that they had pwned someone from LulzSec. Still, it's prudent to assume that any VPN provider will give you up. And that's why I recommend using nested VPN chains. With three different VPN services, it'd be nontrvial for adversaries to obtain enough data.
- fanatic2pope 6y agoLooking at the other comments in here, I have to say Americans still seem way too optimistic that the USA could not become a totalitarian state along the lines of Russia or China.
- mlazos 6y agoIdiotic legislation is proposed all the time. I can still call it idiotic and say we need a new president. Can’t say that in either of those countries. Just because our elected leaders suck doesn’t mean they’re totalitarian.
- catoc 6y agoIf government backdoors are really necessary, the government should be able to provide an explanation without using the words 'terrorism' or 'child pornography'.