6 ms·

Maybe they don’t realize that e-commerce wouldn’t exist without trustworthy encryption. They’re taking about sabotaging trillions of dollars of economic transac

by orev 6y ago

Maybe they don’t realize that e-commerce wouldn’t exist without trustworthy encryption. They’re taking about sabotaging trillions of dollars of economic transactions in lieu of just doing real police work to find the criminals.

autosharp 6y ago
E-commerce would go on just fine even if the government gets a backdoor into the communication.
- 1234letshaveatw 6y ago
  yup- millions upon millions have been victims of data breaches and (at least in the US) regulators don't have the stones to levy harsh penalties.
- marcosdumay 6y ago
  How long will it survive after the backdoor leaks? How long will credit card stay usable? E-commerce has enough problems with security already. Adding digital security as another one will be a huge drag.
  - autosharp 6y ago
    After the backdoor leaks all they need to do is a key rotation.
    - ric2b 6y ago
      Sure, after the damage is done. We'd prefer to prevent the damage.
- Falling3 6y ago
  "The government" and "criminals" are not distinctly separate sets.
jnxx 6y ago
It is not only e-commerce. A digital information network like the Internet is without doubts of great usefulness, be it commerce, business, science, or keeping personal relations. However, a communications network where trustworthiness, integrity, and privacy of communication is not kept is not worth much. This is why: Human communication uses universally some kind of medium to transmit some kind of symbols. This is pretty much universal whether we use gestures, sound waves, smoke signals, handwritten letters, telegraph lines and Morse code or digital networks. To be able to communicate, we need to have trust that the symbols match the reality which they are supposed to describe - be it a bank transaction, a business plan, or a marriage proposal. If symbols and reality do not match, they do not have any value. This is so important that we judge individuals in how well what they say matches what they do, the property which we call honesty and trustworthiness. It is much of the yarn which binds the social fabric. It is quite the same as with money - anyone can print numbers on pieces of paper but to have people agree these pieces represent some value, it needs trust. Without this trust, business is hardly possible. In many realms, privacy is also required, or more technically, confidentiality of individual communication. Especially in business, but also in domains where individuals need to be protected from organizations which have more power than them, and not always benevolent intentions (think of gay people in Russia or Iran). Furthermore, integrity and confidentiality of information is intertwined, as digital signatures do not work without private keys, and security certificates need to be kept safe. This becomes even more important as much software is distributed via the cloud. Without confidential keys, there is no integrity of software. Disabling or crippling encryption is like demanding that no private dwellings can have locks on the doors, so that police can enter at any time and check whether somebody has stolen something. Clearly, theft is not desirable, but preventing theft is not worth it to generally abolish the security of people's private living space.
rocqua 6y ago
Nothing about e-commerce requires e2e encryption. Using non-perfect forward secrecy on TLS has done very little for making webshops safer.
- ric2b 6y ago
  TLS is e2e encryption between the browser and the site. It's absolutely required because the modern e-commerce story relies on sending credit card details over the wire.
megous 6y ago
Not true. E-commerce did just fine even without TLS in the past. Also most of the e-commerce features don't really need encryption, but authenticity. That can be achieved with just asymmetric crypto and signing, but payloads can be in the open. Encryption is only needed for privacy.
- neilalexander 6y ago
  > E-commerce did just fine even without TLS in the past You know what else was easy in the past? Wiretapping, MITMing and network-level surveillance. Moving back to sending credit card numbers and personally-identifiable information in plain-text would be the absolute death of e-commerce.
- orev 6y ago
  There was no e-commerce before SSL. That was a huge thing and one of the main driving factors for all e-commerce sites to get certificates, display all those “trust” badges, etc. Most people buying things online would prefer to keep their credit card information private.
  - megous 6y ago
    Almost no e-commerce solutions handled credit cards. That was done by bank payment gateways. Anyway, most people didn't use credit cards either (and still don't), preferring wire transfers, because they felt they had more control over those (instead of giving someone info they could use to take money from the card at any time, they'd initiate and control the transfer themselves - push vs pull approach). Times changed since then, but there was little financial risk to buyers from e-commerce not being encrypted at the time. You seem to be assuming some US situation, where using credit cards online and handing card details to actual e-commerce websites was/is maybe more common. But this article you're commenting under is about EU and I'm providing an experience from one of the EU member countries. So US situation is not relevant.

by orev 6y ago

autosharp 6y ago

E-commerce would go on just fine even if the government gets a backdoor into the communication.

1234letshaveatw 6y ago
yup- millions upon millions have been victims of data breaches and (at least in the US) regulators don't have the stones to levy harsh penalties.
marcosdumay 6y ago
How long will it survive after the backdoor leaks? How long will credit card stay usable? E-commerce has enough problems with security already. Adding digital security as another one will be a huge drag.
- autosharp 6y ago
  After the backdoor leaks all they need to do is a key rotation.
  - ric2b 6y ago
    Sure, after the damage is done. We'd prefer to prevent the damage.
Falling3 6y ago
"The government" and "criminals" are not distinctly separate sets.

jnxx 6y ago

It is not only e-commerce. A digital information network like the Internet is without doubts of great usefulness, be it commerce, business, science, or keeping personal relations. However, a communications network where trustworthiness, integrity, and privacy of communication is not kept is not worth much. This is why: Human communication uses universally some kind of medium to transmit some kind of symbols. This is pretty much universal whether we use gestures, sound waves, smoke signals, handwritten letters, telegraph lines and Morse code or digital networks. To be able to communicate, we need to have trust that the symbols match the reality which they are supposed to describe - be it a bank transaction, a business plan, or a marriage proposal. If symbols and reality do not match, they do not have any value. This is so important that we judge individuals in how well what they say matches what they do, the property which we call honesty and trustworthiness. It is much of the yarn which binds the social fabric. It is quite the same as with money - anyone can print numbers on pieces of paper but to have people agree these pieces represent some value, it needs trust. Without this trust, business is hardly possible. In many realms, privacy is also required, or more technically, confidentiality of individual communication. Especially in business, but also in domains where individuals need to be protected from organizations which have more power than them, and not always benevolent intentions (think of gay people in Russia or Iran). Furthermore, integrity and confidentiality of information is intertwined, as digital signatures do not work without private keys, and security certificates need to be kept safe. This becomes even more important as much software is distributed via the cloud. Without confidential keys, there is no integrity of software. Disabling or crippling encryption is like demanding that no private dwellings can have locks on the doors, so that police can enter at any time and check whether somebody has stolen something. Clearly, theft is not desirable, but preventing theft is not worth it to generally abolish the security of people's private living space.

rocqua 6y ago

Nothing about e-commerce requires e2e encryption. Using non-perfect forward secrecy on TLS has done very little for making webshops safer.

ric2b 6y ago
TLS is e2e encryption between the browser and the site. It's absolutely required because the modern e-commerce story relies on sending credit card details over the wire.

megous 6y ago

Not true. E-commerce did just fine even without TLS in the past. Also most of the e-commerce features don't really need encryption, but authenticity. That can be achieved with just asymmetric crypto and signing, but payloads can be in the open. Encryption is only needed for privacy.

neilalexander 6y ago
> E-commerce did just fine even without TLS in the past You know what else was easy in the past? Wiretapping, MITMing and network-level surveillance. Moving back to sending credit card numbers and personally-identifiable information in plain-text would be the absolute death of e-commerce.
orev 6y ago
There was no e-commerce before SSL. That was a huge thing and one of the main driving factors for all e-commerce sites to get certificates, display all those “trust” badges, etc. Most people buying things online would prefer to keep their credit card information private.
- megous 6y ago
  Almost no e-commerce solutions handled credit cards. That was done by bank payment gateways. Anyway, most people didn't use credit cards either (and still don't), preferring wire transfers, because they felt they had more control over those (instead of giving someone info they could use to take money from the card at any time, they'd initiate and control the transfer themselves - push vs pull approach). Times changed since then, but there was little financial risk to buyers from e-commerce not being encrypted at the time. You seem to be assuming some US situation, where using credit cards online and handing card details to actual e-commerce websites was/is maybe more common. But this article you're commenting under is about EU and I'm providing an experience from one of the EU member countries. So US situation is not relevant.