3 ms·

You know what, sure. Let's do that. Let's destroy the entirety of online commerce. Let's destroy the ability to digitally prove identities of corporations and

You know what, sure. Let's do that. Let's destroy the entirety of online commerce. Let's destroy the ability to digitally prove identities of corporations and people. Let's eliminate the security and integrity of every computer system. Let's expose every company that uses a network to connect its computers together to hackers. Let's eliminate every viable form of DRM (actually, I'm kinda OK with that one). Let's destroy the entire concept of proof of work. Sure, let's "curb" encryption.

gruez 5y ago
>Let's destroy the entire concept of proof of work. Some HNers would unironically support that.
- actually_a_dog 5y ago
  Sure, I would. Bitcoin proves that proof of work is unsustainable and uses too much energy.
- contravariant 5y ago
  Pretty sure curbing encryption would break proof of stake as well though.
  - falcolas 5y ago
    Crypto-anything, minus crypto, will break. I mean, even the wallets rely on encryption (public/private key encryption, if I understand it correctly).
contravariant 5y ago
DRM isn't encryption just obfuscation.
- falcolas 5y ago
  HDCP. An encrypted stream with a pre-shared key, designed to prevent the interception of video and audio streams over HDMI cables. Even DVDs data streams are encrypted, which is why the release of that magic number (AKA a pre-shared key) is such a big thing.
legutierr 5y ago
Even non-PoW cryptocurrencies depend on cryptographic signatures to verify and authorize state transitions on the blockchain (including value transfer). You can't have a public distributed ledger without public-key cryptography.
- falcolas 5y ago
  I'm realizing I should have said "Merkle tree" instead. But, opportunity lost.
  - deleted 5y ago
    [deleted]
schoen 5y ago
I spent years campaigning on this issue, and I fundamentally don't think that this broad argument will work against measures that encryption opponents are likely to propose today. There was certainly a time when governments opposed availability to the general public of transport encryption and VPNs. Some outliers still do, especially the PRC (when the other endpoint is outside the national territory). But this isn't a mainstream position of governments in liberal democracies today. They generally accept and even promote the use and availability of encryption technology for transport encryption, authentication, and digital signatures. (Some of this may be due to political calculation either in the sense of "it would be too hard to successfully restrict these applications" or "we've decided we think the positives outweigh the negatives".) The remaining campaigns are mostly about device encryption and about end-to-end encryption for messaging. Government agencies campaigning about those mostly think that app stores and software distribution are centralized enough that they could enforce backdoor/exceptional access rules against a few large technology companies and cover the huge majority of civilian applications. It doesn't feel like they're wrong about that these days, does it? (Some recent laws which have already been enacted in certain jurisdictions only kick in when a company has a specified number of users in a particular territory. The enforcement mechanism is typically fines or blocking, or in some cases the threat of arrest of local company representatives, who may also be explicitly required to exist.)
- falcolas 5y ago
  I read the article, which mirrors your points. And what I'm seeing is a bunch of politicians who are ignoring reality for politicial points, using their favorite horsemen of the Infosec apocalypse. Breaking, excuse me, backdooring encryption (including MITM attacks) breaks the trust model which makes our modern devices, communication, and commerce (which fundamentally relies on secure communication between verified parties) work. > It doesn't feel like they're wrong about that these days, does it? If you mean they can/should force companies to break encryption - yes, yes they are. Period.
  - schoen 5y ago
    I don't mean they should, but I mean that if they created laws that were only able to be enforced against a few large tech companies -- including in their roles as intermediaries in software distribution -- most people's access to end-to-end messaging encryption and full-device encryption without backdoors would evaporate quickly. Edit: > Breaking, excuse me, backdooring encryption (including MITM attacks) breaks the trust model which makes our modern devices, communication, and commerce (which fundamentally relies on secure communication between verified parties) work. I would very much like this argument to work, but I don't think it does. First, even with backdoored messenger apps and disk encryption, you can still use HTTPS, and apps can still consume HTTPS APIs. Second, even with backdoored messenger apps and disk encryption, you can still use digital signatures in electronic payment protocols. Third, even with backdoored messenger apps and disk encryption, you can probably still use digital signatures to authenticate software releases and updates. (Although there are many governments interested in tampering with this, so it could easily become another battleground -- and one that I hope the governments would find much more politically difficult.) Most people are already used to having some intermediary (1) possess plaintext of their conversations, and (2) be the authority for them for introducing and confirming contacts. While I think end-to-end encryption represents enormous progress compared to this, I'm not sure there's a political groundswell of support for it when most people don't know what it is and most people don't know if they're using it, or when. (Though I encourage people to continue trying to explain it and make more people care about it more.)

gruez 5y ago

>Let's destroy the entire concept of proof of work. Some HNers would unironically support that.

actually_a_dog 5y ago
Sure, I would. Bitcoin proves that proof of work is unsustainable and uses too much energy.
contravariant 5y ago
Pretty sure curbing encryption would break proof of stake as well though.
- falcolas 5y ago
  Crypto-anything, minus crypto, will break. I mean, even the wallets rely on encryption (public/private key encryption, if I understand it correctly).

contravariant 5y ago

DRM isn't encryption just obfuscation.

falcolas 5y ago
HDCP. An encrypted stream with a pre-shared key, designed to prevent the interception of video and audio streams over HDMI cables. Even DVDs data streams are encrypted, which is why the release of that magic number (AKA a pre-shared key) is such a big thing.

legutierr 5y ago

Even non-PoW cryptocurrencies depend on cryptographic signatures to verify and authorize state transitions on the blockchain (including value transfer). You can't have a public distributed ledger without public-key cryptography.

falcolas 5y ago
I'm realizing I should have said "Merkle tree" instead. But, opportunity lost.
- deleted 5y ago
  [deleted]

schoen 5y ago

I spent years campaigning on this issue, and I fundamentally don't think that this broad argument will work against measures that encryption opponents are likely to propose today. There was certainly a time when governments opposed availability to the general public of transport encryption and VPNs. Some outliers still do, especially the PRC (when the other endpoint is outside the national territory). But this isn't a mainstream position of governments in liberal democracies today. They generally accept and even promote the use and availability of encryption technology for transport encryption, authentication, and digital signatures. (Some of this may be due to political calculation either in the sense of "it would be too hard to successfully restrict these applications" or "we've decided we think the positives outweigh the negatives".) The remaining campaigns are mostly about device encryption and about end-to-end encryption for messaging. Government agencies campaigning about those mostly think that app stores and software distribution are centralized enough that they could enforce backdoor/exceptional access rules against a few large technology companies and cover the huge majority of civilian applications. It doesn't feel like they're wrong about that these days, does it? (Some recent laws which have already been enacted in certain jurisdictions only kick in when a company has a specified number of users in a particular territory. The enforcement mechanism is typically fines or blocking, or in some cases the threat of arrest of local company representatives, who may also be explicitly required to exist.)

falcolas 5y ago
I read the article, which mirrors your points. And what I'm seeing is a bunch of politicians who are ignoring reality for politicial points, using their favorite horsemen of the Infosec apocalypse. Breaking, excuse me, backdooring encryption (including MITM attacks) breaks the trust model which makes our modern devices, communication, and commerce (which fundamentally relies on secure communication between verified parties) work. > It doesn't feel like they're wrong about that these days, does it? If you mean they can/should force companies to break encryption - yes, yes they are. Period.
- schoen 5y ago
  I don't mean they should, but I mean that if they created laws that were only able to be enforced against a few large tech companies -- including in their roles as intermediaries in software distribution -- most people's access to end-to-end messaging encryption and full-device encryption without backdoors would evaporate quickly. Edit: > Breaking, excuse me, backdooring encryption (including MITM attacks) breaks the trust model which makes our modern devices, communication, and commerce (which fundamentally relies on secure communication between verified parties) work. I would very much like this argument to work, but I don't think it does. First, even with backdoored messenger apps and disk encryption, you can still use HTTPS, and apps can still consume HTTPS APIs. Second, even with backdoored messenger apps and disk encryption, you can still use digital signatures in electronic payment protocols. Third, even with backdoored messenger apps and disk encryption, you can probably still use digital signatures to authenticate software releases and updates. (Although there are many governments interested in tampering with this, so it could easily become another battleground -- and one that I hope the governments would find much more politically difficult.) Most people are already used to having some intermediary (1) possess plaintext of their conversations, and (2) be the authority for them for introducing and confirming contacts. While I think end-to-end encryption represents enormous progress compared to this, I'm not sure there's a political groundswell of support for it when most people don't know what it is and most people don't know if they're using it, or when. (Though I encourage people to continue trying to explain it and make more people care about it more.)