3 ms·

I don't mean they should, but I mean that if they created laws that were only able to be enforced against a few large tech companies -- including in their roles

by schoen 5y ago

I don't mean they should, but I mean that if they created laws that were only able to be enforced against a few large tech companies -- including in their roles as intermediaries in software distribution -- most people's access to end-to-end messaging encryption and full-device encryption without backdoors would evaporate quickly. Edit: > Breaking, excuse me, backdooring encryption (including MITM attacks) breaks the trust model which makes our modern devices, communication, and commerce (which fundamentally relies on secure communication between verified parties) work. I would very much like this argument to work, but I don't think it does. First, even with backdoored messenger apps and disk encryption, you can still use HTTPS, and apps can still consume HTTPS APIs. Second, even with backdoored messenger apps and disk encryption, you can still use digital signatures in electronic payment protocols. Third, even with backdoored messenger apps and disk encryption, you can probably still use digital signatures to authenticate software releases and updates. (Although there are many governments interested in tampering with this, so it could easily become another battleground -- and one that I hope the governments would find much more politically difficult.) Most people are already used to having some intermediary (1) possess plaintext of their conversations, and (2) be the authority for them for introducing and confirming contacts. While I think end-to-end encryption represents enormous progress compared to this, I'm not sure there's a political groundswell of support for it when most people don't know what it is and most people don't know if they're using it, or when. (Though I encourage people to continue trying to explain it and make more people care about it more.)

falcolas 5y ago
Along with everything I posted in the original comment. There is no picking and choosing. These idiots, excuse me, politicians, need to understand that.
- schoen 5y ago
  Sorry, I don't think I understand your argument. Could you try it a different way? In the 1990s crypto war there were great points to be made that encryption and authentication are technologically dual to each other, that encryption algorithms are simple, and that knowledge of cryptographic techniques can no longer be monopolized by governments. There were also great points to be made that businesses and governments strongly desired modern encryption technology, and that protecting individuals against mass surveillance sounded like a good idea from the vantage point of many different political and ethical theories. So, the 1990s encryption control approach was super-fragile because it was notionally based on controlling access to knowledge (and also the nationalist part about preventing that knowledge from reaching foreigners, or something). One classic artifact of the old crypto war (you know, when crypto meant "cryptography") is the RSA e-mail signature / t-shirt http://www.cypherspace.org/rsa/ http://www.cypherspace.org/rsa/ while another is CipherSaber, the attempt to get people to learn how to implement the RC4 cipher from scratch http://ciphersaber.gurus.org/ http://ciphersaber.gurus.org/ Both of these seem to be based on the shared understanding between the government and privacy activists that knowing how to implement cryptographic primitives is a super-big deal that must either be strictly controlled or made ubiquitous (depending on your view of the moral valence of civilian cryptography). In the present environment, we have a ton of centralization in software and computing infrastructure and passivity on the part of technology users. Individual governments have already met with tons of success in censoring particular apps from app stores, without purporting to suppress knowledge of how to implement cryptographic software or anything. These app stores have tons of power over most people's experience of technological capabilities. Governments and others are learning to directly influence the exercise of that power, exactly as the free software movement feared throughout the past couple of decades. If a government's model of controlling encryption is to say that apps in app stores must have, or must not have, particular characteristics, then I don't see how those apps are going to remain mainstream, except in a handful of cases where there's a lot of backlash from banning them or blocking a particular product. Nonetheless, "encryption" as a category of technology itself remains totally mainstream even in, say, China, and is used for tons of information security applications other than really strong confidentiality against the state. You could learn about the RSA algorithm in a computer science class in China, just as you could in the United States. You could even implement the RSA algorithm (or call into a library that implements it) in software development in China. Your difficulties might begin only when you tried to use it as part of an end-to-end encrypted instant messaging protocol in an app that you published in an app store (and mainly if the that app became popular). On the other hand, if you had an HTTPS endpoint for an e-commerce API in China, and you had all of the licenses that the government expected, I don't think the government would have the least bit of objection to that. Edit: There is one thing that I still think might push in the other direction, which is governments' rivalry with each other. As I've said before, you could have a Brazilian in France using a Korean app to talk to an American in South Africa (and in the present day, you probably do!). No backdoor proposal has made clear which of those states do or don't get to use the backdoor, or how anyone knows, or how a state can ever guarantee that a particular foreign state doesn't use it. ... But one present-day approach that's growing in popularity seems to be to have apps align with particular power blocs and then just get banned elsewhere. :-(

by schoen 5y ago

falcolas 5y ago

Along with everything I posted in the original comment. There is no picking and choosing. These idiots, excuse me, politicians, need to understand that.

schoen 5y ago
Sorry, I don't think I understand your argument. Could you try it a different way? In the 1990s crypto war there were great points to be made that encryption and authentication are technologically dual to each other, that encryption algorithms are simple, and that knowledge of cryptographic techniques can no longer be monopolized by governments. There were also great points to be made that businesses and governments strongly desired modern encryption technology, and that protecting individuals against mass surveillance sounded like a good idea from the vantage point of many different political and ethical theories. So, the 1990s encryption control approach was super-fragile because it was notionally based on controlling access to knowledge (and also the nationalist part about preventing that knowledge from reaching foreigners, or something). One classic artifact of the old crypto war (you know, when crypto meant "cryptography") is the RSA e-mail signature / t-shirt http://www.cypherspace.org/rsa/ http://www.cypherspace.org/rsa/ while another is CipherSaber, the attempt to get people to learn how to implement the RC4 cipher from scratch http://ciphersaber.gurus.org/ http://ciphersaber.gurus.org/ Both of these seem to be based on the shared understanding between the government and privacy activists that knowing how to implement cryptographic primitives is a super-big deal that must either be strictly controlled or made ubiquitous (depending on your view of the moral valence of civilian cryptography). In the present environment, we have a ton of centralization in software and computing infrastructure and passivity on the part of technology users. Individual governments have already met with tons of success in censoring particular apps from app stores, without purporting to suppress knowledge of how to implement cryptographic software or anything. These app stores have tons of power over most people's experience of technological capabilities. Governments and others are learning to directly influence the exercise of that power, exactly as the free software movement feared throughout the past couple of decades. If a government's model of controlling encryption is to say that apps in app stores must have, or must not have, particular characteristics, then I don't see how those apps are going to remain mainstream, except in a handful of cases where there's a lot of backlash from banning them or blocking a particular product. Nonetheless, "encryption" as a category of technology itself remains totally mainstream even in, say, China, and is used for tons of information security applications other than really strong confidentiality against the state. You could learn about the RSA algorithm in a computer science class in China, just as you could in the United States. You could even implement the RSA algorithm (or call into a library that implements it) in software development in China. Your difficulties might begin only when you tried to use it as part of an end-to-end encrypted instant messaging protocol in an app that you published in an app store (and mainly if the that app became popular). On the other hand, if you had an HTTPS endpoint for an e-commerce API in China, and you had all of the licenses that the government expected, I don't think the government would have the least bit of objection to that. Edit: There is one thing that I still think might push in the other direction, which is governments' rivalry with each other. As I've said before, you could have a Brazilian in France using a Korean app to talk to an American in South Africa (and in the present day, you probably do!). No backdoor proposal has made clear which of those states do or don't get to use the backdoor, or how anyone knows, or how a state can ever guarantee that a particular foreign state doesn't use it. ... But one present-day approach that's growing in popularity seems to be to have apps align with particular power blocs and then just get banned elsewhere. :-(