3 ms·

The difference is that strong encryption is an all or nothing proposition. You either have strong encryption that works in all scenarios, both good and ill, or

The difference is that strong encryption is an all or nothing proposition. You either have strong encryption that works in all scenarios, both good and ill, or you have weak encryption that protects nothing. There unfortunately is no middle ground, and plenty of people and governments have tried. Selective censorship by central authorities can be granular, choosing to create a legal process for selective censorship doesn’t suddenly allow any person on the internet to potentially censor any thing they want. Weak encryption however allows anyone, anywhere, with enough effort to break all encryption everywhere, and do so without without detection or needing to expose themselves via a legal system. Also there aren’t “central encryption authorities” that all encryption passes through. Anyone can implement modern crypto wherever, so banning it makes no sense. It’s like trying to ban the concept of Pi.

slg 5y ago
>You either have strong encryption that works in all scenarios, both good and ill, or you have weak encryption that protects nothing. There unfortunately is no middle ground, and plenty of people and governments have tried. This is always stated as a universal truth of the technology, but this mostly seems like a people and organizational problem. We already have encryption algorithms that can encrypt content for decryption by multiple optional keys. Why couldn't we fragment and distribute one set of those keys among multiple legal entities? That would require coordination and agreement to decrypt anything. That wouldn't be a true backdoor anymore than the original key is a backdoor, it would simply be overhead on the existing encrypted content to allow it to be decrypted by multiple keys. >Also there aren’t “central encryption authorities” that all encryption passes through. Anyone can implement modern crypto wherever, so banning it makes no sense. It’s like trying to ban the concept of Pi. This is true, but defaults matter. If the US makes a law regarding encryption, Google, Apple, Amazon, Microsoft, Facebook, etc are all going to follow it. You still might be able to roll your own encryption, but the people who do that will be a tiny share of overall communication. Laws like this aren't meant to completely stop something. Putting in financial regulations to crack down on money laundering doesn't stop money laundering. The goal is to make it more difficult and prevent the most egregious cases.
- kortilla 5y ago
  > Why couldn't we fragment and distribute one set of those keys among multiple legal entities? Because crypto is implemented in software and it’s trivial to remove the part that encrypts for the government’s key.
  - slg 5y ago
    You completely ignored the last paragraph of my comment where I addressed this type of concern.
    - gjs278 5y ago
      stop posting. you’re wrong and your idea sucks. there’s nothing else to say.
    - kortilla 5y ago
      Because it’s detached from reality and shows a misunderstanding of how deeply embedded secure crypto is into everything. Nearly every X86 processor now supports AES intrinsics that are used in the building blocks of far beyond encrypting messages (e.g. golang’s hashing). Additionally, a from scratch implementation of AES in JavaScript or any other modern programming language is a junior level task. Unless you propose trying to ban every copy of the AES algorithm, it will be trivially implemented and passed around regardless of what FAANG does. Money laundering restrictions work because everything goes through a fairly centralized banking system. Crypto has no such equivalent.
      - slg 5y ago
        >Money laundering restrictions work because everything goes through a fairly centralized banking system. Crypto has no such equivalent. You are treating encryption as an independent end goal by itself when it is only a tool that is used during communication and storage. Communication and to a lesser extent storage are highly centralized. How much of the average person's encrypted communication occurs in a channel that is not touched by some US company?
- 5y ago
TurningCanadian 5y ago
I wouldn't say it's all or nothing. Several of the more regressive countries already demand access to decryption keys. The government gets easy access to the data but it's still hard for the non-state bad guys to intercept.
- avianlyric 5y ago
  Doesn’t help if people are using end-to-end encryption.
  - TurningCanadian 5y ago
    They can block any traffic that they can't decode
ChrisKnott 5y ago
It's not all or nothing, at all. The argument is about whether the material can be theoretically legally recovered like Gmail and Facebook Messenger (currently), or not, like WhatsApp. All these services use encryption and are secure.

slg 5y ago

>You either have strong encryption that works in all scenarios, both good and ill, or you have weak encryption that protects nothing. There unfortunately is no middle ground, and plenty of people and governments have tried. This is always stated as a universal truth of the technology, but this mostly seems like a people and organizational problem. We already have encryption algorithms that can encrypt content for decryption by multiple optional keys. Why couldn't we fragment and distribute one set of those keys among multiple legal entities? That would require coordination and agreement to decrypt anything. That wouldn't be a true backdoor anymore than the original key is a backdoor, it would simply be overhead on the existing encrypted content to allow it to be decrypted by multiple keys. >Also there aren’t “central encryption authorities” that all encryption passes through. Anyone can implement modern crypto wherever, so banning it makes no sense. It’s like trying to ban the concept of Pi. This is true, but defaults matter. If the US makes a law regarding encryption, Google, Apple, Amazon, Microsoft, Facebook, etc are all going to follow it. You still might be able to roll your own encryption, but the people who do that will be a tiny share of overall communication. Laws like this aren't meant to completely stop something. Putting in financial regulations to crack down on money laundering doesn't stop money laundering. The goal is to make it more difficult and prevent the most egregious cases.

kortilla 5y ago
> Why couldn't we fragment and distribute one set of those keys among multiple legal entities? Because crypto is implemented in software and it’s trivial to remove the part that encrypts for the government’s key.
- slg 5y ago
  You completely ignored the last paragraph of my comment where I addressed this type of concern.
  - gjs278 5y ago
    stop posting. you’re wrong and your idea sucks. there’s nothing else to say.
  - kortilla 5y ago
    Because it’s detached from reality and shows a misunderstanding of how deeply embedded secure crypto is into everything. Nearly every X86 processor now supports AES intrinsics that are used in the building blocks of far beyond encrypting messages (e.g. golang’s hashing). Additionally, a from scratch implementation of AES in JavaScript or any other modern programming language is a junior level task. Unless you propose trying to ban every copy of the AES algorithm, it will be trivially implemented and passed around regardless of what FAANG does. Money laundering restrictions work because everything goes through a fairly centralized banking system. Crypto has no such equivalent.
    - slg 5y ago
      >Money laundering restrictions work because everything goes through a fairly centralized banking system. Crypto has no such equivalent. You are treating encryption as an independent end goal by itself when it is only a tool that is used during communication and storage. Communication and to a lesser extent storage are highly centralized. How much of the average person's encrypted communication occurs in a channel that is not touched by some US company?
5y ago

TurningCanadian 5y ago

I wouldn't say it's all or nothing. Several of the more regressive countries already demand access to decryption keys. The government gets easy access to the data but it's still hard for the non-state bad guys to intercept.

avianlyric 5y ago
Doesn’t help if people are using end-to-end encryption.
- TurningCanadian 5y ago
  They can block any traffic that they can't decode

ChrisKnott 5y ago

It's not all or nothing, at all. The argument is about whether the material can be theoretically legally recovered like Gmail and Facebook Messenger (currently), or not, like WhatsApp. All these services use encryption and are secure.