3 ms·

> Why couldn't we fragment and distribute one set of those keys among multiple legal entities? There would be thousands if not millions of legitimate decryptio

> Why couldn't we fragment and distribute one set of those keys among multiple legal entities? There would be thousands if not millions of legitimate decryptions every year. At each instance all of the fragments will need to be put together, creating an opportunity for the data to be exfiltrated. Additionally your making the assumption that legal agencies will be able to securely store these keys long term (I.e forever). Regardless of your view on the operational and security competency of these agencies, it’s extreme difficulty to keep cryptographic keys secure long term if you need to be able to access them on a regular basis. Even if you don’t think most criminal organisations will manage this, you can pretty much guarantee that large nation state actors like China and Russia will find a way to get hold of these keys. You then give your largest competitors the ability to seriously damage your economy or steal secrets by either using the keys themselves, or leaking them on the internet. Suddenly every single message sent by every citizen, politician, bank, weapons company etc becomes public for all to see. > This is true, but defaults matter. If the US makes a law regarding encryption, Google, Apple, Amazon, Microsoft, Facebook, etc are all going to follow it. You still might be able to roll your own encryption You will 100% be able to roll your own, and trivially too. You’ll just need to go to GitHub and grab the source code, or pre-built binaries for a working crypto system, of which there are many. Banning the big companies from using crypto isn’t enough, you also need to ban anyone from talking about crypto as well. This is very different to money laundering rules. Realistically you can’t opt out of the modern financial system, regardless of what blockchain proponents say, so introducing rules to gatekeep money flows at system choke points makes sense. Also one ability to censor money at choke points doesn’t also create an opportunity for enemies to exploit those same choke points. The money laundering equivalent of crypto censorship would be like the US deciding that it was going to switch to Bitcoin so that all transactions are public and accessible to law enforcement. Then just kinda hoping that a country like China isn’t going to launch a 51% attack.

slg 5y ago
Your first three paragraphs are all focusing on structural flaws with my suggestion and not technical limitations of encryption itself. The debate has already moved from this is impossible to this is impractical. We can fix impractical. For example, we can design a way for content to be reencrypted with new keys if anything ever leaks. >You will 100% be able to roll your own, and trivially too. You’ll just need to go to GitHub and grab the source code... Github is owned by Microsoft. Microsoft won't let you host code that is designed specifically to break the law. That is the point. You would need to jump through a variety of hoops in order to avoid this. It wouldn't be impossible, but it won't be the default and most people won't go through the effort to do it.
- avianlyric 5y ago
  > Your first three paragraphs are all focusing on structural flaws with my suggestion and not technical limitations of encryption itself. The debate has already moved from this is impossible to this is impractical. I think the flaws are so large, and fixing them so impractical (especially anything involving direct human involvement), that the problem is essentially impossible. In theory traffic laws should prevent 100% of car accidents. Yet people die every day in traffic accidents. In theory the judicial system should never execute an innocent person. Yet the US sends people later proven innocent to the electric chair on a semi regular basis. In theory everyone should have a strong interest is keeping planet earth healthy enough to support human life, yet we’re on a course to cataclysmic climate change. Alcohol addiction should have ended during prohibition, and weed should be impossible to buy in the US. Yet neither is true. What on earth makes you think we’ll solve the structural issues with government key escrow for all encryption, when all the evidence suggest that we’re unable to perfectly solve these issues as a species? > Github is owned by Microsoft. Microsoft won't let you host code that is designed specifically to break the law. Cool we’ll host it on Gitlab then, or one of many no US hosting providers. We can’t even stop people pirating movies despite the media industry throwing billions at the problem. Do you honestly think we’ll have better luck with crypto? You wanna see how this story ends? Read up on prohibition America, or just the war on drugs. We’ve been down this road many times, with many different vices, it’s ends the same way every time. Normal people get criminalised, illicit behaviour continues regardless. Organised crime profits from facilitating illicit behaviour. Please explain why you thing crypto is going to be the exception?
  - slg 5y ago
    >I think the flaws are so large, and fixing them so impractical (especially anything involving direct human involvement), that the problem is essentially impossible. Then let's as an industry try to think through ways to fix these impractical problems. My original goal was not for you and me to design the perfect system in a quick HN conversation. I was instead pointing out that the tech community too often treats this issue as a mathematical impossibility and refuses to engage anyone who pushes back on that. Admitting that something is not impossible but rather so impractical as to be essentially impossible is the first step in figuring out a solution. It is unlike the tech community to see an extremely difficult problem and just refuse any attempt to solve it because of the difficulty. >What on earth makes you think we’ll solve the structural issues with government key escrow for all encryption, when all the evidence suggest that we’re unable to perfectly solve these issues as a species? I am repeating myself here, but the goal isn't 100% compliance. No law can achieve that and I don't know you you are projecting that expectation on this conversation. The goal is to address most occurrences. >You wanna see how this story ends? Read up on prohibition America, or just the war on drugs. We’ve been down this road many times, with many different vices, it’s ends the same way every time. Normal people get criminalised, illicit behaviour continues regardless. Organised crime profits from facilitating illicit behaviour. Please explain why you thing crypto is going to be the exception? People want to engage in vices. I'm not convinced that people have nearly as strong of a desire for complete privacy as evident by all the behavior we have seen over the last few decades in responses to how governments and corporations invade privacy. It is a popular conspiracy theory that Facebook is secretly recording audio on your phone 24/7 and uses conversations it hears to better target ads. I have multiple friends who genuinely believe this. This belief isn't enough to get them to uninstall Facebook, Instagram, and WhatsApp from their phones. Some people will certainly be willing to go the extra mile for privacy, but most people won't.

slg 5y ago

Your first three paragraphs are all focusing on structural flaws with my suggestion and not technical limitations of encryption itself. The debate has already moved from this is impossible to this is impractical. We can fix impractical. For example, we can design a way for content to be reencrypted with new keys if anything ever leaks. >You will 100% be able to roll your own, and trivially too. You’ll just need to go to GitHub and grab the source code... Github is owned by Microsoft. Microsoft won't let you host code that is designed specifically to break the law. That is the point. You would need to jump through a variety of hoops in order to avoid this. It wouldn't be impossible, but it won't be the default and most people won't go through the effort to do it.

avianlyric 5y ago
> Your first three paragraphs are all focusing on structural flaws with my suggestion and not technical limitations of encryption itself. The debate has already moved from this is impossible to this is impractical. I think the flaws are so large, and fixing them so impractical (especially anything involving direct human involvement), that the problem is essentially impossible. In theory traffic laws should prevent 100% of car accidents. Yet people die every day in traffic accidents. In theory the judicial system should never execute an innocent person. Yet the US sends people later proven innocent to the electric chair on a semi regular basis. In theory everyone should have a strong interest is keeping planet earth healthy enough to support human life, yet we’re on a course to cataclysmic climate change. Alcohol addiction should have ended during prohibition, and weed should be impossible to buy in the US. Yet neither is true. What on earth makes you think we’ll solve the structural issues with government key escrow for all encryption, when all the evidence suggest that we’re unable to perfectly solve these issues as a species? > Github is owned by Microsoft. Microsoft won't let you host code that is designed specifically to break the law. Cool we’ll host it on Gitlab then, or one of many no US hosting providers. We can’t even stop people pirating movies despite the media industry throwing billions at the problem. Do you honestly think we’ll have better luck with crypto? You wanna see how this story ends? Read up on prohibition America, or just the war on drugs. We’ve been down this road many times, with many different vices, it’s ends the same way every time. Normal people get criminalised, illicit behaviour continues regardless. Organised crime profits from facilitating illicit behaviour. Please explain why you thing crypto is going to be the exception?
- slg 5y ago
  >I think the flaws are so large, and fixing them so impractical (especially anything involving direct human involvement), that the problem is essentially impossible. Then let's as an industry try to think through ways to fix these impractical problems. My original goal was not for you and me to design the perfect system in a quick HN conversation. I was instead pointing out that the tech community too often treats this issue as a mathematical impossibility and refuses to engage anyone who pushes back on that. Admitting that something is not impossible but rather so impractical as to be essentially impossible is the first step in figuring out a solution. It is unlike the tech community to see an extremely difficult problem and just refuse any attempt to solve it because of the difficulty. >What on earth makes you think we’ll solve the structural issues with government key escrow for all encryption, when all the evidence suggest that we’re unable to perfectly solve these issues as a species? I am repeating myself here, but the goal isn't 100% compliance. No law can achieve that and I don't know you you are projecting that expectation on this conversation. The goal is to address most occurrences. >You wanna see how this story ends? Read up on prohibition America, or just the war on drugs. We’ve been down this road many times, with many different vices, it’s ends the same way every time. Normal people get criminalised, illicit behaviour continues regardless. Organised crime profits from facilitating illicit behaviour. Please explain why you thing crypto is going to be the exception? People want to engage in vices. I'm not convinced that people have nearly as strong of a desire for complete privacy as evident by all the behavior we have seen over the last few decades in responses to how governments and corporations invade privacy. It is a popular conspiracy theory that Facebook is secretly recording audio on your phone 24/7 and uses conversations it hears to better target ads. I have multiple friends who genuinely believe this. This belief isn't enough to get them to uninstall Facebook, Instagram, and WhatsApp from their phones. Some people will certainly be willing to go the extra mile for privacy, but most people won't.