3 ms·

Interesting thing about intercepting messages which are encrypted using modern encryption protocols like OTR is deniability. If a police installs MitM on a serv

Interesting thing about intercepting messages which are encrypted using modern encryption protocols like OTR is deniability. If a police installs MitM on a server, it can't cryptographically prove that messages were originating from criminals, not written themselves.

CWuestefeld 5y ago
That's an interesting thought, but I doubt it matters much in practice. I mean, we don't refuse to admit into evidence a ransom note just because the criminal didn't get it notarized. And that's all that SSL is doing, is acting as that notary. The jury can still decide that they think other evidence pointing to the message's origin is sufficient proof.
ARandomerDude 5y ago
True but it can be shown to be plausibly written by the defendant if there's no reasonable way the police could have known details without the message being intercepted. For example: "Hey Bill, I'm going to steal the car at 123 Anywhere Street on Thursday at 2 am." Police then put a camera at 123 Anywhere St., and a reasonable juror would likely conclude there are two lines of legitimate evidence.
- tyingq 5y ago
  And there's parallel construction to avoid mentioning the wiretap at all. Cop calls the station from a burner phone and pretends to be an anonymous tipster..."Hey someone is stealing a car at 123 Anywhere..."
- jessaustin 5y ago
  If they have video of a car theft (or any other crime), they don't need to mention the intercepted message. There the defendant is, stealing the car, on video. That's illegal. It is only when they need to prove marginal stuff like conspiracy that intercepts would matter.
upofadown 5y ago
Yeah it is well known that all you have to do is claim that the police forged the evidence and then that evidence is immediately thrown out. If the police don't have hard cryptographic evidence than they are just out of luck. It would be interesting to see what would happen if anyone ever tried the deniability defence in court: "Ha Ha. You can't link those messages to my public key. They could of been forged." "We can't for sure link your identity to your public key in the first place. Why should we care about any of this?"

CWuestefeld 5y ago

That's an interesting thought, but I doubt it matters much in practice. I mean, we don't refuse to admit into evidence a ransom note just because the criminal didn't get it notarized. And that's all that SSL is doing, is acting as that notary. The jury can still decide that they think other evidence pointing to the message's origin is sufficient proof.

ARandomerDude 5y ago

True but it can be shown to be plausibly written by the defendant if there's no reasonable way the police could have known details without the message being intercepted. For example: "Hey Bill, I'm going to steal the car at 123 Anywhere Street on Thursday at 2 am." Police then put a camera at 123 Anywhere St., and a reasonable juror would likely conclude there are two lines of legitimate evidence.

tyingq 5y ago
And there's parallel construction to avoid mentioning the wiretap at all. Cop calls the station from a burner phone and pretends to be an anonymous tipster..."Hey someone is stealing a car at 123 Anywhere..."
jessaustin 5y ago
If they have video of a car theft (or any other crime), they don't need to mention the intercepted message. There the defendant is, stealing the car, on video. That's illegal. It is only when they need to prove marginal stuff like conspiracy that intercepts would matter.

upofadown 5y ago

Yeah it is well known that all you have to do is claim that the police forged the evidence and then that evidence is immediately thrown out. If the police don't have hard cryptographic evidence than they are just out of luck. It would be interesting to see what would happen if anyone ever tried the deniability defence in court: "Ha Ha. You can't link those messages to my public key. They could of been forged." "We can't for sure link your identity to your public key in the first place. Why should we care about any of this?"