2 ms·

Storage is almost free so you can easily afford to wait just about forever, you don’t need to crack AES to crack TLS because you can also crack the key exchange

Storage is almost free so you can easily afford to wait just about forever, you don’t need to crack AES to crack TLS because you can also crack the key exchange or find a weakness in the RNG or the algorithm and we all know everybody knows something is impossible until someone comes around and does it.

brigandish 5y ago
The perfect is the enemy of the good. By that I mean that there is no perfect security, at some point, if given long enough, security of any system (computer or otherwise) can/will be broken. The point is to slow it down for long enough that it is of no use. I have to wonder what kind of information is useful enough to wait forever for? What kind of personal information of mine, for example, will be useful after I'm dead? There may be something. Even if we look at state actors it doesn't change - if China's government manages to decrypt something the UK has that is useful now, like some advanced technology, will it still be advanced when its encryption is cracked? Slow them down for even 20 years and it'll be too long to wait.
- tinus_hn 5y ago
  These are generic platitudes that are not very useful. Obviously you can’t consider whether some random guys data is interesting when you are capturing it in an encrypted state. You just capture everything just in case. And who knows, a way might suddenly appear to decrypt all of it and then you won’t be happy if you didn’t capture it.
  - brigandish 5y ago
    Yes, knowing that any data captured cannot be decrypted until after I’m dead is definitely generic as I don’t know anyone who will live long enough for decryption to happen in their lifetime, do you? If not, then you’re wrong about it being a platitude because you’ve given absolutely no reason how that data will be useful, other than ”who knows, a way might suddenly appear to decrypt all of it”. Maybe they’ll also invent a time machine but I’d prefer to stick to the realms of reality rather than sci-fi when assessing risk.
hilbert42 5y ago
"Storage is almost free so you can easily afford to wait just about forever." Forever is a long time. The point made above is valid, which is that data devalues greatly over time. Take in point the famous case of the Zodiac Killer: https://en.m.wikipedia.org/wiki/Zodiac_Killer https://en.m.wikipedia.org/wiki/Zodiac_Killer. Recent work seems to suggest that his encrypted messages are close to being solved (decrypted). If in fact we do have a solution and we've learned his identity then this information is of much less value now than if it would have been available 50+ years ago. For starters, it seems the killer is now dead. Thus, being able to decrypt his messages after this lengh of time is of little practical use other than of academic interest and or offering some resolution to his victims' families. The value of encrypted data held by the NSA and GCHQ in anticipation of finding a decryption key will rot in exactly the same way. In short, it's only worth keeping the data whilst it's potentially useful.

brigandish 5y ago

The perfect is the enemy of the good. By that I mean that there is no perfect security, at some point, if given long enough, security of any system (computer or otherwise) can/will be broken. The point is to slow it down for long enough that it is of no use. I have to wonder what kind of information is useful enough to wait forever for? What kind of personal information of mine, for example, will be useful after I'm dead? There may be something. Even if we look at state actors it doesn't change - if China's government manages to decrypt something the UK has that is useful now, like some advanced technology, will it still be advanced when its encryption is cracked? Slow them down for even 20 years and it'll be too long to wait.

tinus_hn 5y ago
These are generic platitudes that are not very useful. Obviously you can’t consider whether some random guys data is interesting when you are capturing it in an encrypted state. You just capture everything just in case. And who knows, a way might suddenly appear to decrypt all of it and then you won’t be happy if you didn’t capture it.
- brigandish 5y ago
  Yes, knowing that any data captured cannot be decrypted until after I’m dead is definitely generic as I don’t know anyone who will live long enough for decryption to happen in their lifetime, do you? If not, then you’re wrong about it being a platitude because you’ve given absolutely no reason how that data will be useful, other than ”who knows, a way might suddenly appear to decrypt all of it”. Maybe they’ll also invent a time machine but I’d prefer to stick to the realms of reality rather than sci-fi when assessing risk.

hilbert42 5y ago

"Storage is almost free so you can easily afford to wait just about forever." Forever is a long time. The point made above is valid, which is that data devalues greatly over time. Take in point the famous case of the Zodiac Killer: https://en.m.wikipedia.org/wiki/Zodiac_Killer https://en.m.wikipedia.org/wiki/Zodiac_Killer. Recent work seems to suggest that his encrypted messages are close to being solved (decrypted). If in fact we do have a solution and we've learned his identity then this information is of much less value now than if it would have been available 50+ years ago. For starters, it seems the killer is now dead. Thus, being able to decrypt his messages after this lengh of time is of little practical use other than of academic interest and or offering some resolution to his victims' families. The value of encrypted data held by the NSA and GCHQ in anticipation of finding a decryption key will rot in exactly the same way. In short, it's only worth keeping the data whilst it's potentially useful.