12 ms·

Doomed to repeat history? Lessons from the crypto wars of the 1990s (2015) [pdf]

86 points by martialg 4y ago

skunkworker 4y ago
Needs a (2015) in the title.
- dang 4y ago
  Added. Thanks!
arminiusreturns 4y ago
From an old comment of mine on the topic: https://youtu.be/sKOk4Y4inVY?t=518 https://youtu.be/sKOk4Y4inVY?t=518 [1] 1. "In 1995, there was a debate at Harvard Law School – four of us discussing the future of public key encryption and its control. I was on the side, I suppose, of freedom. It’s where I try to be. With me at that debate was a man called Daniel Weitzner who now works in the White House making Internet policy for the Obama administration. On the other side was the then Deputy Attorney General of the United States and a lawyer in private practice named Stewart Baker who had been chief council to the National Security Agency, our listeners, and who was then in private life helping businesses to deal with the listeners. He then became, later on, the deputy for policy planning in the Department of Homeland Security in the United States and has much to do with what happened in our network after 2001. At any rate, the four of us spent two pleasant hours debating the right to encrypt and at the end there was a little dinner party at the Harvard faculty club, and at the end, after all the food had been taken away and just the port and the walnuts were left on the table, Stuart said, “All right, among us now that we are all in private, just us girls, I’ll let our hair down.” He didn’t have much hair even then, but he let it down. “We are not going to prosecute your client, Mr. Zimmermann," he said. “Public key encryption will become available. We fought a long, losing battle against it, but it was just a delaying tactic.” And then he looked around the room and he said, ”But nobody cares about anonymity, do they?" And a cold chill went up my spine and I thought, all right, Stuart, and now I know you’re going to spend the next twenty years trying to eliminate anonymity in human society and I am going to try to stop you and we’ll see how it goes. And it’s going badly. We didn’t build the net with anonymity built in. That was a mistake. Now we are paying for it." -Eben Moglen Given how prevalent quiet aquisence is in the tech community about mass surveillance, I think the mistake is going to be anonymity, and other user rights and freedoms foundations, including crypto. We already see it happening with crypto, but please remember the real war is on computing freedom. These other things are a subset.
- DaiPlusPlus 4y ago
  > We didn’t build the net with anonymity built in I'd say the Internet is pretty dang anonymous compared to, say, X.25 or PSTN. I'm curious what kind of anonymity Eben Moglen had in mind. > but please remember the real war is on computing freedom. Excepting the MPAA and their fixation on encrypted HDMI, what computing freedoms are at risk of being lost, and to whom, exactly? (well, within the OECD - yes, things are bad in the PRC and in other autocratic regimes - but those are hardly new threats).
  - bitexploder 4y ago
    The number of people on iOS and iPadOS with no other computing devices is high. Walled gardens. Lack of ability to easily install any apps you want. Pushes for remote attestation. Hypervisors beneath OSes. The darker parts of “trusted computing”. I could go on with many more examples.
  - swatcoder 4y ago
    Well, for one, it's getting increasingly hard to run arbitrary code on any kind of manufactured computing device. Riding the current of valid security concerns, all platforms are moving towards all code being signed and attributable and most code operating only within abstract/virtual environments that only provide mediated access to the hardware or the host system.
    - mistrial9 4y ago
      how do GUIX configuration definitions, including the signed-boot parts, fit into the future here?
      - bsedlm 4y ago
        they probably don't.
  - game-of-throws 4y ago
    TPMs and remote attestation on all platforms. For example, there's no reasonable way to run an adblocker on Android without rooting, and if you do root, many apps e.g. banking apps will refuse to run. The feature is called SafetyNet.
thematrixturtle 4y ago
It's refreshing to see the word "crypto" applied to cryptography instead of cryptocurrency, like the good old days.
- sbf501 4y ago
  Remember when CSS meant Content Scramble System? Everyone was printing DeCSS onto everything: t-shirts, sigs, hats, mugs.
  - game-of-throws 4y ago
    And this generations DeCSS is called Reader Mode :)
  - marcosdumay 4y ago
    Content Scramble System is a more recent creation than the Cascading Style Sheets. It got the news for a while, but it's not like the web CSS stole the name.
    - sreekotay 4y ago
      I mean tbf, they were released around the same time (so i agree one did not plagiarize the other) but DVD CSS was likely more widely known first - albeit due to DeCSS
- deleted 4y ago
  [deleted]
pipeline_peak 4y ago
I wish pdf had a mobile view
- gwern 4y ago
  You know PDF makes that AI-complete because it's all about pixels/glyphs and throws away any sort of semantics guarantees... But Adobe's trying AI anyway to give you a mobile view as 'liquid mode': https://www.creativersk.com/liquid-mode-a-better-reading-experience-for-pdf-on-mobile/ https://www.creativersk.com/liquid-mode-a-better-reading-exp... Might be worth a shot.
bradknowles 4y ago
I remember the crypto wars of the 1990s. I played my own small part in 1992: http://www.shub-internet.org/brad/cacm92nov.html http://www.shub-internet.org/brad/cacm92nov.html I was a member of DC CypherPunks, with Declan McCullagh. I got to meet Whitfield Diffie. I saw EFF and EPIC and other such organizations get created. I was just a tiny fly on that wall, but it was clear what we were up against at the time, and how things have just gotten worse since then. Back then, the crazies were worried about these things called RFID strips that were supposedly embedded in all the money, so that the government could track you wherever they wanted. Today, we all carry around phones broadcasting Bluetooth or wifi MAC addresses or RFID tags to tell us where we lost our keys, and we give them so much more information than could ever have been gathered by the claimed RFID strips.
- implements 4y ago
  > Declan McCullagh I remember his Politech mailing list back in the day: https://www.mail-archive.com/politech@politechbot.com/mail9.html https://www.mail-archive.com/politech@politechbot.com/mail9.... - he was alert to the risks of today’s technology decades before they began to be realised.
bregma 4y ago
I hesitated to clock on the URL because "newamerica" is an alt-right keyword now. The article itself was full of alt-right dogwhistles. That is, in 2022 parlance. In 2015 it was just the opposite. I find the 180 degree shift in meaning of many words, phrases, and even political positions over the last 7 years to be fascinating.
- 0thgen 4y ago
  and what were those dogwhistles?
- mw888 4y ago
  Maybe you’re just stuck in The Matrix. Not implying you should be alt right, but maybe stop thinking about everything in relationship to what you perceive as “alt-right,” which is a spurious term to begin with.
erwincoumans 4y ago
Reminds me of TrueCrypt and VeraCrypt, now replaced by corporate solutions (BitLocker etc), and the discussions about backdoors.

86 points by martialg 4y ago

skunkworker 4y ago

Needs a (2015) in the title.

dang 4y ago
Added. Thanks!

arminiusreturns 4y ago

From an old comment of mine on the topic: https://youtu.be/sKOk4Y4inVY?t=518 https://youtu.be/sKOk4Y4inVY?t=518 [1] 1. "In 1995, there was a debate at Harvard Law School – four of us discussing the future of public key encryption and its control. I was on the side, I suppose, of freedom. It’s where I try to be. With me at that debate was a man called Daniel Weitzner who now works in the White House making Internet policy for the Obama administration. On the other side was the then Deputy Attorney General of the United States and a lawyer in private practice named Stewart Baker who had been chief council to the National Security Agency, our listeners, and who was then in private life helping businesses to deal with the listeners. He then became, later on, the deputy for policy planning in the Department of Homeland Security in the United States and has much to do with what happened in our network after 2001. At any rate, the four of us spent two pleasant hours debating the right to encrypt and at the end there was a little dinner party at the Harvard faculty club, and at the end, after all the food had been taken away and just the port and the walnuts were left on the table, Stuart said, “All right, among us now that we are all in private, just us girls, I’ll let our hair down.” He didn’t have much hair even then, but he let it down. “We are not going to prosecute your client, Mr. Zimmermann," he said. “Public key encryption will become available. We fought a long, losing battle against it, but it was just a delaying tactic.” And then he looked around the room and he said, ”But nobody cares about anonymity, do they?" And a cold chill went up my spine and I thought, all right, Stuart, and now I know you’re going to spend the next twenty years trying to eliminate anonymity in human society and I am going to try to stop you and we’ll see how it goes. And it’s going badly. We didn’t build the net with anonymity built in. That was a mistake. Now we are paying for it." -Eben Moglen Given how prevalent quiet aquisence is in the tech community about mass surveillance, I think the mistake is going to be anonymity, and other user rights and freedoms foundations, including crypto. We already see it happening with crypto, but please remember the real war is on computing freedom. These other things are a subset.

DaiPlusPlus 4y ago
> We didn’t build the net with anonymity built in I'd say the Internet is pretty dang anonymous compared to, say, X.25 or PSTN. I'm curious what kind of anonymity Eben Moglen had in mind. > but please remember the real war is on computing freedom. Excepting the MPAA and their fixation on encrypted HDMI, what computing freedoms are at risk of being lost, and to whom, exactly? (well, within the OECD - yes, things are bad in the PRC and in other autocratic regimes - but those are hardly new threats).
- bitexploder 4y ago
  The number of people on iOS and iPadOS with no other computing devices is high. Walled gardens. Lack of ability to easily install any apps you want. Pushes for remote attestation. Hypervisors beneath OSes. The darker parts of “trusted computing”. I could go on with many more examples.
- swatcoder 4y ago
  Well, for one, it's getting increasingly hard to run arbitrary code on any kind of manufactured computing device. Riding the current of valid security concerns, all platforms are moving towards all code being signed and attributable and most code operating only within abstract/virtual environments that only provide mediated access to the hardware or the host system.
  - mistrial9 4y ago
    how do GUIX configuration definitions, including the signed-boot parts, fit into the future here?
    - bsedlm 4y ago
      they probably don't.
- game-of-throws 4y ago
  TPMs and remote attestation on all platforms. For example, there's no reasonable way to run an adblocker on Android without rooting, and if you do root, many apps e.g. banking apps will refuse to run. The feature is called SafetyNet.

thematrixturtle 4y ago

It's refreshing to see the word "crypto" applied to cryptography instead of cryptocurrency, like the good old days.

sbf501 4y ago
Remember when CSS meant Content Scramble System? Everyone was printing DeCSS onto everything: t-shirts, sigs, hats, mugs.
- game-of-throws 4y ago
  And this generations DeCSS is called Reader Mode :)
- marcosdumay 4y ago
  Content Scramble System is a more recent creation than the Cascading Style Sheets. It got the news for a while, but it's not like the web CSS stole the name.
  - sreekotay 4y ago
    I mean tbf, they were released around the same time (so i agree one did not plagiarize the other) but DVD CSS was likely more widely known first - albeit due to DeCSS
deleted 4y ago
[deleted]

pipeline_peak 4y ago

I wish pdf had a mobile view

gwern 4y ago
You know PDF makes that AI-complete because it's all about pixels/glyphs and throws away any sort of semantics guarantees... But Adobe's trying AI anyway to give you a mobile view as 'liquid mode': https://www.creativersk.com/liquid-mode-a-better-reading-experience-for-pdf-on-mobile/ https://www.creativersk.com/liquid-mode-a-better-reading-exp... Might be worth a shot.

bradknowles 4y ago

I remember the crypto wars of the 1990s. I played my own small part in 1992: http://www.shub-internet.org/brad/cacm92nov.html http://www.shub-internet.org/brad/cacm92nov.html I was a member of DC CypherPunks, with Declan McCullagh. I got to meet Whitfield Diffie. I saw EFF and EPIC and other such organizations get created. I was just a tiny fly on that wall, but it was clear what we were up against at the time, and how things have just gotten worse since then. Back then, the crazies were worried about these things called RFID strips that were supposedly embedded in all the money, so that the government could track you wherever they wanted. Today, we all carry around phones broadcasting Bluetooth or wifi MAC addresses or RFID tags to tell us where we lost our keys, and we give them so much more information than could ever have been gathered by the claimed RFID strips.

implements 4y ago
> Declan McCullagh I remember his Politech mailing list back in the day: https://www.mail-archive.com/politech@politechbot.com/mail9.html https://www.mail-archive.com/politech@politechbot.com/mail9.... - he was alert to the risks of today’s technology decades before they began to be realised.

bregma 4y ago

I hesitated to clock on the URL because "newamerica" is an alt-right keyword now. The article itself was full of alt-right dogwhistles. That is, in 2022 parlance. In 2015 it was just the opposite. I find the 180 degree shift in meaning of many words, phrases, and even political positions over the last 7 years to be fascinating.

0thgen 4y ago
and what were those dogwhistles?
mw888 4y ago
Maybe you’re just stuck in The Matrix. Not implying you should be alt right, but maybe stop thinking about everything in relationship to what you perceive as “alt-right,” which is a spurious term to begin with.

erwincoumans 4y ago

Reminds me of TrueCrypt and VeraCrypt, now replaced by corporate solutions (BitLocker etc), and the discussions about backdoors.