3 ms·

I think his argument is a very bad one. It starts with the usual "Adversaries have more money and resources so it's better to just give up the fight". That is n

I think his argument is a very bad one. It starts with the usual "Adversaries have more money and resources so it's better to just give up the fight". That is no help unless you're already on the winning side and posturing. While he certainly has a point that badly done circumvention tools give a false feeling of safety, I don't think completely giving up is a solution either. No matter what, activists in such countries are already daring their lives (through off-line activities). It is important to get some information out there, through regimes' firewalls, and the only way might be through such tools. And only circumvention tools (such as TOR) that are public, open source, and actively being used can be subject to scrutiny (otherwise it'd be a completely academic exercise), which improves the security of the tools over the long run. Edit: Also, with the recent push for internet censorship even in western countries it's starting to be pretty clear we need the tools here too.

tptacek 15y ago
The response I hear you giving my argument sounds like the one I always hear: "your argument is wrong because we need circumvention tools". That's fallacious because our need for circumvention tools is irrelevant. You are talking about moral imperatives and I'm talking about engineering. The fact of the matter is, there is no way to build an assuredly secure messaging system; every attempt to build cryptographically secured messaging has failed, often multiple times. It isn't unlikely that every fielded cryptographic system is broken right now, and we're just waiting to find out how. In the real world, resources matter. Nothing is perfect, so really we're talking about a contest between two parties. Will the circumvention tool authors figure out the flaws (that expose their messages, that allow attackers to use technical flaws in their tools to mislead users into compromising themselves, that allow attackers to easily pinpoint circumventing traffic, &c), or inadvertently fix them by laying more countermeasures into their code? Or will governments find those flaws first, and use them to turn the tools against their users. The governments we're talking --- Iran, Syria, China --- have zero scruples, unlimited funds, and (if you're under the delusion that dictatorships have a hard time finding technical talent or that money doesn't simply buy it like anything else) demonstrated access to research and development skill in this specific area. It doesn't matter that we need these tools. I'm betting on the hostile governments. If you think the dictatorships will win, you need to keep in mind that the worst case isn't "false sense of security". The worst case is, "run this tool and a government computer somewhere silently puts your name on a list".
- wladimir 15y ago
  I'm betting on the hostile governments. Yes, that was very clear. I wish I could be amoral like you. The worst case is, "run this tool and a government computer somewhere silently puts your name on a list" Not always a problem. If enough people use the tool (which will be automatically the case as more ends up in the firewall), it's impossible to distinguish the people that use it for serious purposes (like anti-govt activism) or less serious purposes (like trolling anonymously or watching porn...).
  - tptacek 15y ago
    What's amoral is recognizing that dictatorships have a structural advantage in the contest over circumvention tool vulnerabilities but aggressively papering over that fact because it doesn't fit a congenial narrative about geeks saving the world. Even circumvention tool authors --- I'm guessing I know more of them than you? --- will tell you that's not an uncommon pathology.
    - wladimir 15y ago
      Even with a structural disadvantage it may make sense to fight back. Yes, it's risky. But whether it's worth it, is everyone's own (moral, not engineering) choice. And I don't have any illusion that just geeks can "save the world", but they can at least provide support in some areas, such as allowing journalists to communicate with activists. So you think the world would be a better place without any circumvention tools?
      - tptacek 15y ago
        I think you are militantly avoiding my point. Also, it's amusing that you think we're going to continue to discuss this after you called me "amoral".

tptacek 15y ago

The response I hear you giving my argument sounds like the one I always hear: "your argument is wrong because we need circumvention tools". That's fallacious because our need for circumvention tools is irrelevant. You are talking about moral imperatives and I'm talking about engineering. The fact of the matter is, there is no way to build an assuredly secure messaging system; every attempt to build cryptographically secured messaging has failed, often multiple times. It isn't unlikely that every fielded cryptographic system is broken right now, and we're just waiting to find out how. In the real world, resources matter. Nothing is perfect, so really we're talking about a contest between two parties. Will the circumvention tool authors figure out the flaws (that expose their messages, that allow attackers to use technical flaws in their tools to mislead users into compromising themselves, that allow attackers to easily pinpoint circumventing traffic, &c), or inadvertently fix them by laying more countermeasures into their code? Or will governments find those flaws first, and use them to turn the tools against their users. The governments we're talking --- Iran, Syria, China --- have zero scruples, unlimited funds, and (if you're under the delusion that dictatorships have a hard time finding technical talent or that money doesn't simply buy it like anything else) demonstrated access to research and development skill in this specific area. It doesn't matter that we need these tools. I'm betting on the hostile governments. If you think the dictatorships will win, you need to keep in mind that the worst case isn't "false sense of security". The worst case is, "run this tool and a government computer somewhere silently puts your name on a list".

wladimir 15y ago
I'm betting on the hostile governments. Yes, that was very clear. I wish I could be amoral like you. The worst case is, "run this tool and a government computer somewhere silently puts your name on a list" Not always a problem. If enough people use the tool (which will be automatically the case as more ends up in the firewall), it's impossible to distinguish the people that use it for serious purposes (like anti-govt activism) or less serious purposes (like trolling anonymously or watching porn...).
- tptacek 15y ago
  What's amoral is recognizing that dictatorships have a structural advantage in the contest over circumvention tool vulnerabilities but aggressively papering over that fact because it doesn't fit a congenial narrative about geeks saving the world. Even circumvention tool authors --- I'm guessing I know more of them than you? --- will tell you that's not an uncommon pathology.
  - wladimir 15y ago
    Even with a structural disadvantage it may make sense to fight back. Yes, it's risky. But whether it's worth it, is everyone's own (moral, not engineering) choice. And I don't have any illusion that just geeks can "save the world", but they can at least provide support in some areas, such as allowing journalists to communicate with activists. So you think the world would be a better place without any circumvention tools?
    - tptacek 15y ago
      I think you are militantly avoiding my point. Also, it's amusing that you think we're going to continue to discuss this after you called me "amoral".