4 ms·

I hadn't thought about it before, but encouraging use of moderately weak encryption keys is an interesting way of balancing the needs of privacy and law enforce

by pavon 3y ago

I hadn't thought about it before, but encouraging use of moderately weak encryption keys is an interesting way of balancing the needs of privacy and law enforcement. On one hand, it protects against widespread warrant-less searches (stop and frisk, border patrol, etc). On the other, law enforcement can get access to the data before the statute of limitations runs out if they deem the case to be worth the resources (presumably with a warrant).

NoMoreNicksLeft 3y ago
If the need for encryption stems in part from the need to be safe from some particular sort of authoritarian government for whom evidence of non-crimes is enough to punish... then weak encryption subverts that need. It's difficult to imagine evidence of the sort of crime that evidence for it easily goes on an iPhone or other commercial device and is so heinous that it should override this concern I've described. And of those exceptions (someone conspiring in chat messages to murder for hire) that they happen so frequently that might be the excuse. When the government demands that encryption be crippled, it seems that they aren't doing this to protect me from any crime I might care about myself... but that they are primarily concerned with crimes against the government itself.
- pavon 3y ago
  To be clear I don't support laws mandating the weakening of encryption in any form. If someone wants good security they should have it. However, most users don't want to enter a strong password every time they unlock their phone. Apple chose the pin length based on a balance of what the user would be willing to actually use and the security it provides. Meanwhile biometrics provide stronger keys combined with convenience, but are more prone to abuse (forcibly pressing users finger to unlock during stop and frisk, etc). Security would be better served if device manufactures encouraged pins over biometrics, even though they can be brute forced, since they better protect against the most common abuses, and put a price on whether it is worthwhile to brute force.
loup-vaillant 3y ago
It also make it easier for criminals or any illegitimate party to get your data. I'd rather have Three-Letter-Agency proof encryption everywhere.

by pavon 3y ago

NoMoreNicksLeft 3y ago

If the need for encryption stems in part from the need to be safe from some particular sort of authoritarian government for whom evidence of non-crimes is enough to punish... then weak encryption subverts that need. It's difficult to imagine evidence of the sort of crime that evidence for it easily goes on an iPhone or other commercial device and is so heinous that it should override this concern I've described. And of those exceptions (someone conspiring in chat messages to murder for hire) that they happen so frequently that might be the excuse. When the government demands that encryption be crippled, it seems that they aren't doing this to protect me from any crime I might care about myself... but that they are primarily concerned with crimes against the government itself.

pavon 3y ago
To be clear I don't support laws mandating the weakening of encryption in any form. If someone wants good security they should have it. However, most users don't want to enter a strong password every time they unlock their phone. Apple chose the pin length based on a balance of what the user would be willing to actually use and the security it provides. Meanwhile biometrics provide stronger keys combined with convenience, but are more prone to abuse (forcibly pressing users finger to unlock during stop and frisk, etc). Security would be better served if device manufactures encouraged pins over biometrics, even though they can be brute forced, since they better protect against the most common abuses, and put a price on whether it is worthwhile to brute force.

loup-vaillant 3y ago

It also make it easier for criminals or any illegitimate party to get your data. I'd rather have Three-Letter-Agency proof encryption everywhere.