4 ms·

> we can make it secure, or we can let law enforcement have access, but that means the Chinese can get in too How is this in category 3? Give decryption keys t

> we can make it secure, or we can let law enforcement have access, but that means the Chinese can get in too How is this in category 3? Give decryption keys to your own government and not the others. I get it if you think it'll require more opsec from your government than you might trust them with, or that it'll have other negative effects (see: category 2), but how is this physically impossible (category 3)?

falcor84 3y ago
I would assume that the issue is that the mere idea of decryption keys that can be "given" means there is no end-to-end encryption.
- dataflow 3y ago
  That can't be what they're saying, since asking for "let us access this" is already assuming no end-to-end encryption. The other governments would have nothing to do with the argument in that case.
benedictevans 3y ago
If you give the key to every government that demands it (USA, UK, France, Germany, Japan... ), and every agency (CIA, NSA, FBI, DHS, DEA...) then how long will that remain secure? The key will leak and then you have no security.
- dataflow 3y ago
  You only give it to the government entities your country is asking you to. Heck, you could even encrypt each user's data with their own government's key. Edit: and key rotation is also a thing.
elpool2 3y ago
There are different degrees of “secure”, right? Maybe you could give a key to the FBI without China getting ahold of it, maybe it’s still “secure enough”. But you can’t say it’s “just as secure” as not giving it to them. And that’s what law enforcement often asks for: Give us access without making it any less secure.
- dataflow 3y ago
  > And that’s what law enforcement often asks for: Give us access without making it any less secure. No, I don't buy that. Maybe I'm going out on a limb here but I'm gonna say this is almost certainly a strawman caricature of what they're being asked, not what they're actually being asked. Law enforcement isn't stupid and people (especially law enforcement) understand that pretty much nothing in this world works in absolutes. They probably don't think the decrease in security is significant, but everyone (heck, even a kid) understands that the more people have access to something, the less secure it is.
csours 3y ago
It's type 3 because there's also a requirement that there are NO unintended circumventions to security. That sounds like "hard to circumvent", but it's not the same.
H8crilA 3y ago
You must have never heard of intelligence agencies, and spying in general. People vastly underappreciate the value that intelligence gives and the lengths to which they'll go just to get access to information. This is as old as humanity, for example Sun Tzu clearly wrote that useful spies are the best compensated employees in the entire government.
bee_rider 3y ago
I think it must be category 2, given that you’ve gotten a bunch of very strenuous type 2 objections, and no type 3 ones, in the comments they have responded to you. Actually I think there are almost never type 3 objections. Almost every law is something of the form: “Do this, pay fines, or stop providing your service here.” Of course, the “do this” might be impossible, but there’s no mathematical contradiction in the idea that a company can be run out of business.

falcor84 3y ago

I would assume that the issue is that the mere idea of decryption keys that can be "given" means there is no end-to-end encryption.

dataflow 3y ago
That can't be what they're saying, since asking for "let us access this" is already assuming no end-to-end encryption. The other governments would have nothing to do with the argument in that case.

benedictevans 3y ago

If you give the key to every government that demands it (USA, UK, France, Germany, Japan... ), and every agency (CIA, NSA, FBI, DHS, DEA...) then how long will that remain secure? The key will leak and then you have no security.

dataflow 3y ago
You only give it to the government entities your country is asking you to. Heck, you could even encrypt each user's data with their own government's key. Edit: and key rotation is also a thing.

elpool2 3y ago

There are different degrees of “secure”, right? Maybe you could give a key to the FBI without China getting ahold of it, maybe it’s still “secure enough”. But you can’t say it’s “just as secure” as not giving it to them. And that’s what law enforcement often asks for: Give us access without making it any less secure.

dataflow 3y ago
> And that’s what law enforcement often asks for: Give us access without making it any less secure. No, I don't buy that. Maybe I'm going out on a limb here but I'm gonna say this is almost certainly a strawman caricature of what they're being asked, not what they're actually being asked. Law enforcement isn't stupid and people (especially law enforcement) understand that pretty much nothing in this world works in absolutes. They probably don't think the decrease in security is significant, but everyone (heck, even a kid) understands that the more people have access to something, the less secure it is.

csours 3y ago

It's type 3 because there's also a requirement that there are NO unintended circumventions to security. That sounds like "hard to circumvent", but it's not the same.

H8crilA 3y ago

You must have never heard of intelligence agencies, and spying in general. People vastly underappreciate the value that intelligence gives and the lengths to which they'll go just to get access to information. This is as old as humanity, for example Sun Tzu clearly wrote that useful spies are the best compensated employees in the entire government.

bee_rider 3y ago

I think it must be category 2, given that you’ve gotten a bunch of very strenuous type 2 objections, and no type 3 ones, in the comments they have responded to you. Actually I think there are almost never type 3 objections. Almost every law is something of the form: “Do this, pay fines, or stop providing your service here.” Of course, the “do this” might be impossible, but there’s no mathematical contradiction in the idea that a company can be run out of business.