5 ms·

Perhaps you could take this opportunity where you’ve gotten the attention of an audience to, instead of criticize, educate us? I don’t see what’s wrong with thi

by lukevp 3y ago

Perhaps you could take this opportunity where you’ve gotten the attention of an audience to, instead of criticize, educate us? I don’t see what’s wrong with this comic at all. It’s saying that if someone really wants to get into your laptop, they can torture you for your credentials. They could similarly ransom/blackmail you or any number of other approaches that don’t involve attempting a brute force decryption. Perhaps you think the link was to a different comic (maybe the entropy one about the horses and the batteries) and didn’t actually click it?

xoa 3y ago
Sorry, I just edited to add that. But >I don’t see what’s wrong with this comic at all. Everything is wrong with that comic. >It’s saying that if someone really wants to get into your laptop, they can torture you for your credentials. Can they? Please take a moment to actually think about this. What if they stole the laptop out of my car while I'm traveling? How do they even find me? Is it worth them sending a warm body and paying for airfare to follow me home if they do? How do they keep me from shooting them when they break into my house or attack me to torture me? Or my friends or family from shooting them? How do they evade law enforcement? Again, is all this worth it? And how am I worse off if I instantly give the password vs if it was plain text and they never had to let me know at all? What does encryption have to do with physical attacks? It's completely stupid. Seriously, if you think this is correct take it to the logical conclusion: why bother wish any password beyond abc123? After all, they can "just" torture you for it right? Why bother with HTTPS? Attackers can "just" torture bank IT for the accounts anyway right? Except obviously that's not how it works. >They could similarly ransom/blackmail you or any number of other approaches that don’t involve attempting a brute force decryption. Again, no they generally cannot. It's impossible to be secure against an omniscient attacker with infinite resources, but IRL there is no such thing. Not even the biggest most powerful security agencies. If the cost of attacking is higher than the value of whatever it is, the security is good. Forcing attackers away from cheap, undetectable attacks into expensive, noisy attacks is what it's all about! This comic pushes one of the most fundamental misconceptions about security, and in a doomer despair sort of way. "Why bother taking any steps, the CIA/KGB/whomever can still get you!" is not a reasonable message or argument. Edit: another real common flaw in thinking about security is inventing fanciful threat models vs real ones, which is bad because it can mean poor allocation of limited resources. It happens a lot in certain parts of the gun community for example, egged on of course by those with things to sell: people worried about defending their homes might spend 4, even 5 figures on firearms, yet then also have a crummy door and lock that would take approximately 3.8 seconds to kick in. It would be much more effective and have higher ROI to invest much less money in basic physical security first. Decent frame/door/bolt, shatter resistant first floor windows (or film on the windows), cosmetic but spiky bush beneath them, etc won't keep out determined attackers. But most likely attackers aren't determined. They aren't after "you" they're after "someone", low hanging fruit. You don't have to be Fort Knox, you just need to be enough of a pain that police are more likely to show up in time and make it not worth it. Or enough of a pain that they go next door as cold as that is to say. It's another sort of "preoptimization is the root of all evil", focusing on outliers vs the common case.
- jeremyjh 3y ago
  I wouldn’t have downvoted your original comment if you had explained this to begin with.
- b112 3y ago
  I think what you're missing, is the comic shows a scene with two guys, and the discussion shows the guy is in the other room. And points out how encryption is useless in such a situation. And this is just the sort of situation you end up in, if the law decides you'd better hand over your password. You are beaten(depending upon who is the law), or physically grabbed at gunpoint, and thrown in jail.. until you hand over the password. So the point is, encryption is useless in some circumstances. I don't see anyone in that comic, claiming that encrypted passwords are useless. Or that someone hacking you from half way around the world, will fly to your house and kidnap you. Instead, it's a point to think on. Are the steps being taken, useful and helpful for the planned scenario? Really, you should level your complaints at people using this humorous comic wrong. Not the author.
  - xoa 3y ago
    >I think what you're missing, is the comic shows a scene with two guys, and the discussion shows the guy is in the other room. There are no guys in the other room 99.999999999% of the time. And it's mostly out of scope. >And points out how encryption is useless in such a situation Which is wrong. You're doing a great job of illustrating the problem. Encryption is not useless, it's still doing its exact job which is forcing the threat model to shift from undetectable electronic to real world physical. Thanks to encryption, you now have knowledge and choice. You now know that they wanted the data, enough to commit crimes for it. You know they have it if you comply. >And this is just the sort of situation you end up in, if the law decides you'd better hand over your password. I'm interested in your statistics on times when the FBI beat American citizens with lead pipes to get them to hand over their passwords. Please do share. Then also share the big smiles on defense attorney faces afterwards during the resulting motions to suppress all evidence and subsequent 7-8 figure civil rights lawsuits. In countries that allow jail or torture for it, well first many may choose not to travel there. Or travel there only with throwaway data. Even there though encryption still serves some value, again in knowing but also opening up more degrees of freedom for how to respond. In a western country that requires decryption but does still have some respect for human rights and rule of law, you may for example be able to have your defense lawyer insist on witnesses to the access, and that the access warrant will be limited in scope ahead of time. Here encryption makes it far harder to plant evidence transparently, or conduct completely unrestricted fishing expeditions. It may allow more avenues for appealing a case. Same reason that you should never consent to just allow police to "look around" your house or car. Sure, they can beat you up and break in. But there would be consequences to that. >So the point is, encryption is useless in some circumstances. Again, it's not useless. Physical attacks are outside of encryption's threat model, indeed forcing attackers into physical attack is the exact point. That's vastly more expensive for attackers than non-physical attacks, and gives far more options for defenders. If your data is unencrypted, it can just be silently copied off with you none the wiser. >Really, you should level your complaints at people using this humorous comic wrong. Not the author. You just used this comic wrong though! Because it's a bad comic, and the message is all wrong. I think it's fairly obvious that it wasn't intended to some super subtle wrong point to promote discussion, or if it was then it's too subtle because I've never seen it cited in any way but played straight. ---- Edit to reply to below: >You are instead blathering on about all sorts of other scenarios, and failing to see that the encryption is utterly useless in that circumstance, because the point is you will give up your password, period. As I took the time and made real effort to explain to you, encryption is not at all useless in those scenarios. There is more to encryption then merely giving up the password or not, same as there is more to a lock or safe then whether it gets broken into or not. You are wrong. And then of course having failed to address anything, you retreat into "oh it's all humor (somehow)". Still, good to know you're the kind of person that finds torture and flagrant rights violations funny. As an American I'm not into that myself, but will acknowledge humor is highly subjective.

by lukevp 3y ago

xoa 3y ago

Sorry, I just edited to add that. But >I don’t see what’s wrong with this comic at all. Everything is wrong with that comic. >It’s saying that if someone really wants to get into your laptop, they can torture you for your credentials. Can they? Please take a moment to actually think about this. What if they stole the laptop out of my car while I'm traveling? How do they even find me? Is it worth them sending a warm body and paying for airfare to follow me home if they do? How do they keep me from shooting them when they break into my house or attack me to torture me? Or my friends or family from shooting them? How do they evade law enforcement? Again, is all this worth it? And how am I worse off if I instantly give the password vs if it was plain text and they never had to let me know at all? What does encryption have to do with physical attacks? It's completely stupid. Seriously, if you think this is correct take it to the logical conclusion: why bother wish any password beyond abc123? After all, they can "just" torture you for it right? Why bother with HTTPS? Attackers can "just" torture bank IT for the accounts anyway right? Except obviously that's not how it works. >They could similarly ransom/blackmail you or any number of other approaches that don’t involve attempting a brute force decryption. Again, no they generally cannot. It's impossible to be secure against an omniscient attacker with infinite resources, but IRL there is no such thing. Not even the biggest most powerful security agencies. If the cost of attacking is higher than the value of whatever it is, the security is good. Forcing attackers away from cheap, undetectable attacks into expensive, noisy attacks is what it's all about! This comic pushes one of the most fundamental misconceptions about security, and in a doomer despair sort of way. "Why bother taking any steps, the CIA/KGB/whomever can still get you!" is not a reasonable message or argument. Edit: another real common flaw in thinking about security is inventing fanciful threat models vs real ones, which is bad because it can mean poor allocation of limited resources. It happens a lot in certain parts of the gun community for example, egged on of course by those with things to sell: people worried about defending their homes might spend 4, even 5 figures on firearms, yet then also have a crummy door and lock that would take approximately 3.8 seconds to kick in. It would be much more effective and have higher ROI to invest much less money in basic physical security first. Decent frame/door/bolt, shatter resistant first floor windows (or film on the windows), cosmetic but spiky bush beneath them, etc won't keep out determined attackers. But most likely attackers aren't determined. They aren't after "you" they're after "someone", low hanging fruit. You don't have to be Fort Knox, you just need to be enough of a pain that police are more likely to show up in time and make it not worth it. Or enough of a pain that they go next door as cold as that is to say. It's another sort of "preoptimization is the root of all evil", focusing on outliers vs the common case.

jeremyjh 3y ago
I wouldn’t have downvoted your original comment if you had explained this to begin with.
b112 3y ago
I think what you're missing, is the comic shows a scene with two guys, and the discussion shows the guy is in the other room. And points out how encryption is useless in such a situation. And this is just the sort of situation you end up in, if the law decides you'd better hand over your password. You are beaten(depending upon who is the law), or physically grabbed at gunpoint, and thrown in jail.. until you hand over the password. So the point is, encryption is useless in some circumstances. I don't see anyone in that comic, claiming that encrypted passwords are useless. Or that someone hacking you from half way around the world, will fly to your house and kidnap you. Instead, it's a point to think on. Are the steps being taken, useful and helpful for the planned scenario? Really, you should level your complaints at people using this humorous comic wrong. Not the author.
- xoa 3y ago
  >I think what you're missing, is the comic shows a scene with two guys, and the discussion shows the guy is in the other room. There are no guys in the other room 99.999999999% of the time. And it's mostly out of scope. >And points out how encryption is useless in such a situation Which is wrong. You're doing a great job of illustrating the problem. Encryption is not useless, it's still doing its exact job which is forcing the threat model to shift from undetectable electronic to real world physical. Thanks to encryption, you now have knowledge and choice. You now know that they wanted the data, enough to commit crimes for it. You know they have it if you comply. >And this is just the sort of situation you end up in, if the law decides you'd better hand over your password. I'm interested in your statistics on times when the FBI beat American citizens with lead pipes to get them to hand over their passwords. Please do share. Then also share the big smiles on defense attorney faces afterwards during the resulting motions to suppress all evidence and subsequent 7-8 figure civil rights lawsuits. In countries that allow jail or torture for it, well first many may choose not to travel there. Or travel there only with throwaway data. Even there though encryption still serves some value, again in knowing but also opening up more degrees of freedom for how to respond. In a western country that requires decryption but does still have some respect for human rights and rule of law, you may for example be able to have your defense lawyer insist on witnesses to the access, and that the access warrant will be limited in scope ahead of time. Here encryption makes it far harder to plant evidence transparently, or conduct completely unrestricted fishing expeditions. It may allow more avenues for appealing a case. Same reason that you should never consent to just allow police to "look around" your house or car. Sure, they can beat you up and break in. But there would be consequences to that. >So the point is, encryption is useless in some circumstances. Again, it's not useless. Physical attacks are outside of encryption's threat model, indeed forcing attackers into physical attack is the exact point. That's vastly more expensive for attackers than non-physical attacks, and gives far more options for defenders. If your data is unencrypted, it can just be silently copied off with you none the wiser. >Really, you should level your complaints at people using this humorous comic wrong. Not the author. You just used this comic wrong though! Because it's a bad comic, and the message is all wrong. I think it's fairly obvious that it wasn't intended to some super subtle wrong point to promote discussion, or if it was then it's too subtle because I've never seen it cited in any way but played straight. ---- Edit to reply to below: >You are instead blathering on about all sorts of other scenarios, and failing to see that the encryption is utterly useless in that circumstance, because the point is you will give up your password, period. As I took the time and made real effort to explain to you, encryption is not at all useless in those scenarios. There is more to encryption then merely giving up the password or not, same as there is more to a lock or safe then whether it gets broken into or not. You are wrong. And then of course having failed to address anything, you retreat into "oh it's all humor (somehow)". Still, good to know you're the kind of person that finds torture and flagrant rights violations funny. As an American I'm not into that myself, but will acknowledge humor is highly subjective.