4 ms·

At the transport level: The EU has a lot of power, but the power to force the IETF to withdraw an RFC globally? That would be a reach even for them.

vaylian 3y ago
RFCs are not legally binding. Most politicians have no idea what a RFC is. They don't care about the actual technical details. They will just order a result without being aware of how unrealistic and harmful it is. You might be an educated technical citizen, but when you don't comply then there will be all kinds of legal trouble.
besrious 3y ago
Everyone mocked the Australian PM when he said that the laws of Australia applied in Australia, and not the laws of mathematics, but he was correct. This is peak nerd-delusion to think that the state will somehow be stopped by your cypherpunk schemes. It was already a delusion 20 years ago, and now to make things worse, all those guys that used to hang out in those hacker spaces promoting those attractive but silly ideas work for big corporations and governments.
- ethbr1 3y ago
  The state will be stopped by widespread use of anonymous strong encryption. It's the widespread part that confounds cypherpunks, and why PGP, Signal, Let's Encrypt are important despite the bikeshedding they attract from purists.
- justinclift 3y ago
  > Everyone mocked the Australian PM when he said that the laws of Australia applied in Australia, and not the laws of mathematics ... Oh come on. That was his flippant response to a smartarse question.
- ben_w 3y ago
  In a fight between law and maths, maths can't be arrested up, can't be put on trial, can't be detained at the border. It is intangible, and can be anywhere, even inside the unreadable mind of a traveller. The only way for any state to prevent the use of crypto they can't break is to wind back all the things that can perform it, meaning all computers, not just all internet banking and other things that are everywhere now and can't be used safely without it. States are free to do so, because a state can outlaw physical devices, seize them at the border, etc. — but that is what it would take to do this. I doubt they will, but that's the only option. Unfortunately, we also have the problem that political factions both native and foreign regularly try to undermine states; doing so in secret is a necessary but not sufficient part of this, and thus getting past crypto is IMO absolutely necessary[0] to keep any state from being usurped. Fortunately (from the POV of a state) "getting past crypto" can also be Van Eck phreaking, not just weak crypto. Unfortunately for everyone, just as any crypto backdoor is almost certain to be exploited by criminals gangs to get valuable information, so so are the non-crypto surveillance possibilities: not just Van Eck, there's more than one way to use wifi as a wall penetrating radar to violate your privacy; laser microphones can listen on you remotely for pennies; smart dust is just about starting to be a serious possibility rather than a tech demo. My current vibe here is that each new invention creates a power vacuum that takes 15 years to properly fill, and we're currently creating new tech too fast for either states or organised crime to fill the gaps. [0] despite the previous "but not sufficient" because Swiss cheese defence: https://en.wikipedia.org/wiki/Swiss_cheese_model https://en.wikipedia.org/wiki/Swiss_cheese_model
  - KirillPanov 3y ago
    > to wind back all the things that can perform it, meaning all computers Beware, they are attempting this. It's a big project; UEFI, secure boot, and the end of General Purpose Computing. But they will throw absolutely everything they have into this Hail Mary plan, and the chip fabs are a chokepoint...
    - ben_w 3y ago
      When I said "all computers" I wasn't being metaphorical. Do you have something that can XOR two blob of data? Doesn't matter how, if this is JavaScript on a web page, or an app: if it can XOR, it can do a one-time-pad, which is unbreakable encryption. The hard part of that way of encrypting things has always been sharing the key, but if you're in a criminal gang, or if you're actually trying to undermine a government, you can share the key in person. None of the things you've listed are even remotely sufficient to prevent unbreakable cryptography. Strictly speaking you don't even need computers: even a handful of transistors soldered up right would do this.
  - miki123211 3y ago
    > States are free to do so, because a state can outlaw physical devices, seize them at the border, etc. — but that is what it would take to do this. I doubt they will, but that's the only option. Another alternative is forcing these devices to be designed in such a way that installing unauthorized crypto tools isn't possible. We're already very close to this point. PCs have Secure Boot, which prevents installing non-approved operating systems. Windows 11 won't boot unless it is enabled. It also requires TPM, which can prevent modification of system and user files by putting the hard drive in an unencumbered computer. Windows Smart screen really doesn't want you to run apps not certified by Microsoft, although it is still possible. Web browsers are doing more and more to prevent you from visiting websites not secured by TLS, outright blocking some APIs if HTTPS isn't enabled. The tech is here, all it takes is a regulator to tighten up the screws. It's not unimaginable for the EU to ban all motherboards with Secure Boot that can be disabled, to force Microsoft to refuse uncertified apps, to force Microsoft-certified browsers to require TLS with a specific set of root CAs, and to require those root CAs to only issue certificates to those the EU deems worthy. The EU isn't terribly likely to do these specific things out of right-to-repair concerns, though those concerns could probably be assuaged if the certification was done in a fair way by a third party, possibly the government itself, instead of tech companies. This way, you can have perfectly secure crypto with your bank while still giving the EU the ability to access your messages at need.
- KirillPanov 3y ago
  > This is peak nerd-delusion to think that the state will somehow be stopped by your cypherpunk schemes. Nonsense. Encryption is legal. We got rid of the ITAR restrictions on encryption. We prevented Key Escrow and the Clipper Chip Mandate. We won. PS, governments hate bitcoin more than anything else on earth, and yet it is still worth half a trillion dollars. We're still winning.
  - fulafel 3y ago
    Both can be true. Encryption is not a panacea.

vaylian 3y ago

RFCs are not legally binding. Most politicians have no idea what a RFC is. They don't care about the actual technical details. They will just order a result without being aware of how unrealistic and harmful it is. You might be an educated technical citizen, but when you don't comply then there will be all kinds of legal trouble.

besrious 3y ago

Everyone mocked the Australian PM when he said that the laws of Australia applied in Australia, and not the laws of mathematics, but he was correct. This is peak nerd-delusion to think that the state will somehow be stopped by your cypherpunk schemes. It was already a delusion 20 years ago, and now to make things worse, all those guys that used to hang out in those hacker spaces promoting those attractive but silly ideas work for big corporations and governments.

ethbr1 3y ago
The state will be stopped by widespread use of anonymous strong encryption. It's the widespread part that confounds cypherpunks, and why PGP, Signal, Let's Encrypt are important despite the bikeshedding they attract from purists.
justinclift 3y ago
> Everyone mocked the Australian PM when he said that the laws of Australia applied in Australia, and not the laws of mathematics ... Oh come on. That was his flippant response to a smartarse question.
ben_w 3y ago
In a fight between law and maths, maths can't be arrested up, can't be put on trial, can't be detained at the border. It is intangible, and can be anywhere, even inside the unreadable mind of a traveller. The only way for any state to prevent the use of crypto they can't break is to wind back all the things that can perform it, meaning all computers, not just all internet banking and other things that are everywhere now and can't be used safely without it. States are free to do so, because a state can outlaw physical devices, seize them at the border, etc. — but that is what it would take to do this. I doubt they will, but that's the only option. Unfortunately, we also have the problem that political factions both native and foreign regularly try to undermine states; doing so in secret is a necessary but not sufficient part of this, and thus getting past crypto is IMO absolutely necessary[0] to keep any state from being usurped. Fortunately (from the POV of a state) "getting past crypto" can also be Van Eck phreaking, not just weak crypto. Unfortunately for everyone, just as any crypto backdoor is almost certain to be exploited by criminals gangs to get valuable information, so so are the non-crypto surveillance possibilities: not just Van Eck, there's more than one way to use wifi as a wall penetrating radar to violate your privacy; laser microphones can listen on you remotely for pennies; smart dust is just about starting to be a serious possibility rather than a tech demo. My current vibe here is that each new invention creates a power vacuum that takes 15 years to properly fill, and we're currently creating new tech too fast for either states or organised crime to fill the gaps. [0] despite the previous "but not sufficient" because Swiss cheese defence: https://en.wikipedia.org/wiki/Swiss_cheese_model https://en.wikipedia.org/wiki/Swiss_cheese_model
- KirillPanov 3y ago
  > to wind back all the things that can perform it, meaning all computers Beware, they are attempting this. It's a big project; UEFI, secure boot, and the end of General Purpose Computing. But they will throw absolutely everything they have into this Hail Mary plan, and the chip fabs are a chokepoint...
  - ben_w 3y ago
    When I said "all computers" I wasn't being metaphorical. Do you have something that can XOR two blob of data? Doesn't matter how, if this is JavaScript on a web page, or an app: if it can XOR, it can do a one-time-pad, which is unbreakable encryption. The hard part of that way of encrypting things has always been sharing the key, but if you're in a criminal gang, or if you're actually trying to undermine a government, you can share the key in person. None of the things you've listed are even remotely sufficient to prevent unbreakable cryptography. Strictly speaking you don't even need computers: even a handful of transistors soldered up right would do this.
- miki123211 3y ago
  > States are free to do so, because a state can outlaw physical devices, seize them at the border, etc. — but that is what it would take to do this. I doubt they will, but that's the only option. Another alternative is forcing these devices to be designed in such a way that installing unauthorized crypto tools isn't possible. We're already very close to this point. PCs have Secure Boot, which prevents installing non-approved operating systems. Windows 11 won't boot unless it is enabled. It also requires TPM, which can prevent modification of system and user files by putting the hard drive in an unencumbered computer. Windows Smart screen really doesn't want you to run apps not certified by Microsoft, although it is still possible. Web browsers are doing more and more to prevent you from visiting websites not secured by TLS, outright blocking some APIs if HTTPS isn't enabled. The tech is here, all it takes is a regulator to tighten up the screws. It's not unimaginable for the EU to ban all motherboards with Secure Boot that can be disabled, to force Microsoft to refuse uncertified apps, to force Microsoft-certified browsers to require TLS with a specific set of root CAs, and to require those root CAs to only issue certificates to those the EU deems worthy. The EU isn't terribly likely to do these specific things out of right-to-repair concerns, though those concerns could probably be assuaged if the certification was done in a fair way by a third party, possibly the government itself, instead of tech companies. This way, you can have perfectly secure crypto with your bank while still giving the EU the ability to access your messages at need.
KirillPanov 3y ago
> This is peak nerd-delusion to think that the state will somehow be stopped by your cypherpunk schemes. Nonsense. Encryption is legal. We got rid of the ITAR restrictions on encryption. We prevented Key Escrow and the Clipper Chip Mandate. We won. PS, governments hate bitcoin more than anything else on earth, and yet it is still worth half a trillion dollars. We're still winning.
- fulafel 3y ago
  Both can be true. Encryption is not a panacea.