6 ms·

blah blah blah use PGP for emails blah blah in fact encrypt all the things blah blah "no it's too hard for Joe Public" blah then Joe gets what he deserves.

by Jach 15y ago

4ad 15y ago
You miss the whole point, it's about the implications of the legal frameworks which are put in place, not about how to hide from governments. The simple fact that you need to hide from the governments is indicative of a deep systemic problem. This is just a first step in making encryption illegal. Not like that's not the case already in some parts of the world, and it's not regulated heavily in other parts of the world.
- Jach 15y ago
  I don't think I missed the point, that point's pretty obvious. All of us on HN recognize that the legal frameworks of the US and the UK (and other countries) are screwed up, and we don't need this particular post to point that out. The looming totalitarianism manifests itself elsewhere with even more clarity. My point, admittedly facetiously expressed before, was an aside, and it is that hey, we know the government's screwed up, and it's not likely to get much better soon (especially on this particular issue) without a fundamental shift away from Big Government (and more debatable, a Massarchy implementation of government). In the meantime, there are technical solutions around it which we could implement en-masse today for the benefit of the masses instead of the localized solutions like GnuPG that us privileged nerds have--and it's worth reminding/letting be known by budding smarty-pantses that they too can communicate with other smarties securely if they want to. (I suspect any dangerous terrorists already do communicate securely and don't need reminding, but most terrorists are dumb and ineffectual in whatever their particular goals are so most probably don't.) If only Joe Public was educated about it and motivated to care and demand... Does a gmail-to-gmail message stay on Google's network alone? If not, they should encrypt everything behind the scenes before it leaves their network, just like how they've now been using https by default. It limits gov. snooping to subpoenaing the specific email provider to get the data off their servers rather than catching it in real-time as it passes through some network node. Also, I think that most probably gmail-to-hotmail or gmail-to-yahoo goes outside, so you can expand. Why can't Google, Microsoft, and Yahoo each agree to roll out an auto-PGP system where when an email is sent to one of the others, a handshake occurs first where a one-time public key is swapped from receiver to sender that's used to encrypt before sending, and the receiver will decrypt before presenting the decrypted email to the receiver user? (And to the receiving user's provider's content-scanners to display targeted ads.) With similar legal implications, the public could always demand regulations that require an auto-PGP protocol alongside a requirement of https (even though https isn't as secure as it could be). But that would be an instance of the government looking out for its people when the private companies aren't doing so, therefore it's not going to happen. It's hard to enforce any anti-encryption laws beyond monitoring for distribution of specific software and monitoring for users who encrypt almost everything. Basically you can only catch someone using encryption for almost everything by noticing that none of their data is understood by any of your software. If you only encrypt important things, well, a steg'd image once in a while isn't going to be detected (and there are other things you can do too).
UK-AL 15y ago
It's kind of silly really, anyone who really wants to get around this can, but innocents get screwed over.
Angostura 15y ago
PGP protects your from the state knowing who you are communicating with? I think not. And that's the main aim of this legislation. Tracking who you are talking to, and which Web sites your are visiting.
- Jach 15y ago
  I confess ignorance on the particular details of whether a PGP-encrypted message leaks who the sender/receiver are, though supposing it does it only leaks a single token--a username-email pair. If the state can read everything you as an individual send, they can only know who you're communicating with if the PGP-encrypted message itself leaks a name that maps to another offline individual. You could argue that a PGP-encrypted email leaks the name by default--i.e., the recipient of the email. You tell me how useful it is to know that I sent a message to cornflakesrule12345@emailprovider.ext without knowing what the message says. (More information can of course be found by coercing the particular email provider, if you can, to give up an IP address of the user, but we all know how reliable IP addresses are at pinpointing a single offline individual and there are many other options...) Of course, we can go further down the rabbit hole of schemes, we don't have to stick with just PGP. As one of your sibling-comments noticed, anyone who wants to get around any State Spying can do so as long as the State leaves room for some reasonable assumptions. (As for outlawing encryption, that's a problem on its own, both in enforcement and in definition. You'd likely just get particular encryption software outlawed rather than the concept. (I'm aware of the US classifying certain algorithms as munitions.) Funnily enough, telegraph operators tried to outlaw simple ciphers and encodings (like 'u' for 'you' and even anagrams) used back in the day because they were losing money, since they charged a fee for a message length.) I like the '89 paper entitled The Dining Cryptographers in the Disco: Unconditional Sender and Recipient Untraceability with Computationally Secure Serviceability. Here's part of the abstract: We present a protocol which guarantees unconditional untraceability, the original goal of the DC-net, on the inseparability assumption (i.e. the attacker must be unable to prevent honest participants from communicating, which is considerably less than reliable broadcast), and computationally secure serviceability: Computationally restricted disrupters can be identified and removed from the DC-net.
  - 15y ago

blah blah blah use PGP for emails blah blah in fact encrypt all the things blah blah "no it's too hard for Joe Public" blah then Joe gets what he deserves.

by Jach 15y ago

blah blah blah use PGP for emails blah blah in fact encrypt all the things blah blah "no it's too hard for Joe Public" blah then Joe gets what he deserves.

4ad 15y ago

You miss the whole point, it's about the implications of the legal frameworks which are put in place, not about how to hide from governments. The simple fact that you need to hide from the governments is indicative of a deep systemic problem. This is just a first step in making encryption illegal. Not like that's not the case already in some parts of the world, and it's not regulated heavily in other parts of the world.

Jach 15y ago
I don't think I missed the point, that point's pretty obvious. All of us on HN recognize that the legal frameworks of the US and the UK (and other countries) are screwed up, and we don't need this particular post to point that out. The looming totalitarianism manifests itself elsewhere with even more clarity. My point, admittedly facetiously expressed before, was an aside, and it is that hey, we know the government's screwed up, and it's not likely to get much better soon (especially on this particular issue) without a fundamental shift away from Big Government (and more debatable, a Massarchy implementation of government). In the meantime, there are technical solutions around it which we could implement en-masse today for the benefit of the masses instead of the localized solutions like GnuPG that us privileged nerds have--and it's worth reminding/letting be known by budding smarty-pantses that they too can communicate with other smarties securely if they want to. (I suspect any dangerous terrorists already do communicate securely and don't need reminding, but most terrorists are dumb and ineffectual in whatever their particular goals are so most probably don't.) If only Joe Public was educated about it and motivated to care and demand... Does a gmail-to-gmail message stay on Google's network alone? If not, they should encrypt everything behind the scenes before it leaves their network, just like how they've now been using https by default. It limits gov. snooping to subpoenaing the specific email provider to get the data off their servers rather than catching it in real-time as it passes through some network node. Also, I think that most probably gmail-to-hotmail or gmail-to-yahoo goes outside, so you can expand. Why can't Google, Microsoft, and Yahoo each agree to roll out an auto-PGP system where when an email is sent to one of the others, a handshake occurs first where a one-time public key is swapped from receiver to sender that's used to encrypt before sending, and the receiver will decrypt before presenting the decrypted email to the receiver user? (And to the receiving user's provider's content-scanners to display targeted ads.) With similar legal implications, the public could always demand regulations that require an auto-PGP protocol alongside a requirement of https (even though https isn't as secure as it could be). But that would be an instance of the government looking out for its people when the private companies aren't doing so, therefore it's not going to happen. It's hard to enforce any anti-encryption laws beyond monitoring for distribution of specific software and monitoring for users who encrypt almost everything. Basically you can only catch someone using encryption for almost everything by noticing that none of their data is understood by any of your software. If you only encrypt important things, well, a steg'd image once in a while isn't going to be detected (and there are other things you can do too).

UK-AL 15y ago

It's kind of silly really, anyone who really wants to get around this can, but innocents get screwed over.

Angostura 15y ago

PGP protects your from the state knowing who you are communicating with? I think not. And that's the main aim of this legislation. Tracking who you are talking to, and which Web sites your are visiting.

Jach 15y ago
I confess ignorance on the particular details of whether a PGP-encrypted message leaks who the sender/receiver are, though supposing it does it only leaks a single token--a username-email pair. If the state can read everything you as an individual send, they can only know who you're communicating with if the PGP-encrypted message itself leaks a name that maps to another offline individual. You could argue that a PGP-encrypted email leaks the name by default--i.e., the recipient of the email. You tell me how useful it is to know that I sent a message to cornflakesrule12345@emailprovider.ext without knowing what the message says. (More information can of course be found by coercing the particular email provider, if you can, to give up an IP address of the user, but we all know how reliable IP addresses are at pinpointing a single offline individual and there are many other options...) Of course, we can go further down the rabbit hole of schemes, we don't have to stick with just PGP. As one of your sibling-comments noticed, anyone who wants to get around any State Spying can do so as long as the State leaves room for some reasonable assumptions. (As for outlawing encryption, that's a problem on its own, both in enforcement and in definition. You'd likely just get particular encryption software outlawed rather than the concept. (I'm aware of the US classifying certain algorithms as munitions.) Funnily enough, telegraph operators tried to outlaw simple ciphers and encodings (like 'u' for 'you' and even anagrams) used back in the day because they were losing money, since they charged a fee for a message length.) I like the '89 paper entitled The Dining Cryptographers in the Disco: Unconditional Sender and Recipient Untraceability with Computationally Secure Serviceability. Here's part of the abstract: We present a protocol which guarantees unconditional untraceability, the original goal of the DC-net, on the inseparability assumption (i.e. the attacker must be unable to prevent honest participants from communicating, which is considerably less than reliable broadcast), and computationally secure serviceability: Computationally restricted disrupters can be identified and removed from the DC-net.
- 15y ago