4 ms·

Asymmetric cryptography and its consequences have been a disaster for the human race. I’m not even joking all of the centralization of power and the rise of tot

by ls612 5mo ago

Asymmetric cryptography and its consequences have been a disaster for the human race. I’m not even joking all of the centralization of power and the rise of totalitarianism tech is driving is downstream from asymmetric cryptography.

lpcvoid 5mo ago
I disagree, I think you cast the net way too wide. Asymmetric cryptography enables secure communication in the first place. It's being used nefariously by Google and Apple, of course, but that's to be expected from big tech.
- ls612 5mo ago
  Isn’t the ability to create certificates guaranteed conceptually once you have asymmetric crypto? In that case there is no intermediate technology which allows key exchanges without also creating digital totalitarianism.
  - lpcvoid 5mo ago
    [dead]
- rossjudson 5mo ago
  Nefariously how?
  - microtonal 5mo ago
    Remote attestation also uses asymmetric cryptography. (Device-bound private key that can sign attestation challenges, a known public key that can verify that challenge was signed with the device-bound private key.)
    - rossjudson 5mo ago
      Not sure where the nefarious is in that. That's how PKI works.
grishka 5mo ago
It's not asymmetric cryptography itself. It's the fact that it takes enormous resources to manufacture modern SoCs, such that the economy only makes sense if you're churning them out by millions at least. It's also the fact that they can't be modified after they've been manufactured. It's basically those people who can manufacture chips having technological supremacy over the rest of the humanity.
- ls612 5mo ago
  It doesn’t matter if you can produce SOCs if your hardware isn’t trusted.
  - grishka 5mo ago
    What if you can copy someone else's SoC including their keys?
    - ls612 5mo ago
      I guess read-only memory is another requirement but that is very old technology we have never had asymmetric cryptography without read only memory.
amarant 5mo ago
FFS, cryptography is not the problem. How many times will we have to shut down that particular stupidity? Asymmetric cryptography is a corner stone of basically all online secure communications, and has been since before Google and apple were even founded as companies! (First invented in 1970) When did Https ever hurt you? That's built on asymmetric cryptography. Wherever you see the word "secure" it's basically shorthand for asymmetric cryptography. Https Ssh Sftp E2ee It's asymmetric cryptography all the way.
- ls612 5mo ago
  Easy there I don’t want to take away your encrypted messaging. I’m just pointing out that the technology that enables it also enables the techno-totalitarianism we have been seeing rise since the mid 2010s
  - amarant 5mo ago
    >Easy there I don’t want to take away your encrypted messaging Then stop trying to take away the technology it's built on
  - nullc 5mo ago
    You're just not going far enough-- the dual use technology suppressing human liberty in this case isn't asymetric crypto, it's _computing_.
deleted 5mo ago
[deleted]
__MatrixMan__ 5mo ago
My introduction to asymmetric cryptography had to do with protecting myself from the authorities while buying drugs on the internet. One of its first applications anywhere was protecting anti nuclear protestors from government provocateurs. We could prevent so much fraud of we could only convince the credit card companies to start using it (instead of printing a symmetric secret on the outside of the card). It's predominantly a force for good. If anything, its a bit anarchical. What you're noticing is not the leading edge of set of harms brought about by asymmetric cryptography, but rather the late stage of adoption where the bad guys realize that their enemy's sword has had two edges all this time. Every technology that mediates an adversarial relationship goes through this eventually. With the printing press came temporary freedom followed by intellectual property. So too with radios and the FCC. So too with social media. It's useless to blame the technology. Blame the people.
- ls612 5mo ago
  My point is that as far as I understand (not a cryptography expert) once you have the mathematical concept of asymmetric cryptography you also have the mathematical concept of a certificate, so you can't have one without the other.
  - __MatrixMan__ 5mo ago
    Well, it goes one way, so yeah you can't have a mathematically verifiable certificate without asymmetric key-pair cryptography. It's just that there's nothing pro-authority about making it easy for people to verify: "this data hasn't changed since the signer signed it." It's a neutral capability. There are cases where we can and should blame technologists for building antisocial things that shouldn't exist, but I think that cryptography for the most part falls on the pro-social side of that spectrum.
krautburglar 5mo ago
Exactly. The weapon is available to all, but only parasites like FAANG can afford to hire the best brains who know how to wield it. As Apple uses it to take a 30% cut of everything on their device, the “democratized” PGP features in mom’s mail client gather dust.
nullc 5mo ago
you don't need asymmetric crypto to make remote attest like this. Google can put a hmac key in each device which it knows and keeps secret. Device can author authenticated messages using it. Of course, only google can verify them-- but it appears that the workflow in this depends on google in any case and if anything that limitation would be more a feature to them than a bug.
userbinator 5mo ago
This is an extreme opinion and is not surprisingly unpopular and downvoted but one must realise that it is exactly how the governments were thinking when they wanted to ban encryption, and how the export restrictions and classification as a munition came about. Now companies are wielding it against us.
- ls612 5mo ago
  I think you misunderstand the point I'm making. Governments love having this centralized ability to attest hardware and control what software can be run. This is why for instance the EU has really slow-walked and watered down side loading requirements for Apple.

by ls612 5mo ago

lpcvoid 5mo ago

I disagree, I think you cast the net way too wide. Asymmetric cryptography enables secure communication in the first place. It's being used nefariously by Google and Apple, of course, but that's to be expected from big tech.

ls612 5mo ago
Isn’t the ability to create certificates guaranteed conceptually once you have asymmetric crypto? In that case there is no intermediate technology which allows key exchanges without also creating digital totalitarianism.
- lpcvoid 5mo ago
  [dead]
rossjudson 5mo ago
Nefariously how?
- microtonal 5mo ago
  Remote attestation also uses asymmetric cryptography. (Device-bound private key that can sign attestation challenges, a known public key that can verify that challenge was signed with the device-bound private key.)
  - rossjudson 5mo ago
    Not sure where the nefarious is in that. That's how PKI works.

grishka 5mo ago

It's not asymmetric cryptography itself. It's the fact that it takes enormous resources to manufacture modern SoCs, such that the economy only makes sense if you're churning them out by millions at least. It's also the fact that they can't be modified after they've been manufactured. It's basically those people who can manufacture chips having technological supremacy over the rest of the humanity.

ls612 5mo ago
It doesn’t matter if you can produce SOCs if your hardware isn’t trusted.
- grishka 5mo ago
  What if you can copy someone else's SoC including their keys?
  - ls612 5mo ago
    I guess read-only memory is another requirement but that is very old technology we have never had asymmetric cryptography without read only memory.

amarant 5mo ago

FFS, cryptography is not the problem. How many times will we have to shut down that particular stupidity? Asymmetric cryptography is a corner stone of basically all online secure communications, and has been since before Google and apple were even founded as companies! (First invented in 1970) When did Https ever hurt you? That's built on asymmetric cryptography. Wherever you see the word "secure" it's basically shorthand for asymmetric cryptography. Https Ssh Sftp E2ee It's asymmetric cryptography all the way.

ls612 5mo ago
Easy there I don’t want to take away your encrypted messaging. I’m just pointing out that the technology that enables it also enables the techno-totalitarianism we have been seeing rise since the mid 2010s
- amarant 5mo ago
  >Easy there I don’t want to take away your encrypted messaging Then stop trying to take away the technology it's built on
- nullc 5mo ago
  You're just not going far enough-- the dual use technology suppressing human liberty in this case isn't asymetric crypto, it's _computing_.

deleted 5mo ago

[deleted]

__MatrixMan__ 5mo ago

My introduction to asymmetric cryptography had to do with protecting myself from the authorities while buying drugs on the internet. One of its first applications anywhere was protecting anti nuclear protestors from government provocateurs. We could prevent so much fraud of we could only convince the credit card companies to start using it (instead of printing a symmetric secret on the outside of the card). It's predominantly a force for good. If anything, its a bit anarchical. What you're noticing is not the leading edge of set of harms brought about by asymmetric cryptography, but rather the late stage of adoption where the bad guys realize that their enemy's sword has had two edges all this time. Every technology that mediates an adversarial relationship goes through this eventually. With the printing press came temporary freedom followed by intellectual property. So too with radios and the FCC. So too with social media. It's useless to blame the technology. Blame the people.

ls612 5mo ago
My point is that as far as I understand (not a cryptography expert) once you have the mathematical concept of asymmetric cryptography you also have the mathematical concept of a certificate, so you can't have one without the other.
- __MatrixMan__ 5mo ago
  Well, it goes one way, so yeah you can't have a mathematically verifiable certificate without asymmetric key-pair cryptography. It's just that there's nothing pro-authority about making it easy for people to verify: "this data hasn't changed since the signer signed it." It's a neutral capability. There are cases where we can and should blame technologists for building antisocial things that shouldn't exist, but I think that cryptography for the most part falls on the pro-social side of that spectrum.

krautburglar 5mo ago

Exactly. The weapon is available to all, but only parasites like FAANG can afford to hire the best brains who know how to wield it. As Apple uses it to take a 30% cut of everything on their device, the “democratized” PGP features in mom’s mail client gather dust.

nullc 5mo ago

you don't need asymmetric crypto to make remote attest like this. Google can put a hmac key in each device which it knows and keeps secret. Device can author authenticated messages using it. Of course, only google can verify them-- but it appears that the workflow in this depends on google in any case and if anything that limitation would be more a feature to them than a bug.

userbinator 5mo ago

This is an extreme opinion and is not surprisingly unpopular and downvoted but one must realise that it is exactly how the governments were thinking when they wanted to ban encryption, and how the export restrictions and classification as a munition came about. Now companies are wielding it against us.

ls612 5mo ago
I think you misunderstand the point I'm making. Governments love having this centralized ability to attest hardware and control what software can be run. This is why for instance the EU has really slow-walked and watered down side loading requirements for Apple.