6 ms·
Like I said before guys, start using end-to-end encryption. Stop talking and start sticking it to the man. If a company cooperates with the government, then don
by w1ntermute 14y ago
Like I said before guys, start using end-to-end encryption. Stop talking and start sticking it to the man. If a company cooperates with the government, then don't use their products or services.
- Udo 14y agoWhat good is end-to-end encryption if the server you're communicating with is legally obliged to forward your data to a gov database?
- sneak 14y agoEnd to end, not client to server.
- Udo 14y agoUser-to-user encryption is really not feasible/possible for public forums, social media, blogging, photo sharing, or web search. It's hard enough to do where it actually is feasible, such as message interchange - especially considering the fact that we now all have multiple auto-synched devices.
- betterunix 14y ago"User-to-user encryption is really not feasible/possible for...social media" The research community has a thing or two to say about that: https://www.usenix.org/conference/usenixsecurity12/social-networking-frientegrity-privacy-and-integrity-untrusted-provider https://www.usenix.org/conference/usenixsecurity12/social-ne...
- boi_v2 14y agoThis is great stuff betterunix
- jterce 14y agoEverything you just mentioned is more or less public by its very nature. Encryption wouldn't make any sense even were it feasible.
- EvanKelly 14y agoUnless I misread the bill, CISPA information sharing is opt-in. There is no legal obligation for a company to share your information.
- Udo 14y ago"We got two models for you: either you continue running your site as you see fit, which of course will mean tons of take-down orders, NSLs and other harassment - OR you could OPT IN to our new system which necessitates no further action on your part, as long as you install our little black box here next to your server. Your call."
- lawnchair_larry 14y agoThat's not the legal obligation you should care about. Under CISPA, there's no longer any legal obligation to protect your information. There is full immunity for not doing so.
- tptacek 14y agoThere is immunity for sharing information "in good faith" under CISPA. CISPA is not a blanket authorization to share data. If an ISP suffers a breach and coughs up huge amounts of PII that they handled negligently, they are absolutely still liable after CISPA becomes a law.
- straight_talk 14y ago
- aespinoza 14y agoIf you encrypt the data coming from the client all the way to the database or any other persistence mechanism, then it doesn't matter if the company is obliged to forward your data to a gov database. It would be encrypted, hence not easily readable. In my case, as a service provider, we are encrypting as much as we can, so that we can't even read the data even if obliged to. It becomes troublesome for some pieces of data because we need to decrypt it so that it can be displayed in the website. So if we can decrypt it, as a provider, then we would be obliged to decrypt it for government agencies. It would be interesting to see what can we do as a provider, to protect our own customers without breaking the law.
- straight_talk 14y agoYou can't do anything. The complete system is corrupted to the bone. If you are a successful company someday somebody with very deep pockets or a huge bank credit will show and buy you up. A few days later the encryption will start to disappear (e.g. Skype). If you don't sell your competitor will get the money and drive you out of business by the sheer force of money - pay higher salaries and get better ppl, better locations, more ads, etc.
- frankydp 14y agoIf the person you get your encryption keys from is "voluntarily" helping protect the nation what is really secure.
- drawkbox 14y agoThe voluntarily part is also shaky. Eventually not 'volunteering' to do it will be too costly. The systems, rewards, costs will be rigged so that volunteering is the only way to play, but not required. Also, the so called protections that it must be a cyber-security threat also hold little check and balance, how about an attack just happening when an agency needs information, or waiting for an attack by baiting it, any protection against creating honeypots to bait certain services? Probably not. Everyday servers and systems are attacked, so it is pretty much open season for getting information. There are no checks and balances and 'volunteering' means nothing. Try getting a gov't contract or deflecting problems without volunteering. I am glad all these freedom giving up people have nothing to hide such as their business ideas, sites they visit, downloads, emails etc will all be tracked now. I am sure they have something to hide from then. All of this will now be stored not only on their computers and their services, but at the ISP and the NSA now as well. Lots more chances, especially at the ISP level, of identity theft and threats. Crypto products might be a big market after this.
- tptacek 14y agoThe man wants you use end-to-end encryption. NIST has been trying to tell you how to do it for years. They even published Suite B to try to get us to use modern crypto instead of the '90s stuff we're using today.
- w1ntermute 14y agoThe man has many different hands. Just because NIST is doing something doesn't mean the NSA isn't doing something completely different.
- tptacek 14y agoThe NSA is the reason NIST got behind Suite B.
- dmix 14y agoBut rationally supporting the adoption of encryption among all citizens would still be counter to many of the NSA's primary goals. Maybe it was just primarily a technology contribution among the nerds at NSA, and not the bureaucrats intended goals?
- tptacek 14y agoIf NSA is trying to retard cryptography, why are they getting people to migrate from RSA-1024 to ECC? Can you find a cryptographer that believes RSA is the future?
- betterunix 14y agoECC is a minefield of patents, making it basically impossible to deploy; pushing for ECC does little to advance cryptography in practice. ECC also does not address concerns about quantum computers. In terms of mathematics, ECC is based on a problem that is in the intersection of NP and coNP, the same complexity class as the RSA assumption; there are more modern constructions based on NP-hard lattice problems. Really, if you want to point to the NSA/NIST helping to advance the state of cryptography, point to the AES contest.
- mtgx 14y agoSure, but never rely solely on technology to escape your government. Political solutions are much better and more "comfortable" in the long term.
- diminoten 14y agoWhat? Seems alarmist... if a company shares md5sums and directory paths of malware with the government, we should write that company off?