3 ms·

What good is end-to-end encryption if the server you're communicating with is legally obliged to forward your data to a gov database?

by Udo 14y ago

sneak 14y ago
End to end, not client to server.
- Udo 14y ago
  User-to-user encryption is really not feasible/possible for public forums, social media, blogging, photo sharing, or web search. It's hard enough to do where it actually is feasible, such as message interchange - especially considering the fact that we now all have multiple auto-synched devices.
  - betterunix 14y ago
    "User-to-user encryption is really not feasible/possible for...social media" The research community has a thing or two to say about that: https://www.usenix.org/conference/usenixsecurity12/social-networking-frientegrity-privacy-and-integrity-untrusted-provider https://www.usenix.org/conference/usenixsecurity12/social-ne...
    - boi_v2 14y ago
      This is great stuff betterunix
  - jterce 14y ago
    Everything you just mentioned is more or less public by its very nature. Encryption wouldn't make any sense even were it feasible.
EvanKelly 14y ago
Unless I misread the bill, CISPA information sharing is opt-in. There is no legal obligation for a company to share your information.
- Udo 14y ago
  "We got two models for you: either you continue running your site as you see fit, which of course will mean tons of take-down orders, NSLs and other harassment - OR you could OPT IN to our new system which necessitates no further action on your part, as long as you install our little black box here next to your server. Your call."
  - tptacek 14y ago
    The USG could do that without CISPA. Why would they need to pass a law to do that?
    - Udo 14y ago
      They could probably, but CISPA (and the things that inevitably come after it) makes it a lot smoother.
- lawnchair_larry 14y ago
  That's not the legal obligation you should care about. Under CISPA, there's no longer any legal obligation to protect your information. There is full immunity for not doing so.
  - tptacek 14y ago
    There is immunity for sharing information "in good faith" under CISPA. CISPA is not a blanket authorization to share data. If an ISP suffers a breach and coughs up huge amounts of PII that they handled negligently, they are absolutely still liable after CISPA becomes a law.
    - straight_talk 14y ago
      Keep dreaming ...
    - lawnchair_larry 14y ago
      I did mean within the context of security and handing it over to authorities without due process, but it can easily extend to contradict your proposed scenario. If they claim that said negligence was even tangentially related to some other good faith effort to facilitate anything security related, they get a pass.
aespinoza 14y ago
If you encrypt the data coming from the client all the way to the database or any other persistence mechanism, then it doesn't matter if the company is obliged to forward your data to a gov database. It would be encrypted, hence not easily readable. In my case, as a service provider, we are encrypting as much as we can, so that we can't even read the data even if obliged to. It becomes troublesome for some pieces of data because we need to decrypt it so that it can be displayed in the website. So if we can decrypt it, as a provider, then we would be obliged to decrypt it for government agencies. It would be interesting to see what can we do as a provider, to protect our own customers without breaking the law.
- straight_talk 14y ago
  You can't do anything. The complete system is corrupted to the bone. If you are a successful company someday somebody with very deep pockets or a huge bank credit will show and buy you up. A few days later the encryption will start to disappear (e.g. Skype). If you don't sell your competitor will get the money and drive you out of business by the sheer force of money - pay higher salaries and get better ppl, better locations, more ads, etc.
- frankydp 14y ago
  If the person you get your encryption keys from is "voluntarily" helping protect the nation what is really secure.
  - drawkbox 14y ago
    The voluntarily part is also shaky. Eventually not 'volunteering' to do it will be too costly. The systems, rewards, costs will be rigged so that volunteering is the only way to play, but not required. Also, the so called protections that it must be a cyber-security threat also hold little check and balance, how about an attack just happening when an agency needs information, or waiting for an attack by baiting it, any protection against creating honeypots to bait certain services? Probably not. Everyday servers and systems are attacked, so it is pretty much open season for getting information. There are no checks and balances and 'volunteering' means nothing. Try getting a gov't contract or deflecting problems without volunteering. I am glad all these freedom giving up people have nothing to hide such as their business ideas, sites they visit, downloads, emails etc will all be tracked now. I am sure they have something to hide from then. All of this will now be stored not only on their computers and their services, but at the ISP and the NSA now as well. Lots more chances, especially at the ISP level, of identity theft and threats. Crypto products might be a big market after this.

What good is end-to-end encryption if the server you're communicating with is legally obliged to forward your data to a gov database?

by Udo 14y ago

What good is end-to-end encryption if the server you're communicating with is legally obliged to forward your data to a gov database?

sneak 14y ago

End to end, not client to server.

Udo 14y ago
User-to-user encryption is really not feasible/possible for public forums, social media, blogging, photo sharing, or web search. It's hard enough to do where it actually is feasible, such as message interchange - especially considering the fact that we now all have multiple auto-synched devices.
- betterunix 14y ago
  "User-to-user encryption is really not feasible/possible for...social media" The research community has a thing or two to say about that: https://www.usenix.org/conference/usenixsecurity12/social-networking-frientegrity-privacy-and-integrity-untrusted-provider https://www.usenix.org/conference/usenixsecurity12/social-ne...
  - boi_v2 14y ago
    This is great stuff betterunix
- jterce 14y ago
  Everything you just mentioned is more or less public by its very nature. Encryption wouldn't make any sense even were it feasible.

EvanKelly 14y ago

Unless I misread the bill, CISPA information sharing is opt-in. There is no legal obligation for a company to share your information.

Udo 14y ago
"We got two models for you: either you continue running your site as you see fit, which of course will mean tons of take-down orders, NSLs and other harassment - OR you could OPT IN to our new system which necessitates no further action on your part, as long as you install our little black box here next to your server. Your call."
- tptacek 14y ago
  The USG could do that without CISPA. Why would they need to pass a law to do that?
  - Udo 14y ago
    They could probably, but CISPA (and the things that inevitably come after it) makes it a lot smoother.
lawnchair_larry 14y ago
That's not the legal obligation you should care about. Under CISPA, there's no longer any legal obligation to protect your information. There is full immunity for not doing so.
- tptacek 14y ago
  There is immunity for sharing information "in good faith" under CISPA. CISPA is not a blanket authorization to share data. If an ISP suffers a breach and coughs up huge amounts of PII that they handled negligently, they are absolutely still liable after CISPA becomes a law.
  - straight_talk 14y ago
    Keep dreaming ...
  - lawnchair_larry 14y ago
    I did mean within the context of security and handing it over to authorities without due process, but it can easily extend to contradict your proposed scenario. If they claim that said negligence was even tangentially related to some other good faith effort to facilitate anything security related, they get a pass.

aespinoza 14y ago

If you encrypt the data coming from the client all the way to the database or any other persistence mechanism, then it doesn't matter if the company is obliged to forward your data to a gov database. It would be encrypted, hence not easily readable. In my case, as a service provider, we are encrypting as much as we can, so that we can't even read the data even if obliged to. It becomes troublesome for some pieces of data because we need to decrypt it so that it can be displayed in the website. So if we can decrypt it, as a provider, then we would be obliged to decrypt it for government agencies. It would be interesting to see what can we do as a provider, to protect our own customers without breaking the law.

straight_talk 14y ago
You can't do anything. The complete system is corrupted to the bone. If you are a successful company someday somebody with very deep pockets or a huge bank credit will show and buy you up. A few days later the encryption will start to disappear (e.g. Skype). If you don't sell your competitor will get the money and drive you out of business by the sheer force of money - pay higher salaries and get better ppl, better locations, more ads, etc.
frankydp 14y ago
If the person you get your encryption keys from is "voluntarily" helping protect the nation what is really secure.
- drawkbox 14y ago
  The voluntarily part is also shaky. Eventually not 'volunteering' to do it will be too costly. The systems, rewards, costs will be rigged so that volunteering is the only way to play, but not required. Also, the so called protections that it must be a cyber-security threat also hold little check and balance, how about an attack just happening when an agency needs information, or waiting for an attack by baiting it, any protection against creating honeypots to bait certain services? Probably not. Everyday servers and systems are attacked, so it is pretty much open season for getting information. There are no checks and balances and 'volunteering' means nothing. Try getting a gov't contract or deflecting problems without volunteering. I am glad all these freedom giving up people have nothing to hide such as their business ideas, sites they visit, downloads, emails etc will all be tracked now. I am sure they have something to hide from then. All of this will now be stored not only on their computers and their services, but at the ISP and the NSA now as well. Lots more chances, especially at the ISP level, of identity theft and threats. Crypto products might be a big market after this.