11 ms·

NSA-proof encryption exists. Why doesn’t anyone use it?

138 points by glenstein 13y ago

kimlelly 13y ago
Why doesn't anyone use it? The FIRST question is: Is it really a solution? The answer to that: NO, see: https://news.ycombinator.com/item?id=5879308 https://news.ycombinator.com/item?id=5879308
- glurgh 13y ago
  This simply isn't true. Even if you (with likely a few orders of magnitude margin) overestimate total world computing capacity at 1e21 decryption operations per second it's going to take you about age-of-the-universe seconds to brute force a single 128 bit key. No amount of money or supposed 'exponential technology growth' is going to let any government brute force these anytime soon. And those are the smallest symmetric keys in wide use.
  - kimlelly 13y ago
    Can you back these calculations up with a known scientific source?
    - aryastark 13y ago
      http://www.eetimes.com/design/embedded-internet-design/4372428/How-secure-is-AES-against-brute-force-attacks- http://www.eetimes.com/design/embedded-internet-design/43724... The only feasible thing against AES 128 right now would be if a flaw was discovered. This is also why it doesn't matter whether you use 128, 192, 256, or higher. If one is flawed, they all are. The reason we even have higher than 128 is simply because the government loves excessive amounts of redundancy. It lets them sleep easier at night, even if it's completely unnecessary.
    - kimlelly 13y ago
      @aryastark - What's the nature of AES 128 & Co., meaning: Who can and cannot discover flaws? Is this like open source where the whole world can watch or is this somehow a closed thing like Windows, MacOS, etc.?
      - glurgh 13y ago
        These are openly available, highly reviewed algorithms - their adoption as standards, too, is done by a process of open competition. And it's probably safe to say that the amount of research and analysis being done on them in the open exceeds that done in secret by government agencies by a wide margin.
        kimlelly 13y ago
        Thanks, very important to know!
        jlgaddis 13y ago
        Also, note that while AES and friends are public and designed "in the open", the government also has a number of algorithms that are developed and used internally and are not "public".
      - aryastark 13y ago
        Correct. The AES family of algorithms are public knowledge, not proprietary. They are open for scrutiny by mathematicians and crypto experts across the world. https://en.wikipedia.org/wiki/Advanced_Encryption_Standard https://en.wikipedia.org/wiki/Advanced_Encryption_Standard
      - jlgaddis 13y ago
        As a (related) example, consider the SHA family of hashing algorithms. Competitions are held in which anyone can submit their own algorithm as a possible contender. Like a beauty pageant, the entries are narrowed down over a few rounds until just a few are left. Eventually, one algorithm is chosen and declared the winner! The whole process is done in the open and, similar to RFCs, anyone who wishes to may provide feedback. The SHA-3 competition took roughly five years. You can read about the whole process on the NIST's web site: http://csrc.nist.gov/groups/ST/hash/sha-3/index.html I'm not a developer or math whiz so most of the underlying principles of crypto are over my head but read about the process (above) is quite interesting and gave me a much better understanding in general.
    - tobiasu 13y ago
      http://arxiv.org/pdf/quant-ph/9908043.pdf http://arxiv.org/pdf/quant-ph/9908043.pdf
    - glurgh 13y ago
      Sure. A 128 bit key is 2^128 or 3.4e38. Numbers about total world computing power (most of it probably stuck in GPUs doing windows animations and playing Call of Duty) bandied about are in the Ne18ish ops/sec range, age of the universe is in the 4e17 range. And I have a great deal of margin by treating a 'decrypt and verify' operation as a 'basic operation' and using a completely preposterous time period like the age of the universe instead of say, 10,000 years. Nobody is brute-forcing 128 bit keys anytime soon, that's a pretty basic mathematical and physical given. But if you're particularly paranoid, you can just as easily use 256 bit keys - nobody is brute-forcing those until we hit the singularity and become a galaxy-encompassing brain. Even then it might give us a serious, millennia-long headache.
      - kimlelly 13y ago
        Thanks, that helps!
  - njharman 13y ago
    Compute power is far from the most effective brute force method to get someone's encryption key. Other means include; rendition, waterboarding, jail, similar threats and keyloggers.
    - glurgh 13y ago
      The OP's contention was that government computational resources and the progress of technology itself make currently-available, robust encryption technology worthless. This is inaccurate. The fact that someone can beat a key out of you is not what is usually meant by 'brute forcing' a key, in a cryptographic context.
    - derleth 13y ago
      If they can beat a key out of you, they can beat you for any reason, or no reason at all.
aasarava 13y ago
From the article: "And while most types of software get more user-friendly over time, user-friendly cryptography seems to be intrinsically difficult. Experts are not much closer to solving the problem today than they were two decades ago." I'm not sure I agree that user-friendly cryptography is "intrinsically difficult." It doesn't seem like it would be hard for email clients and even the Gmail frontend to pop up a message saying, "Your email is insecure. To let people send you private messages securely, set up your 'public key' now. It's easy." Then a short wizard would walk users through the process and automatically append the public key to all outgoing messages. On the other side, if you were going to send a message to a friend, the email client would check if that person has published a public key and then ask, "The recipient allows secure messages. Would you like us to send this message securely?" Google and Microsoft and other large companies are no strangers to implementing a feature and using their size and clout to quickly make it a de facto standard. The real reason we don't have easy end-user cryptography is that these companies would lose access to mine your data and provide new services on top of that (and the article mentions this too.)
- maaku 13y ago
  And where is the private key stored? On Google or Microsoft's server? What then would be the point? (I assume you'll answer that it'll be done client-side, but JavaScript cryptography is a whole mess of fail. But that's a separate issue.)
  - pavel_lishin 13y ago
    And if it is stored client-side, what happens when the user inevitably loses their key? You and I might have backups in multiple places, and on an encrypted USB stick in a bank vault, but my dad doesn't, and the next time he spills wine on his laptop, there goes literally all of his e-mail.
    - baltcode 13y ago
      It's stored client-side, and as a back up on the central server, with a passphrase that is the users responsibility.
gasull 13y ago
Bitmessage is absolutely user-friendly. You are not even asked to enter a password.
marcosdumay 13y ago
That's the question about all this thing that I don't know how to anwer. Just extend it a bit... There are OSs that won't give root access to the NSA, encryption that the NSA won't be able to read and cloud services that the NSA won't be able to access even with cooperation of the CEO. Why none of them are widely used? And I don't accept the answer on the article as suficient. Yes, a few things are harder when you want any level of security, but not all. There are plenty of applications where security just won't disturb you (like VoIP), and plent of places that put security above all other concerns and should care about this (like non-US military). Yet, nearly nobody chooses the secure path.
- Spearchucker 13y ago
  The glib answer is that it's a matter of triage - given usability, security and cost, choose any two. While that is an influencer, the reality is a bit more complex. That social drive we've been going through for the last ~5 years means that developers focus on customer value. Also, while there's little new after Snowdens' leak - other than absolute proof - there's not been much demand, and hence incentive to make things secure.
aleclarsoniv 13y ago
"In contrast, when a system has end-to-end encryption, losing a password is catastrophic; it means losing all data in the user’s account." Um... what? Can't the user just reset his/her password, instead of a website emailing him/her the old password?...
- phillmv 13y ago
  Er, not if it's the password to the private key.
- glurgh 13y ago
  You can't 'reset the password' on gigabytes of already encrypted data. Lose the key, you've effectively lost the data.
bdamm 13y ago
Intelligence-community-proof is somewhat of a fallacy. You can make it more expensive for the NSA to get your email, because then you're forcing them (or another arm of the government) to penetrate your client and extract the key there. And, all you have done is make damn sure they keep your metadata records. Somewhere I read that sending encrypted email is an automatic flag, in the same category as using words that incite violence. So to truly make it effective, encrypted email has to be the norm, not the exception.
- Vivtek 13y ago
  To make it truly effective, you'd be sending your true message steganographically encoded in otherwise unexceptional text about business matters.
- jiggy2011 13y ago
  That sounds unlikely, encrypted email is relatively common in business. For example many domain registrars used it as a mechanism for changing domain settings before "APIs" were a thing.
Xcelerate 13y ago
I have a question that perhaps a cryptography expert could answer for me. My father told me when he was young, he visited Oak Ridge National Labs on a trip, and while there, they told him they had satellites that could read the print on a newspaper. At the time, it wasn't classified information; it was just something that nobody knew. Approximately 15-20 years later, satellites with that capability became well-known. This indicates to me that top secret technology is probably somewhere around 15-20 years ahead of what the general public knows about. This may be less true today than it was back then since nowadays the equipment and factories to develop state-of-the-art technology run in the billions of dollars. Where I'm going with this: is it reasonable to assume that "future technology" 20 years from now could crack AES-256 or PGP? If so, it seems reasonable to me that the NSA could already crack today's encryption for high-priority data. Add that to the fact that they tend to hire the very best experts in the field (mathematicians and cryptographers) and it doesn't seem entirely unreasonable to me that their decryption technologies are pretty good. Of course, I'm not talking about better technology in a brute-force sense; it would still be impossible to crack 256-bit encryption. I'm talking about algorithmic weaknesses. But then again, I have only a basic knowledge of cryptography. Would any experts like to comment?
- lordgilman 13y ago
  This has come up in the past on HN. As I understand it the newspaper story is bull. As for advancements in technology the answer is likely no - producing that technology requires an entire toolchain/industry that the NSA is unlikely to replicate with its size. The only shot the NSA has at pulling ahead of us is with entirely mathematical things like crypto (which they did at least in the 70s with differential cryptanalysis). With math you can simply hire a bunch of smart people and throw them in a room together which is much less capital intensive than the massive, fundamental research needed to advance technology ahead of the industry.
  - Xcelerate 13y ago
    > As I understand it the newspaper story is bull Could you clarify what you mean by this? And yeah, I should have been more clear in my original question; I was lumping mathematical advances under "technology".
david_shaw 13y ago
> NSA-proof encryption exists. Yup. Except it's not that easy. Let's say that you're using OTR to provide very strong end-to-end encryption for a conversation between yourself and a buddy, Bob. Maybe he's in a hostile area, and you're worried that if his government sniffs his traffic, that he could be executed for speaking to Americans. Data in transit that is intercepted, if configured correctly, is almost certainly safe. No one will be able to immediately decrypt it because of the strong encryption. So are you safe? Probably not. The next step that government would take would be to raid your friend Bob's apartment, arrest him, and take his hard disk. His OTR key (and, if using Pidgin, account credentials in plaintext if stored) is plainly available on the disk. You now have the private key. But what if he used Truecrypt or PGP full-disk encryption? His data would be safe from decryption then, right? Sort of. If they're trying to break the actual encryption, they'd likely be unable to do so. Unfortunately, the weak point for Truecrypt disks or volumes isn't the crypto... it's the passphrase. The passphrase can be brute-forced significantly more easily than breaking the encryption itself. Furthermore, as xkcd so accurately pointed out, a hostile government will throw you in prison (or, worse, hit you repeatedly with a wrench) until you divulge your passphrase and data. Encryption is great, and I encourage everyone to use reliably strong crypto. Will that keep your data safe from the criminals that stole your work laptop? Absolutely. Will it keep your data safe from the NSA? You're kidding yourself.
- tsahyt 13y ago
  Weren't there cases of the government forcing people to give them their passphrase in the US already? Somehow I seem to remember something like this very vaguely.
  - aroch 13y ago
    You're probably thinking about the child pornography case that's going on right now where the accused was ordered by the courts to provide his passphrase. Higher level courts say you cannot compel that sort of evidence.
  - __alexs 13y ago
    In the UK Oliver Drage (alleged child pornographer) was convicted and jailed for 16 weeks under RIPA for not disclosing his password. http://www.newstatesman.com/blogs/the-staggers/2010/10/police-drage-password-sex http://www.newstatesman.com/blogs/the-staggers/2010/10/polic...
crazy1van 13y ago
Because the vast majority of people like privacy in theory but not enough to spend the hour it would take to learn how to encrypt their email and documents. Seriously, how many HN users have spent hours complaining about privacy on here but still don't encrypt their own email? This isn't to excuse anything illegal the US gov't might be doing, but if it matters as much to people as they say you'd think they'd have at least taken some immediate action.
- unimpressive 13y ago
  >Seriously, how many HN users have spent hours complaining about privacy on here but still don't encrypt their own email? I would think that most HN users would be willing to encrypt their email, but know they can't convince their friends/family/etc to do so. Encryption takes two to tango.
  - crazy1van 13y ago
    I'd like to think that's true, but I doubt it. I bet tons of HN users run in the same circles as other HN users and communicate regularly, but never even consider encrypting their emails.
  - betterunix 13y ago
    To put things in perspective: at CRYPTO at some point in the past, I had a student stipend. I needed to send some documentation via email. I asked the person responsible, a prominent cryptography researcher (who will not be named), if they had a public key. The answer was, "No, I really should set one up but I'm just too busy." When not even the researchers who run a top-tier cryptography conference are bothering, you know that it is not just about non-technical folks being clueless.
Balgair 13y ago
I just posted this question the other day. Let me explain some of my travails trying to use PGP with Thunderbird: The install of T-Bird wasn't too bad The install of OpenPGP was not easy but I managed it. The instructions on the site were not all that clear and for an out-of-date version, but YouTube helped out a lot. My mom, the business owners, or a computer science teacher at Central High School simply do not have time to do this. This could be streamlined. The making of keys and storing of data was totally obtuse, fortunately, the wizard guided me through a lot of it. This could be streamlined. Now sending a message is where it gets tough. OpenPGP says that I have to use [shift]+"left-click" on the Write button in T-bird to make sure the html won't be used so the PGP message will de-crypted correctly. This is non-sense. Why is this happening? Ok now assuming I have a plain text email I have to hit [ctrl]+[shift]+[s] and [ctrl]+[shift]+[e] to sign and encrypt. BS. This needs to be better. Just a pop-up and type in the pass-phrase (brilliant wording, btw, phrase makes this so clear it has to be many words long my mom can understand this). Ok now my buddy can't read it because I did not send him a public key? What the hell are those? Why do I care? I thought I put in my pass-phrase? Didn't he? What is going on? I sort this out, I find the public key and send it over. Now he can read it. But wait I have another buddy that I have to do this with. Where were those options in the menus again? There needs to be a button that remembers if I sent the public key to them, sends it if I did not, and then automatically tells their email client that I don't have theirs and gets theirs with permission from them. Awww, fuck it... the NSA can probably crack this anyway.
- ef4 13y ago
  It's even worse than you think, because several of the things you said in there don't actually make sense. It sounds like you possibly didn't manage to get the message encrypted at all, just signed. And how you exchange public keys matters a great deal -- if you just send them over email, you haven't actually achieved any meaningful security. So yes. The entire process is a usability nightmare.
  - Balgair 13y ago
    ....fudge....
- 13y ago
zobzu 13y ago
Its not about convenience. its about money. Like everything really. Using GPG/PGP for example (which IMO is the best solution) is nice. It has a good, convenient design. The clients, UI, etc are terrible. Theyre extremely inconvenient. That can be fixed. This needs some time and a little dedication. Nobody will pay for a product that has proper, easy, fast PGP support across the board. Nobody. Since it's not a trivial task, and the benefits are "only" privacy, it didn't happen yet. If anything, people re-code their own, incompatible and generally lesser version of PGP, because they will get financial gain, or popularity from it (patching GPG doesn't give you as much popularity as making your own, you see.. and we're quite ego-driven / NIH-happy) So, here we are. And I'm to blame too, I haven't worked on this either. I'm secretly hoping things like PRISM will actually help making this move forward.
- tmzt 13y ago
  You could build a Chrome (or Firefox) extension that added GPG/PGP/SMIME to Gmail, you would have to intercept the emails before they were stored as drafts in order to protect the message in the inbox. You could use a plugin or native client to interface with the OS or desktop environment's keystore to keep the private key out of Javascript. The key passphrase could double as the passphrase for symmetrically encrypting the message stored in the inbox. Add to this a keyserver for automatically discovering public keys of contacts and you have a "good" solution between interested parties, without compromising recoverability of the majority of your messages. You could do the same for Gtalk/Hangouts chats with OTR.
  - brightsize 13y ago
    In other words, something similar to Mailvelope. http://www.mailvelope.com/ http://www.mailvelope.com/
rasengan0 13y ago
Hmm...the writer of the article almost echoes the exact same narrative of Defcon 18 Changing threats to privacy - Moxie Marlinspike http://youtu.be/eG0KrT6pBPk http://youtu.be/eG0KrT6pBPk
ww520 13y ago
How timely. This NSA fiasco has prompted me to finish up an old project https://boxuptext.com/ https://boxuptext.com/, which is a convenient webapp to encrypt message to url entirely on the browser. It's ready for use. Not many people use crypto because in general it's hard to set up and hard to use. A webapp is accessible and easy to use and provide reasonable security. I know there's a prevailing view against doing crypto in Javascript, and I've gone the extra steps to address the negatives. At the end I think the benefits of doing javascript on the browser outweigh the negatives. See https://boxuptext.com/faq#benefits https://boxuptext.com/faq#benefits
rsync 13y ago
All I want to know is, can SSH traffic be decoded ? I don't trust SSL, for various reasons of implementation and many, many questions about weak links in the PKI chain, etc. But I rely on SSH. I'd like very much to see some kind of assurance that this is a reasonable thing to rely on...
deleted 13y ago
[deleted]
sneak 13y ago
We do. We use it in the browser, for communicating between client and server. Service providers use it internally, for storing messages on disk. The problem is not one of operations; the problem is one of law. Google (and others) have been forced under federal law to provide the plaintext to the government, or have their individual persons face jail time. This is not a technological problem, and there are no technological solutions.
csense 13y ago
> Experts are not much closer to solving the problem [of user-friendly cryptography] today than they were two decades ago. I disagree. Recently there have been breakthroughs in homomorphic encryption. From Wikipedia [1]: "...any circuit can be homomorphically evaluated, effectively allowing the construction of programs which may be run on encryptions of their inputs to produce an encryption of their output. Since such a program never decrypts its input, it can be run by an untrusted party without revealing its inputs and internal state." While currently known constructions with the right mathematical properties are kind of slow, I'm sure that a lot of people are now interested and in the future we'll eventually be able to do it at practical speeds (especially with the help of future computers that are faster, and/or have more cores, and/or have dedicated coprocessors hard-wired for homomorphic encryption computations, like recent x86 chips have hardware accelerated AES [2]). If this happens, websites will be able to implement features, like search, that rely on manipulation of user data, without having access to that data themselves. > [Certain] features depend on Facebook’s servers having access to a person’s private data Today this is true, at least for people who aren't on the cutting edge of research in this field. But it might not be true tomorrow, if homomorphic encryption ever becomes practical (both in terms of fast algorithms, and in terms of frameworks/libraries which make it easy for developers to use). Off-topic remark: Homomorphic encryption will also impact the economics of cloud computing, since you'll be able to use CPU cycles provided by others without the security concerns of disclosing the unencrypted confidential data you want them to manipulate. [1] http://en.wikipedia.org/wiki/Homomorphic_encryption#Fully_homomorphic_encryption http://en.wikipedia.org/wiki/Homomorphic_encryption#Fully_ho... [2] http://en.wikipedia.org/wiki/AES_instruction_set http://en.wikipedia.org/wiki/AES_instruction_set
beefman 13y ago
The main point for me is to have a government I don't need to protect myself from. And more generally, a society where I don't need to disguise my every action. Points about the impracticality of strong encryption are secondary. Here are some of them anyway: * The vast majority of internet users don't have the domain knowledge needed to use strong encryption effectively. A classic example with e-mail is using a prominent phrase from the plain text of the message body in the (unencrypted) subject field. * Any cryptography scheme is vulnerable to social engineering, attacks on the trust networks used to exchange keys, etc. Avoiding these requires a nontrivial and ongoing amount of effort even for expert users. * Encryption complicates archival and search of content even for its author. * Any service that would help users with the above would be legally obligated to provide information to authorities anyway.

138 points by glenstein 13y ago

Why doesn't anyone use it? The FIRST question is: Is it really a solution? The answer to that: NO, see: https://news.ycombinator.com/item?id=5879308 https://news.ycombinator.com/item?id=5879308

glurgh 13y ago
This simply isn't true. Even if you (with likely a few orders of magnitude margin) overestimate total world computing capacity at 1e21 decryption operations per second it's going to take you about age-of-the-universe seconds to brute force a single 128 bit key. No amount of money or supposed 'exponential technology growth' is going to let any government brute force these anytime soon. And those are the smallest symmetric keys in wide use.
- kimlelly 13y ago
  Can you back these calculations up with a known scientific source?
  - aryastark 13y ago
    http://www.eetimes.com/design/embedded-internet-design/4372428/How-secure-is-AES-against-brute-force-attacks- http://www.eetimes.com/design/embedded-internet-design/43724... The only feasible thing against AES 128 right now would be if a flaw was discovered. This is also why it doesn't matter whether you use 128, 192, 256, or higher. If one is flawed, they all are. The reason we even have higher than 128 is simply because the government loves excessive amounts of redundancy. It lets them sleep easier at night, even if it's completely unnecessary.
  - kimlelly 13y ago
    @aryastark - What's the nature of AES 128 & Co., meaning: Who can and cannot discover flaws? Is this like open source where the whole world can watch or is this somehow a closed thing like Windows, MacOS, etc.?
    - glurgh 13y ago
      These are openly available, highly reviewed algorithms - their adoption as standards, too, is done by a process of open competition. And it's probably safe to say that the amount of research and analysis being done on them in the open exceeds that done in secret by government agencies by a wide margin.
      - kimlelly 13y ago
        Thanks, very important to know!
        jlgaddis 13y ago
        Also, note that while AES and friends are public and designed "in the open", the government also has a number of algorithms that are developed and used internally and are not "public".
    - aryastark 13y ago
      Correct. The AES family of algorithms are public knowledge, not proprietary. They are open for scrutiny by mathematicians and crypto experts across the world. https://en.wikipedia.org/wiki/Advanced_Encryption_Standard https://en.wikipedia.org/wiki/Advanced_Encryption_Standard
    - jlgaddis 13y ago
      As a (related) example, consider the SHA family of hashing algorithms. Competitions are held in which anyone can submit their own algorithm as a possible contender. Like a beauty pageant, the entries are narrowed down over a few rounds until just a few are left. Eventually, one algorithm is chosen and declared the winner! The whole process is done in the open and, similar to RFCs, anyone who wishes to may provide feedback. The SHA-3 competition took roughly five years. You can read about the whole process on the NIST's web site: http://csrc.nist.gov/groups/ST/hash/sha-3/index.html I'm not a developer or math whiz so most of the underlying principles of crypto are over my head but read about the process (above) is quite interesting and gave me a much better understanding in general.
  - tobiasu 13y ago
    http://arxiv.org/pdf/quant-ph/9908043.pdf http://arxiv.org/pdf/quant-ph/9908043.pdf
  - glurgh 13y ago
    Sure. A 128 bit key is 2^128 or 3.4e38. Numbers about total world computing power (most of it probably stuck in GPUs doing windows animations and playing Call of Duty) bandied about are in the Ne18ish ops/sec range, age of the universe is in the 4e17 range. And I have a great deal of margin by treating a 'decrypt and verify' operation as a 'basic operation' and using a completely preposterous time period like the age of the universe instead of say, 10,000 years. Nobody is brute-forcing 128 bit keys anytime soon, that's a pretty basic mathematical and physical given. But if you're particularly paranoid, you can just as easily use 256 bit keys - nobody is brute-forcing those until we hit the singularity and become a galaxy-encompassing brain. Even then it might give us a serious, millennia-long headache.
    - kimlelly 13y ago
      Thanks, that helps!
- njharman 13y ago
  Compute power is far from the most effective brute force method to get someone's encryption key. Other means include; rendition, waterboarding, jail, similar threats and keyloggers.
  - glurgh 13y ago
    The OP's contention was that government computational resources and the progress of technology itself make currently-available, robust encryption technology worthless. This is inaccurate. The fact that someone can beat a key out of you is not what is usually meant by 'brute forcing' a key, in a cryptographic context.
  - derleth 13y ago
    If they can beat a key out of you, they can beat you for any reason, or no reason at all.

aasarava 13y ago

From the article: "And while most types of software get more user-friendly over time, user-friendly cryptography seems to be intrinsically difficult. Experts are not much closer to solving the problem today than they were two decades ago." I'm not sure I agree that user-friendly cryptography is "intrinsically difficult." It doesn't seem like it would be hard for email clients and even the Gmail frontend to pop up a message saying, "Your email is insecure. To let people send you private messages securely, set up your 'public key' now. It's easy." Then a short wizard would walk users through the process and automatically append the public key to all outgoing messages. On the other side, if you were going to send a message to a friend, the email client would check if that person has published a public key and then ask, "The recipient allows secure messages. Would you like us to send this message securely?" Google and Microsoft and other large companies are no strangers to implementing a feature and using their size and clout to quickly make it a de facto standard. The real reason we don't have easy end-user cryptography is that these companies would lose access to mine your data and provide new services on top of that (and the article mentions this too.)

maaku 13y ago
And where is the private key stored? On Google or Microsoft's server? What then would be the point? (I assume you'll answer that it'll be done client-side, but JavaScript cryptography is a whole mess of fail. But that's a separate issue.)
- pavel_lishin 13y ago
  And if it is stored client-side, what happens when the user inevitably loses their key? You and I might have backups in multiple places, and on an encrypted USB stick in a bank vault, but my dad doesn't, and the next time he spills wine on his laptop, there goes literally all of his e-mail.
  - baltcode 13y ago
    It's stored client-side, and as a back up on the central server, with a passphrase that is the users responsibility.

gasull 13y ago

Bitmessage is absolutely user-friendly. You are not even asked to enter a password.

marcosdumay 13y ago

That's the question about all this thing that I don't know how to anwer. Just extend it a bit... There are OSs that won't give root access to the NSA, encryption that the NSA won't be able to read and cloud services that the NSA won't be able to access even with cooperation of the CEO. Why none of them are widely used? And I don't accept the answer on the article as suficient. Yes, a few things are harder when you want any level of security, but not all. There are plenty of applications where security just won't disturb you (like VoIP), and plent of places that put security above all other concerns and should care about this (like non-US military). Yet, nearly nobody chooses the secure path.

Spearchucker 13y ago
The glib answer is that it's a matter of triage - given usability, security and cost, choose any two. While that is an influencer, the reality is a bit more complex. That social drive we've been going through for the last ~5 years means that developers focus on customer value. Also, while there's little new after Snowdens' leak - other than absolute proof - there's not been much demand, and hence incentive to make things secure.

aleclarsoniv 13y ago

"In contrast, when a system has end-to-end encryption, losing a password is catastrophic; it means losing all data in the user’s account." Um... what? Can't the user just reset his/her password, instead of a website emailing him/her the old password?...

phillmv 13y ago
Er, not if it's the password to the private key.
glurgh 13y ago
You can't 'reset the password' on gigabytes of already encrypted data. Lose the key, you've effectively lost the data.

bdamm 13y ago

Intelligence-community-proof is somewhat of a fallacy. You can make it more expensive for the NSA to get your email, because then you're forcing them (or another arm of the government) to penetrate your client and extract the key there. And, all you have done is make damn sure they keep your metadata records. Somewhere I read that sending encrypted email is an automatic flag, in the same category as using words that incite violence. So to truly make it effective, encrypted email has to be the norm, not the exception.

Vivtek 13y ago
To make it truly effective, you'd be sending your true message steganographically encoded in otherwise unexceptional text about business matters.
jiggy2011 13y ago
That sounds unlikely, encrypted email is relatively common in business. For example many domain registrars used it as a mechanism for changing domain settings before "APIs" were a thing.

Xcelerate 13y ago

I have a question that perhaps a cryptography expert could answer for me. My father told me when he was young, he visited Oak Ridge National Labs on a trip, and while there, they told him they had satellites that could read the print on a newspaper. At the time, it wasn't classified information; it was just something that nobody knew. Approximately 15-20 years later, satellites with that capability became well-known. This indicates to me that top secret technology is probably somewhere around 15-20 years ahead of what the general public knows about. This may be less true today than it was back then since nowadays the equipment and factories to develop state-of-the-art technology run in the billions of dollars. Where I'm going with this: is it reasonable to assume that "future technology" 20 years from now could crack AES-256 or PGP? If so, it seems reasonable to me that the NSA could already crack today's encryption for high-priority data. Add that to the fact that they tend to hire the very best experts in the field (mathematicians and cryptographers) and it doesn't seem entirely unreasonable to me that their decryption technologies are pretty good. Of course, I'm not talking about better technology in a brute-force sense; it would still be impossible to crack 256-bit encryption. I'm talking about algorithmic weaknesses. But then again, I have only a basic knowledge of cryptography. Would any experts like to comment?

lordgilman 13y ago
This has come up in the past on HN. As I understand it the newspaper story is bull. As for advancements in technology the answer is likely no - producing that technology requires an entire toolchain/industry that the NSA is unlikely to replicate with its size. The only shot the NSA has at pulling ahead of us is with entirely mathematical things like crypto (which they did at least in the 70s with differential cryptanalysis). With math you can simply hire a bunch of smart people and throw them in a room together which is much less capital intensive than the massive, fundamental research needed to advance technology ahead of the industry.
- Xcelerate 13y ago
  > As I understand it the newspaper story is bull Could you clarify what you mean by this? And yeah, I should have been more clear in my original question; I was lumping mathematical advances under "technology".

david_shaw 13y ago

> NSA-proof encryption exists. Yup. Except it's not that easy. Let's say that you're using OTR to provide very strong end-to-end encryption for a conversation between yourself and a buddy, Bob. Maybe he's in a hostile area, and you're worried that if his government sniffs his traffic, that he could be executed for speaking to Americans. Data in transit that is intercepted, if configured correctly, is almost certainly safe. No one will be able to immediately decrypt it because of the strong encryption. So are you safe? Probably not. The next step that government would take would be to raid your friend Bob's apartment, arrest him, and take his hard disk. His OTR key (and, if using Pidgin, account credentials in plaintext if stored) is plainly available on the disk. You now have the private key. But what if he used Truecrypt or PGP full-disk encryption? His data would be safe from decryption then, right? Sort of. If they're trying to break the actual encryption, they'd likely be unable to do so. Unfortunately, the weak point for Truecrypt disks or volumes isn't the crypto... it's the passphrase. The passphrase can be brute-forced significantly more easily than breaking the encryption itself. Furthermore, as xkcd so accurately pointed out, a hostile government will throw you in prison (or, worse, hit you repeatedly with a wrench) until you divulge your passphrase and data. Encryption is great, and I encourage everyone to use reliably strong crypto. Will that keep your data safe from the criminals that stole your work laptop? Absolutely. Will it keep your data safe from the NSA? You're kidding yourself.

tsahyt 13y ago
Weren't there cases of the government forcing people to give them their passphrase in the US already? Somehow I seem to remember something like this very vaguely.
- aroch 13y ago
  You're probably thinking about the child pornography case that's going on right now where the accused was ordered by the courts to provide his passphrase. Higher level courts say you cannot compel that sort of evidence.
- __alexs 13y ago
  In the UK Oliver Drage (alleged child pornographer) was convicted and jailed for 16 weeks under RIPA for not disclosing his password. http://www.newstatesman.com/blogs/the-staggers/2010/10/police-drage-password-sex http://www.newstatesman.com/blogs/the-staggers/2010/10/polic...

crazy1van 13y ago

Because the vast majority of people like privacy in theory but not enough to spend the hour it would take to learn how to encrypt their email and documents. Seriously, how many HN users have spent hours complaining about privacy on here but still don't encrypt their own email? This isn't to excuse anything illegal the US gov't might be doing, but if it matters as much to people as they say you'd think they'd have at least taken some immediate action.

unimpressive 13y ago
>Seriously, how many HN users have spent hours complaining about privacy on here but still don't encrypt their own email? I would think that most HN users would be willing to encrypt their email, but know they can't convince their friends/family/etc to do so. Encryption takes two to tango.
- crazy1van 13y ago
  I'd like to think that's true, but I doubt it. I bet tons of HN users run in the same circles as other HN users and communicate regularly, but never even consider encrypting their emails.
- betterunix 13y ago
  To put things in perspective: at CRYPTO at some point in the past, I had a student stipend. I needed to send some documentation via email. I asked the person responsible, a prominent cryptography researcher (who will not be named), if they had a public key. The answer was, "No, I really should set one up but I'm just too busy." When not even the researchers who run a top-tier cryptography conference are bothering, you know that it is not just about non-technical folks being clueless.

Balgair 13y ago

I just posted this question the other day. Let me explain some of my travails trying to use PGP with Thunderbird: The install of T-Bird wasn't too bad The install of OpenPGP was not easy but I managed it. The instructions on the site were not all that clear and for an out-of-date version, but YouTube helped out a lot. My mom, the business owners, or a computer science teacher at Central High School simply do not have time to do this. This could be streamlined. The making of keys and storing of data was totally obtuse, fortunately, the wizard guided me through a lot of it. This could be streamlined. Now sending a message is where it gets tough. OpenPGP says that I have to use [shift]+"left-click" on the Write button in T-bird to make sure the html won't be used so the PGP message will de-crypted correctly. This is non-sense. Why is this happening? Ok now assuming I have a plain text email I have to hit [ctrl]+[shift]+[s] and [ctrl]+[shift]+[e] to sign and encrypt. BS. This needs to be better. Just a pop-up and type in the pass-phrase (brilliant wording, btw, phrase makes this so clear it has to be many words long my mom can understand this). Ok now my buddy can't read it because I did not send him a public key? What the hell are those? Why do I care? I thought I put in my pass-phrase? Didn't he? What is going on? I sort this out, I find the public key and send it over. Now he can read it. But wait I have another buddy that I have to do this with. Where were those options in the menus again? There needs to be a button that remembers if I sent the public key to them, sends it if I did not, and then automatically tells their email client that I don't have theirs and gets theirs with permission from them. Awww, fuck it... the NSA can probably crack this anyway.

ef4 13y ago
It's even worse than you think, because several of the things you said in there don't actually make sense. It sounds like you possibly didn't manage to get the message encrypted at all, just signed. And how you exchange public keys matters a great deal -- if you just send them over email, you haven't actually achieved any meaningful security. So yes. The entire process is a usability nightmare.
- Balgair 13y ago
  ....fudge....
13y ago

zobzu 13y ago

Its not about convenience. its about money. Like everything really. Using GPG/PGP for example (which IMO is the best solution) is nice. It has a good, convenient design. The clients, UI, etc are terrible. Theyre extremely inconvenient. That can be fixed. This needs some time and a little dedication. Nobody will pay for a product that has proper, easy, fast PGP support across the board. Nobody. Since it's not a trivial task, and the benefits are "only" privacy, it didn't happen yet. If anything, people re-code their own, incompatible and generally lesser version of PGP, because they will get financial gain, or popularity from it (patching GPG doesn't give you as much popularity as making your own, you see.. and we're quite ego-driven / NIH-happy) So, here we are. And I'm to blame too, I haven't worked on this either. I'm secretly hoping things like PRISM will actually help making this move forward.

tmzt 13y ago
You could build a Chrome (or Firefox) extension that added GPG/PGP/SMIME to Gmail, you would have to intercept the emails before they were stored as drafts in order to protect the message in the inbox. You could use a plugin or native client to interface with the OS or desktop environment's keystore to keep the private key out of Javascript. The key passphrase could double as the passphrase for symmetrically encrypting the message stored in the inbox. Add to this a keyserver for automatically discovering public keys of contacts and you have a "good" solution between interested parties, without compromising recoverability of the majority of your messages. You could do the same for Gtalk/Hangouts chats with OTR.
- brightsize 13y ago
  In other words, something similar to Mailvelope. http://www.mailvelope.com/ http://www.mailvelope.com/

rasengan0 13y ago

Hmm...the writer of the article almost echoes the exact same narrative of Defcon 18 Changing threats to privacy - Moxie Marlinspike http://youtu.be/eG0KrT6pBPk http://youtu.be/eG0KrT6pBPk

ww520 13y ago

How timely. This NSA fiasco has prompted me to finish up an old project https://boxuptext.com/ https://boxuptext.com/, which is a convenient webapp to encrypt message to url entirely on the browser. It's ready for use. Not many people use crypto because in general it's hard to set up and hard to use. A webapp is accessible and easy to use and provide reasonable security. I know there's a prevailing view against doing crypto in Javascript, and I've gone the extra steps to address the negatives. At the end I think the benefits of doing javascript on the browser outweigh the negatives. See https://boxuptext.com/faq#benefits https://boxuptext.com/faq#benefits

rsync 13y ago

All I want to know is, can SSH traffic be decoded ? I don't trust SSL, for various reasons of implementation and many, many questions about weak links in the PKI chain, etc. But I rely on SSH. I'd like very much to see some kind of assurance that this is a reasonable thing to rely on...

deleted 13y ago

[deleted]

sneak 13y ago

We do. We use it in the browser, for communicating between client and server. Service providers use it internally, for storing messages on disk. The problem is not one of operations; the problem is one of law. Google (and others) have been forced under federal law to provide the plaintext to the government, or have their individual persons face jail time. This is not a technological problem, and there are no technological solutions.

csense 13y ago

> Experts are not much closer to solving the problem [of user-friendly cryptography] today than they were two decades ago. I disagree. Recently there have been breakthroughs in homomorphic encryption. From Wikipedia [1]: "...any circuit can be homomorphically evaluated, effectively allowing the construction of programs which may be run on encryptions of their inputs to produce an encryption of their output. Since such a program never decrypts its input, it can be run by an untrusted party without revealing its inputs and internal state." While currently known constructions with the right mathematical properties are kind of slow, I'm sure that a lot of people are now interested and in the future we'll eventually be able to do it at practical speeds (especially with the help of future computers that are faster, and/or have more cores, and/or have dedicated coprocessors hard-wired for homomorphic encryption computations, like recent x86 chips have hardware accelerated AES [2]). If this happens, websites will be able to implement features, like search, that rely on manipulation of user data, without having access to that data themselves. > [Certain] features depend on Facebook’s servers having access to a person’s private data Today this is true, at least for people who aren't on the cutting edge of research in this field. But it might not be true tomorrow, if homomorphic encryption ever becomes practical (both in terms of fast algorithms, and in terms of frameworks/libraries which make it easy for developers to use). Off-topic remark: Homomorphic encryption will also impact the economics of cloud computing, since you'll be able to use CPU cycles provided by others without the security concerns of disclosing the unencrypted confidential data you want them to manipulate. [1] http://en.wikipedia.org/wiki/Homomorphic_encryption#Fully_homomorphic_encryption http://en.wikipedia.org/wiki/Homomorphic_encryption#Fully_ho... [2] http://en.wikipedia.org/wiki/AES_instruction_set http://en.wikipedia.org/wiki/AES_instruction_set

beefman 13y ago

The main point for me is to have a government I don't need to protect myself from. And more generally, a society where I don't need to disguise my every action. Points about the impracticality of strong encryption are secondary. Here are some of them anyway: * The vast majority of internet users don't have the domain knowledge needed to use strong encryption effectively. A classic example with e-mail is using a prominent phrase from the plain text of the message body in the (unencrypted) subject field. * Any cryptography scheme is vulnerable to social engineering, attacks on the trust networks used to exchange keys, etc. Avoiding these requires a nontrivial and ongoing amount of effort even for expert users. * Encryption complicates archival and search of content even for its author. * Any service that would help users with the above would be legally obligated to provide information to authorities anyway.