4 ms·

I have to agree. The user needs control over their encryption. Taking advantage of Norway's laws is fine, until the day that those laws go sour on you.

by noarchy 13y ago

switch007 13y ago
Don't you need a combination of encryption AND no law forcing you to reveal the key?
- vog 13y ago
  The law that might force you to reveal the key depends on where you are, not where your hoster is.
  - mike-cardwell 13y ago
    Or the law of the country you are extradited to.
  - Sami_Lehtinen 13y ago
    Good luck, I have terabytes of random data. I can always provide you OTP key, and create what ever content I want you to see. (Malleable encryption)
    - vidarh 13y ago
      Stay away from the UK - here a judge can throw you in jail for failure to provide keys, even if there's no evidence you still have the keys, and said judge would pretty much be guaranteed to believe that you did not hand over the correct keys if the result is garbage.
      - Ntrails 13y ago
        I think this might be slight hyperbole but can you link to some cases/incidents for support? Cheers.
        michaelt 13y ago
        It's not actually that common, but there have been at least 3 people prosecuted: http://www.bbc.co.uk/news/uk-england-11479831 http://www.bbc.co.uk/news/uk-england-11479831 http://www.theregister.co.uk/2009/08/11/ripa_iii_figures/ http://www.theregister.co.uk/2009/08/11/ripa_iii_figures/
        Ntrails 13y ago
        That's in line with what I expected, thanks. Specifically to read: "Of the 15 individuals served, 11 did not comply with the notices. Of the 11, seven were charged and two convicted." Whilst they may have been incarcerated since the report, at the least it would seem that there is some evidence based procedure to determine "guilt" in terms of whether you are able to produce the key or not.
      - scott_w 13y ago
        http://www.theregister.co.uk/2008/10/14/ripa_self_incrimination_ruling/ http://www.theregister.co.uk/2008/10/14/ripa_self_incriminat... A couple of people have been convicted of refusing to hand over their encryption key. It's worth noting that this is a separate offence, so there's a determinate prison sentence. You can't be held in contempt of court for refusing to hand it over.
      - aianus 13y ago
        If you claim the encryption was done using a One Time Pad, you can pick any result you want, generate the corresponding key, and hand that over. https://en.wikipedia.org/wiki/One-time_pad https://en.wikipedia.org/wiki/One-time_pad
        vog 13y ago
        Unfortunately, the OTP is always as large as the encrypted data. So strictly speaking, this is not really "encrypted data + password" but more of a "split data into two random-looking parts". In particular, this is nothing you can keep in your head or print on paper. You'd have to keep it on a separate storage medium. And if you have to hand out the done medium, what's preventing them to get your second medium? And if you are able to keep that second medium secret and safe, why don't you store the whole unencrypted data on it in the first place? Either way: OTPs are really cool, but I don't think they have any relevance here.
- richardw 13y ago
  If so, then the law essentially forces you to give your files up and no server location will protect you. For any person who is not being forced into giving their keys up, encrypting their own files must be safer than hoping a cloud provider won't freely hand them over to the US government. This is especially true for non-US citizens, who seem to have no protection at all. Even the earlier whistle-blowers don't consider us anything but open season: http://www.usatoday.com/story/news/politics/2013/06/16/snowden-whistleblower-nsa-officials-roundtable/2428809/ http://www.usatoday.com/story/news/politics/2013/06/16/snowd... Fine. If you're foreign, encrypt your files and store them anywhere you like. If you're a US citizen, do the same and know that the government only has them when they force you to hand the keys over. (Barring them being able to hack them some other way, e.g. simply grabbing your keys off your machine.)
at-fates-hands 13y ago
The slippery slope in all of this is the application of the law. Sure, if the government was going after someone like Steve Muller (http://www.wired.com/threatlevel/2008/04/gsm-researcher/ http://www.wired.com/threatlevel/2008/04/gsm-researcher/) you'd want him to be able to keep his stuff from prying eyes. What about a Suadi National accused of plotting terror attacks in NYC? Would you want the same laws applied to him? Or would you want to able to force someone like this to de-crypt their files in order to stop an attack? I really don't know what the right answer is, but sometimes laws intended to keep us safe, also give shelter to bad guys.
- icelancer 13y ago
  >I really don't know what the right answer is, but sometimes laws intended to keep us safe, also give shelter to bad guys. Americans inherently know this. We were brought up with the idea that freedom isn't free and that the price of liberty is eternal vigilance. Just because it is more convenient to violate the civil liberties of all to catch a few bad actors doesn't mean it is what our country is all about. Europeans often find that sentiment ridiculous. But that is just the cost of privacy and liberty - one that our forefathers were welcome to pay.

I have to agree. The user needs control over their encryption. Taking advantage of Norway's laws is fine, until the day that those laws go sour on you.

by noarchy 13y ago

I have to agree. The user needs control over their encryption. Taking advantage of Norway's laws is fine, until the day that those laws go sour on you.

switch007 13y ago

Don't you need a combination of encryption AND no law forcing you to reveal the key?

vog 13y ago
The law that might force you to reveal the key depends on where you are, not where your hoster is.
- mike-cardwell 13y ago
  Or the law of the country you are extradited to.
- Sami_Lehtinen 13y ago
  Good luck, I have terabytes of random data. I can always provide you OTP key, and create what ever content I want you to see. (Malleable encryption)
  - vidarh 13y ago
    Stay away from the UK - here a judge can throw you in jail for failure to provide keys, even if there's no evidence you still have the keys, and said judge would pretty much be guaranteed to believe that you did not hand over the correct keys if the result is garbage.
    - Ntrails 13y ago
      I think this might be slight hyperbole but can you link to some cases/incidents for support? Cheers.
      - michaelt 13y ago
        It's not actually that common, but there have been at least 3 people prosecuted: http://www.bbc.co.uk/news/uk-england-11479831 http://www.bbc.co.uk/news/uk-england-11479831 http://www.theregister.co.uk/2009/08/11/ripa_iii_figures/ http://www.theregister.co.uk/2009/08/11/ripa_iii_figures/
        Ntrails 13y ago
        That's in line with what I expected, thanks. Specifically to read: "Of the 15 individuals served, 11 did not comply with the notices. Of the 11, seven were charged and two convicted." Whilst they may have been incarcerated since the report, at the least it would seem that there is some evidence based procedure to determine "guilt" in terms of whether you are able to produce the key or not.
    - scott_w 13y ago
      http://www.theregister.co.uk/2008/10/14/ripa_self_incrimination_ruling/ http://www.theregister.co.uk/2008/10/14/ripa_self_incriminat... A couple of people have been convicted of refusing to hand over their encryption key. It's worth noting that this is a separate offence, so there's a determinate prison sentence. You can't be held in contempt of court for refusing to hand it over.
    - aianus 13y ago
      If you claim the encryption was done using a One Time Pad, you can pick any result you want, generate the corresponding key, and hand that over. https://en.wikipedia.org/wiki/One-time_pad https://en.wikipedia.org/wiki/One-time_pad
      - vog 13y ago
        Unfortunately, the OTP is always as large as the encrypted data. So strictly speaking, this is not really "encrypted data + password" but more of a "split data into two random-looking parts". In particular, this is nothing you can keep in your head or print on paper. You'd have to keep it on a separate storage medium. And if you have to hand out the done medium, what's preventing them to get your second medium? And if you are able to keep that second medium secret and safe, why don't you store the whole unencrypted data on it in the first place? Either way: OTPs are really cool, but I don't think they have any relevance here.
richardw 13y ago
If so, then the law essentially forces you to give your files up and no server location will protect you. For any person who is not being forced into giving their keys up, encrypting their own files must be safer than hoping a cloud provider won't freely hand them over to the US government. This is especially true for non-US citizens, who seem to have no protection at all. Even the earlier whistle-blowers don't consider us anything but open season: http://www.usatoday.com/story/news/politics/2013/06/16/snowden-whistleblower-nsa-officials-roundtable/2428809/ http://www.usatoday.com/story/news/politics/2013/06/16/snowd... Fine. If you're foreign, encrypt your files and store them anywhere you like. If you're a US citizen, do the same and know that the government only has them when they force you to hand the keys over. (Barring them being able to hack them some other way, e.g. simply grabbing your keys off your machine.)

at-fates-hands 13y ago

The slippery slope in all of this is the application of the law. Sure, if the government was going after someone like Steve Muller (http://www.wired.com/threatlevel/2008/04/gsm-researcher/ http://www.wired.com/threatlevel/2008/04/gsm-researcher/) you'd want him to be able to keep his stuff from prying eyes. What about a Suadi National accused of plotting terror attacks in NYC? Would you want the same laws applied to him? Or would you want to able to force someone like this to de-crypt their files in order to stop an attack? I really don't know what the right answer is, but sometimes laws intended to keep us safe, also give shelter to bad guys.

icelancer 13y ago
>I really don't know what the right answer is, but sometimes laws intended to keep us safe, also give shelter to bad guys. Americans inherently know this. We were brought up with the idea that freedom isn't free and that the price of liberty is eternal vigilance. Just because it is more convenient to violate the civil liberties of all to catch a few bad actors doesn't mean it is what our country is all about. Europeans often find that sentiment ridiculous. But that is just the cost of privacy and liberty - one that our forefathers were welcome to pay.