3 ms·

This thread perfectly demonstrates why injunctions on free speech are evil. We could be reading their paper now instead of contemplating what this piece of low-

This thread perfectly demonstrates why injunctions on free speech are evil. We could be reading their paper now instead of contemplating what this piece of low-effort journalism could have possibly meant. The rash of high tech car robberies, I think, used the OBD port to reprogram the car to recognize their fake key. Like a dealer would. So they didn't break the actual crypto, as is claimed here. The software that is referenced here could be the software VW distributes to dealerships to reprogram the car when a customer lost their key. So thats certainly one possible way to find out how the crypto system works, by the interaction of the software with the car. The article also mentions decaping the actual ICs that do the crypto. Thats a very time intensive way to find out how a crypto system works, but it may be the only one when you are dealing with fixed master keys and propietary algorithms. If the keys alluded to here are actually master keys, burned into every car, then they should certainly be published along with the other results, since they are an integral part of the system.

ds9 13y ago
Suppressions of freedom of speech are evil, but not only because they prevent us gaining knowledge. It also punishes innocent activities to protect others against fourth parties - an obvious injustice. "Finding in Volkswagen's favour, Mr Justice Birss said he recognised the importance of the right for academics to publish, but it would mean 'that car crime will be facilitated'." If "crime would be facilitated" is to be the criterion of suppressing communications, there can be no digital security and no freedom of speech.
- marshray 13y ago
  Oh for the days when Western governments had to invoke the threat of terrorism with weapons of mass destruction in order to suppress academic speech.
vacri 13y ago
If I found out your bank account details, would you be happy for me to publish them?
- DJN 13y ago
  A poor analogy but in general terms, if it is in the public's interest, yes. Security by obscurity is flawed.
  - vacri 13y ago
    So freedom of speech is only morally necessitated if it's deemed to be in the public interest? That sounds like you're setting a restriction on speech.
    - crumblan 13y ago
      That's not what you asked, you asked "would you be happy".
      - vacri 13y ago
        Yes, it was a rhetorical question meant to illustrate that there are some things for which it's not evil to publish. Another example would be the names and locations of victims of spousal abuse that are in refuges. In any case, if you're being that pedantic, why didn't you notice that I actually asked revelation that question, and not DJN?
    - DJN 13y ago
      If something is in the public's interest, it generally makes sense to disclose it to the public. For example, if a car manufacturer (or bank) makes public claims that their system is secure, yet they use 56-bit DES keys to encrypt data, then I think the public should know. Your "account number" analogy was off because it's is generally not in the public interest to reveal a private citizen's account number. However, if an account number (email address or ip address) was being used frequently to commit crime, say in an advance fee fraud, then it makes sense to blow the lid on the said account number. That's what I meant by "in the public interest".
  - smsm42 13y ago
    Security by obscurity means hiding the algorithms, not the keys. In this example account numbers, etc. are the keys Unfortunately, it is how most of the banking world right now works. It is quite easy to initiate transactions and create accounts knowing a few basic numbers about you - bank account numbers, name, date of birth, SSN number (I'm talking about the US of course), home address. And it is very hard to change or hide many of these numbers and data items. The system is very fragile right now, and the only reason why it works is that overwhelming majority of users aren't crooks and losses from the crooks are small enough to be covered without triggering move to a more resilient system.

ds9 13y ago

Suppressions of freedom of speech are evil, but not only because they prevent us gaining knowledge. It also punishes innocent activities to protect others against fourth parties - an obvious injustice. "Finding in Volkswagen's favour, Mr Justice Birss said he recognised the importance of the right for academics to publish, but it would mean 'that car crime will be facilitated'." If "crime would be facilitated" is to be the criterion of suppressing communications, there can be no digital security and no freedom of speech.

marshray 13y ago
Oh for the days when Western governments had to invoke the threat of terrorism with weapons of mass destruction in order to suppress academic speech.

vacri 13y ago

If I found out your bank account details, would you be happy for me to publish them?

DJN 13y ago
A poor analogy but in general terms, if it is in the public's interest, yes. Security by obscurity is flawed.
- vacri 13y ago
  So freedom of speech is only morally necessitated if it's deemed to be in the public interest? That sounds like you're setting a restriction on speech.
  - crumblan 13y ago
    That's not what you asked, you asked "would you be happy".
    - vacri 13y ago
      Yes, it was a rhetorical question meant to illustrate that there are some things for which it's not evil to publish. Another example would be the names and locations of victims of spousal abuse that are in refuges. In any case, if you're being that pedantic, why didn't you notice that I actually asked revelation that question, and not DJN?
  - DJN 13y ago
    If something is in the public's interest, it generally makes sense to disclose it to the public. For example, if a car manufacturer (or bank) makes public claims that their system is secure, yet they use 56-bit DES keys to encrypt data, then I think the public should know. Your "account number" analogy was off because it's is generally not in the public interest to reveal a private citizen's account number. However, if an account number (email address or ip address) was being used frequently to commit crime, say in an advance fee fraud, then it makes sense to blow the lid on the said account number. That's what I meant by "in the public interest".
- smsm42 13y ago
  Security by obscurity means hiding the algorithms, not the keys. In this example account numbers, etc. are the keys Unfortunately, it is how most of the banking world right now works. It is quite easy to initiate transactions and create accounts knowing a few basic numbers about you - bank account numbers, name, date of birth, SSN number (I'm talking about the US of course), home address. And it is very hard to change or hide many of these numbers and data items. The system is very fragile right now, and the only reason why it works is that overwhelming majority of users aren't crooks and losses from the crooks are small enough to be covered without triggering move to a more resilient system.