6 ms·

Maybe they don't want drug pushers and users to know they have this either?

by willvarfar 13y ago

gaius 13y ago
Security through obscurity?
- aroman 13y ago
  …actually works outside of theory. We're not talking cryptosystems here, we're talking about intelligence and counterintelligence. You don't call a spy's disguise security through obscurity. Note that I'm not condoning mass government surveilance, only objecting to its criticism on the grounds of "security through obsecurity".
  - sliverstorm 13y ago
    Even real-world cryptography can benefit from security through obscurity. It's all a time game- how fast can my attackers attack my security, how much time do I need to buy. If security through obscurity buys you time, why not?
    - bad_user 13y ago
      "Buys you time" for what? For fixing it? Why not do it right in the first place? The danger in this line of thought is that security breaches only have to happen once for real damage to ensue. For software companies, when it happens, I always expect to see a clear explanation for why it did happen and in case of stupid architectural problems, I tend to avoid that company in the future. Of course there's a difference between software and real world undercover operations performed by government agencies. Placing an agent undercover is both a gamble and a race against the clock. The government knows the risks involved, the agent knows the risks involved, human casualties can happen but that's part of the contract so to speak. Nobody willingly enters such operations without knowing the risks involved. But if you're gambling with customer's data, be prepared to explain that to the angry customers when the shit hits the fan.
      - derefr 13y ago
        As far as I know, we've never yet created a cryptographic algorithm that's withstood more than 20 years of scrutiny. We could assume this trend continues into the future, and that any crypto algorithm we do create will be broken within 20 years. This means that encrypting a piece of data isn't some magical eternal protection--it just seals it in a time-capsule that'll "degrade" after 20 years or less. (Sometimes far less.) But, so far, this property has also been pretty much irrelevant: almost all the things we want to do by passing along a secret are time-sensitive, and breaking the secret 20 years after the fact doesn't really buy you anything. Being able to impersonate the SSL key of Microsoft.com-as-it-was-in-1993 doesn't let you do anything to Microsoft.com-as-it-is-today. This policy scales down, of course: in military comsec terms, you only need the encryption on operational details to last until the day after the operation is carried out. After that, your "secret" has become "plain" (something quite obviously blew up, etc.) and so the enemy breaking the encryption on the orders won't tell them anything they didn't already realize by hearing the explosion. This is why the military keeps multiple different kinds of ciphers for different levels of secrecy, by the way: they assume that the more things they use a particular crypto algorithm for--the more signals the enemy gets to intercept that use that algorithm--the more enemy sigint folks will be put to the task of breaking that algorithm. So "top secret" encryption isn't meant to withstand any more scrutiny than "secret" encryption; it's just generally a bunch of orthogonal crypto primitives to the ones in the merely-secret crypto, and only used rarely, for the kinds of orders that need to stay secret long after execution (e.g. covert ops on allies.) Thus, enemy nations will have comparatively little reason to have analyzed and broken it--and breaking the secret-level ciphers won't help them, because of the orthogonal implementations.
        bad_user 13y ago
        You're right of course, however we need to make a distinction here. First of all there's the issue of how strong is an encryption algorithm. For example RSA is based on the problem of factoring large numbers, a problem that's generally considered to be hard as we know of no efficient algorithm for solving it. But we haven't proved that factoring large numbers will remain a hard to solve problem in the future. The NSA could very well have custom hardware for efficiently factoring 1024-bit primes by now and the upcoming quantum computing is a real threat. If they haven't done it by now, 1024-bit keys will become breakable in the future, however 2048-bit keys are another issue entirely and 4096-bit keys will probably stay unbreakable. But, even if breakthroughs in solving the integer factorization problem will be made in the future, as long as P != NP then perfect encryption is possible. In fact, we already know of encryption schemes that are provably unbreakable even with unlimited hardware at disposal, the problem being that they are also hard to implement, so we ended up with making tradeoffs. Second, it's far easier to attack a particular implementation, to bypass the encryption algorithm entirely, e.g. attacks against the key generation system, side-channels, the protocol of the software system we are talking about, etc ... because software always has bugs, as in zero-day exploits that one could make use of. For this reason - if indeed the military is using different encryption algorithms for different security levels, algorithms that aren't used in the wild, then to me that's a pretty bad idea, as far more often than not it's the implementation that's broken, not the algorithm. And in case of inside leaks, the implementation is always easier to get a hold of, compared to the key.
legutierr 13y ago
Is this an argument in favor of the practice? Because, honestly, drugs should be legal to sell and to purchase. If all drugs should be legal and if the trade in drugs should be legal, then how can any program like this designed solely to enforce drug laws be justified? In that event, who cares what drug "pushers" and users know?
- tinco 13y ago
  Well, honestly, drugs should not be legal to sell and to purchase. What world are you living in? Do you think these guys deal weed? Have you seen what (crack) cocaine does to people? These cocaine pushers are in the business of destroying people, and they certainly should be apprehended.
  - Zigurd 13y ago
    It is less expensive and less destructive to treat addicts than it is to conduct a Drug War.
  - betterunix 13y ago
    "Well, honestly, drugs should not be legal to sell and to purchase." Care to cite any reasons here? See, when it comes to cocaine, Congress has not revisited the debate since people said these sort of things: http://query.nytimes.com/gst/abstract.html?res=F70F1EFA3A5A15738DDDAB0894D0405B888CF1D3 http://query.nytimes.com/gst/abstract.html?res=F70F1EFA3A5A1... http://www.druglibrary.org/schaffer/history/negro_cocaine_fiends.htm http://www.druglibrary.org/schaffer/history/negro_cocaine_fi... Yeah, you read that correctly. Black guys who use cocaine become more accurate with a gun and will attack white women! Also, Jews are selling it. Cocaine also makes it nearly impossible to kill a black man using a standard issue handgun, so let's upgrade the caliber. "Have you seen what (crack) cocaine does to people?" Yes: I have seen the children of the wealthy doing cocaine at college parties, then going on to get high-paying jobs on Wall St. Truly ruinous, truly! How about we drop the boogeyman and drop the anecdotes and start citing some sources? You claim that cocaine destroys people; let's see the proof.
  - TausAmmer 13y ago
betterunix 13y ago
I think we need to take a step back and get to the part where it makes sense to use these tactics against drug users.
downandout 13y ago
The point of my comment wasn't that we shouldn't use technology to enforce our laws (though our drug laws are ridiculous and counterproductive). It was that our local, state, and federal governments operate as a collection of thousands of fiefdoms that run for the most part without supervision from any other agency. Each of those fiefdoms can implement programs like this in secret, and no one can challenge them because no one knows about them. Every so often one of these programs is identified and disbanded after years of litigation, but hundreds more will soon appear in its place. The simplicity of implementing such programs combined with the near impossibility of identifying and eliminating them makes this an insurmountable problem. Our government seems to have adopted the mantra of the criminals they claim to dislike so much: If you don't get caught, it's not illegal.

Maybe they don't want drug pushers and users to know they have this either?

gaius 13y ago

Security through obscurity?

aroman 13y ago
…actually works outside of theory. We're not talking cryptosystems here, we're talking about intelligence and counterintelligence. You don't call a spy's disguise security through obscurity. Note that I'm not condoning mass government surveilance, only objecting to its criticism on the grounds of "security through obsecurity".
- sliverstorm 13y ago
  Even real-world cryptography can benefit from security through obscurity. It's all a time game- how fast can my attackers attack my security, how much time do I need to buy. If security through obscurity buys you time, why not?
  - bad_user 13y ago
    "Buys you time" for what? For fixing it? Why not do it right in the first place? The danger in this line of thought is that security breaches only have to happen once for real damage to ensue. For software companies, when it happens, I always expect to see a clear explanation for why it did happen and in case of stupid architectural problems, I tend to avoid that company in the future. Of course there's a difference between software and real world undercover operations performed by government agencies. Placing an agent undercover is both a gamble and a race against the clock. The government knows the risks involved, the agent knows the risks involved, human casualties can happen but that's part of the contract so to speak. Nobody willingly enters such operations without knowing the risks involved. But if you're gambling with customer's data, be prepared to explain that to the angry customers when the shit hits the fan.
    - derefr 13y ago
      As far as I know, we've never yet created a cryptographic algorithm that's withstood more than 20 years of scrutiny. We could assume this trend continues into the future, and that any crypto algorithm we do create will be broken within 20 years. This means that encrypting a piece of data isn't some magical eternal protection--it just seals it in a time-capsule that'll "degrade" after 20 years or less. (Sometimes far less.) But, so far, this property has also been pretty much irrelevant: almost all the things we want to do by passing along a secret are time-sensitive, and breaking the secret 20 years after the fact doesn't really buy you anything. Being able to impersonate the SSL key of Microsoft.com-as-it-was-in-1993 doesn't let you do anything to Microsoft.com-as-it-is-today. This policy scales down, of course: in military comsec terms, you only need the encryption on operational details to last until the day after the operation is carried out. After that, your "secret" has become "plain" (something quite obviously blew up, etc.) and so the enemy breaking the encryption on the orders won't tell them anything they didn't already realize by hearing the explosion. This is why the military keeps multiple different kinds of ciphers for different levels of secrecy, by the way: they assume that the more things they use a particular crypto algorithm for--the more signals the enemy gets to intercept that use that algorithm--the more enemy sigint folks will be put to the task of breaking that algorithm. So "top secret" encryption isn't meant to withstand any more scrutiny than "secret" encryption; it's just generally a bunch of orthogonal crypto primitives to the ones in the merely-secret crypto, and only used rarely, for the kinds of orders that need to stay secret long after execution (e.g. covert ops on allies.) Thus, enemy nations will have comparatively little reason to have analyzed and broken it--and breaking the secret-level ciphers won't help them, because of the orthogonal implementations.
      - bad_user 13y ago
        You're right of course, however we need to make a distinction here. First of all there's the issue of how strong is an encryption algorithm. For example RSA is based on the problem of factoring large numbers, a problem that's generally considered to be hard as we know of no efficient algorithm for solving it. But we haven't proved that factoring large numbers will remain a hard to solve problem in the future. The NSA could very well have custom hardware for efficiently factoring 1024-bit primes by now and the upcoming quantum computing is a real threat. If they haven't done it by now, 1024-bit keys will become breakable in the future, however 2048-bit keys are another issue entirely and 4096-bit keys will probably stay unbreakable. But, even if breakthroughs in solving the integer factorization problem will be made in the future, as long as P != NP then perfect encryption is possible. In fact, we already know of encryption schemes that are provably unbreakable even with unlimited hardware at disposal, the problem being that they are also hard to implement, so we ended up with making tradeoffs. Second, it's far easier to attack a particular implementation, to bypass the encryption algorithm entirely, e.g. attacks against the key generation system, side-channels, the protocol of the software system we are talking about, etc ... because software always has bugs, as in zero-day exploits that one could make use of. For this reason - if indeed the military is using different encryption algorithms for different security levels, algorithms that aren't used in the wild, then to me that's a pretty bad idea, as far more often than not it's the implementation that's broken, not the algorithm. And in case of inside leaks, the implementation is always easier to get a hold of, compared to the key.

legutierr 13y ago

Is this an argument in favor of the practice? Because, honestly, drugs should be legal to sell and to purchase. If all drugs should be legal and if the trade in drugs should be legal, then how can any program like this designed solely to enforce drug laws be justified? In that event, who cares what drug "pushers" and users know?

tinco 13y ago
Well, honestly, drugs should not be legal to sell and to purchase. What world are you living in? Do you think these guys deal weed? Have you seen what (crack) cocaine does to people? These cocaine pushers are in the business of destroying people, and they certainly should be apprehended.
- Zigurd 13y ago
  It is less expensive and less destructive to treat addicts than it is to conduct a Drug War.
- betterunix 13y ago
  "Well, honestly, drugs should not be legal to sell and to purchase." Care to cite any reasons here? See, when it comes to cocaine, Congress has not revisited the debate since people said these sort of things: http://query.nytimes.com/gst/abstract.html?res=F70F1EFA3A5A15738DDDAB0894D0405B888CF1D3 http://query.nytimes.com/gst/abstract.html?res=F70F1EFA3A5A1... http://www.druglibrary.org/schaffer/history/negro_cocaine_fiends.htm http://www.druglibrary.org/schaffer/history/negro_cocaine_fi... Yeah, you read that correctly. Black guys who use cocaine become more accurate with a gun and will attack white women! Also, Jews are selling it. Cocaine also makes it nearly impossible to kill a black man using a standard issue handgun, so let's upgrade the caliber. "Have you seen what (crack) cocaine does to people?" Yes: I have seen the children of the wealthy doing cocaine at college parties, then going on to get high-paying jobs on Wall St. Truly ruinous, truly! How about we drop the boogeyman and drop the anecdotes and start citing some sources? You claim that cocaine destroys people; let's see the proof.
- TausAmmer 13y ago

betterunix 13y ago

I think we need to take a step back and get to the part where it makes sense to use these tactics against drug users.

downandout 13y ago

The point of my comment wasn't that we shouldn't use technology to enforce our laws (though our drug laws are ridiculous and counterproductive). It was that our local, state, and federal governments operate as a collection of thousands of fiefdoms that run for the most part without supervision from any other agency. Each of those fiefdoms can implement programs like this in secret, and no one can challenge them because no one knows about them. Every so often one of these programs is identified and disbanded after years of litigation, but hundreds more will soon appear in its place. The simplicity of implementing such programs combined with the near impossibility of identifying and eliminating them makes this an insurmountable problem. Our government seems to have adopted the mantra of the criminals they claim to dislike so much: If you don't get caught, it's not illegal.