5 ms·

It seems to me we are seeing a variant of the same problem that Ken Thompson articulated in his paper "Reflections on Trusting Trust."[1] While not a compiler

It seems to me we are seeing a variant of the same problem that Ken Thompson articulated in his paper "Reflections on Trusting Trust."[1] While not a compiler intercept of the sort Thompson is talking about, this is effectively a library intercept of critical crypto functions and it poses the same basic problem. I don't think the industry will ever be the same. I think more and more folks are going to demand source-level access to everything crypto-related, and cryptoanalysts are going to put a lot more effort into scrutinizing these things. The NSA failed to heed the basic warning of the Greek drama: ὕβρις-ἄτη-Νέμεσις Or in more familiar terms, "Pride goeth before a fall." [1] http://cm.bell-labs.com/who/ken/trust.html http://cm.bell-labs.com/who/ken/trust.html

acqq 13y ago
I just had too look up the Greek words: hubris [ὕβρις] ‘outrage’; the opposite of dikē [δίκη] dikē [δίκη], plural dikai [δίκαι] ‘judgment (short-range); justice (long-range)’; dikaios [δίκαιος] ‘just’ atē [ἄτη], plural atai [ἆται] ‘aberration, derangement, veering off-course; disaster; punishment for disaster’ nemesis [νέμεσις] indicates the process whereby everyone gets what he or she deserves
- einhverfr 13y ago
  In other words, the basic formula of Greek tragedy is the hubris or outrageous pride overwhelming judgement, leading to deserved disaster. There's an additional subtext btw of exceeding prudent limits in "hubris."[1] The thing here is that the NSA has acted out of hubris and exceeded prudent limits, and the result will be predictable. The deserved disaster will come from far more routine use of encryption, and this will deny legitimate law enforcement investigations many critical tools. While this is a cost that to some extent will be borne by everyone, it will particularly hit the NSA and law enforcement really hard. [1] See "From Religion to Philosophy" by F. M. Cornford, 1914. Some parts are dated, but the general discussion of partition and nomos/nemesis is very well done.
  - acqq 13y ago
    Thanks for the book recommendation! > The deserved disaster will come It's still hard for me to see that. I don't know any person who started to more encrypt. And the companies will always have to fullfill the requests of the state: http://www.theatlantic.com/technology/archive/2014/03/don-t-listen-to-google-and-facebook-the-public-private-surveillance-partnership-is-still-going-strong/284612/ http://www.theatlantic.com/technology/archive/2014/03/don-t-... There's still a lot to be done to induce the significant change.
    - einhverfr 13y ago
      > It's still hard for me to see that. If nothing else, criminals will take encryption far more seriously, which is where the real cost comes in from a LEO perspective. > I don't know any person who started to more encrypt. I have started to encrypt more, and new businesses are springing up with more encryption built-in. It's also something which has impacted Efficito's approach to security to some extent. > And the companies will always have to fullfill the requests of the state Sure. However as of now, there is no requirement that they be able to fulfil the requests, so the current struggle is really with coming up with systems where the administrator/cloud provider has no access. This will lead to predictable results, and the next battle will be over whether to require such providers to retain access. To my mind, that's the legal battle we must prepare for.

acqq 13y ago

I just had too look up the Greek words: hubris [ὕβρις] ‘outrage’; the opposite of dikē [δίκη] dikē [δίκη], plural dikai [δίκαι] ‘judgment (short-range); justice (long-range)’; dikaios [δίκαιος] ‘just’ atē [ἄτη], plural atai [ἆται] ‘aberration, derangement, veering off-course; disaster; punishment for disaster’ nemesis [νέμεσις] indicates the process whereby everyone gets what he or she deserves

einhverfr 13y ago
In other words, the basic formula of Greek tragedy is the hubris or outrageous pride overwhelming judgement, leading to deserved disaster. There's an additional subtext btw of exceeding prudent limits in "hubris."[1] The thing here is that the NSA has acted out of hubris and exceeded prudent limits, and the result will be predictable. The deserved disaster will come from far more routine use of encryption, and this will deny legitimate law enforcement investigations many critical tools. While this is a cost that to some extent will be borne by everyone, it will particularly hit the NSA and law enforcement really hard. [1] See "From Religion to Philosophy" by F. M. Cornford, 1914. Some parts are dated, but the general discussion of partition and nomos/nemesis is very well done.
- acqq 13y ago
  Thanks for the book recommendation! > The deserved disaster will come It's still hard for me to see that. I don't know any person who started to more encrypt. And the companies will always have to fullfill the requests of the state: http://www.theatlantic.com/technology/archive/2014/03/don-t-listen-to-google-and-facebook-the-public-private-surveillance-partnership-is-still-going-strong/284612/ http://www.theatlantic.com/technology/archive/2014/03/don-t-... There's still a lot to be done to induce the significant change.
  - einhverfr 13y ago
    > It's still hard for me to see that. If nothing else, criminals will take encryption far more seriously, which is where the real cost comes in from a LEO perspective. > I don't know any person who started to more encrypt. I have started to encrypt more, and new businesses are springing up with more encryption built-in. It's also something which has impacted Efficito's approach to security to some extent. > And the companies will always have to fullfill the requests of the state Sure. However as of now, there is no requirement that they be able to fulfil the requests, so the current struggle is really with coming up with systems where the administrator/cloud provider has no access. This will lead to predictable results, and the next battle will be over whether to require such providers to retain access. To my mind, that's the legal battle we must prepare for.