4 ms·

Here's a provocative gem: > The purpose of cryptography is to force the US government to torture you.

by asciimo 12y ago

cperciva 12y ago
It's pretty simple -- if the US government really really wants your secrets, they can kidnap you and torture you until you tell them what they want to know. Cryptography can protect data, but it doesn't protect humans; all it can do is make sure that humans are the only remaining point of attack.
- mseebach 12y ago
  That's not entirely true. Proper cryptography can keep them from learning that it's you they'll need to kidnap to get the secret, or even keep them from learning that there is a secret they might care about in the first place. Also, there are plenty of bad guys in the world that can't kidnap and torture you that it's still quite worthwhile to keep your secrets from.
  - cperciva 12y ago
    You're over-thinking this. The point is simply that no matter how good the cryptography in a system is, if there are humans involved then you need to worry about human factors as well.
    - peterwwillis 12y ago
      The easiest way to avoid the human factor is to get a scapegoat. You make it seem like someone else is responsible for, or knows about, the crypto or its data payload. They will then torture that individual indefinitely until they confess to something. It's better if they don't know you or anything about your scheme as that way it'll look like they're holding out a really long time on important information. Then the only thing you need to worry about is that person dying, in which case the investigation continues. So similar to upping the number of rounds on PBKDF2 every year, you need a new scapegoat every year, or however long it takes them to break either the crypto or the scapegoat.
cschmidt 12y ago
As in the $5 wrench xkcd: http://xkcd.com/538/ http://xkcd.com/538/
- broken 12y ago
  or Rubber-hose Cryptanalysis http://en.wikipedia.org/wiki/Rubber-hose_cryptanalysis http://en.wikipedia.org/wiki/Rubber-hose_cryptanalysis
  - corpselord420 12y ago
    why yes that is indeed what the adults have been discussing
deleted 12y ago
[deleted]

Here's a provocative gem: > The purpose of cryptography is to force the US government to torture you.

by asciimo 12y ago

Here's a provocative gem: > The purpose of cryptography is to force the US government to torture you.

It's pretty simple -- if the US government really really wants your secrets, they can kidnap you and torture you until you tell them what they want to know. Cryptography can protect data, but it doesn't protect humans; all it can do is make sure that humans are the only remaining point of attack.

mseebach 12y ago
That's not entirely true. Proper cryptography can keep them from learning that it's you they'll need to kidnap to get the secret, or even keep them from learning that there is a secret they might care about in the first place. Also, there are plenty of bad guys in the world that can't kidnap and torture you that it's still quite worthwhile to keep your secrets from.
- cperciva 12y ago
  You're over-thinking this. The point is simply that no matter how good the cryptography in a system is, if there are humans involved then you need to worry about human factors as well.
  - peterwwillis 12y ago
    The easiest way to avoid the human factor is to get a scapegoat. You make it seem like someone else is responsible for, or knows about, the crypto or its data payload. They will then torture that individual indefinitely until they confess to something. It's better if they don't know you or anything about your scheme as that way it'll look like they're holding out a really long time on important information. Then the only thing you need to worry about is that person dying, in which case the investigation continues. So similar to upping the number of rounds on PBKDF2 every year, you need a new scapegoat every year, or however long it takes them to break either the crypto or the scapegoat.

cschmidt 12y ago

As in the $5 wrench xkcd: http://xkcd.com/538/ http://xkcd.com/538/

broken 12y ago
or Rubber-hose Cryptanalysis http://en.wikipedia.org/wiki/Rubber-hose_cryptanalysis http://en.wikipedia.org/wiki/Rubber-hose_cryptanalysis
- corpselord420 12y ago
  why yes that is indeed what the adults have been discussing

deleted 12y ago

[deleted]