6 ms·

I'd like for people to start thinking about security measures, including encryption, as a cost function rather than as a boolean condition (e.g. safe vs. unsafe

I'd like for people to start thinking about security measures, including encryption, as a cost function rather than as a boolean condition (e.g. safe vs. unsafe; stop the NSA vs. not stop the NSA). I doubt there is anyone who can stop the NSA from executing a targeted attack that breaches that information. My feeling is that good security measures increase the marginal cost per person surveilled. As the article points out, there are some kinds of communications that Apple is obliged to provide access to. Those are likely to carry low marginal costs per person surveilled, as law enforcement may have the legal means to directly and unilaterally access that information. Even if they don't, the capacity for Apple, telecoms, whoever, to operate in "God mode" with respect to some kinds of communications means that mechanism is a good target for agencies like the NSA to breach. By contrast, even flawed technologies like iMessage (centralized key management) raise the per-person marginal cost by forcing attacks to be reasonably targeted. While the NSA could probably figure out how to attack Apple's key management infrastructure to set themselves up with a virtual iMessage device for an individual, doing so for all the people would, in principle, be fairly noticeable to Apple. The more we can instrument technologies that force attacks from "bulk mode" to "targeted," the better chance we have at actually curbing surveillance. Of course, this still leaves the panopticon problem--if we accept that targeted attacks will always be possible, and that any of us could be watched at roughly any time, the psychological chilling effects of surveillance remain.

spacefight 12y ago
Rising the cost hurts the population much more in the long run - we, the people, we pay the surveillance for us. No one else. We must fight hard that we don't need to pay that tax any more - money which flows in large sums directly to the military/industrial complex.
- LeoNatan25 12y ago
  I think you misunderstood the term "cost" as used here.
  - spacefight 12y ago
    Not sure, no. Why?
    - tombrossman 12y ago
      I think cost can be looked at in terms of money, time, risk, effort, or any number of other things and this is what is being referred to above. That point is probably moot though, as all will translate to additional financial costs as you mention.
  - peatmoss 12y ago
    Insofar as analyst hours, kwh, computing hardware, etc. can all be converted to dollars, spacefight and I are talking about comparable units. And the idea of reducing the cost for intelligence agencies to surveil us to save money is an interesting one. While I agree that paying more taxes for a dubiously useful "service" is bad, I disagree that the right response is to reduce that marginal cost--i.e. be more transparent in the face of government surveillance. Under a regime of high marginal costs, I'd like to believe that the NSA would simply be more selective in its targets, rather than be successful in securing additional funding.
    - aftbit 12y ago
      Not to mention, the larger the black budget, the harder it is to hide, and the more outrage when something like Snowden happens.
- mstolpm 12y ago
  So, perhaps a law to ban any encryption would save us a lot of money. Better yet, force everyone to make every information public. But most likely, all this data would be of great interest for criminals? What about the cost of fraud, crime, identity theft? Is it better to have unencrypted phones stolen by criminals in exchange for easier and cheaper surveillance? I'd think Apples encryption isn't mostly targeted to stop law enforcement and surveillance but more to stop misuse of lost and stolen phones. In addition, if able to implant zero-day exploits, any attacker can bypath any encryption - or he might just target the transmission or the other side of a sent/received secret. Most information isn't produced on an iPhone to sit there forever: either it is received from a server / second device or it is intended to be transmitted to a receiver. So, an encrypted phone isn't really stopping surveillance.
- adventured 12y ago
  Those intelligence budgets aren't going to get smaller, almost no matter what. The general US population has no idea how much is spent, their best guess would be: a lot (and it'd be a correct one); so there can't hardly even be a voter push-back based on expenditures. As such, the best option is to make it so expensive to carry out mass surveillance, their only choice is to be selective about who they target and to focus on specific individuals rather than a billion people in general. The cost should be drastically increased in all regards: time, electricity, water, monetary, etc. It's very likely this will happen. The NSA was sitting at the ultimate sweet-spot in history, but windows like that are only open for extremely brief amounts of time. It will close and there is nothing that the NSA can do to stop it.
- manicdee 12y ago
  Increasing the cost of surveillance means it becomes easier to constrain the intelligence agencies by simply not allowing them endless budgets.
aftbit 12y ago
We could make passive observation (beamsplitters) useless by opportunistically encrypting all traffic with unauthenticated DH to derive a key. This would do nothing against an active observer, but it would raise the cost of interception significantly.
- tacotime 12y ago
  There's a fine line between significantly and marginally in the case of a massively well funded organization like the NSA. Unauthed HD is so damn trivial to MiTM that accepting it as the status quo might just as likely force our government to invest a couple extra billions in MiTM equipment next year as it would be likely to protect the masses from the over reaching hand of mass surveillance. Who's to say they don't already use this capability on a regular basis? As long as you're using an unauthenticated encryption scheme you will never know...
  - JoachimS 12y ago
    "Who's to say they don't already use this capability on a regular basis? As long as you're using an unauthenticated encryption scheme you will never know" Oh, but we could know. And we should know. This is a good example of good vs perfect and boolean cost. You are right that we currently don't know how prevalent these attacks are and if they are employed on big scale. But it is possible to know and would make a good research topic and/or a way for the community to raise the bar and know more about the state of Internet. Yes do MITM on unauth DH is easy. But that does not say anything about the actual application traffic flowing through the connection. A successful, _undetected_ attack must also know and subvert the application traffic to keep the illusion alive. We could do second level authentication, out-of-band authentication etc at application level to make it possible to detect the MITM. If we do this measurement on large scale and continuously we can find out who and where these attacks are in fact occuring. IMHO one of the best network security research projects lately is the Spoiled Onions: http://www.cs.kau.se/philwint/spoiled_onions/ http://www.cs.kau.se/philwint/spoiled_onions/ This project aims at monitoring Tor for bad nodes and use out-of-band mechanisms to find things like MITM attacks. Very cool and relevant.
azonenberg 12y ago
Disk encryption will only stop a targeted attack (someone physically gets their hands on your phone) anyway. All this does is raise the cost by a bit.
- Tyrannosaurs 12y ago
  Or move the attack. If it's encrypted at rest you look at attack in transit or via social engineering or whatever. I think sometimes we get too hung up about the technology around security. For a targeted attack, going for the technology often won't be the best route.
crazy1van 12y ago
> I'd like for people to start thinking about security measures, including encryption, as a cost function rather than as a boolean condition (e.g. safe vs. unsafe; stop the NSA vs. not stop the NSA) Great point and one that I think typical computer savvy users already do. It is in the security-expert-fantasy-world that the perfect quickly becomes the enemy of the good. For example, using SSL to send sensitive data like passwords or payment info is nearly ubiquitous. Yes, there are many flaws in SSL's trust model, but the cost is so small, using it is a no brainer. However, PGP encrypted email is much more rarely used. It has numerous higher costs, from special email software to the social pain of getting your friends to also use it. The benefit is still high, but the cost is high too and that results in far less usage. In the real world, informed people look at the cost benefit break down of security. Just like we all don't drive semi trucks around even though they are safer in a collision, we all don't communicate in the most secure fashion because there is a cost associated with that decision. With that in mind, the easiest path towards greater security in communications population-wide would be to focus less on improving the security and more on lowering the associated cost.
- peatmoss 12y ago
  In a traditional economic sense, the optimal amount to spend on security measures is when the marginal costs equal the marginal benefits.
  - qzc4 12y ago
    Yes, but it's hard to quantify the benefits (or even the costs) of a security measure—it's just as much a risk evaluation as it is a cost one.
    - peatmoss 12y ago
      Like so much of economics, the hard part is coming up with a price tag that everyone agrees on in all contexts. How much would you pay to save your grandmother's life from an illness? How much would you accept to allow me to hunt her for sport? So, in that sense, coming up with a precise measure of marginal cost / marginal benefit would be hard in practice.
bjornsing 12y ago
I agree to some extent (and I'm excited by the progress in "opportunistic encryption"), but I'd like for people to also start thinking about what's possible and what's simply not. For example, modern block ciphers like AES can protect data against an attacker that does not have access to the encryption key. However, in this case we're talking about an attacker that has perhaps 90% of the encryption key, the UID, in its physical possession. The UID can be concealed in many ingenious ways, but that doesn't change the fact that the attacker is in physical possession of the atoms that encode it. This is essentially "security by obscurity", albeit on a high level. In contrast I would argue that message exchange over the internet can be made secure, even against a nationstate adversary.
nine_k 12y ago
Exactly. Good security is not an unbreakable lock, it's a lock that costs significantly more to break than the value of what it's guarding.
teekert 12y ago
But the NSA has unlimited funds, created by the tax payers they spy on. So why not make it easy, save us all a lot of money </sarcasm>. It so crazy that we are talking about people that require the consent of their governed... On second though maybe outside of our bubble they have that consent and we have to bow to that majority.
- x0x0 12y ago
  If they had that majority, my guess is they wouldn't have had to lie about what they were doing. Or at least my hope.
moe 12y ago
While the NSA could probably figure out how to attack Apple's key management infrastructure [...], doing so for all the people would, in principle, be fairly noticeable to Apple. Maybe that's why Apple's warrant canary has disappeared[1]. [1] https://gigaom.com/2014/09/18/apples-warrant-canary-disappears-suggesting-new-patriot-act-demands/ https://gigaom.com/2014/09/18/apples-warrant-canary-disappea...

spacefight 12y ago

Rising the cost hurts the population much more in the long run - we, the people, we pay the surveillance for us. No one else. We must fight hard that we don't need to pay that tax any more - money which flows in large sums directly to the military/industrial complex.

LeoNatan25 12y ago
I think you misunderstood the term "cost" as used here.
- spacefight 12y ago
  Not sure, no. Why?
  - tombrossman 12y ago
    I think cost can be looked at in terms of money, time, risk, effort, or any number of other things and this is what is being referred to above. That point is probably moot though, as all will translate to additional financial costs as you mention.
- peatmoss 12y ago
  Insofar as analyst hours, kwh, computing hardware, etc. can all be converted to dollars, spacefight and I are talking about comparable units. And the idea of reducing the cost for intelligence agencies to surveil us to save money is an interesting one. While I agree that paying more taxes for a dubiously useful "service" is bad, I disagree that the right response is to reduce that marginal cost--i.e. be more transparent in the face of government surveillance. Under a regime of high marginal costs, I'd like to believe that the NSA would simply be more selective in its targets, rather than be successful in securing additional funding.
  - aftbit 12y ago
    Not to mention, the larger the black budget, the harder it is to hide, and the more outrage when something like Snowden happens.
mstolpm 12y ago
So, perhaps a law to ban any encryption would save us a lot of money. Better yet, force everyone to make every information public. But most likely, all this data would be of great interest for criminals? What about the cost of fraud, crime, identity theft? Is it better to have unencrypted phones stolen by criminals in exchange for easier and cheaper surveillance? I'd think Apples encryption isn't mostly targeted to stop law enforcement and surveillance but more to stop misuse of lost and stolen phones. In addition, if able to implant zero-day exploits, any attacker can bypath any encryption - or he might just target the transmission or the other side of a sent/received secret. Most information isn't produced on an iPhone to sit there forever: either it is received from a server / second device or it is intended to be transmitted to a receiver. So, an encrypted phone isn't really stopping surveillance.
adventured 12y ago
Those intelligence budgets aren't going to get smaller, almost no matter what. The general US population has no idea how much is spent, their best guess would be: a lot (and it'd be a correct one); so there can't hardly even be a voter push-back based on expenditures. As such, the best option is to make it so expensive to carry out mass surveillance, their only choice is to be selective about who they target and to focus on specific individuals rather than a billion people in general. The cost should be drastically increased in all regards: time, electricity, water, monetary, etc. It's very likely this will happen. The NSA was sitting at the ultimate sweet-spot in history, but windows like that are only open for extremely brief amounts of time. It will close and there is nothing that the NSA can do to stop it.
manicdee 12y ago
Increasing the cost of surveillance means it becomes easier to constrain the intelligence agencies by simply not allowing them endless budgets.

aftbit 12y ago

We could make passive observation (beamsplitters) useless by opportunistically encrypting all traffic with unauthenticated DH to derive a key. This would do nothing against an active observer, but it would raise the cost of interception significantly.

tacotime 12y ago
There's a fine line between significantly and marginally in the case of a massively well funded organization like the NSA. Unauthed HD is so damn trivial to MiTM that accepting it as the status quo might just as likely force our government to invest a couple extra billions in MiTM equipment next year as it would be likely to protect the masses from the over reaching hand of mass surveillance. Who's to say they don't already use this capability on a regular basis? As long as you're using an unauthenticated encryption scheme you will never know...
- JoachimS 12y ago
  "Who's to say they don't already use this capability on a regular basis? As long as you're using an unauthenticated encryption scheme you will never know" Oh, but we could know. And we should know. This is a good example of good vs perfect and boolean cost. You are right that we currently don't know how prevalent these attacks are and if they are employed on big scale. But it is possible to know and would make a good research topic and/or a way for the community to raise the bar and know more about the state of Internet. Yes do MITM on unauth DH is easy. But that does not say anything about the actual application traffic flowing through the connection. A successful, _undetected_ attack must also know and subvert the application traffic to keep the illusion alive. We could do second level authentication, out-of-band authentication etc at application level to make it possible to detect the MITM. If we do this measurement on large scale and continuously we can find out who and where these attacks are in fact occuring. IMHO one of the best network security research projects lately is the Spoiled Onions: http://www.cs.kau.se/philwint/spoiled_onions/ http://www.cs.kau.se/philwint/spoiled_onions/ This project aims at monitoring Tor for bad nodes and use out-of-band mechanisms to find things like MITM attacks. Very cool and relevant.

azonenberg 12y ago

Disk encryption will only stop a targeted attack (someone physically gets their hands on your phone) anyway. All this does is raise the cost by a bit.

Tyrannosaurs 12y ago
Or move the attack. If it's encrypted at rest you look at attack in transit or via social engineering or whatever. I think sometimes we get too hung up about the technology around security. For a targeted attack, going for the technology often won't be the best route.

crazy1van 12y ago

> I'd like for people to start thinking about security measures, including encryption, as a cost function rather than as a boolean condition (e.g. safe vs. unsafe; stop the NSA vs. not stop the NSA) Great point and one that I think typical computer savvy users already do. It is in the security-expert-fantasy-world that the perfect quickly becomes the enemy of the good. For example, using SSL to send sensitive data like passwords or payment info is nearly ubiquitous. Yes, there are many flaws in SSL's trust model, but the cost is so small, using it is a no brainer. However, PGP encrypted email is much more rarely used. It has numerous higher costs, from special email software to the social pain of getting your friends to also use it. The benefit is still high, but the cost is high too and that results in far less usage. In the real world, informed people look at the cost benefit break down of security. Just like we all don't drive semi trucks around even though they are safer in a collision, we all don't communicate in the most secure fashion because there is a cost associated with that decision. With that in mind, the easiest path towards greater security in communications population-wide would be to focus less on improving the security and more on lowering the associated cost.

peatmoss 12y ago
In a traditional economic sense, the optimal amount to spend on security measures is when the marginal costs equal the marginal benefits.
- qzc4 12y ago
  Yes, but it's hard to quantify the benefits (or even the costs) of a security measure—it's just as much a risk evaluation as it is a cost one.
  - peatmoss 12y ago
    Like so much of economics, the hard part is coming up with a price tag that everyone agrees on in all contexts. How much would you pay to save your grandmother's life from an illness? How much would you accept to allow me to hunt her for sport? So, in that sense, coming up with a precise measure of marginal cost / marginal benefit would be hard in practice.

bjornsing 12y ago

I agree to some extent (and I'm excited by the progress in "opportunistic encryption"), but I'd like for people to also start thinking about what's possible and what's simply not. For example, modern block ciphers like AES can protect data against an attacker that does not have access to the encryption key. However, in this case we're talking about an attacker that has perhaps 90% of the encryption key, the UID, in its physical possession. The UID can be concealed in many ingenious ways, but that doesn't change the fact that the attacker is in physical possession of the atoms that encode it. This is essentially "security by obscurity", albeit on a high level. In contrast I would argue that message exchange over the internet can be made secure, even against a nationstate adversary.

nine_k 12y ago

Exactly. Good security is not an unbreakable lock, it's a lock that costs significantly more to break than the value of what it's guarding.

teekert 12y ago

But the NSA has unlimited funds, created by the tax payers they spy on. So why not make it easy, save us all a lot of money </sarcasm>. It so crazy that we are talking about people that require the consent of their governed... On second though maybe outside of our bubble they have that consent and we have to bow to that majority.

x0x0 12y ago
If they had that majority, my guess is they wouldn't have had to lie about what they were doing. Or at least my hope.

moe 12y ago

While the NSA could probably figure out how to attack Apple's key management infrastructure [...], doing so for all the people would, in principle, be fairly noticeable to Apple. Maybe that's why Apple's warrant canary has disappeared[1]. [1] https://gigaom.com/2014/09/18/apples-warrant-canary-disappears-suggesting-new-patriot-act-demands/ https://gigaom.com/2014/09/18/apples-warrant-canary-disappea...