5 ms·

I'm not arguing against SSL. I'm arguing against making SSL mandatory, because that will force NSA to break it so they can do their work, and then we will have

by phkamp 12y ago

I'm not arguing against SSL. I'm arguing against making SSL mandatory, because that will force NSA to break it so they can do their work, and then we will have nothing to protect our privacy. More encryption is not a solution to a political problem: http://queue.acm.org/detail.cfm?id=2508864 http://queue.acm.org/detail.cfm?id=2508864

arielby 12y ago
The more important sites have user credentials that should be secret, and therefore have to use SSL anyway, so NSA will do their best to break it anyway.
cesarb 12y ago
> I'm arguing against making SSL mandatory, because that will force NSA to break it so they can do their work, and then we will have nothing to protect our privacy. That line of reasoning sounds bizarre to me. It sounds like "don't add a lock to your door, because that will force the criminals to break the lock, and then your door will be unlocked".
- phkamp 12y ago
  A bad analogy is like a wet screwdriver. Try this one, it's better, but not perfect: Imagine what happened if some cheap invention turned all buildings into inpenetrable fortresses unless you had a key for the lock. Now police can not execute a valid judge-sanctioned search warrant. How long time do you think lawmakers will take to react ?
  - cesarb 12y ago
    You were talking about the NSA breaking SSL, not lawmakers forbidding it. If the problem is with the analogy, without analogies this time: > I'm arguing against making SSL mandatory, because that will force NSA to break it so they can do their work, and then we will have nothing to protect our privacy. Without SSL, our privacy is unprotected, since eavesdroppers can read our traffic. Now add SSL, and eavesdroppers cannot read the traffic. Then NSA breaks it, and eavesdroppers can read our traffic again - we've just circled back to the beginning. We will have nothing to protect our privacy, but we already had nothing to protect our privacy before we added SSL; and in the meantime before the NSA breaks it, we had privacy. And it assumes that the NSA will be able to break it, and that the NSA is the only attacker which matters.
    - phkamp 12y ago
      NSA does what the do because lawmakers told them to and gave them the money -- you cannot separate these two sides of the problem. There are many ways to break SSL, the easiest, cheapest and most in tune with the present progression towards police-states is to legislate key-escrow. Google "al gore clipper chip" if you don't think that is a real risk.
MichaelGG 12y ago
... Seriously? The NSA is just sitting around, unable to commit resources to breaking TLS because it's not widespread enough? But HTTP2 is suddenly gonna make the NSA say "alright, we'll break it now. We didn't want to break the most widely deployed crypto protocol, but now we jusT have to make huge crypto breakthroughs, sigh". It's bizarre to think if the NSA could break TLS they're holding back.

by phkamp 12y ago

arielby 12y ago

The more important sites have user credentials that should be secret, and therefore have to use SSL anyway, so NSA will do their best to break it anyway.

cesarb 12y ago

> I'm arguing against making SSL mandatory, because that will force NSA to break it so they can do their work, and then we will have nothing to protect our privacy. That line of reasoning sounds bizarre to me. It sounds like "don't add a lock to your door, because that will force the criminals to break the lock, and then your door will be unlocked".

phkamp 12y ago
A bad analogy is like a wet screwdriver. Try this one, it's better, but not perfect: Imagine what happened if some cheap invention turned all buildings into inpenetrable fortresses unless you had a key for the lock. Now police can not execute a valid judge-sanctioned search warrant. How long time do you think lawmakers will take to react ?
- cesarb 12y ago
  You were talking about the NSA breaking SSL, not lawmakers forbidding it. If the problem is with the analogy, without analogies this time: > I'm arguing against making SSL mandatory, because that will force NSA to break it so they can do their work, and then we will have nothing to protect our privacy. Without SSL, our privacy is unprotected, since eavesdroppers can read our traffic. Now add SSL, and eavesdroppers cannot read the traffic. Then NSA breaks it, and eavesdroppers can read our traffic again - we've just circled back to the beginning. We will have nothing to protect our privacy, but we already had nothing to protect our privacy before we added SSL; and in the meantime before the NSA breaks it, we had privacy. And it assumes that the NSA will be able to break it, and that the NSA is the only attacker which matters.
  - phkamp 12y ago
    NSA does what the do because lawmakers told them to and gave them the money -- you cannot separate these two sides of the problem. There are many ways to break SSL, the easiest, cheapest and most in tune with the present progression towards police-states is to legislate key-escrow. Google "al gore clipper chip" if you don't think that is a real risk.

MichaelGG 12y ago

... Seriously? The NSA is just sitting around, unable to commit resources to breaking TLS because it's not widespread enough? But HTTP2 is suddenly gonna make the NSA say "alright, we'll break it now. We didn't want to break the most widely deployed crypto protocol, but now we jusT have to make huge crypto breakthroughs, sigh". It's bizarre to think if the NSA could break TLS they're holding back.