3 ms·

This reads like a strong case of: http://xkcd.com/538/ http://xkcd.com/538/ > Now, each of those parties is a fully independent company, with its own CEO, own

This reads like a strong case of: http://xkcd.com/538/ http://xkcd.com/538/ > Now, each of those parties is a fully independent company, with its own CEO, own board, own employees and own counter-espionage division. [...] Do you remember that US judges didn't even give a fuck about other _countries_ having different privacy laws? I can't imagine that they will respect that "this company which actually isn't one, but five"-move.

lazaroclapp 12y ago
Being in a different jurisdiction makes the wrench crypto-analysis pretty hard as well ;). Not impossible, sure, but politically and economically costly. Remember, this is about trusting some sort of global cloud without everyone in the world having to trust a single third-party government. If the user lives within the country of the government seeking to compel them, and the laws of said country are such that torture is a permitted method of interrogation (specifically, by monkey wrench), well... nothing your cloud provider can do for you, except perhaps try to help you fly under the radar (stenography, anonymous logins, etc.). Keep in mind, that in the case of mass surveillance, even if every user is vulnerable to wrench crypto-analysis, the fact that the cloud provider isn't still raises the costs of widespread surveillance enormously. As for US judges not caring about the five companies thing. Well, so what? They can, assuming their local laws and political climate lets them get away with it, jail everyone working for their local company. This should not compel the other four companies, in four other countries, to give them the extra four components of the key. Note that I selected USA/EU/China/Russia/India for a reason, and not, say... USA/Mexico/Colombia/Afghanistan/Iraq. If this sort of system were the accepted global standard, any nation that tries to "brute force" their own local company, instead of using whatever legitimate procedure becomes available for internationally agreed law enforcement, would just be basically marginalizing itself out of the internet. I'll be the first to admit that what I am describing is not very likely. It would probably require a significant number of governments to be basically OK with not having access to certain data about people, so long as other governments don't have access either, which is not what most political leaders are clamoring for right now. But the problem is, the alternative is not business as usual either, the alternative is every country basically building their own silo-ed internet over time (China is there, Russia is heading there, the EU is strongly considering it, etc). Reasonably powerful non-U.S. countries will eventually see using U.S.-company run cloud services as equivalent to what Americans would think of say, having their energy grid directly connected to power plants in Russia over Alaska and running no plants within their own territory.

lazaroclapp 12y ago

Being in a different jurisdiction makes the wrench crypto-analysis pretty hard as well ;). Not impossible, sure, but politically and economically costly. Remember, this is about trusting some sort of global cloud without everyone in the world having to trust a single third-party government. If the user lives within the country of the government seeking to compel them, and the laws of said country are such that torture is a permitted method of interrogation (specifically, by monkey wrench), well... nothing your cloud provider can do for you, except perhaps try to help you fly under the radar (stenography, anonymous logins, etc.). Keep in mind, that in the case of mass surveillance, even if every user is vulnerable to wrench crypto-analysis, the fact that the cloud provider isn't still raises the costs of widespread surveillance enormously. As for US judges not caring about the five companies thing. Well, so what? They can, assuming their local laws and political climate lets them get away with it, jail everyone working for their local company. This should not compel the other four companies, in four other countries, to give them the extra four components of the key. Note that I selected USA/EU/China/Russia/India for a reason, and not, say... USA/Mexico/Colombia/Afghanistan/Iraq. If this sort of system were the accepted global standard, any nation that tries to "brute force" their own local company, instead of using whatever legitimate procedure becomes available for internationally agreed law enforcement, would just be basically marginalizing itself out of the internet. I'll be the first to admit that what I am describing is not very likely. It would probably require a significant number of governments to be basically OK with not having access to certain data about people, so long as other governments don't have access either, which is not what most political leaders are clamoring for right now. But the problem is, the alternative is not business as usual either, the alternative is every country basically building their own silo-ed internet over time (China is there, Russia is heading there, the EU is strongly considering it, etc). Reasonably powerful non-U.S. countries will eventually see using U.S.-company run cloud services as equivalent to what Americans would think of say, having their energy grid directly connected to power plants in Russia over Alaska and running no plants within their own territory.