6 ms·

What's the point of encryption if the government can still force the creators to decrypt it at the drop of a legal reason, which may or may not be substantial?

jbigelow76 11y ago
Because people other than the government might want access to data you would rather them not have?
- joshstrange 11y ago
  What you are missing is that if the government has access then ANYONE can have access. That's the problem with backdoors ANYONE can walk through them. If I encrypt data I want to be the ONLY person who can decrypt it. If not then it's no better than security through obscurity.
  - bad_user 11y ago
    Not "anyone", but it's all a matter of price. Given enough resources, all back-doors are shallow :-) And when speaking of encryption, people should be concerned with crime syndicates or with industrial espionage, in other words entities that might have the resources to find and access those back-doors.
    - MichaelGG 11y ago
      Seeing how cheaply the KGB compromised FBI and CIA agents, it's probably a price many can reach. You don't need to compromise the key, just fake evidence so as to put the target under suspicion and get it decrypted. They must often chase down false leads, so this might be rather unnoticeable.
  - sliverstorm 11y ago
    Government access doesn't require a backdoor per-se, does it? Can't you encrypt something with two public keys, such that either associated private key alone can decrypt? http://stackoverflow.com/questions/597188/encryption-with-multiple-different-keys http://stackoverflow.com/questions/597188/encryption-with-mu... Multi-encrypt the harddrive with YourPubKey & SpooksPubKey, and viola. The spooks have access, without giving criminals access (unless they steal SpooksPrivateKey, but is that any more risky than theft of YourPrivateKey?)
    - junto 11y ago
      The problem here is that the NSA are also in the business of corporate espionage. They spy on US competitors and give the ideas and patentable concepts to US companies. Therefore any company that is not American should shun such products like it is a herpes ridden whore.
      - sliverstorm 11y ago
        That's completely tangent to the point; allowing government access does not require the purposeful introduction of vulnerabilities.
        junto 11y ago
        Not at all. The BND in Germany have been shown to have been complicit in corporate espionage on behalf of the NSA on German companies. That's why dual key (government access) aren't to be trusted.
        sliverstorm 11y ago
        Did I say the government was to be trusted?
  - caskance 11y ago
    If you can have access then anyone can have access.
  - nickpsecurity 11y ago
    That's not true: it's a myth commonly reported by mainstream security types. They say that despite using so-called remote administration tools such as SSH that are specifically designed to do what they say a "backdoor" can't. They contradict themselves. So, a secure backdoor means you have to make a high assurance design/implementation of a remote access tool plus protect its keys. The last part is harder to do. NSA already does this, though, with their EKMS. So, most technical problems outside EMSEC and side channels are solved for such a simple use-case. It's the malicious insider risk that worries me and U.S. government is so thoroughly infiltrated that giving them keys = giving keys to top opponents. Maybe. I wish those briefing Congress would bring up this side of things more often while citing DOD's own documents on their thorough compromise by Chinese, Russians, and so on. "Trust us and our double agents to protect your secrets against foreign governments" can't look convincing to most of Congress. ;)
trentnelson 11y ago
Same reason you lock your front door despite the landlord having a spare key, or the lock maker having a master key. You're screwed if the landlord or a rouge lock maker employee want to get into your place -- but it's good protection against everything else.
- emn13 11y ago
  Physicals locks are poor analogies for encryption. A physical lock isn't designed to provide robust security - it's trivially easy to open almost any lock - it's to make opening it a noisy, slow, dangerous and expensive affair. And even if you have that magical perfect physical lock, few houses (or other containers) are impregnable. A physical lock is more like an effective intrusion detection system - it's not going to prevent hacks, but it might make those that have something to lose think twice, and at least you're likely to know if you've been robbed. Just like intrusion detection, physical locks make it at least somewhat risky to even try to break in - after all, you might get caught.
- nickpsecurity 11y ago
  Exactly what you said whether people like the lock analogy or not. I used to encourage the use of high assurance security that comes from defense sector. People said "but they might be backdoored by NSA!" I said, "Maybe but they'll protect you from all the other threats which are doing the real damage here. You can always layer something foreign in there if you want to give NSA headaches." Same concept.
tomjen3 11y ago
How about you being protected from basically everybody else? Am I the only one who would rather not let any random theif have access to all my personal stuff? If the government wants to fuck me over they don't need my laptop for that.
bad_user 11y ago
A court order is not easy to obtain and usually investigators have good reasons for asking for one. Warrantless searches is what I worry about, plus in some countries there are laws protecting people that don't want to disclose their password, like the fifth amendment in the US. You also have to consider that the punishment for refusing to comply with a court order may be less than the damage you may do to your case by disclosing your password and here I'm specifically thinking about people that do have something life-threatening to hide, like whistleblowers or whatever.
- Lawtonfogle 11y ago
  I see grandparent comment as being more about backdoors than legally requiring the password (though that is a valid issue in and of itself).
happyscrappy 11y ago
Because there are two types of security scenarios. Mossad and non-Mossad. You can't win against Mossad.

jbigelow76 11y ago

Because people other than the government might want access to data you would rather them not have?

joshstrange 11y ago
What you are missing is that if the government has access then ANYONE can have access. That's the problem with backdoors ANYONE can walk through them. If I encrypt data I want to be the ONLY person who can decrypt it. If not then it's no better than security through obscurity.
- bad_user 11y ago
  Not "anyone", but it's all a matter of price. Given enough resources, all back-doors are shallow :-) And when speaking of encryption, people should be concerned with crime syndicates or with industrial espionage, in other words entities that might have the resources to find and access those back-doors.
  - MichaelGG 11y ago
    Seeing how cheaply the KGB compromised FBI and CIA agents, it's probably a price many can reach. You don't need to compromise the key, just fake evidence so as to put the target under suspicion and get it decrypted. They must often chase down false leads, so this might be rather unnoticeable.
- sliverstorm 11y ago
  Government access doesn't require a backdoor per-se, does it? Can't you encrypt something with two public keys, such that either associated private key alone can decrypt? http://stackoverflow.com/questions/597188/encryption-with-multiple-different-keys http://stackoverflow.com/questions/597188/encryption-with-mu... Multi-encrypt the harddrive with YourPubKey & SpooksPubKey, and viola. The spooks have access, without giving criminals access (unless they steal SpooksPrivateKey, but is that any more risky than theft of YourPrivateKey?)
  - junto 11y ago
    The problem here is that the NSA are also in the business of corporate espionage. They spy on US competitors and give the ideas and patentable concepts to US companies. Therefore any company that is not American should shun such products like it is a herpes ridden whore.
    - sliverstorm 11y ago
      That's completely tangent to the point; allowing government access does not require the purposeful introduction of vulnerabilities.
      - junto 11y ago
        Not at all. The BND in Germany have been shown to have been complicit in corporate espionage on behalf of the NSA on German companies. That's why dual key (government access) aren't to be trusted.
        sliverstorm 11y ago
        Did I say the government was to be trusted?
- caskance 11y ago
  If you can have access then anyone can have access.
- nickpsecurity 11y ago
  That's not true: it's a myth commonly reported by mainstream security types. They say that despite using so-called remote administration tools such as SSH that are specifically designed to do what they say a "backdoor" can't. They contradict themselves. So, a secure backdoor means you have to make a high assurance design/implementation of a remote access tool plus protect its keys. The last part is harder to do. NSA already does this, though, with their EKMS. So, most technical problems outside EMSEC and side channels are solved for such a simple use-case. It's the malicious insider risk that worries me and U.S. government is so thoroughly infiltrated that giving them keys = giving keys to top opponents. Maybe. I wish those briefing Congress would bring up this side of things more often while citing DOD's own documents on their thorough compromise by Chinese, Russians, and so on. "Trust us and our double agents to protect your secrets against foreign governments" can't look convincing to most of Congress. ;)

trentnelson 11y ago

Same reason you lock your front door despite the landlord having a spare key, or the lock maker having a master key. You're screwed if the landlord or a rouge lock maker employee want to get into your place -- but it's good protection against everything else.

emn13 11y ago
Physicals locks are poor analogies for encryption. A physical lock isn't designed to provide robust security - it's trivially easy to open almost any lock - it's to make opening it a noisy, slow, dangerous and expensive affair. And even if you have that magical perfect physical lock, few houses (or other containers) are impregnable. A physical lock is more like an effective intrusion detection system - it's not going to prevent hacks, but it might make those that have something to lose think twice, and at least you're likely to know if you've been robbed. Just like intrusion detection, physical locks make it at least somewhat risky to even try to break in - after all, you might get caught.
nickpsecurity 11y ago
Exactly what you said whether people like the lock analogy or not. I used to encourage the use of high assurance security that comes from defense sector. People said "but they might be backdoored by NSA!" I said, "Maybe but they'll protect you from all the other threats which are doing the real damage here. You can always layer something foreign in there if you want to give NSA headaches." Same concept.

tomjen3 11y ago

How about you being protected from basically everybody else? Am I the only one who would rather not let any random theif have access to all my personal stuff? If the government wants to fuck me over they don't need my laptop for that.

bad_user 11y ago

A court order is not easy to obtain and usually investigators have good reasons for asking for one. Warrantless searches is what I worry about, plus in some countries there are laws protecting people that don't want to disclose their password, like the fifth amendment in the US. You also have to consider that the punishment for refusing to comply with a court order may be less than the damage you may do to your case by disclosing your password and here I'm specifically thinking about people that do have something life-threatening to hide, like whistleblowers or whatever.

Lawtonfogle 11y ago
I see grandparent comment as being more about backdoors than legally requiring the password (though that is a valid issue in and of itself).

happyscrappy 11y ago

Because there are two types of security scenarios. Mossad and non-Mossad. You can't win against Mossad.