5 ms·

Because people other than the government might want access to data you would rather them not have?

joshstrange 11y ago
What you are missing is that if the government has access then ANYONE can have access. That's the problem with backdoors ANYONE can walk through them. If I encrypt data I want to be the ONLY person who can decrypt it. If not then it's no better than security through obscurity.
- bad_user 11y ago
  Not "anyone", but it's all a matter of price. Given enough resources, all back-doors are shallow :-) And when speaking of encryption, people should be concerned with crime syndicates or with industrial espionage, in other words entities that might have the resources to find and access those back-doors.
  - MichaelGG 11y ago
    Seeing how cheaply the KGB compromised FBI and CIA agents, it's probably a price many can reach. You don't need to compromise the key, just fake evidence so as to put the target under suspicion and get it decrypted. They must often chase down false leads, so this might be rather unnoticeable.
- sliverstorm 11y ago
  Government access doesn't require a backdoor per-se, does it? Can't you encrypt something with two public keys, such that either associated private key alone can decrypt? http://stackoverflow.com/questions/597188/encryption-with-multiple-different-keys http://stackoverflow.com/questions/597188/encryption-with-mu... Multi-encrypt the harddrive with YourPubKey & SpooksPubKey, and viola. The spooks have access, without giving criminals access (unless they steal SpooksPrivateKey, but is that any more risky than theft of YourPrivateKey?)
  - junto 11y ago
    The problem here is that the NSA are also in the business of corporate espionage. They spy on US competitors and give the ideas and patentable concepts to US companies. Therefore any company that is not American should shun such products like it is a herpes ridden whore.
    - sliverstorm 11y ago
      That's completely tangent to the point; allowing government access does not require the purposeful introduction of vulnerabilities.
      - junto 11y ago
        Not at all. The BND in Germany have been shown to have been complicit in corporate espionage on behalf of the NSA on German companies. That's why dual key (government access) aren't to be trusted.
        sliverstorm 11y ago
        Did I say the government was to be trusted?
- caskance 11y ago
  If you can have access then anyone can have access.
- nickpsecurity 11y ago
  That's not true: it's a myth commonly reported by mainstream security types. They say that despite using so-called remote administration tools such as SSH that are specifically designed to do what they say a "backdoor" can't. They contradict themselves. So, a secure backdoor means you have to make a high assurance design/implementation of a remote access tool plus protect its keys. The last part is harder to do. NSA already does this, though, with their EKMS. So, most technical problems outside EMSEC and side channels are solved for such a simple use-case. It's the malicious insider risk that worries me and U.S. government is so thoroughly infiltrated that giving them keys = giving keys to top opponents. Maybe. I wish those briefing Congress would bring up this side of things more often while citing DOD's own documents on their thorough compromise by Chinese, Russians, and so on. "Trust us and our double agents to protect your secrets against foreign governments" can't look convincing to most of Congress. ;)

What you are missing is that if the government has access then ANYONE can have access. That's the problem with backdoors ANYONE can walk through them. If I encrypt data I want to be the ONLY person who can decrypt it. If not then it's no better than security through obscurity.

bad_user 11y ago
Not "anyone", but it's all a matter of price. Given enough resources, all back-doors are shallow :-) And when speaking of encryption, people should be concerned with crime syndicates or with industrial espionage, in other words entities that might have the resources to find and access those back-doors.
- MichaelGG 11y ago
  Seeing how cheaply the KGB compromised FBI and CIA agents, it's probably a price many can reach. You don't need to compromise the key, just fake evidence so as to put the target under suspicion and get it decrypted. They must often chase down false leads, so this might be rather unnoticeable.
sliverstorm 11y ago
Government access doesn't require a backdoor per-se, does it? Can't you encrypt something with two public keys, such that either associated private key alone can decrypt? http://stackoverflow.com/questions/597188/encryption-with-multiple-different-keys http://stackoverflow.com/questions/597188/encryption-with-mu... Multi-encrypt the harddrive with YourPubKey & SpooksPubKey, and viola. The spooks have access, without giving criminals access (unless they steal SpooksPrivateKey, but is that any more risky than theft of YourPrivateKey?)
- junto 11y ago
  The problem here is that the NSA are also in the business of corporate espionage. They spy on US competitors and give the ideas and patentable concepts to US companies. Therefore any company that is not American should shun such products like it is a herpes ridden whore.
  - sliverstorm 11y ago
    That's completely tangent to the point; allowing government access does not require the purposeful introduction of vulnerabilities.
    - junto 11y ago
      Not at all. The BND in Germany have been shown to have been complicit in corporate espionage on behalf of the NSA on German companies. That's why dual key (government access) aren't to be trusted.
      - sliverstorm 11y ago
        Did I say the government was to be trusted?
caskance 11y ago
If you can have access then anyone can have access.
nickpsecurity 11y ago
That's not true: it's a myth commonly reported by mainstream security types. They say that despite using so-called remote administration tools such as SSH that are specifically designed to do what they say a "backdoor" can't. They contradict themselves. So, a secure backdoor means you have to make a high assurance design/implementation of a remote access tool plus protect its keys. The last part is harder to do. NSA already does this, though, with their EKMS. So, most technical problems outside EMSEC and side channels are solved for such a simple use-case. It's the malicious insider risk that worries me and U.S. government is so thoroughly infiltrated that giving them keys = giving keys to top opponents. Maybe. I wish those briefing Congress would bring up this side of things more often while citing DOD's own documents on their thorough compromise by Chinese, Russians, and so on. "Trust us and our double agents to protect your secrets against foreign governments" can't look convincing to most of Congress. ;)