6 ms·

Remember that it's pretty much impossible to decipher a message, but it's trivial to tell if a message is encrypted or not. Once you outlaw encryption all encr

by josu 11y ago

Remember that it's pretty much impossible to decipher a message, but it's trivial to tell if a message is encrypted or not. Once you outlaw encryption all encrypted communications will be illegal and the people that use them terrorists. This is how it begins.

kryps 11y ago
http://en.wikipedia.org/wiki/Steganography http://en.wikipedia.org/wiki/Steganography
- staunch 11y ago
  http://en.wikipedia.org/wiki/Deniable_encryption http://en.wikipedia.org/wiki/Deniable_encryption
- zyxley 11y ago
  I imagine it wouldn't be too hard to take encrypted text and transform it into something indistinguishable from the already unintelligible spam emails that pass through global networks en masse every day.
  - spacemanmatt 11y ago
    Some say this has already happened.
click170 11y ago
Do you have any supporting evidence? I believe it may be incorrect because in my (limited) understanding, good encryption is indistinguishable from random sequences of characters. How can you tell a string of random characters is simply random, or is an encrypted message, unless said encryption includes some kind of header or marker information? I may simply be wrong but I'm curious about the answer too.
- cortesoft 11y ago
  They will start making random strings illegal
  - josu 11y ago
    As absurd as this sounds, I agree. Just look at all the 09 F9 controversy.
  - tripzilch 11y ago
    Then we will use a different random string!
- josu 11y ago
  I was talking about a encrypted message vs. a non encrypted message, I wasn't taking into account random strings of text. But who would send random strings of text if not terrorists?
  - bigiain 11y ago
    For some values of "random strings of text", you could include compressed video from porn sites and bittorrent. How much would you bet against "the bad guys" already using those as steganographic comms channels?
- ipsin 11y ago
  You might say it's indistinguishable in a theoretical sense, but how are you planning on accessing this random sequence of characters? Using software? Why are you in possession of random data on a hard drive? A prosecutor will be happy to spin theories about what it might be. How do you hide the possession of software you use to acess it? If you manage that, how do you hide the forensic evidence of "file access in random data consistent with evidence of hidden data or a hidden filesystem", in your OS or on your storage device? I very much want to live in a world where these tools are legal. Otherwise, in the same sense as "lying to the FBI", they will be used as a weapon by law enforcement when none other is handy.
TazeTSchnitzel 11y ago
> but it's trivial to tell if a message is encrypted or not No it isn't. Encrypted data is indecipherable from random noise.
- drodgers 11y ago
  > Encrypted data is indecipherable from random noise. Which makes it noticeably different from all other (plaintext) communication.
  - naveen99 11y ago
    Most communication is not plain text.
- AngrySkillzz 11y ago
  Yeah, but most unencrypted data doesn't look like random noise. If you run a few statistics on a packet/file/whatever and it looks random, you can comfortably assume its probably encrypted.
  - woodman 11y ago
    > ... you can comfortably assume its probably encrypted. Or compressed, so you'd need to be able to detect every compression format ever created. I imagine that any time somebody serializes a succinct data structure [0], you're going to have to add a signature for that as well. I'm not confident that even an organization with the resources of the NSA would be able to keep up with that, you'd have to make illegal the writing of data structure libraries. Of course, the optimistic bureaucrat would see this as an opportunity for the creation of another federal entity, like the patent office, where code can be submitted for registration and approval. The Department of Circumlocution™. [0] http://en.wikipedia.org/wiki/Succinct_data_structure http://en.wikipedia.org/wiki/Succinct_data_structure
woodman 11y ago
It isn't trivial actually. Detection would be a multipass process, the first pass would be a measurement of entropy, which would also flag compressed data (which would be very common). The second pass being magic number detection (file headers, can't be trusted). The third pass would likely be some sort of conformance test to every know compression format. The result of all this io intensive processing would not be a definitive answer. If you want to get a taste of how difficult it would be to implement some method of detection, with a useful detection rate at scale, try to write some software that can detect localization encoding of strings on a binary stream. There is a reason why automatic translation of unknown localization doesn't really exist, there have been plenty of attempts, but nothing that results in a definitive answer. I once wrote some software that would parse very poorly written csv files, it was one of the most frustrating projects I've ever done - and taught me the value of standards conformance. Basically, if the data source is non-cooperative, you aren't going to be able to reliably use the data.

by josu 11y ago

kryps 11y ago

http://en.wikipedia.org/wiki/Steganography http://en.wikipedia.org/wiki/Steganography

staunch 11y ago
http://en.wikipedia.org/wiki/Deniable_encryption http://en.wikipedia.org/wiki/Deniable_encryption
zyxley 11y ago
I imagine it wouldn't be too hard to take encrypted text and transform it into something indistinguishable from the already unintelligible spam emails that pass through global networks en masse every day.
- spacemanmatt 11y ago
  Some say this has already happened.

click170 11y ago

Do you have any supporting evidence? I believe it may be incorrect because in my (limited) understanding, good encryption is indistinguishable from random sequences of characters. How can you tell a string of random characters is simply random, or is an encrypted message, unless said encryption includes some kind of header or marker information? I may simply be wrong but I'm curious about the answer too.

cortesoft 11y ago
They will start making random strings illegal
- josu 11y ago
  As absurd as this sounds, I agree. Just look at all the 09 F9 controversy.
- tripzilch 11y ago
  Then we will use a different random string!
josu 11y ago
I was talking about a encrypted message vs. a non encrypted message, I wasn't taking into account random strings of text. But who would send random strings of text if not terrorists?
- bigiain 11y ago
  For some values of "random strings of text", you could include compressed video from porn sites and bittorrent. How much would you bet against "the bad guys" already using those as steganographic comms channels?
ipsin 11y ago
You might say it's indistinguishable in a theoretical sense, but how are you planning on accessing this random sequence of characters? Using software? Why are you in possession of random data on a hard drive? A prosecutor will be happy to spin theories about what it might be. How do you hide the possession of software you use to acess it? If you manage that, how do you hide the forensic evidence of "file access in random data consistent with evidence of hidden data or a hidden filesystem", in your OS or on your storage device? I very much want to live in a world where these tools are legal. Otherwise, in the same sense as "lying to the FBI", they will be used as a weapon by law enforcement when none other is handy.

TazeTSchnitzel 11y ago

> but it's trivial to tell if a message is encrypted or not No it isn't. Encrypted data is indecipherable from random noise.

drodgers 11y ago
> Encrypted data is indecipherable from random noise. Which makes it noticeably different from all other (plaintext) communication.
- naveen99 11y ago
  Most communication is not plain text.
AngrySkillzz 11y ago
Yeah, but most unencrypted data doesn't look like random noise. If you run a few statistics on a packet/file/whatever and it looks random, you can comfortably assume its probably encrypted.
- woodman 11y ago
  > ... you can comfortably assume its probably encrypted. Or compressed, so you'd need to be able to detect every compression format ever created. I imagine that any time somebody serializes a succinct data structure [0], you're going to have to add a signature for that as well. I'm not confident that even an organization with the resources of the NSA would be able to keep up with that, you'd have to make illegal the writing of data structure libraries. Of course, the optimistic bureaucrat would see this as an opportunity for the creation of another federal entity, like the patent office, where code can be submitted for registration and approval. The Department of Circumlocution™. [0] http://en.wikipedia.org/wiki/Succinct_data_structure http://en.wikipedia.org/wiki/Succinct_data_structure

woodman 11y ago

It isn't trivial actually. Detection would be a multipass process, the first pass would be a measurement of entropy, which would also flag compressed data (which would be very common). The second pass being magic number detection (file headers, can't be trusted). The third pass would likely be some sort of conformance test to every know compression format. The result of all this io intensive processing would not be a definitive answer. If you want to get a taste of how difficult it would be to implement some method of detection, with a useful detection rate at scale, try to write some software that can detect localization encoding of strings on a binary stream. There is a reason why automatic translation of unknown localization doesn't really exist, there have been plenty of attempts, but nothing that results in a definitive answer. I once wrote some software that would parse very poorly written csv files, it was one of the most frustrating projects I've ever done - and taught me the value of standards conformance. Basically, if the data source is non-cooperative, you aren't going to be able to reliably use the data.