Re: Obama on Fetishizing Our Phones

One strong point that comes out is reference to the transitory nature of governments, just because you trust yours now (!), does not mean you can trust future incarnations, don't give this kind of power to an unknown.

If the San Bernardino case proves anything, it's that encryption is not the whole picture.

> The question here is: do you place any trust in government?

The Snowden leaks have shown the NSA's system-wide abuse and sealed courtroom judgements allowing rampant abuse and overreach by the NSA where they're able to operate free from oversight where even most of Congress had no idea what they were doing.

> If not, then you really can't function in a normal society. Good luck building your own army.

This ridiculous conclusion tantamounts to we either have to trust the US Govt or we need to build a private army. We are already functioning in a society without the need of a private army. We also live in a time where we can protect our sensitive information from the US Govt with readily-available strong encryption. Do I trust the US Govt with my most sensitive information? No I don't. Do I need a private Army? No, no I don't.

Yeah, the ones that were badly misconfigured and easily circumvented, like how NSA employees were caught snooping on their love interests. I for one do not want to live in a society where the government is one .conf file away from putting my entire life story in plaintext under scrutiny.

First, it doesn't matter what process governments (plural) have in place to protect backdoor access mechanisms or escrowed keys. That those mechanisms exist at all means they can and will be abused by people who do not go through those mechanisms.

Beyond that:

> If government is monitoring your communications, then there's a pretty dammed good reason, as determined by a judge.

Not even close to true. We have documented evidence at this point that the government is monitoring all communications. They have no discretion.

For the moment, I trust that the government has not yet descended so far that it will arbitrarily arrest or detain everyone who attempts to maintain the security of their information. That doesn't mean I trust the government to unilaterally decide whose information it can access.

Government brokenness is not binary. There's a spectrum from "theoretical perfection" to "absolute tyranny". The US and UK governments are currently attempting to take a step in the wrong direction; that doesn't immediately imply that anyone opposing that step "ceases to be able to function in a society". Or are you seriously attempting to suggest that the government is entirely infallible and incorruptible?

The safeguard for privacy isn't just the court system. That provides a modest amount of protection against abuse of information that was left insecure to begin with, such as information left unencrypted with a third party. However, for information that truly needs security, the privacy of that information is maintained by the system holding it; that system neither has nor needs any concept of "a user other than the owner who somehow has access".

Let's ignore the Apple case for a moment, since Apple fundamentally does have access to the device. Even additions like the more recent security chip have potential ways to bypass security, albeit by dissecting a tamper-resistant chip; that's a tradeoff for supporting insufficiently long user PINs, and wouldn't be needed with a secure passphrase. Whether Apple wins or loses, the much more interesting question is whether challenges arise to the construction of devices that genuinely cannot be accessed by anyone other than the device owner.

As a simple example, consider an encrypted device, using a key and passphrase, where the passphrase uses an appropriate strengthening technique to make it computationally intensive to test a single possibility. Easy to get in if you know the passphrase, but if done right, computationally infeasible to brute force even with NSA-level computing resources and centuries of time.

Laptops regularly use that level of security today (modulo the user's chosen passphrase). Phones should as well.

If I had a perfect eidetic memory, I could memorize huge volumes of information and keep no records of them; in that case, that information is completely secure (against anything except rubber-hose). Encryption provides an amplification mechanism there: instead of memorizing gigabytes of data, I can instead memorize a passphrase, and gain access to arbitrarily large amounts of information that nobody else can access (modulo security bugs, or physical device compromise followed by my continued access).