Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

FBI Wants It to Be Impractical to Deploy Strong Encryption Without Key Escrow

rietta.com

Post reply on HN
Print view View original

71–80 of 184 posts

Re: FBI Wants It to Be Impractical to Deploy Strong Encryption Without Key Escrow

#71

Post by adrianN »

kbenson wrote: post #53
slg wrote: post #48

Earlier quoted context omitted.

The FBI already has access to pretty much any locked door they want if they get a warrant. Their problem is that warrants don't work against encryption.

The front door is a less useful metaphor than your safe. We have safes in addition to locked front doors because it's accepted getting into the house is generally not that hard, whether you be law enforcement or a criminal.

Getting in a safe is also not that hard if you're the FBI, I think. I'm pretty sure that every safe can be cracked in a day or two without destroying whatever is inside.

Re: FBI Wants It to Be Impractical to Deploy Strong Encryption Without Key Escrow

#72

Post by AngrySkillzz »

ethbro wrote: post #52
f00b4r123 wrote: post #38

Earlier quoted context omitted.

An even stronger guarantee: That the definition of trustworthy and "good guy" are unchanging, and even in a dystopian future where a rogue actor is in control of government, those keys are safe because they understand the morality of the people who created them.

I'd say something to invoke Godwin's law, but it seems pretty clear that genocidal governments that sweep into power love having access to copious amounts of detailed records.

They don't even have to be genocidal; they could just be Richard Nixon.

Re: FBI Wants It to Be Impractical to Deploy Strong Encryption Without Key Escrow

#74

Post by derefr »

krzrak wrote: post #31
makecheck wrote: post #21

Remember how New York’s (physical) master keys became easily accessible[1] despite the fact that they were supposedly so carefully managed? All that effort, all that trouble, and now not only is there essentially no security at all but the master keys created a security hole that did not need to exist. The security of encryption is similarly proportional to the security of keys. The fewer things you have to secure, t…

Interesting article. I find amusing this (quite popular) type of argumentation: > "This is a serious security breach," said Councilman Peter Vallone (D-Queens), who heads the Council's Public Safety Committee. "We know terrorists are planning to attack our subways, and the MTA and NYPD better find these magical morons quickly, and then make them disappear for a year in jail." Like the only thing between terrorists an…

> Like the only thing between terrorists and the subway platforms is that they can't afford ticket, so they have to go through the staff gate.

Obviously, terrorists must always break all laws in the process of committing terrorism. They have to illegally park their cars, jaywalk to the location, commit some acts of public indecency on the way, litter at random, and pop their heads into a crowded theatre just to yell "fire!"

Re: FBI Wants It to Be Impractical to Deploy Strong Encryption Without Key Escrow

#75

Post by smsm42 »

anexprogrammer wrote: post #49
krzrak wrote: post #31

Earlier quoted context omitted.

Interesting article. I find amusing this (quite popular) type of argumentation: > "This is a serious security breach," said Councilman Peter Vallone (D-Queens), who heads the Council's Public Safety Committee. "We know terrorists are planning to attack our subways, and the MTA and NYPD better find these magical morons quickly, and then make them disappear for a year in jail." Like the only thing between terrorists an…

But that is so revealing of the mindset. * We can have strong encryption just for the good guys * We can have master keys that only approved staff will use * We can block all the bad things on the internet and it'll be like they don't exist * If we have a back door into an encrypted device, only the good guys will use it It's like no politician ever read about crime. Staff can't be blackmailed or bribed. No one worki…

They are not stupid. They are just driven by wrong set on incentives. One which emphasizes short-term local success - i.e., being able to see the phone of the terrorist and maybe find something there and get a good press release and promotion, and maybe find some other terrorist (that rarely happens but has to be at least part of the law enforcement motivation) or drug seller (that happens much more often and is really what it all is about). Long-term problems do not figure much in that calculation - if the system gets corrupt and ruins security, it's not their fault, they didn't do it, they just did their job. And note that with drug war going on, which law enforcement is losing miserably, and terrorist threat to which they don't really have a good answer (not their fault here, nobody does, at least not in the enforcement realm) they may not exactly feel they have the luxury of long-term planning. Now add mass-media to that which provides extremely sensationalistic short-term reporting with almost no long-term focus - and you get perfect collection of incentives driving this behavior.

Re: FBI Wants It to Be Impractical to Deploy Strong Encryption Without Key Escrow

#76

Post by snowwrestler »

mike_hearn wrote: post #15
jpgvm wrote: post #3

I wonder if anyone has explained to them there is this thing called open-source software. Sure you may be able to convince/force Apple to give you some sort of key escrow system but do you think you can convince the GPG developers? If you implement key escrow and it's public knowledge that encryption systems that implement it are useless then people that actually want to hide stuff will simply use GPG and other uncom…

I see this objection raised so frequently, and I feel it really misses the point badly. The tech community tells itself that it won the first "crypto wars". You cannot win "wars" against governments in that sort of sense and the first crypto war was never actually won at all. I think in light of events in recent years we need to reinterpret the events of the 90's in a new light - the tech industry didn't win, rather,…

> they only care about the encryption their adversaries actually use which - given that 99.9% of the FBI's adversaries are not crypto experts - turns out to be whatever ordinary people are using automatically thanks to tech companies switching it on.

Of course, this is also the technology that 99.9% of U.S. federal staff use too. Probably more like 100% counting personal use of technology.

Across the board, enterprise security today is dependent on the security of consumer technology. Unfortunately, a lot of people in the federal government don't get this; they still think there is a difference between "secure federal technology," and what every else uses.

There's not even a Cabinet official charged with enterprise security for the federal government, so there is no one to even speak up. The FBI and intelligence chiefs are all very high-profile, and they are primarily concerned with access, so the federal conversation seems skewed. Which it is--it matches the skew of the federal mindset in general. The best technologists go to the breaking and entering teams. Meanwhile OPM loses 22 million accounts.

Re: FBI Wants It to Be Impractical to Deploy Strong Encryption Without Key Escrow

#77

Post by grandalf »

Grishnakh wrote: post #61
grandalf wrote: post #47

Comey's argument makes sense at first. Why not have a trusted escrow provider keep keys safe, and also respond to court orders when necessary. It feels almost like a checks and balances kind of argument, the kind that Americans find persuasive with our three-branch government. The problem is that we now know that the government has the goal of unlawful surveillance without oversight from courts, the legislature, or t…

So what do you do when the "trusted" escrow provider gets hacked, just like OPM was, and countless US corporations who've had customer records and credit card numbers stolen? What's the point of using encryption if you're going to put the keys in the hands of some unaccountable entity which is easily hacked? You might as well not use it at all then.

I didn't argue any of those things. I think you missed the subtlety of my comment.

Re: FBI Wants It to Be Impractical to Deploy Strong Encryption Without Key Escrow

#78

Post by zeveb »

grandalf wrote: post #47

Comey's argument makes sense at first. Why not have a trusted escrow provider keep keys safe, and also respond to court orders when necessary. It feels almost like a checks and balances kind of argument, the kind that Americans find persuasive with our three-branch government. The problem is that we now know that the government has the goal of unlawful surveillance without oversight from courts, the legislature, or t…

> The problem is that we now know that the government has the goal of unlawful surveillance without oversight from courts, the legislature, or the public … There has been a profound breach of trust (revealed by Snowden) and we must insist upon the rule of law …

Nothing Snowden alleges is illegal or unconstitutional, despite his and his supporters' repeated assertions. 'I don't like it' does not imply 'it is illegal and unconstitutional.' Neither the law nor the constitution forbids all bad things (nor does either mandate all good things, but that's another issue).

You are correct, of course, that one major issue is that States cannot be trusted to respect their citizens' liberties. Another is that States cannot be trusted to take care of their own data: an escrowed key will shortly become a leaked key.

> Incidentally, if Apple seems likely to lose the battle over a back door, it ought to offer an Ethereum smart contract that will unlock one phone every day, require a key provided by each member of congress (with 100% consent required to unlock a device), and publish all unlock key requests on the Ethereum blockchain after a 30 day delay in case an investigation is in progress.

That doesn't make sense, since the Congress is the legislative branch and it is the executive which actually does things. What could make sense is a smart contract which is unlocked by the judiciary.

But we're a long, long way from enforced smart contracts which do things like handle succession of new members &c. I can't wait until we're there, someday, but it'll take a good long while.

Re: FBI Wants It to Be Impractical to Deploy Strong Encryption Without Key Escrow

#79

Post by qb45 »

lostgame wrote: post #63
anexprogrammer wrote: post #49

Earlier quoted context omitted.

But that is so revealing of the mindset. * We can have strong encryption just for the good guys * We can have master keys that only approved staff will use * We can block all the bad things on the internet and it'll be like they don't exist * If we have a back door into an encrypted device, only the good guys will use it It's like no politician ever read about crime. Staff can't be blackmailed or bribed. No one worki…

Change it up: • We can have guns just for the good guys • We can have guns that only approved staff will use • We can block all the bad people from having guns and it'll be like guns don't exist! • If we have guns, only the good guys will use them. Seems like any dangerous technology can follow this mindset. :P

If only good guys used guns, nobody would need them.

It actually is "we know bad guys already have guns, so better if good guys have them too".

Same with crypto, btw.

Re: FBI Wants It to Be Impractical to Deploy Strong Encryption Without Key Escrow

#80

Post by gherkin0 »

Benjammer wrote: post #33
onion2k wrote: post #13

Earlier quoted context omitted.

The FBI want to have a giant warehouse that houses a copy of every house key but we don't need to worry because no one will ever manage to break in to the warehouse.

And everyone with legitimate access to the warehouse will be 100% trustworthy no matter what for the entire span of time they are granted access, and nobody without legitimate access will ever be allowed in, even someone like a co-worker of someone with access, and even under the full supervision of someone with legitimate access.

> And everyone with legitimate access to the warehouse will be 100% trustworthy no matter what for the entire span of time they are granted access

Of course. These are upstanding FBI agents we're talking about. There's no way one would ever cheat or steal or blackmail anyone.

http://www.cnn.com/2015/03/30/politics/federal-agents-charge...

Post reply on HN