Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

FBI Wants It to Be Impractical to Deploy Strong Encryption Without Key Escrow

rietta.com

Post reply on HN
Print view View original

81–90 of 184 posts

Re: FBI Wants It to Be Impractical to Deploy Strong Encryption Without Key Escrow

#81

Post by graycat »

Aelinsaar wrote: post #22
jpgvm wrote: post #14

Earlier quoted context omitted.

Like I said it's not about the average person, it's about someone with something to hide. Those with something to hide will always go the extra distance. The issue I take with the FBI approach is it will have no effect on those that have stuff to hide but destroy any semblance privacy for those that don't. Terrorists will use GPG, citizens will use their backdoored iPhone full disk encryption and everyone but the ter…

That's a problem too. Right now people with something to hide don't stand out amidst a background of similar encryption. If they suddenly have to switch to something relatively more exotic, that alone would be a coup for people in signals intelligence, don't you think?

It doesn't have to look "exotic" at all: Sam just sends Joe a file in base 64. But that is how all the multimedia content is sent in e-mail now. Until dig into what Sam sent, it looks like just another JPG file sent in e-mail. But translate it from base 64 and give it to an image program and will discover that the file is not a JPG file. Or a PNG, BMP, MP3, WAV, EXE etc. file either. But about have to translate from base 64 to conclude this.

Re: FBI Wants It to Be Impractical to Deploy Strong Encryption Without Key Escrow

#82

Post by duaneb »

ThrustVectoring wrote: post #70
anexprogrammer wrote: post #49

Earlier quoted context omitted.

But that is so revealing of the mindset. * We can have strong encryption just for the good guys * We can have master keys that only approved staff will use * We can block all the bad things on the internet and it'll be like they don't exist * If we have a back door into an encrypted device, only the good guys will use it It's like no politician ever read about crime. Staff can't be blackmailed or bribed. No one worki…

It's a huge lack of systems thinking. It's like they believe that the universe somehow cares about what they were trying to accomplish. * If we reward schools for increasing student test scores, then we'll have better schools. * If we fund a "war on drugs", we'll reduce the damage drugs do. * If we enact rent controls and mandate the construction of below-market rate housing units, it'll help people afford housing. T…

> If we enact rent controls and mandate the construction of below-market rate housing units, it'll help people afford housing.

To be fair, this does in fact help many people afford housing. It just doesn't fix the endemic issue.

Re: FBI Wants It to Be Impractical to Deploy Strong Encryption Without Key Escrow

#84

Post by JoshTriplett »

jpgvm wrote: post #36
mike_hearn wrote: post #15

Earlier quoted context omitted.

I see this objection raised so frequently, and I feel it really misses the point badly. The tech community tells itself that it won the first "crypto wars". You cannot win "wars" against governments in that sort of sense and the first crypto war was never actually won at all. I think in light of events in recent years we need to reinterpret the events of the 90's in a new light - the tech industry didn't win, rather,…

GPG was just an example. Other end-to-end open-source systems are more widely used like Signal are the same, not exactly easy to insert a backdoor into a system that is a) open and b) completely distributed with no central key authority. Maybe it still misses the point because the FBI doesn't actually care about hitting hard targets. If that is the case that is pretty sad. Average crimes can be solved with average to…

> Other end-to-end open-source systems are more widely used like Signal are the same, not exactly easy to insert a backdoor into a system that is a) open and b) completely distributed with no central key authority.

If Signal weren't available from any of the major app stores, such that it didn't work on iOS at all and didn't work on Android devices without turning on the intimidating option to allow non-Play-Store apps, how much usage do you think it would get compared to today?

Making real security hard to get would cause far fewer people to actually use it.

Re: FBI Wants It to Be Impractical to Deploy Strong Encryption Without Key Escrow

#85

Post by derefr »

ThrustVectoring wrote: post #70
anexprogrammer wrote: post #49

Earlier quoted context omitted.

But that is so revealing of the mindset. * We can have strong encryption just for the good guys * We can have master keys that only approved staff will use * We can block all the bad things on the internet and it'll be like they don't exist * If we have a back door into an encrypted device, only the good guys will use it It's like no politician ever read about crime. Staff can't be blackmailed or bribed. No one worki…

It's a huge lack of systems thinking. It's like they believe that the universe somehow cares about what they were trying to accomplish. * If we reward schools for increasing student test scores, then we'll have better schools. * If we fund a "war on drugs", we'll reduce the damage drugs do. * If we enact rent controls and mandate the construction of below-market rate housing units, it'll help people afford housing. T…

I don't know about the universe; I think it's rather a weird sort of overly-strong faith in the capacity of other humans. Legislation at every level seems to treat the people implementing and enforcing the legislation as a fleet of magic genies, who will Do What You Mean and achieve exactly your goal with no side-effects.

Though also, do note, if you apply systems thinking to legislators, establishing that they're "doing something that pattern-matches to helping" is exactly in line with their current incentives. You need much more direct oversight to give them an effective feedback loop for the consequences of their actions, rather than just the "optics" of the actions themselves.

Things like https://www.trudeaumetre.ca/, but done by an opposition-minded third party who won't give them an inch but won't like like campaign ads, would be a good start. Ultimately, something like prediction markets on the upholding of each elected candidate's campaign promises during their tenure would be amazing, in the sense that sufficiently-large bets would be a form of lobbying without lobbying.

Re: FBI Wants It to Be Impractical to Deploy Strong Encryption Without Key Escrow

#86

Post by grandalf »

zeveb wrote: post #78
grandalf wrote: post #47

Comey's argument makes sense at first. Why not have a trusted escrow provider keep keys safe, and also respond to court orders when necessary. It feels almost like a checks and balances kind of argument, the kind that Americans find persuasive with our three-branch government. The problem is that we now know that the government has the goal of unlawful surveillance without oversight from courts, the legislature, or t…

> The problem is that we now know that the government has the goal of unlawful surveillance without oversight from courts, the legislature, or the public … There has been a profound breach of trust (revealed by Snowden) and we must insist upon the rule of law … Nothing Snowden alleges is illegal or unconstitutional, despite his and his supporters' repeated assertions. 'I don't like it' does not imply 'it is illegal a…

> Nothing Snowden alleges is illegal or unconstitutional...

First, I did not claim it was unconstitutional or strictly illegal (since secret things can't be considered by normal courts or legislatures, everything is in a sense extralegal, which is itself a big problem).

There are protections against unlawful search and seizure. Seizure in this case is data capture, search is viewing by a human (with or without a warrant). There was not any law granting the NSA the power to do domestic surveillance unless there was some suspected behavior involving foreign nationals or international circuits.

But it's more relevant that our leaders repeatedly assured us that no such surveillance was going on. Blatant lies told to the public is as serious a breach of trust as an unconstitutional program. Thus I think the technical constitutionality (or even strict legality) of the program is more of a detail than the core issue.

My suggestion of giving keys to each member of congress is simply for Apple to force the issue into the most democratic institution, effectively giving any member of congress veto power against unlocking the data. While this doesn't fit the exact delegation of powers that we're used to for such things, it does address the terrorism/kiddie-porn argument that Obama recently made... in other words, it addresses the meat of the emotional argument that our leaders are making.

>But we're a long, long way from enforced smart contracts which do things like handle succession of new members &c. I can't wait until we're there, someday, but it'll take a good long while.

I agree, but I think it might be a good strategic move for Apple if things start to look bad for Apple offering an unfettered secure-hardware / strong encryption platform. Apple could then claim that it had offered enough of a back door to prevent any interim attack should one occur.

The government's strategy is to leverage public outrage about any attacks (large or small) to get back doors into everything. Apple does not want to be accused of stonewalling if an attack occurs and the government subsequently claims that decrypting one or two phones a few weeks ago could have prevented it.

Re: FBI Wants It to Be Impractical to Deploy Strong Encryption Without Key Escrow

#87

Post by rlidwka »

anexprogrammer wrote: post #49
krzrak wrote: post #31

Earlier quoted context omitted.

Interesting article. I find amusing this (quite popular) type of argumentation: > "This is a serious security breach," said Councilman Peter Vallone (D-Queens), who heads the Council's Public Safety Committee. "We know terrorists are planning to attack our subways, and the MTA and NYPD better find these magical morons quickly, and then make them disappear for a year in jail." Like the only thing between terrorists an…

But that is so revealing of the mindset. * We can have strong encryption just for the good guys * We can have master keys that only approved staff will use * We can block all the bad things on the internet and it'll be like they don't exist * If we have a back door into an encrypted device, only the good guys will use it It's like no politician ever read about crime. Staff can't be blackmailed or bribed. No one worki…

That's what being politician means. This job isn't about solving problems, it's about making an appearance that you solve them.

Suppose a terrorist did something with his shoe that he wasn't supposed to. Here is how it should be solved:

"Based on our research, the probability of dying because of the terrorist attack is XXX, which we can reduce by YYY using blah-blah, therefore we should allocate ZZZ funds in that area."

Would you vote for this guy? Well, most people won't even understand what he is talking about.

So here is what happens in practice:

"Okay, I don't know how to decrease national debt or prevent poverty, so let's find something else. Oh hey, terrorism! I know how to solve it. Forbid shoes at the airport. Sounds simple enough. So we can say 'we successfully fight terrorism'. And just in case people don't care enough, make this issue the most important one and add 'hey, think of the children' into the mix."

So the general population becomes scared of terrorism 'cause guys running for office told them they should be.

It's not politicians who are stupid, it's people who vote for them.

Re: FBI Wants It to Be Impractical to Deploy Strong Encryption Without Key Escrow

#88

Post by Gracana »

cubano wrote: post #44

How is this even news anymore? It is utterly and completely unsurprising that all the government agencies involved in law enforcement on all levels will fight a never-ending fight against anything that impedes their ability to do what they think their job is. They don't care about privacy or any of that, and see restrictions to getting full access to all data as we see bugs in our systems that keep them from running…

News doesn't have to be surprising to make headlines.

Re: FBI Wants It to Be Impractical to Deploy Strong Encryption Without Key Escrow

#89

Post by DamnYuppie »

italophil wrote: post #25

This sounds like the equivalent to the TSA approved locks for luggage. Just decoration and no real protection at all.

The funny thing is that if you transport firearms you CAN'T use TSA locks. Which I find very funny, it is as if they are saying we don't trust our own people.

Re: FBI Wants It to Be Impractical to Deploy Strong Encryption Without Key Escrow

#90

Post by JoshTriplett »

hamburglar wrote: post #64
makecheck wrote: post #21

Remember how New York’s (physical) master keys became easily accessible[1] despite the fact that they were supposedly so carefully managed? All that effort, all that trouble, and now not only is there essentially no security at all but the master keys created a security hole that did not need to exist. The security of encryption is similarly proportional to the security of keys. The fewer things you have to secure, t…

People challenging this anti-crypto movement should really push this example because it is really perfect. Before we consider key escrow, please explain exactly how physical key escrow was breached in New York and tell us how that will be prevented when the key in question isn't even something you have to physically get.

This should always be presented as an additional argument, though, not the only argument. Because an argument based solely on securing the backdoor implies that if it could be kept secure enough, there's no other reason not to do it.

Even if we could somehow guarantee absolutely that the backdoor will only be used by the intended users, backdoors are still not acceptable. For much the same reason that it's not acceptable to put a camera in every home or car, even if the footage were "only" accessible by the government with a warrant.

Post reply on HN