More encryption means less privacy • Hacker News Board

Re: More encryption means less privacy

#11

Post by mordocai » Tue, Aug 09, 2016, 4:29 PM UTC

All of the things the governments are trying to do won't (and shouldn't) work though. We can work around their attempts.

If the government wants data, it should get it at rest not during transmission. They can get a warrant to get the data store that your data is residing on. If they can't get what they want because that is encrypted then they can try to legislate all they want but it is pretty much impossible to stop someone from encrypting something at rest, especially considering the existence of the open source and open hardware movements.

Re: More encryption means less privacy

#12

Post by mindslight » Tue, Aug 09, 2016, 4:30 PM UTC

It sure makes for a nice contrarian opinion, but fighting politically vs technically is a needless dichotomy. At least this post attempts to back up this assertion, but it seems a quite handwavey to assume that because eg a protocol contains key escrow, that governments aren't still going to want to preemptively read, archive, and datamine the cleartext.

Yes, all governments. Because governments, even democratic ones, fundamentally desire power. The best political argument we have is getting working strong encryption into the hands of everybody and making them appreciate the security it gives them. Presently, they have no choice about being personally surveilled, so they might as well lobby for everyone else to be surveilled as well.

As an aside, HTTPS is easy to coopt by network operators because it is a terribly naive protocol:

- fingerprintable, even going so far as to put the site name in the clear!

- naming system that assumes unfettered Internet access

- generally requires communication for every micro action

- crypto keys are disconnected from naming, requiring binding together by ambient third party

- naming system based on specific servers inevitably leading to centralized data silos that will be governmentally or economically coopted

(Yes, the problems are centered around naming. It's one of the 3^h2 hard things in computer science, yet is easy to ignore when focused on the details of transferring data)

Re: More encryption means less privacy

#13

Post by noenpnqnoen » Tue, Aug 09, 2016, 4:31 PM UTC

bhhaskin wrote: post #8

theandrewbailey wrote: post #3

Kinda clickbait-y, and ignores the fact that encrypted communications were able to be used (with some effort) before Snowden, but his last point is solid: > The only way to retain any amount of electronic privacy is through political engagement.

No its not. The reality is the biggest threat to privacy is due to political engagement. Stronger encryption that no one can break is really the only viable option.

- Written by Poul-Henning Kamp

- In a section called The Bike Shed

Re: More encryption means less privacy

#14

Post by theandrewbailey » Tue, Aug 09, 2016, 4:32 PM UTC

bhhaskin wrote: post #8

theandrewbailey wrote: post #3

Kinda clickbait-y, and ignores the fact that encrypted communications were able to be used (with some effort) before Snowden, but his last point is solid: > The only way to retain any amount of electronic privacy is through political engagement.

No its not. The reality is the biggest threat to privacy is due to political engagement. Stronger encryption that no one can break is really the only viable option.

Political engagement is a very good tool to keep political engagement in check. Political engagement can make strong crypto illegal to use, or mandate a state MITM[0]; neither are viable or effective at anything, but those inconveniences aren't going to stop their implementation.

[0] Almost happened in the USA: https://en.wikipedia.org/wiki/Clipper_chip

Re: More encryption means less privacy

#15

Post by omginternets » Tue, Aug 09, 2016, 4:33 PM UTC

zyxley wrote: post #7

The article seems to make the fundamental error of assuming that there is any middle ground between "unbreakable crypto" and "effectively no crypto at all". If crypto can be broken, it will be broken, whether that's by state actors or by some kid in Mongolia who wants to make a quick buck by ransoming all your files.

I read this a bit differently, i.e.: "unbreakable crypto is necessary but not sufficient" && "unbreakable crypto alone has a paradoxical effect of decreasing privacy through political means."

Re: More encryption means less privacy

#16

Post by angersock » Tue, Aug 09, 2016, 4:33 PM UTC

tvanantwerp wrote: post #5

codemac wrote: post #2

> Slapping unbreakable crypto onto more and more packets is just going to make matters worse. The only way to retain any amount of electronic privacy is through political engagement. While political engagement is an alternative to "slapping unbreakable crypto" onto things, this article establishes no precedent for political engagement actually helping! I see the technical as political, direct action as engagement. An…

I do IT for a think tank in DC. I've seen people across the political spectrum fail to enact their particular agenda for their entire multi-decade careers. Changing policy is slow and, quite often, impossible.

If only there was some way of contiuing policy through some other means...

That's the importance of technology (and arms).

Re: More encryption means less privacy

#17

Post by skybrian » Tue, Aug 09, 2016, 4:36 PM UTC

I'd put it a different way. Encryption and other forms of good security force surveillance out of the shadows. Without it we wouldn't know what Kazakhstan is doing.

If the law requires a warrant to access your GMail account, good security is why law enforcement has to get a valid warrant and send it to Google to get access.

Done right, it's not a substitute for politics. It enables politics. It allows agreements on checks and balances to be enforced rather than letting state hackers do what they like.

Re: More encryption means less privacy

#18

Post by Bartweiss » Tue, Aug 09, 2016, 4:37 PM UTC

codemac wrote: post #2

> Slapping unbreakable crypto onto more and more packets is just going to make matters worse. The only way to retain any amount of electronic privacy is through political engagement. While political engagement is an alternative to "slapping unbreakable crypto" onto things, this article establishes no precedent for political engagement actually helping! I see the technical as political, direct action as engagement. An…

I'm actually curious: can anyone cite a serious win for privacy that was wholly political?

I frequently see pieces criticizing over-reliance on crypto as solutionism and political apathy, but I don't understand what they expect. The people fighting for strong cryptography have also led the political fight for privacy, but their nontechnical efforts have been ignored or circumvented at every turn. At this point it's hard to imagine what a strong, trustworthy political advance would even look like.

Re: More encryption means less privacy

#19

Post by fatdog » Tue, Aug 09, 2016, 4:39 PM UTC

Encryption is political engagement. Loosely translated, TLS and PGP have historically been computerese for "get a warrant."

Of course the deep state will use politicians to assert its power, and if politicians do not work for us instead, people will use networks, technology, and trade (or the alternatives) to defend their freedom.

It is a reasonable question to ask, how long does a typical nation really maintain its territorial sovereignty, and which ones are outliers?

Kamp misinterprets the fact that because some states have begun to fight means that they will win. It does mean, however, that crypto facilitates freedom, and it forces the discussion in regard to the limits on elite powers. The crypto genie is out of the bottle. It is on states to rethink how they engage, not us.

Re: More encryption means less privacy

#20

Post by CaptSpify » Tue, Aug 09, 2016, 4:39 PM UTC

ffwd wrote: post #9

Nobody really knows the correct answer and I think that's the reason communication is failing between the government and the tech sector. I think we have to realize that some transparency into private lives is needed to have a proper society, and the anarcho-capitalists want full privacy from the get go and then increasing transparency as needed for society, while government is kind of hovering on the "we need transp…

Absolutely disagree.

A) Even when the government has the data to stop someone, they don't: https://theintercept.com/2015/11/18/terrorists-were-already-...

B) Outlawing crypto just doesn't work. You can't outlaw math. You can try all day long, but that only hurts the masses

At some point, you have to realize that breaking encryption has nothing to do with safety, but is all about power.