More encryption means less privacy • Hacker News Board

Re: More encryption means less privacy

#101

Post by krapp » Tue, Aug 09, 2016, 6:08 PM UTC

rocqua wrote: post #32

skybrian wrote: post #17

I'd put it a different way. Encryption and other forms of good security force surveillance out of the shadows. Without it we wouldn't know what Kazakhstan is doing. If the law requires a warrant to access your GMail account, good security is why law enforcement has to get a valid warrant and send it to Google to get access. Done right, it's not a substitute for politics. It enables politics. It allows agreements on c…

We all like end to end encryption though. In fact, most people call it the pinnacle of crypto done right. And yet, it completely circumvents any warrants.

Where does it say that the government has the right to expect the evidence obtained from a warrant to be useful?

If the government can't do their job effectively with the presence of strong, pervasive encryption, that's their problem. The right of the people to be "secure in their persons, houses, papers and effects" is non-negotiable (at least in the US, barring a Constitutional amendment.)

They have the right to serve a warrant for my phone, and I have the right to hand them an encrypted phone. There may be circumstances where, legally, the government can demand a password, or pay for an exploit, and that's fair enough. But I don't believe any government does or should have the right to demand that encryption not exist, or that it should be fundamentally broken.

Re: More encryption means less privacy

#102

Post by mike_hearn » Tue, Aug 09, 2016, 6:08 PM UTC

Confusion wrote: post #93

mike_hearn wrote: post #22

Earlier quoted context omitted.

Because it's not a fundamental error or indeed an error at all. What you've just expressed is one of those fascinating pieces of mental junk that clutters up social groups, a political desire that's so strongly held you've managed to rationalise to yourself that it's a fact and not a personal desire at all. But it's still not a fact. It is trivial to use cryptography in ways that yield some sort of balance between pe…

Client-to-server encryption with central message routing [..] will be abused by the NSA and anyone else that can get their hands on access. And no amount of politicking is going to change that, as it hasn't changed anything about their blatant disregard of the law thus far. BTW, 'anyone else that can get their hands on access' will include foreign nations and criminals. [..] can easily be given a backdoor [..] that m…

How many of the NSA's backdoors have ended up in the hands of foreign nations and criminals, again?

Re: More encryption means less privacy

#103

Post by ori_b » Tue, Aug 09, 2016, 6:10 PM UTC

Retric wrote: post #91

rocqua wrote: post #30

Earlier quoted context omitted.

I think a very important point was raised though. Before crypto, basically all guarantees where conditional on a judge's say so. With crypto this changes. The issue also comes up, in a clearer way, with crypto currencies. There is no way to deal with fraud or mistaken tranfers in bitcoin. That loss of intervention hurts, and we gotta think about it. Even though no government has given a satisfactory solution, that do…

Until very recently 99.99% of conversations where completely private and society functioned just fine. Even with crypto everywhere the governments have far more access to what people say and do than they had for thousands of years. People with power pretend if they just had more power everything would be better. But, reality is if everything on a computer where private not much would change.

> Until very recently 99.99% of conversations where completely private and society functioned just fine.

Until very recently, most conversations were plausibly deniable, and off the record. The internet and cryptography changes that.

Edit: [Both plausibly deniable in the formal/cryptographic sense, and in the informal "You're misremembering, there's no record in writing of me saying that" sense]

Re: More encryption means less privacy

#104

Post by nathanlied » Tue, Aug 09, 2016, 6:10 PM UTC

stinkytaco wrote: post #41

bhhaskin wrote: post #8

Earlier quoted context omitted.

No its not. The reality is the biggest threat to privacy is due to political engagement. Stronger encryption that no one can break is really the only viable option.

I totally disagree. Political and social solutions prevailed in our physical space during the 60s and 70s with the expansion of rights related to search and seizure and the statement of rights to those who are unaware of them. There is precedent for social engagement here. And remember, all encryption is susceptible to rubber hose cryptography. There needs to be a two pronged approach here.

Not all encryption. There is such a thing as self-destructing data/keys. Once it's gone, it cannot be recovered, even if your life is threatened and you really don't want to die.

Whether you're willing to go that far for your data or not is up to you, though.

Re: More encryption means less privacy

#105

Post by Aelinsaar » Tue, Aug 09, 2016, 6:10 PM UTC

sliverstorm wrote: post #70

nightcracker wrote: post #35

Earlier quoted context omitted.

If there is a backdoor, that backdoor can be used by anyone that has the key. I do not trust a government to responsibly handle such a key, as it leaking once results in total failure of security for everyone. A backdoored crypto system is a broken crypto system.

You can always mitigate the "failure for everyone" scenario. Plethora of government keys, for example, or rotating government keys, or rapidly expiring government keys... Anyway, they've managed to keep stacks and stacks of information secret for decades and decades. It seems like it could be managed. No one has stolen the cert for *.whitehouse.gov. Sidenote, why do people call a second key a backdoor? To me, backdoo…

Because it involves trusting that no one made copies of the key, turning a locked door into a backdoor? Your mitigation ideas are sound though, and could also be used as a kind of rolling canary trap.

Re: More encryption means less privacy

#106

Post by stinkytaco » Tue, Aug 09, 2016, 6:10 PM UTC

kefka wrote: post #69

stinkytaco wrote: post #37

Earlier quoted context omitted.

Well, two things: 1. I've always maintained that privacy is a political and social problem, not just a technological one. Nothing stops a more powerful actor from breaking encryption with a rubber hose if they really want to. Technological solutions are still needed since there's a variety of actors involved, only some of which will obey the political doctrine. 2. I often wonder if encryption will make us think of pr…

How does a rubber hose work when the people are talking via Tox or via .onion sites?

Rarely does encryption exist in a complete vacuum. Just as we cannot necessarily listen to every one on one conversation, those conversations become important when related to something occurring withing the "physical" world. I think we've seen that Tor does not protect you from someone who's determined to find you (see: Silk Road).

Re: More encryption means less privacy

#107

Post by EGreg » Tue, Aug 09, 2016, 6:11 PM UTC

mindslight wrote: post #75

rocqua wrote: post #30

Earlier quoted context omitted.

I think a very important point was raised though. Before crypto, basically all guarantees where conditional on a judge's say so. With crypto this changes. The issue also comes up, in a clearer way, with crypto currencies. There is no way to deal with fraud or mistaken tranfers in bitcoin. That loss of intervention hurts, and we gotta think about it. Even though no government has given a satisfactory solution, that do…

This point is a tired falsehood. There have always been phenomena with physical rules that supersede any human decision. The legal system recognizes and works with such boundaries - some even end up codified in our highest laws such as the 5th amendment. We're only in this present quandary because of professionally irresponsible "web 2.0 services" that siloed up user data for their own surveillance goals, creating en…

When everything is decentralized, it's going to be much harder to enforce any rules about no-crypto. For now things like social networks are cenetralized, leading to all these temptations to mine the data. It's not just government who wants youd data - it's every organization!

http://magarshak.com/blog/?p=169

Re: More encryption means less privacy

#108

Post by Aelinsaar » Tue, Aug 09, 2016, 6:11 PM UTC

venomsnake wrote: post #62

bhhaskin wrote: post #8

Earlier quoted context omitted.

No its not. The reality is the biggest threat to privacy is due to political engagement. Stronger encryption that no one can break is really the only viable option.

You don't need to break the strong encryption, when you can break the kneecaps of people using strong encryption.

Broken kneecaps speak for themselves, "I was tased, and it REALLY hurt! I was terrified and alone in the cold and dark, naked, for hours, I thought I was going to die many times!" is... harder to understand and harder to prove.

Re: More encryption means less privacy

#109

Post by CaptSpify » Tue, Aug 09, 2016, 6:12 PM UTC

ffwd wrote: post #86

CaptSpify wrote: post #71

Earlier quoted context omitted.

B) The FBI is certainly not talking about only defaults. They have said that they don't want unbreakable encryption anywhere. > They aren't meant to have their own will and goals like "power". Yet they undeniably do. Pretending that they don't is sheer naivety. I'm not much of a political theorist, but we have government because we tend to trust them more than the average mob. They aren't infallible though, and we ne…

> The FBI is certainly not talking about only defaults. You are right that considering the whole history of encryption and the FBI, they don't want it anywhere, but as James Comey has himself said, this debate kicked into high gear late 2014 when Apple started with the default encryption, and law enforcement saw an increase in devices they couldn't get into. I think if strong encryption had been on the outliers as it…

And we wouldn't have kicked privacy into high-gear if government agencies had proven themselves trustworthy. But they abused their powers, and here we are. I hate saying "they started it", but... they did.

> There are real harms to strong encryption, whether one would like to admit it or not, so the point is to weigh the costs and benefits and go from there. Right now encryption seems more like a religion, a last bastion of freedom or something. Maybe there are other ways to have accountability.

Oh, there absolutely are cons, I don't see anyone saying otherwise. But, just statistically speaking, there is vastly more harm in not having strong encryption. The cost/benefits are so skewed to one side, it's not even really a discussion. Maybe there are other ways to have accountability, but I have yet to see a viable one.

Re: More encryption means less privacy

#110

Post by FungalRaincloud » Tue, Aug 09, 2016, 6:12 PM UTC

I'm probably echoing others by saying this, but: I don't agree that there is even correlation between more encryption and less privacy. Even if we were not attempting to subvert injustices done to us by our own governments by providing technical solutions, I believe wholeheartedly that many governments would still be attempting to decrease our privacy in every possible way. They're using increased encryption use as a scapegoat, but they have never had a shortage of scapegoats. Not employing strong crypto wherever possible would be irresponsible for the future of our privacy. Likewise, not engaging in political activism to change laws that impact our privacy would also be irresponsible. We need to do both, whenever possible and necessary.