Live data from Hacker News

More encryption means less privacy

queue.acm.org

141–150 of 221 posts

Re: More encryption means less privacy

#141

Earlier quoted context omitted.

it's easy to design cryptosystems to be [...] unbreakably strong against mass eavesdropping by governments, yet still provide access on a case by case basis. Is it? How? Because that's certainly not the default that you referred to.

It's absolutely the default. Imagine you own a webmail company. You secure your SMTP relays with SMTP-TLS (let's pretend it works well) and your client connections with TLS again. Now your users are safe from random creepy flatmates, criminals with wifi sniffers, your telco and even mass government surveillance. But, governments can still serve a warrant on you to get email in a targeted manner, assuming they have a…

You use a weird definition of "mass surveillance" if installing a single tapping device that can snoop on every customer of a company (hundreds of millions, for the large providers) doesn't qualify.

Re: More encryption means less privacy

#142
> whatever you may feel about politicians, they do have the legitimacy and power to do so. They have the constitutions, legislative powers, courts of law, and police forces to make this happen.

Do they have the actual power?

As the article states, the reason for the all or nothing approach is that we currently don't have any way to do a middle ground with TLS.

We have the technology, and it's already available anywhere. How do you actually put that genie back in the bottle? Probably the best you can do is heavy handed enforcement.

That also does nothing to deal with the fact that an organization like ISIS are going to find ways to continue to use strong encryption.

Re: More encryption means less privacy

#143

Earlier quoted context omitted.

Part of the way the legal system deals with fraud is by recovering money (where possible). With bitcoin, unless the destination wallet can be obtained, that is not possible. With cash, you seize the cash. Bank accounts can be frozen, Credit card transactions canceled, wire transfers flagged ( http://www.npr.org/sections/money/2016/01/29/464859624/episo... ).

With cash, unless the wallet in which it resides can be obtained, that is not possible. I fail to see the difference.

Hiding a wallet is much easier. You can even have several copies of it, so that you can hide it so well that you do not even care if you lose it.

Re: More encryption means less privacy

#144
post #139
post #91

Earlier quoted context omitted.

Until very recently 99.99% of conversations where completely private and society functioned just fine. Even with crypto everywhere the governments have far more access to what people say and do than they had for thousands of years. People with power pretend if they just had more power everything would be better. But, reality is if everything on a computer where private not much would change.

> Until very recently 99.99% of conversations where completely private and society functioned just fine. In fairness, until very recently it was also extremely difficult for two people to privately plot to murder hundreds. Technology has changed the balances on a lot of scales. To be clear, I'm not advocating for government back doors in encryption here. But I am saying we should not pretend that encryption just puts…

> until very recently it was also extremely difficult for two people to privately plot to murder hundreds. Technology has changed the balances on a lot of scales.

Was what McVeigh did highly technical?

Re: More encryption means less privacy

#145
post #111

everything means everything. lately i am starting to become really mad at high schools and universities for teaching this "x implies y" mentality as a tool to look at real world phenomenas. thanks to this kind of "education" everyone constantly feels like s/he is discovering some Ultimate Truth™ and thus fails at accounting for a chaotic, ever changing world. "cause and effect" may exists but these pattern mostly hap…

This is incoherent

Re: More encryption means less privacy

#146
The observations being made are correct in that what he's describing is actually and actively happening. The spot where things stop working is in the very last paragraph in that it very neatly wrecks the argument:

Slapping unbreakable crypto onto more and more packets is just going to make matters worse. The only way to retain any amount of electronic privacy is through political engagement.

The words "any amount of electronic privacy" are where we have big problems. When it comes to protecting privacy from the prying eyes of a hacker, the only amount of electronic privacy that is acceptable is total privacy through unbreakable crypto. This is the problem our politicians have a difficult time grokking but most of us understand: what the government is able to break into (i.e. a lesser amount of privacy from total) is also able to be broken into by a hacker. And, in fact, it becomes more easy if it is government mandated since a hack only need to attack the specific method used by the government to inspect those packets.

I agree that political engagement is necessary, but so too is slapping unbreakable crypto onto ore and more packets. The political engagement needs to come in the form of educating politicians on the realities of today's internet-connected world. We either have solid, unbreakable encryption[0] which necessarily includes protection for people performing financial and otherwise sensitive operations over a public network or we have limited and government-breakable encryption that offers less security than "in the clear" transmission[1].

[0] To the extent that such a thing is possible since this isn't a "set it and it's done" sort of situation but an ever increasing arms race of privacy vs. attacker. This includes such things as ensuring researchers are allowed to test/expose and validate said technologies and not be hindered by legal requirements that prevent them from notifying people of the dangers of broken crypto.

[1] At least, potentially less. Assuming the "backdoor" method is used and protected as well as TSA master keys, we now have a scenario where limited use results in easy to identify "high value" traffic and less security because the hacker need only attack the government for the masters. Even if a much more "well thought out" method is used for providing government access, the problems multiply since now we're not only having to create sufficiently attack-resistant protocols but also manage sufficiently complicated escrow or other processes to provide access. Complexity is the enemy of reliability.

Re: More encryption means less privacy

#148

Earlier quoted context omitted.

Client-to-server encryption with central message routing [..] will be abused by the NSA and anyone else that can get their hands on access. And no amount of politicking is going to change that, as it hasn't changed anything about their blatant disregard of the law thus far. BTW, 'anyone else that can get their hands on access' will include foreign nations and criminals. [..] can easily be given a backdoor [..] that m…

How many of the NSA's backdoors have ended up in the hands of foreign nations and criminals, again?

All of them.

Re: More encryption means less privacy

#149
post #139
post #91

Earlier quoted context omitted.

Until very recently 99.99% of conversations where completely private and society functioned just fine. Even with crypto everywhere the governments have far more access to what people say and do than they had for thousands of years. People with power pretend if they just had more power everything would be better. But, reality is if everything on a computer where private not much would change.

> Until very recently 99.99% of conversations where completely private and society functioned just fine. In fairness, until very recently it was also extremely difficult for two people to privately plot to murder hundreds. Technology has changed the balances on a lot of scales. To be clear, I'm not advocating for government back doors in encryption here. But I am saying we should not pretend that encryption just puts…

I take your point, but I think it's important to distinguish two issues that are raised by modern technology here.

One is about information. Modern technology allows new kinds of communications and learning and collaboration. It also means that for the first time it is technologically feasible for governments and other powerful organisations to monitor entire societies pervasively.

Another is about automation and efficiency and scale. Modern technology allows individuals or small groups to do many wonderful things. It also potentially allows individuals or small groups to cause far more damage than they could before, whether that is physical, emotional, economic, or any combination of those.

There is a certain amount of overlap. For example, some of the implications of widely distributed surveillance are concerning, but some of the implications of not just monitoring but actively influencing large groups of people by modifying (overtly or otherwise) the information and communications they receive are downright terrifying.

However, I think these are two quite separate issues in principle, and they each introduce risks of their own along with the benefits. Encryption is the counter to one form of risk in the communications area, and in that sense it does roughly speaking bring back the privacy that everyone used to enjoy automatically. Restoring that privacy necessarily means that bad people can use those communications channels to discuss doing bad things as well, but they could discuss those things in other forums instead if they needed to. We need other ways to control the risks of new technologies enabling larger scale threats, regardless of what we do about communications and encryption.

Re: More encryption means less privacy

#150
post #139
post #91

Earlier quoted context omitted.

Until very recently 99.99% of conversations where completely private and society functioned just fine. Even with crypto everywhere the governments have far more access to what people say and do than they had for thousands of years. People with power pretend if they just had more power everything would be better. But, reality is if everything on a computer where private not much would change.

> Until very recently 99.99% of conversations where completely private and society functioned just fine. In fairness, until very recently it was also extremely difficult for two people to privately plot to murder hundreds. Technology has changed the balances on a lot of scales. To be clear, I'm not advocating for government back doors in encryption here. But I am saying we should not pretend that encryption just puts…

What are you talking about? There have been plenty on bombings and shootings for hundreds of years.
Post reply on HN