Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

More encryption means less privacy

queue.acm.org

Post reply on HN
Print view View original

201–210 of 221 posts

Re: More encryption means less privacy

#201

Post by icebraining »

mike_hearn wrote: post #200
icebraining wrote: post #141

Earlier quoted context omitted.

You use a weird definition of "mass surveillance" if installing a single tapping device that can snoop on every customer of a company (hundreds of millions, for the large providers) doesn't qualify.

No, I use the definition that makes sense given the Snowden documents: high capacity cable taps on the backbone itself, not FBI style taps on specific companies after getting the keys via some sort of court process.

OK, under which of them would you classify NSA's MUSCULAR program?

Re: More encryption means less privacy

#202

Post by michael_fine »

Confusion wrote: post #199
michael_fine wrote: post #181

Earlier quoted context omitted.

That's entirely unprovable, given that we have no idea how many backdoors the NSA has, nor for the matter, are we even sure how many have been leaked.

Of course it is, but note that my comment did not make any statement about NSA backdoors and anyone mentioning those is just trying to muddy my argument by acting as if it did.

Yeah, implied subject is a thing, implied predicate less so in common parlance.

Re: More encryption means less privacy

#203

Post by Too »

nightcracker wrote: post #35
mike_hearn wrote: post #22

Earlier quoted context omitted.

Because it's not a fundamental error or indeed an error at all. What you've just expressed is one of those fascinating pieces of mental junk that clutters up social groups, a political desire that's so strongly held you've managed to rationalise to yourself that it's a fact and not a personal desire at all. But it's still not a fact. It is trivial to use cryptography in ways that yield some sort of balance between pe…

If there is a backdoor, that backdoor can be used by anyone that has the key. I do not trust a government to responsibly handle such a key, as it leaking once results in total failure of security for everyone. A backdoored crypto system is a broken crypto system.

While I'm not a fan of crypto backdoors - thinking of it, aren't all public/private key pair systems a form of backdoor? If someone leaks the private key then everybody with the public key are affected? Think root CAs or app store signatures as example. They manage to keep their private keys secret quite well.

Re: More encryption means less privacy

#204

Post by omginternets »

krapp wrote: post #101
rocqua wrote: post #32

Earlier quoted context omitted.

We all like end to end encryption though. In fact, most people call it the pinnacle of crypto done right. And yet, it completely circumvents any warrants.

Where does it say that the government has the right to expect the evidence obtained from a warrant to be useful? If the government can't do their job effectively with the presence of strong, pervasive encryption, that's their problem. The right of the people to be "secure in their persons, houses, papers and effects" is non-negotiable (at least in the US, barring a Constitutional amendment.) They have the right to se…

>Where does it say that the government has the right to expect the evidence obtained from a warrant to be useful? If the government can't do their job effectively with the presence of strong, pervasive encryption, that's their problem.

This is patently absurd.

US courts have, time and time again, upheld limits on the 4th amendment pertaining to the risk that evidence might be destroyed. The textbook example of this can be found in the so-called "motor vehicle exception". This exception holds that because of the inherent mobility of automobiles, there is exigent cause for a warrantless search, since evidence may trivially be destroyed, obfuscated or hidden.

>The right of the people to be "secure in their persons, houses, papers and effects" is non-negotiable (at least in the US, barring a Constitutional amendment.)

The 4th amendment protects against unreasonable search and seizure, not warrantless search and seizure. Granted, a warrant often (but not always) renders a search/seizure reasonable, but a warrant granted absent probable cause is invalid.

Further, there are other well-established cases in which warrants are not required for searches and seizures. Three such examples are (1) Terry stops (2) the "in hot pursuit" exception (3) the "plain view" exception [0].

Hell, the text even states it plain as day:

The right of the people to be secure in their persons, houses, papers, and effects, against unreasonable searches and seizures, shall not be violated, and no Warrants shall issue, but upon probable cause, supported by Oath or affirmation, and particularly describing the place to be searched, and the persons or things to be seized.

The only mention of warrants is that they are only valid if issued based on probable cause, supported by oath or affirmation, and are specific.

>They have the right to serve a warrant for my phone, and I have the right to hand them an encrypted phone. There may be circumstances where, legally, the government can demand a password, or pay for an exploit, and that's fair enough. But I don't believe any government does or should have the right to demand that encryption not exist, or that it should be fundamentally broken.

I agree with one caveat: while I would hope that phone-decryption would be subject to a warrant, it's unclear whether or not this is constitutionally required. We may well see a "mobile electronics exception" appear. You and I might not agree that it's a good idea, but prima facie, there is a legal basis for such a statute.

[0] http://nationalparalegal.edu/conLawCrimProc_Public/Protectio...

Re: More encryption means less privacy

#205

Post by omginternets »

michael_fine wrote: post #125
hx87 wrote: post #68

Earlier quoted context omitted.

> Your encrypted machine, on the other hand, does not listen to judges. My machine doesn't, but I do, unless I am willing to face the consequences of being in contempt of court.

Which many members of conspiracies would be more than willing to do, hindering the investigation of organized crime, and (genuine) terrorist cells.

That's why we have laws to punish them.

If your argument is that they're willing to face the consequences in order to perpetrate their greater crime, then (respectfully) you've missed two crucial points:

1. US legal tradition wholeheartedly rejects the goal of absolute security. Better to suffer a few terrorist attacks than live in a surveillance state (yes, yes ... I know... not the point...)

2. Deterrence, in general, doesn't work against self-sacrificing adversaries. Even if crypto were outlawed, terrorists would still use end-to-end crypto, and refuse to comply with a court order to decrypt.

Re: More encryption means less privacy

#206

Post by FungalRaincloud »

michael_fine wrote: post #129
FungalRaincloud wrote: post #110

I'm probably echoing others by saying this, but: I don't agree that there is even correlation between more encryption and less privacy. Even if we were not attempting to subvert injustices done to us by our own governments by providing technical solutions, I believe wholeheartedly that many governments would still be attempting to decrease our privacy in every possible way. They're using increased encryption use as a…

Typically (in the US) it's been the executive branch that has tried to subvert privacy (see COINTELPRO), and the judicial which has (sometimes) upheld it. However, because crypto would actively impede the ability of the judicial branch to use warrants, I imagine it would alienate our typical ally.

That might be true, and that's a conversation we should definitely have, as we decide how we will be governed in the future. But that alone does not mean less crypto is preferable.

Re: More encryption means less privacy

#207

Post by mike_hearn »

icebraining wrote: post #201
mike_hearn wrote: post #200

Earlier quoted context omitted.

No, I use the definition that makes sense given the Snowden documents: high capacity cable taps on the backbone itself, not FBI style taps on specific companies after getting the keys via some sort of court process.

OK, under which of them would you classify NSA's MUSCULAR program?

MUSCULAR is/was a codename for a UK based bulk cable tap.

It's easy to confuse that with the name of a programme to reverse engineer and analyse Google internal traffic (which is presumably now over as all that traffic is encrypted), and I made that mistake myself, but I was corrected on HN no less by someone who is closer to the leaks than I am.

It wasn't something done with the knowledge of Google or Yahoo, as evidenced by the use of reverse engineering of the data formats.

Re: More encryption means less privacy

#208

Post by rocqua »

omginternets wrote: post #205
michael_fine wrote: post #125

Earlier quoted context omitted.

Which many members of conspiracies would be more than willing to do, hindering the investigation of organized crime, and (genuine) terrorist cells.

That's why we have laws to punish them. If your argument is that they're willing to face the consequences in order to perpetrate their greater crime, then (respectfully) you've missed two crucial points: 1. US legal tradition wholeheartedly rejects the goal of absolute security. Better to suffer a few terrorist attacks than live in a surveillance state (yes, yes ... I know... not the point...) 2. Deterrence, in gener…

Being held in contempt is a very light sentence. Moreover, when a defendant refuses to comply, consequences can only be coercive, not punitive. That means that, e.g. imprisonment is limited, because if 1 year in prison isn't going to coerce you, neither will 10 years.

The great issue here is the total unbreakability of crypto when compared to e.g. a safe. Before this, all we had was human memory which is very limited.

Re: More encryption means less privacy

#209

Post by rocqua »

cbsmith wrote: post #61
rocqua wrote: post #30

Earlier quoted context omitted.

I think a very important point was raised though. Before crypto, basically all guarantees where conditional on a judge's say so. With crypto this changes. The issue also comes up, in a clearer way, with crypto currencies. There is no way to deal with fraud or mistaken tranfers in bitcoin. That loss of intervention hurts, and we gotta think about it. Even though no government has given a satisfactory solution, that do…

> Before crypto, basically all guarantees where conditional on a judge's say so. Sadly, they weren't. > With crypto this changes. Actually, with crypto it is much harder to claim that a judge's authorization isn't required to even try to subvert the privacy intent. > There is no way to deal with fraud or mistaken tranfers in bitcoin. There's no way because legally the system (for the most part) considers it outside t…

> with crypto it is much harder to claim that a judge's authorization isn't required to even try to subvert the privacy intent.

No doubt, but the issue is that a judge's authorization can be ineffective in the face of crypto.

> TLS doesn't create a real loss of intervention. It requires that the intervention be far more explicit and/or targeted.

That targeted intervention is really easy to block for those who want too. All it takes is not revealing a key/passphrase.

> There's no way because legally the system (for the most part) considers it outside the scope of fraud laws.

Not just that though, it is also impossible because the conditionals introduced by a court system are very hard to encode in a crypto system, even more so if you want to do this and be able to retain trust.

Re: More encryption means less privacy

#210

Post by rocqua »

icebraining wrote: post #53
sliverstorm wrote: post #51

Earlier quoted context omitted.

Part of the way the legal system deals with fraud is by recovering money (where possible). With bitcoin, unless the destination wallet can be obtained, that is not possible. With cash, you seize the cash. Bank accounts can be frozen, Credit card transactions canceled, wire transfers flagged ( http://www.npr.org/sections/money/2016/01/29/464859624/episo... ).

With cash, unless the wallet in which it resides can be obtained, that is not possible. I fail to see the difference.

Bitcoin moves much faster and much further that cash though.
Post reply on HN