Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Americans' Access to Strong Encryption Is at Risk, an Open Letter to Congress

rietta.com

Post reply on HN
Print view View original

91–100 of 139 posts

Re: Americans' Access to Strong Encryption Is at Risk, an Open Letter to Congress

#91

Post by rocqua »

sanderjd wrote: post #59
xupybd wrote: post #21

Just think of the outrage if the government required master keys to everyone's homes? I know there is a difference, but it's not a huge leap to compare the two. We don't want the government to have such easy access to our homes because we can't trust every government employee not to abuse it. I think the same goes here. No mater what safe guards you put in place it's a scary thought that you simply can't keep the gov…

Disclaimer: I agree with you but I always struggle to convince people that this line of reasoning makes sense. The government can already enter anybody's home upon receiving a warrant to do so. If you don't let them in, they can bust through a door or tear down a wall. We trust the government not to do this without court oversight. We trust courts to provide good and honest oversight. It is far from a perfect system,…

I actually agree with you that this is an issue. However, key-escrow has some issues that warrants don't have.

The first, as others have mentioned, is how easy it is to use an escrowed key without detection. The second is the fact that strong encryption remains available. This means you need to outlaw strong encryption, at which point steganography comes up to hide the encryption. Finally, key-escrow is a massive increase of the attack surface of encryption. It's almost as if the government mandates we all use TSA locks on our doors.

Re: Americans' Access to Strong Encryption Is at Risk, an Open Letter to Congress

#92

Post by noir_lord »

xupybd wrote: post #62
sanderjd wrote: post #59

Earlier quoted context omitted.

Disclaimer: I agree with you but I always struggle to convince people that this line of reasoning makes sense. The government can already enter anybody's home upon receiving a warrant to do so. If you don't let them in, they can bust through a door or tear down a wall. We trust the government not to do this without court oversight. We trust courts to provide good and honest oversight. It is far from a perfect system,…

Personally I think you can make it a crime not to produce a key if a warrant has been issued to search what ever you've encrypted. That is a lot more out in the open than a "back door". When the government bashes through the door at least it's in plain site and the house owner knows it's happening. But with encryption how would you know if the government has used their access?

> Personally I think you can make it a crime not to produce a key if a warrant has been issued to search what ever you've encrypted.

That's exactly what my (UK) government has done.

It's a horrific idea.

Re: Americans' Access to Strong Encryption Is at Risk, an Open Letter to Congress

#93

Post by rocqua »

xupybd wrote: post #62
sanderjd wrote: post #59

Earlier quoted context omitted.

Disclaimer: I agree with you but I always struggle to convince people that this line of reasoning makes sense. The government can already enter anybody's home upon receiving a warrant to do so. If you don't let them in, they can bust through a door or tear down a wall. We trust the government not to do this without court oversight. We trust courts to provide good and honest oversight. It is far from a perfect system,…

Personally I think you can make it a crime not to produce a key if a warrant has been issued to search what ever you've encrypted. That is a lot more out in the open than a "back door". When the government bashes through the door at least it's in plain site and the house owner knows it's happening. But with encryption how would you know if the government has used their access?

A "better" way to do this would be to use key-escrow where a key only you have access to is needed to unlock the escrowed key.

If your personal escrow key is government mandated, and well-protected, that prevents the issue of you forgetting passwords (Estonia already has something like this). It also fully ensures that the government accessing escrowed keys requires you being informed.

I still don't support this plan, but it is the best thing I've seen.

Re: Americans' Access to Strong Encryption Is at Risk, an Open Letter to Congress

#94

Post by rocqua »

vbezhenar wrote: post #82
xupybd wrote: post #21

Just think of the outrage if the government required master keys to everyone's homes? I know there is a difference, but it's not a huge leap to compare the two. We don't want the government to have such easy access to our homes because we can't trust every government employee not to abuse it. I think the same goes here. No mater what safe guards you put in place it's a scary thought that you simply can't keep the gov…

Government already has master key to anyone's home. They'll just break the door, it can be done easily. Proper encryption is a different beast, you just don't have that option to break the door.

I can see a broken door, I can't see an escrowed key being accessed.

Re: Americans' Access to Strong Encryption Is at Risk, an Open Letter to Congress

#95

Post by kakarot »

bumblebeard wrote: post #71
CoryG89 wrote: post #17

Earlier quoted context omitted.

I don't think it is the encryption protocols at risk really. Secure protocols exist now, they will continue to exist. It is the future hardware implementations and closed source software implementations that we will no longer be able to trust.

Are we currently able to trust hardware and closed source software implementations?

That's a negative, Ghost Rider

Re: Americans' Access to Strong Encryption Is at Risk, an Open Letter to Congress

#96

Post by libeclipse »

I did my Extended Project Qualification (EPQ) [1] on this issue, and it actually surprised me how many people think that the governments are right in this debate.

When presenting the work, I had a chance to ask ordinary people, and they all pretty much agreed that the government should be able to "break" encryption with a warrant.

This is a scary prospect, and I feel that educating citizens as well as the government is important.

[1] https://github.com/libeclipse/EPQ/blob/master/paper.pdf

Re: Americans' Access to Strong Encryption Is at Risk, an Open Letter to Congress

#97

Post by libeclipse »

Nomentatus wrote: post #2

The irony here is that simple one-time-pad solutions (OTP) will continue to be available to securely encrypt the sort of messaging that's of use to terrorists (relatively short infrequent messages), instead it's the general communications (including for banking) that the rest of us perform online that will be made vulnerable. You don't even have to program or use a computer to create these OTP solutions, for limited…

Or terrorists could simply use open source, secure solutions and ignore the backdoored implementations.

Citizens lose.

Re: Americans' Access to Strong Encryption Is at Risk, an Open Letter to Congress

#98

Post by rocqua »

paulddraper wrote: post #16

Encryption will never be intentionally backdoored on a large scale. I think one of RSA argued this, basically "Do you really think the government will want to review and approve everything on the app store?" Forcing big players to divulge data, making accused people decrypt their devices -- those are things the government could do. Encryption per se isn't in any danger.

The government doesn't review every app on the app-store to check whether it complies with CIPA (Children Internet Protection Act). And yet, most apps do comply. Why? because people don't like to break laws, especially when the fines are rather large.

Re: Americans' Access to Strong Encryption Is at Risk, an Open Letter to Congress

#99

Post by omginternets »

rietta wrote: post #3
Nomentatus wrote: post #2

The irony here is that simple one-time-pad solutions (OTP) will continue to be available to securely encrypt the sort of messaging that's of use to terrorists (relatively short infrequent messages), instead it's the general communications (including for banking) that the rest of us perform online that will be made vulnerable. You don't even have to program or use a computer to create these OTP solutions, for limited…

One time pads are perfect! Everything less than that trades security for convenience. So true.

Key management is a very real issue in cryptographic systems. Arguably, convenient key management improves security.

Simplistic interpretations are the bane of security engineering, especially where human factors are involved.

Re: Americans' Access to Strong Encryption Is at Risk, an Open Letter to Congress

#100

Post by rietta »

omginternets wrote: post #99
rietta wrote: post #3

Earlier quoted context omitted.

One time pads are perfect! Everything less than that trades security for convenience. So true.

Key management is a very real issue in cryptographic systems. Arguably, convenient key management improves security. Simplistic interpretations are the bane of security engineering, especially where human factors are involved.

Indeed. I'm about to have a form of that conversation with a client today. Just encrypting columns in your database is of some value, but having the symmetric key in an environment variable (a common practice) is not going to prevent a breach when the data and the key are compromised at the same time.
Post reply on HN