Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

DOJ: Strong encryption that we don’t have access to is “unreasonable”

arstechnica.com

Post reply on HN
Print view View original

91–100 of 238 posts

Re: DOJ: Strong encryption that we don’t have access to is “unreasonable”

#91

Post by molszanski »

bo1024 wrote: post #41

It's hard to know where to even begin in arguing against this. There's the freedom/privacy argument, but I guess this is debatable depending on if you view computer files as an extension of your ideas/knowledge, or an extension of your physical possessions. Someone brought up the entire "risk of overreach and abuse" argument. There's also the likelihood of any tools the government has being leaked and used by bad act…

Consider these two points as a start:

- They solved crimes before iPhones. Encryption is not a roadblock

- In many countries guns are illegal. Yet criminals do own them. If encryption becomes illegal, criminals would still use it

Re: DOJ: Strong encryption that we don’t have access to is “unreasonable”

#92

Post by [deleted] »

Moru wrote: post #85
indubitable wrote: post #54

Earlier quoted context omitted.

Everything you're saying is true, but I think there's something far less dramatic that somehow rings true for people even more. One revelation of Snowden is that the NSA would regularly 'seize' and pass around attractive nudes and other such media that were intercepted from people. [1] At other times there was something that even got its own little name 'LOVEINT' which would involve NSA workers spying on their love o…

Another thing to the debate about "I have nothing to hide": Who decides what is meaningfull to hide in 20 years time? The relationships you had 20 years ago, what are they doing now? You don't know but the government surely does and you had connections to these people that now are possible terrorists. Good luck getting through the security check at the next airport.

[deleted]

Re: DOJ: Strong encryption that we don’t have access to is “unreasonable”

#93

Post by draugadrotten »

molszanski wrote: post #91
bo1024 wrote: post #41

It's hard to know where to even begin in arguing against this. There's the freedom/privacy argument, but I guess this is debatable depending on if you view computer files as an extension of your ideas/knowledge, or an extension of your physical possessions. Someone brought up the entire "risk of overreach and abuse" argument. There's also the likelihood of any tools the government has being leaked and used by bad act…

Consider these two points as a start: - They solved crimes before iPhones. Encryption is not a roadblock - In many countries guns are illegal. Yet criminals do own them. If encryption becomes illegal, criminals would still use it

> - In many countries guns are illegal. Yet criminals do own them. If encryption becomes illegal, criminals would still use it

Making guns illegal doesn't stop criminals from using them, but it does make it possible to jail someone only because they had a gun.

Outlawing encyrption won't stop criminals from using encryption (just look at China) but it does make it possible to jail dissidents only because they were using encryption.

Surveillance will be easier if encryption is illegal, but surveillance would be easier if everyone was obligated to wear a GPS tracker as well. "Making surveillance easier" is not sufficient to argue it should be implemented. There needs to be checks and balances. And when only the government can keep secrets, and they will, there are no more.

Re: DOJ: Strong encryption that we don’t have access to is “unreasonable”

#95

Post by cvwright »

olliej wrote: post #15
SomeStupidPoint wrote: post #11

Earlier quoted context omitted.

> Key strength changes because we predict when a key will /cease being secure/. Yes, we use keys up the gradient of security that key size represents as attacks become more powerful. The reason we don't use the more secure keys in the first place isn't that 2048b keys weren't always more secure than 1024b keys -- it's just that we didn't (for most purposes) need to be that secure, and so we choose an appropriate spot…

No one came up with a better "solution" than escrow because there is not one. I've spent years of my life working on making it so people don't have to risk their information whenever it touches a computer. Key length is a measure of how long you want the key to be secure. Also note that we tried that once in the past: DES had a deliberately crippled key space. That was resulting in terrible security bugs only a few y…

> No one came up with a better "solution" than escrow because there is not one.

I keep seeing this statement being made whenever this topic comes up. Yet I've never seen a formal impossibility result.

It's amazing. Cryptographers are the smartest people in the world when it comes to solving most problems. (Just ask them!)

But seriously, some of the stuff they can do is like magic. Things that, intuitively, sound like they should be impossible. For example:

Zero knowledge proofs? Can do.

Oblivious transfer? Sure thing.

Fully homomorphic encryption? Coming right up!

But then the DOJ says they want some way to investigate the Texas shooter's phone without also getting access to everyone else's data. And suddenly the whole community is like "I dunno man, aren't you just asking me to 'nerd harder'? ¯\_(ツ)_/¯ lololol"

It was cute at first, but if we keep it up we're going to start burning through our credibility real soon.

Re: DOJ: Strong encryption that we don’t have access to is “unreasonable”

#96

Post by AstralStorm »

shakna wrote: post #74
Spivak wrote: post #53

Earlier quoted context omitted.

The other side of this is that enshrining encryption as something that police can't compel you to help with just creates a huge loophole for hiding incriminating documents. You can go to jail for destroying evidence, why would encrypting the data and refusing to provide the password or deleting the key be any different?

You don't know what's in the file. Police need reasonable cause to take action. If all you have is an encrypted file, there's nothing to say it is incriminating. Encryption is necessary for a whole range of things. Would you like banks to be forced to use weak encryption when processing bank-to-bank transfers?

What they want is strong but backdoored. Nobody told them that backdoors are detected and leaked or cracked. A single set of powerful keys will be a really high value target. Alternatively the backdoor key schedule.

Net time, they should ask DoD if they would use the proposed scheme. Or whether the critical economical infrastructure of the US warrants less protection than DoD documents.

Re: DOJ: Strong encryption that we don’t have access to is “unreasonable”

#97

Post by Freak_NL »

nickwanninger wrote: post #69

Gotta love the fact that the EU seems to think the exact opposite https://www.theguardian.com/technology/2017/jun/19/eu-outlaw...

It's not as simple as that. In the EU there are lots of political factors (like the director of the Dutch intelligence service, to name just one) that are quite vocal about abolishing strong end-to-end encryption; just as there are political factors in the US that wish to grant citizens the freedom to use strong encryption unencumbered.

Re: DOJ: Strong encryption that we don’t have access to is “unreasonable”

#98

Post by AstralStorm »

unabst wrote: post #78
bradknowles wrote: post #75

Earlier quoted context omitted.

But how do you design a strong encryption algorithm that can be trivially unlocked once a warrant is provided? Answer: you can’t.

That's not the point. Like a body buried in the desert, there is nothing that can force a person to reveal anything. Silence is encryption enough when it comes to secrets. Torture doesn't work either. So it's business as usual. It's obstruction of justice. Book'em. And of course, "I can't remember" is always the greatest defense. This whole thing is about the government endangering the public in exchange for abusing…

Can't remember is a statement that can be disproven. Pleading non self incrimination laws (as per Miranda) is more effective. Even if you have nothing incriminating.

This is what DoJ wants to close by making just possession of encrypted documents criminal.

(Note: not a lawyer.)

Re: DOJ: Strong encryption that we don’t have access to is “unreasonable”

#99

Post by AstralStorm »

crankylinuxuser wrote: post #37
fulafel wrote: post #35

Earlier quoted context omitted.

The "how long" is fits well with some other estabilished measures of security we use. For example, safes are designed to resist entry for a certain length of time. In military, defenses are often quantified by how long they should be able to hold back a presumed attack scenario.

But thanks to math, we jumped from safes that can withstand hours of attack to math that can withstand every computer on this planet for the next 1e7 years before being cracked. The problem with what others have posited as "money based encryption" easily scales up with AWS, Azure, GCE, and private clouds. Even individuals can buy a large cloud for 1h for cheap and crack with rainbow tables or such. But for a real saf…

Those 1e7 numbers are highly speculative actually. Decade or two is more reliable as a prediction. (Just remember we might have big quantum computers soon.)

These vastly speed up even dumb attacks against the passwords. (Not even keys.)

Re: DOJ: Strong encryption that we don’t have access to is “unreasonable”

#100

Post by cvwright »

crankylinuxuser wrote: post #21
SomeStupidPoint wrote: post #12

Earlier quoted context omitted.

We can also require that the hardware issuer (eg, Apple) stores an encrypted copy of the key (throwing away the key used to encrypt the original key), such that it costs $1M (or other amount) to break the encryption and reveal the key. There's no reason it shouldn't require expense and physical breaking to gain entry, just because it's digital (and I think that this scheme gains legal protection because of such featu…

To be honest, I'm against the "moneyball" solution. Hardware's going to only get: cheaper, faster, better. That $1m price will inexorably come down to the point that skiddie could do it on their phone with AWS. I still stand by the point of having a consortium of opposing interests as a combined group (or supermajority) to override an encryption. I think of it as a strong version of checks and balances. In that case,…

Let's work through your $1M example. Assume Moore's Law continues for the foreseeable future, so the price of all computation halves every 18 months (ie, every 1.5 years).

Then in 15 years, that $1M computation still costs $1000.

In 30 years, it can be done for one dollar.

Is that good or bad? I guess it depends on your threat model and what the data is worth.

Post reply on HN