191–200 of 238 posts
Earlier quoted context omitted.
But it's funny that the US is so adament about being able to defend yourself with guns. But with software it's a debate. And it seems that often, the people for guns are against encryption and vice versa. From a european perspective it's so strange.
Members of congress aren't pro "defend yourself with guns," they are pro "get votes of people who are pro defend yourself with guns."
Earlier quoted context omitted.
That's... just not true. And that kind of misrepresentation just weakens the arguments for strong encryption, because intelligent people will see them as pretty transparent misrepresentations. Have you considered that's why the arguments for strong encryption aren't going well -- that we're not actually engaging with intelligent people trying to understand the issue, we're chanting trite, shallow inaccuracies? I mean…
I wish I didn't agree with you but I do. Security is a process not a state. You cant say that something is "secure", there is more secure and less secure. What the politicians are saying is that your individual security is not as important as their responsibility in security policy. Security + Politics = Every shade of grey conceivable and then some not yet conceived.
But as a practical matter, I think we will do more to protect privacy and security by engaging with the process and honestly addressing their concerns so we can strike a balance between conflicting societal needs than we'll do with hardline stances based on inaccuracies.
I think pretty rightly a lot of tech people got told off by the political process for misrepresenting what was possible and how technology worked in an effort to not have to obey social structures. I don't think most of us liked that (I sure didn't!), but we're not going to have everything our way (and especially not by lying or throwing tantrums). I mean, if I were a senator, I'd be thinking "So, they can secure a ledger with floating cryptographic difficulty when they want to make money, but a solution for national security is impossible? Yeah, fuck these guys." There just hasn't been the kind of open, honest discussion around the topic that would satisfy their concerns.
And the key to having some of it our way is explaining why that issue is paramount to have our way and honestly engaging in the process to make it happen. Politics is a game of compromise and negotiation -- the government is almost certainly not only willing to concede some of the things on the FBI wishlist if better alternatives are put forward, but actually is interested in doing so.
Everyone knows professional investigators ask for too much, but if no one else is putting forward honest suggestions -- what choice do politicians have?
Earlier quoted context omitted.
DUAL_EC_DRBG is, in principle, equivalent to encrypting the same data with two separate keys, each one being able to recover the plaintext. There are no "two separate levels at the same time" here: the weakest of these two keys determines your security level. With DUAL_EC_DRBG, one of these keys is a static key which, once leaked, can break every message with a small amount of extra effort. The same applies to the re…
I don't see how this is a substantive reply. Yes, once your key is known you no longer have security. That's true regardless of how many keys your scheme employs. Just like in traditional encryption scenarios, your personal key remaining secret is a part of the assumption. That there are now two secret keys doesn't alter the analysis substantially.
Of course it does. At best it doubles the risk of key compromise, but it's really much worse than that.
A master key isn't like a normal key. If you compromise Alice and Bob's key, you can spy on Alice and Bob, but not Alice and Carol and definitely not Carol and Dan.
The existence of a master key is a massive security risk. Alice and Bob's key is worth say $5000. The value of stealing it generally isn't worth the effort. Nobody sends Mossad to spy on every plain old Alice and Bob.
A master key for everything is worth trillions of dollars. Every government and crime family would throw everything they have at stealing it, and many of them would succeed. Spetsnaz units and foreign intelligence operatives would fall out of the sky. Crime bosses would pay multi-million dollar bribes and still turn a huge profit.
And from there it would leak.
It's a completely different level of risk. Orders of magnitude worse. And it implies a prohibition on forward secrecy. So when it leaks, Armageddon.
However two things are striking about this speech, and similar recent (over the past few years) ones in the US and UK at least:
1 - Rosenstein is no dummy, so must be perfectly aware of the doublespeak in his statement that they don't want to make things easier for criminals yet companies must provide accomodation for alleged non-criminals. The pre-GWOT NSA took information assurance seriously and, at least in some cases, made encryption stronger for everyone (consider the RSA S-box) even (perhaps) at the expense of the NSA's SIGIINT efforts. I don't know if the Information Assurance Directorate is even staffed any more.
2 - The propaganda is at its most flagrant with the Sutherland shooter: Apple reportedly offered its help but the FBI ignored that until the 48 hours had passed to lock the phone, and then excoriated Apple. Meretricious malpractice, as far as I am concerned.
Neither of which makes me in any way supportive of the FBIs position, no matter what actual merit might lie in it.
Earlier quoted context omitted.
I don’t get it.
I think, roughly, the government can't really stop you encrypting stuff but it's fairly easy for them and a bunch of advertisers to track what you are up to online.
Earlier quoted context omitted.
But it's funny that the US is so adament about being able to defend yourself with guns. But with software it's a debate. And it seems that often, the people for guns are against encryption and vice versa. From a european perspective it's so strange.
Doesn't seem odd to me, the government has bigger and more guns at their disposal and that's the situation they want with encryption too.
The argument here is extremely simple. Encryption is the only way to secure information. This is true for criminals and non-criminals alike. To deny encryption is to deny security to everyone. Presuming it's the criminals who will look to exploit these vulnerabilities, denying security is making every non-criminal susceptible to attack. So the only question that needs to be answered is this. Do we want to protect our…
> Encryption is the only way to secure information. I am not sure that this argument is simple at all. Encryption only provides theoretical security. In practice even if strong encryption can't be broken it can almost always be bypassed rather trivially if data is being accessed on a regular basis. If data is encrypted and left cold then that can be difficult or impossible to retrieve if a secure key is used and that…
Earlier quoted context omitted.
This ignores transport encryption, which is the bulk of what protects you on a daily basis from street criminals.
Interesting example. Transport encryption provides basically no real world security at all. The fact of the matter is that there are hundreds of millions of credit cards with full PII available for sale so it is almost certain that whatever PII you are sending over your highly secure connection is already in the hands of criminals. The only security you have is the fact that there aren't nearly enough criminals to ex…
This is pretty much the case, to include security vulnerabilities in most systems as well. Most just are not exploited because their arent enough criminals with enough time.
The Dept of Justice official referred to was Deputy Attorney General Jamie Gorelick, who is now a partner at a big DC law firm WilmerHale, where she represents Jared Kushner and Ivanka Trump.
See our paper, Keys under doormats: mandating insecurity by requiring government access to all data and communications, for more. https://doi.org/10.1093/cybsec/tyv009
Earlier quoted context omitted.
"If they were instead physical documents buried somewhere hidden where the police could not possibly find them without your help the court still has the ability to hold you in contempt if you don't produce them" Are you sure this is so, this sounds awfully similar to compelling you to testify against yourself. Perhaps you are confused.
Not really. If it is a foregone conclusion that the documents exist, the court can legally compel you to turn them over.
Are you sure? That would imply that you could be compelled to produce documents that are known to exist but were stolen from you.
It seems like a faulty premise. If they don't know where the documents are then how could they know they haven't been stolen or destroyed?
It's the same problem with encryption keys. Just because you had it yesterday doesn't mean you have it today. People actually lose or forget things, especially under stress.
That's one of the main purposes of protection against self-incrimination -- so that the government can't claim you know something that you don't and then hold you in contempt for not telling them.