71–80 of 130 posts
We can have a little test - let's put backdoors on all of law enforcement's encryption usage and see how long it stays safe. I really don't know if people like Barr are arguing in good faith. But then I try to assume incompetence first and malice second.
> The cost of encryption, he said, is measured in "victims" who might have been saved from crime if law enforcement had been able to lawfully intercept communications earlier. The cost of backdoors is measured in hospitals paralyzed by ransomware, personal information stolen by hackers, government secrets obtained by hostile nations. Not to mention the threat of pervasive surveillance by our own government, which has…
Look, same applies for example to 2nd amendment. But people find it plausible and vote for more gun control.
Yeah but what's to stop a bad actor simply switching to a provably secure cryptographic system or app? Don't forget there's an arms race going on, where bad actors consistently try to outpace law enforcement by switching to provably secure and private systems. Take for example when 3DES[0] was discovered as insecure and all the criminals switched to AES[1]. And don't forget the old adage: If you outlaw encryption, th…
> then only outlaws will use encryption Which makes them easy to find in a dragnet unless they're also using stenography.
I challenge him to describe what an encryption backdoor actually is. Its like putting a hidden switch behind a brick in a wall. The brick looks the same, but if you take the time to knock on every brick, you'll eventually find the button. Every moderately powerful nations will have someone out there knocking on the bricks.
It takes a prohibitively long time to knock on 2^256 bricks. The real risks aren't from the crypto; they're from the humans who have access to the back door. Can they be trusted? Can they be compromised? That's not to mention the business damage this would cause. The US is trying to block Huawei products due to back doors. Other countries will block US products if the US government starts requiring back doors.
This assumes you have to knock on 2^256 bricks and not just wiggle the mortar free in one spot. WEP wifi encryption is an example of an implementation failure vs. theoretical time to brute force the encryption.
We don't need to make arguments like "I trust the state, but what about criminals?". All US administrations have exhibited strong evidence of criminality and work to suppress dissent and oppress minorities. The current administration makes AG Barr's machinations exceptionally clear as they employ an ever more viscous kidnapping force and (incompetently) attempt to start wars around the world. If you want to be able t…
A "viscous kidnapping force" is an especially sticky problem. ^__^;
It'd be nice is encryption fell under the 2nd amendment. It's been classified as a munition before, and with the creation of USCYBERCOM, the govt has a vested interest in ensuring that it's citizens have experience using encryption software.
Even if the gov required backdoors. It's not going to stop the highly invested terrorists. If someone was to go through all the trouble of plotting another 911, I think they'd have more then enough money to create a secure messaging site of their own. All it takes is one little web site with a really strong encryption algorithm. It's pretty trivial to create your own messaging platform and not too hard to add a large…
"Your rental car payment is due."
"OK, I will pay it on Wednesday at 10am. Stop nagging me."
I would imagine that if enough people knew everything had lawful intercept, then they would just obfuscate their communications.
Yeah but what's to stop a bad actor simply switching to a provably secure cryptographic system or app? Don't forget there's an arms race going on, where bad actors consistently try to outpace law enforcement by switching to provably secure and private systems. Take for example when 3DES[0] was discovered as insecure and all the criminals switched to AES[1]. And don't forget the old adage: If you outlaw encryption, th…
3DES was kind of a quick hacky extension to DES after it was found vulnerable to brute forcing in the late 90s to have something 'good enough' until a more suitable replacement was developed (which was AES). By the time any practical attacks had been developed against 3DES (Sweet32 from 2016 was probably the earliest) almost everyone had long since stopped using it other than in old legacy systems.
Firefox still uses 3DES to encrypt its password database though... it's probably not a major issue because all of the publicly known attacks on 3DES require gigabytes of ciphertext. Wikipedia has a 'citation needed' claim that "the whole 3DES keyspace can be searched thoroughly by affordable consumer hardware as of 2017" but good luck searching a 112 bit keyspace.
I certainly agree with your general point though.
> The cost of encryption, he said, is measured in "victims" who might have been saved from crime if law enforcement had been able to lawfully intercept communications earlier. The cost of backdoors is measured in hospitals paralyzed by ransomware, personal information stolen by hackers, government secrets obtained by hostile nations. Not to mention the threat of pervasive surveillance by our own government, which has…
Look, same applies for example to 2nd amendment. But people find it plausible and vote for more gun control.
We say not to roll your own encryption, but it's one thing to build a lock that is easily picked, and quite another to build one that instantly and silently opens to a key held by a stranger, outside your supervision. Even if there weren't open source crypto projects out there, some managed on servers outside the US, just because I don't roll my own, doesn't mean I can't.
I wrote a paper while in high school on the Clipper Chip, explaining why it was a bad idea. I have learned a lot since 1994, and these folks have apparently learned nothing. Backdoors are inherently flawed. DRM is inherently flawed. You can't create security by trusting an untrustworthy party, or by declaring the intended recipient to be the eavesdropper, or by redefining up to be down.