Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

DOJ plans to strike against encryption while the Techlash iron is hot

cyberlaw.stanford.edu

Post reply on HN
Print view View original

201–210 of 347 posts

Re: DOJ plans to strike against encryption while the Techlash iron is hot

#201

Post by JoshTriplett »

dropoutcoder wrote: post #191
unionpivo wrote: post #172

Earlier quoted context omitted.

As someone from ex comunist/socialist state, I am completely fine with LE not having too much power. I think them being able to break all encryption in use is way too much power. Its not if, it's when it will be abused, and how many people die for it. And LE's can do a lot more damage than all terrorist combined.

Thanks for that. The goal is to design a system that prevents abuses. A technological solution to the ape problem would be helpful.

Current systems prevent most abuses, and many people are working on improving it to prevent more abuses.

As an excellent example, Certificate Transparency has almost completely mitigated the potential abuse of compromising a certificate authority and using it to MITM traffic. Similarly, "binary transparency" or "software transparency" will hopefully eliminate the abuse of delivering a "special binary" to just one person that others have not received.

Part of the threat model is the belief that any system with a backdoor has any hope of "preventing abuses". The backdoor is the abuse, leaving aside all the misuses of it that will happen.

Re: DOJ plans to strike against encryption while the Techlash iron is hot

#202

Post by tbyehl »

dropoutcoder wrote: post #149
JoshTriplett wrote: post #142

Earlier quoted context omitted.

Leave whatever jurisdiction was attempting to force me to build something unethical, and after being safely out of that jurisdiction, disclose absolutely everything I can about the attempted coercion.

In that case you would not be forced, at least in a more extreme application of the word. Regarding ethics, my opinion is that it’s unethical to offer strong E2EE to the masses at scale, without considering the needs of LE.

Why should Law Enforcement have a seat at the table in the design of anything?

Should my sneakers be made more uncomfortable so I can't run away too fast?

Should they be able to remotely disable my car?

Remotely open the blinds to my home's windows?

Should I not be able to install a front door that resists attempts at forced entry?

What's the line where Law Enforcement's wants merit consideration?

Re: DOJ plans to strike against encryption while the Techlash iron is hot

#203

Post by excalibur »

Mirioron wrote: post #185
heartbeats wrote: post #170

Earlier quoted context omitted.

Freedom isn't free. I think people have just ought to realize that. People have this idea that free countries are more efficient, which is probably true in the long run, but it's a cop-out to just call it a day there. Once I was in Belarus. It's a heavily authoritarian country, make no mistake. When they had protests against their rigged elections, they traced the phones of everyone who went, then brought them in for…

> But it does work. I was at a restaurant there. Some girls are chatting, and they walk away to go get something, and just leave their bags there unattended. Why? Because it's an authoritarian country - people aren't going to steal stuff there. Chances are high that you could do the same in most European countries. Just like in the Soviet Union, thieves exist in Belarus. People's perception might be that they're safe…

I don't recommend leaving bags unattended in public anywhere these days, they're likely to call in the bomb squad.

Re: DOJ plans to strike against encryption while the Techlash iron is hot

#204

Post by Mirioron »

Retric wrote: post #179
Karunamon wrote: post #164

Earlier quoted context omitted.

I don't mean this to sound snippy, but where would you go? Most non-US countries I'm aware of have even worse restrictions around speech, encryption, and so forth.

New Zealand has stronger free speech protection than the US and no encryption issues. More freedom of the press and even ‘free’ heathcare for citizens or permanent residents make it a solid contender.

Are you talking about the same New Zealand that literally has a government position called Chief Censor? The same New Zealand that tried to censor sites after the attacks? The same New Zealand that then went on to push for weakening free speech protections online?[0] New Zealand is at the bottom of the list for me when I consider western countries that protect free speech.

[0] https://www.scoop.co.nz/stories/PO1905/S00277/new-zealand-pm...

Re: DOJ plans to strike against encryption while the Techlash iron is hot

#205

Post by dahfizz »

heartbeats wrote: post #177
dahfizz wrote: post #162

Earlier quoted context omitted.

I've heard this argument a few times, and I don't think it passes legal muster. A computer is much more analogous to a fancy paper notebook than a part of your brain.

With how some people use smartphones, you really do start to wonder. Just try to get someone to leave their smartphone at home when they're going outside - they look at you like you're crazy.

I don't disagree with you, but I would be absolutely shocked if that matters one bit to a court.

Re: DOJ plans to strike against encryption while the Techlash iron is hot

#206

Post by Klonoar »

solotronics wrote: post #197
Karunamon wrote: post #164

Earlier quoted context omitted.

I don't mean this to sound snippy, but where would you go? Most non-US countries I'm aware of have even worse restrictions around speech, encryption, and so forth.

I have a US and UK passport. I would probably end up in Singapore or a Nordic country? I always figured I would evaluate my options if that time ever came.

Singapore is a democracy in name only and is its own budding surveillance nightmare.

Re: DOJ plans to strike against encryption while the Techlash iron is hot

#207

Post by Andrew_nenakhov »

hurricanetc wrote: post #129

This will just push people to open source applications and peer to peer networking. Basically, devolve back to the early days of the internet with regard to person to person communications. How is the DoJ going to force Signal or even Telegram to add a back door?

I really would not be surprised if will surface that Telegram has a backdoor for Russian special services. After Anton Rosenberg's posts [1] and Durov's (very unconvincing) responses, it is clear that Durov lies a lot how Telegram operates, and it is quite likely that all their 'blocking' in Russia is just a show to boost credibility.

It also should be noted, that while Telegram markets itself as the most safe and protected messenger, it's regular chats are, in fact, non-encrypted at all and are way less secure than WhatsApps. It's actually baffling, he bashes WhatsApp with such audacity [2], telling in one sentence, that 'if your phone dies, you can't access your messages on another device', and then continues preaching how cool it is to use encryption. BUT IF ONE USES END-TO-END ENCRYPTION, ONE CAN'T ACCESS MESSAGES ON ANOTHER DEVICE, BY DEFINITION!!!!!

It never ceases to amaze me that people bought into this. A comfortable to use app and a really good promise of security turns out to be better than real proper security. ¯\_(ツ)_/¯

[1]: https://medium.com/@anton.rozenberg/friendship-betrayal-clai...

[2]: https://youtu.be/kVZN9QbtFgs?t=106

Re: DOJ plans to strike against encryption while the Techlash iron is hot

#208

Post by JoshTriplett »

Ididntdothis wrote: post #169
JoshTriplett wrote: post #146

Earlier quoted context omitted.

Do not under any circumstances let the discussion move from "whether" to "how". Reject the premise of the question. Such a system cannot be built; the requirements are broken. Treat it as though someone asked you to build a system that solves the halting problem, or factors products of large primes in linear time: the correct direct response is patient explanation of impossibility, and the correct indirect response i…

I don’t think it’s right to reject something outright. You should always give people the opportunity to show what they have. Then take a look at it and decide whether it’s good. A strong indicator for a scam is that they won’t show anything when asked for details. Then things should get rejected.

I'm not suggesting a refusal to listen to the question. I'm observing that it's dangerous to accept the premise of a question that may move the goalposts, without first noticing the implicit premise or differing definition, and explaining why the premise or definition is faulty. Accepting the faulty premise moves the line to "so you just need to come up with the right technology", which then moves to "what's the most secure system you can build while still having a backdoor". The right answer to that is not "here's what we could hypothetically build", it's "by definition we cannot build a secure system with a backdoor, and also here are all the additional problems that a backdoor would introduce".

By all means, fully listen to proposals, in order to understand the misconceptions and better address them. Or, in some cases, it's useful to listen to proposals to anticipate upcoming security threats and build a more robust security model. For instance, the potential threat of compromising CAs led to the invention of Certificate Transparency, which almost completely eliminates that possibility.

We also need to get a lot better at rhetoric and PR.

Re: DOJ plans to strike against encryption while the Techlash iron is hot

#209

Post by martin8412 »

solotronics wrote: post #197
Karunamon wrote: post #164

Earlier quoted context omitted.

I don't mean this to sound snippy, but where would you go? Most non-US countries I'm aware of have even worse restrictions around speech, encryption, and so forth.

I have a US and UK passport. I would probably end up in Singapore or a Nordic country? I always figured I would evaluate my options if that time ever came.

Don't bother with the Nordic countries if trying to avoid surveilance. Surveillance shitholes and it's only getting worse.

Denmark has been illegally requiring all telcos to monitor everything for years, and nothing has changed. No one is willing to change anything or impose any consequence for it. It's even gotten people falsely imprisoned due to complete reliance on location data from mobile phones.

Sweden is not much better, and just passed legislation allowing law enforcement to hack people's phones.

I'm almost certain that Norway, Finland and Iceland are no better.

Re: DOJ plans to strike against encryption while the Techlash iron is hot

#210

Post by JoshTriplett »

slg wrote: post #183
JoshTriplett wrote: post #131

Earlier quoted context omitted.

> Criminals being able to hide evidence is a serious concern for the average person. Suspects . Alleged criminals. Until convicted, they're not criminals. The government does not have an unlimited right to collect all information; they have a limited, judicially controlled right to try to collect information. One key detail: strong encryption does not prevent investigations from targeted collection of information, su…

>Suspects. Alleged criminals. Until convicted, they're not criminals. And even after they are convicted, they and their associates are still protected by encryption. Encryption protects everyone equally. That is viewed as a positive by pro-encryption people and a negative by anti-encryption people. >The government does not have an unlimited right to collect all information; they have a limited, judicially controlled…

> One of my personal annoyances with the tech community is that we have a tendency to try to work around any governmental problems as if that solves the issue while making no attempt at fixing the root cause.

Agreed. We need to produce technical solutions, and effect policy solutions, and get a lot better at PR and rhetoric.

Post reply on HN