Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Earn-IT threatens encryption and therefore user freedom

fsf.org

Post reply on HN
Print view View original

151–160 of 209 posts

Re: Earn-IT threatens encryption and therefore user freedom

#151

Post by minton »

godelski wrote: post #45
heavyset_go wrote: post #35

Earlier quoted context omitted.

Our security doesn't matter to them, the only security they value is their security from the rest of us. This bill grants them just that.

Which is strange because our security is their security. If we don't have security then we are more vulnerable to foreign influences. We are more vulnerable to foreign attacks. You can't have your cake and eat it too. Either everyone has security or no one does, including politicians and elites.

I don’t know if that’s entirely true. There are politicians against the second amendment but yet they have armed security guards.

Re: Earn-IT threatens encryption and therefore user freedom

#152

Post by CJefferson »

usrbinbash wrote: post #146
rhn_mk1 wrote: post #140

Earlier quoted context omitted.

That's oversimplifying it. Banning encryption is a form of censorship (because words don't need to be manufactured), and censorship, as far, as I can tell, does have an effect. For example, criminals who abuse children to produce pornography aren't going to follow laws against having child pornography. Does it follow that laws against the posession of child pornography have no effect in curbing abuse? I think they do…

Difference: There are perfectly legal reasons to generate encrypted traffic; All payment processing (ATMs, credit cards, online shops) generate encrypted traffic. Sending legal documents, technical data, company internals, contracts, etc. generated encrypted traffic. Sending sensible personal information like medical, indurance or financial records generates encrypted traffic. Most of these cannot be sent unencrypted…

I don't see why, hypothetically, they can't all be sent with encryption that the government has a secret key to decrypt.

The world worked using mail, then phones, for many decades. These were treated as "mostly secure", but could be tapped. The world basically worked fine.

Re: Earn-IT threatens encryption and therefore user freedom

#153

Post by usrbinbash »

CJefferson wrote: post #150
usrbinbash wrote: post #145

Earlier quoted context omitted.

> it will be the easiest thing in the world to detect if anyone tries sending it over the open internet. And how shall "goverment sanctioned encryption" be distinguished from "non sanctioned encryption"? The point of (good) encryption is to make the result look like stochastically random bytes.

If government can demand the keys, they can take them and decrypt it. You could claim you are sending packets of random bytes for no reason to a friend, but I doubt any jury would believe you.

> If government can demand the keys, they can take them and decrypt it.

The question isn't how its decrypted, the question is how to determine WHICH traffic to decrypt in order to inspect it.

Re: Earn-IT threatens encryption and therefore user freedom

#154

Post by usrbinbash »

CJefferson wrote: post #152
usrbinbash wrote: post #146

Earlier quoted context omitted.

Difference: There are perfectly legal reasons to generate encrypted traffic; All payment processing (ATMs, credit cards, online shops) generate encrypted traffic. Sending legal documents, technical data, company internals, contracts, etc. generated encrypted traffic. Sending sensible personal information like medical, indurance or financial records generates encrypted traffic. Most of these cannot be sent unencrypted…

I don't see why, hypothetically, they can't all be sent with encryption that the government has a secret key to decrypt. The world worked using mail, then phones, for many decades. These were treated as "mostly secure", but could be tapped. The world basically worked fine.

> I don't see why, hypothetically, they can't all be sent with encryption that the government has a secret key to decrypt.

Because it's too risky, simple as that.

Let's say there is a single, super-secret-key, for government use only, that can decrypt any encrypted message on the planet.

What happens if this key is leaked? What if it's found out? What if the implementation of that key turns out to be buggy and is cracked? Remember, once there is such a key, it won't just be some criminals in godknowswherecountry trying to get it, it will be state-level actors with unlimited funds, resources and manpower.

If a single one of them gets their hands on this key, even ONCE, it's game over. Our modern society relies on encryption. If this key gets out, the results could be catastrophic; eg. Airplane navigational data manipulated in flight, stock market data manipulated in transit, financial transfers wide open for everyone to read and manipulate at will, control data for electrical grids, hydroelectric dams, nuclear power plants out in the open...it would be anarchy.

Re: Earn-IT threatens encryption and therefore user freedom

#155

Post by savant_penguin »

Every time one of those moronic bills show up I wonder if they know they are making the entire US banking system and online marketplaces vulnerable to Chinese and Russian hacking.

And what is that for? Some false promise of security? People who commit real crimes will just use illegal tools and would rather be prosecuted for """illegal use of real encryption""" than for whatever they are doing

Meanwhile people who actually need it for legitimate reasons are endangered by this law

Re: Earn-IT threatens encryption and therefore user freedom

#156

Post by ddaalluu2 »

galoisscobi wrote: post #30

Wrote to Dianne Feinstein of CA about being against Earn-IT act and got a letter back about how Earn IT act would prevent child sexual abuse material online. Sigh. As disappointed as I was in the response, I'm glad that EFF makes it really easy to reach out to reps. Took me less than a minute to send out my stance against the Earn IT act to my representatives https://act.eff.org/action/stop-the-earn-it-act-to-save-ou…

Ah yes the old child abuse argument, because it would never happen without crypto. We only have how many 1000 years of proof otherwise.

The thing is mothers really believe that. When I told a friend's wife that there should be no regulation on what people can post online she replied with "even child abuse". And I was caught unprepared. Of course I don't want children or any other people to be abused but outlawing crypto is not the solution to that problem.

Of course I'm aware that you're aware.

Re: Earn-IT threatens encryption and therefore user freedom

#158

Post by clsec »

galoisscobi wrote: post #30

Wrote to Dianne Feinstein of CA about being against Earn-IT act and got a letter back about how Earn IT act would prevent child sexual abuse material online. Sigh. As disappointed as I was in the response, I'm glad that EFF makes it really easy to reach out to reps. Took me less than a minute to send out my stance against the Earn IT act to my representatives https://act.eff.org/action/stop-the-earn-it-act-to-save-ou…

Yep, I wanted to blow my top when she sent me the same response. We really need to get rid of Feinstein!

Re: Earn-IT threatens encryption and therefore user freedom

#159

Post by strofcon »

roenxi wrote: post #110
vitiral wrote: post #20

I feel like they missed the primary point which is that E2E encryption is the primary thing protecting everyone from hackers/criminals/other-governments. Without it the criminals WILL have access to your systems and data and then you can basically say goodbye to anything being valuable at all. Locking your door at night is a poor metaphor. A criminal can literally infiltrate and search through every unsecured compute…

The FSF isn't the EFF. The FSF is supposed to advocate why the stupid law is an affront to user freedom and the EFF is meant to be advocating why the stupid law makes people vulnerable to criminals. The FSF has a complicated and niche advocacy position, they should stay focused. If they don't advocate software user freedom, nobody will. In this case, there are already lots of people against encryption restrictions.

Seems to me that banning encryption would thoroughly limit software freedoms. Ie:can't use anything secure, thus can't freely choose your toolset.

Re: Earn-IT threatens encryption and therefore user freedom

#160

Post by CJefferson »

usrbinbash wrote: post #154
CJefferson wrote: post #152

Earlier quoted context omitted.

I don't see why, hypothetically, they can't all be sent with encryption that the government has a secret key to decrypt. The world worked using mail, then phones, for many decades. These were treated as "mostly secure", but could be tapped. The world basically worked fine.

> I don't see why, hypothetically, they can't all be sent with encryption that the government has a secret key to decrypt. Because it's too risky, simple as that. Let's say there is a single, super-secret-key, for government use only, that can decrypt any encrypted message on the planet. What happens if this key is leaked? What if it's found out? What if the implementation of that key turns out to be buggy and is cra…

I feel there is already a similar problem with the internet in general -- there exist keys which could be used to sign a HTTPS certificate for any website. If you work your way up the heirachy there are some very high-value keys, and the same kind of problems you describe would occur. However, we all just seem to live with that.

Something similar could be set up with, with a collection of keys. I'm not saying it's a good idea, but we already base the security of the internet on a small number of top-level encryption keys.

Post reply on HN