NSA-proof encryption exists. Why doesn’t anyone use it?

> Experts are not much closer to solving the problem [of user-friendly cryptography] today than they were two decades ago.

I disagree. Recently there have been breakthroughs in homomorphic encryption. From Wikipedia [1]:

"...any circuit can be homomorphically evaluated, effectively allowing the construction of programs which may be run on encryptions of their inputs to produce an encryption of their output. Since such a program never decrypts its input, it can be run by an untrusted party without revealing its inputs and internal state."

While currently known constructions with the right mathematical properties are kind of slow, I'm sure that a lot of people are now interested and in the future we'll eventually be able to do it at practical speeds (especially with the help of future computers that are faster, and/or have more cores, and/or have dedicated coprocessors hard-wired for homomorphic encryption computations, like recent x86 chips have hardware accelerated AES [2]).

If this happens, websites will be able to implement features, like search, that rely on manipulation of user data, without having access to that data themselves.

> [Certain] features depend on Facebook’s servers having access to a person’s private data

Today this is true, at least for people who aren't on the cutting edge of research in this field. But it might not be true tomorrow, if homomorphic encryption ever becomes practical (both in terms of fast algorithms, and in terms of frameworks/libraries which make it easy for developers to use).

Off-topic remark: Homomorphic encryption will also impact the economics of cloud computing, since you'll be able to use CPU cycles provided by others without the security concerns of disclosing the unencrypted confidential data you want them to manipulate.

[1] http://en.wikipedia.org/wiki/Homomorphic_encryption#Fully_ho...

[2] http://en.wikipedia.org/wiki/AES_instruction_set

And this is why, despite a noticeable decline, HN is still my go to for meaningful discussion. Bravo, you two.

> This is not the threat model that we're faced with now. Let's say you and Bob communicate using accounts you've made on random XMPP servers using Tor, and all the messages are encrypted with OTR. Both servers are in the US, and the NSA's metadata database shows E83Gxw@jabber.org sending lots of ciphertext to PAnd9B@jabber.org.

Tor won't help at all if all of the long-distance network traffic in the country is being mirrored (as it has been in the USA for most of a decade).

Corollary: The NSA knows exactly who runs The Silk Road. Stopping drug trafficking is obviously not as high a priority to them as not letting potentially kinetic adversaries know that Tor provides no anonymity to someone who can (and does) monitor _all_ network traffic.

The main point for me is to have a government I don't need to protect myself from. And more generally, a society where I don't need to disguise my every action. Points about the impracticality of strong encryption are secondary. Here are some of them anyway:

* The vast majority of internet users don't have the domain knowledge needed to use strong encryption effectively. A classic example with e-mail is using a prominent phrase from the plain text of the message body in the (unencrypted) subject field.

* Any cryptography scheme is vulnerable to social engineering, attacks on the trust networks used to exchange keys, etc. Avoiding these requires a nontrivial and ongoing amount of effort even for expert users.

* Encryption complicates archival and search of content even for its author.

* Any service that would help users with the above would be legally obligated to provide information to authorities anyway.

The light isn't being bent light-years away. It is being bent at the beginning of the atmosphere, resulting in the same degree of bending as the satellite has to deal with.