Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

As Feds Demand the Keys, Preparing for the Death of Public-Key Encryption

lauren.vortex.com

Post reply on HN
Print view View original

171–180 of 295 posts

Re: As Feds Demand the Keys, Preparing for the Death of Public-Key Encryption

#171

Post by tallpapab »

wahsd wrote: post #72

Something that people have apparently not quite connected is that these developments are incremental steps towards and can already be considered within the spectrum of mind reading. The only reason that that a majority of today's people do not recognize the situation as squarely in mind reading territory based on examples from literature and popular culture is that the the technical limitations still retrain governme…

Balderdash! How many people are in the baby boom generation? And you paint them all with one bush? Do you do the same for people of a particular race? Upon closer inspection you will find that few boomers are responsible for your woes. Your parents maybe, but most of us are as powerless as you. "Industrial mindset"? Poppycock! I look around and I see many young people serving up enormous amounts of their private information on public forums. Boomers have nothing to do with this. Quit obsessing about "boomers". It's such a useless distraction.

Re: As Feds Demand the Keys, Preparing for the Death of Public-Key Encryption

#172

Post by rdl »

chmodd wrote: post #43
1337biz wrote: post #25

Earlier quoted context omitted.

Situations like these probably rarely produce a real "winner". It is going to be an arms race between those favoring personal privacy and those favoring government snooping. Just keep in mind that government operates basically on an unlimited budget and has access to a wide range of harassment opportunities for non compliance in matters like these. This fact alone will keep them at least at a dead level with potentia…

I can think of at least one counterexample, namely the failure of the NSA-promoted key escrow system in 1990s (aka Clipper chip)

And removing publicly available software crypto from the most serious export restrictions, at roughly the same time.

Re: As Feds Demand the Keys, Preparing for the Death of Public-Key Encryption

#173

Post by gcb0 »

rafcavallaro wrote: post #133
northernmonkey wrote: post #109

Earlier quoted context omitted.

Tepid? The response has been cooler than that.

You apparently missed the fact that the Obama administration had a full scale Democratic congressional revolt on its hands yesterday - a majority of congressional Dems voted to defund the NSA collection of bulk call records under FISA - the White House was seriously afraid the Amash Ammendment would pass - it only failed narrowly - 217 to 205. So in objective terms, the response has been far worse than the administra…

But still, everything continues as usual.

Nobody is guilty.

Nobody did anything wrong.

And money to the program continues to flow.

Re: As Feds Demand the Keys, Preparing for the Death of Public-Key Encryption

#174

Post by ptaffs »

The monitoring program is costing an awful lot of money, the data centers could be doing real work streamlining government processes and making the administration more efficient. We know governments, corporates, sys admins will snoop and should be objecting to our tax being used for a probably useless effort to process this raw data. Discuss tax rather than privacy, everyone cares more about that.

Re: As Feds Demand the Keys, Preparing for the Death of Public-Key Encryption

#175

Post by hkolek »

tallpapab wrote: post #151

Please forgive my rudimentary (and possible erroneous understanding. There are three things important to public-key encryption. The public key, the private key (together called the key pair) and a certificate. If I understand it the cert is just to give confidence that you have the correct public key. So the NSA having access to the cert is a non issue as everyone has access to same. That's its purpose in life. Also…

The article is conflating stuff and is just FUD. You don't need certs to apply asymmetric cryptography.

As I understand it, the NSA could insert itself as a so-called "Men in the Middle" (aka MITM Attack). See this SO question for a far better explanation than I could provide: http://stackoverflow.com/questions/14907581/ssl-and-man-in-t...

Re: As Feds Demand the Keys, Preparing for the Death of Public-Key Encryption

#176

Post by tallpapab »

jka wrote: post #152
wahsd wrote: post #72

Something that people have apparently not quite connected is that these developments are incremental steps towards and can already be considered within the spectrum of mind reading. The only reason that that a majority of today's people do not recognize the situation as squarely in mind reading territory based on examples from literature and popular culture is that the the technical limitations still retrain governme…

Precisely, I agree that this is the logical direction in which this is heading. I think there's an implicit but rarely stated understanding - in silicon valley in particular - that there's value beyond traditional monetary capital in collecting and storing personalized information about individuals, groups, and organizations - i.e. security, profiling, recruitment and research value. Background checks for hires, sele…

This is all very interesting. So far it seems to be used to show me adverts for stuff I have already bought.

Re: As Feds Demand the Keys, Preparing for the Death of Public-Key Encryption

#177

Post by bhauer »

falcolas wrote: post #135
fab13n wrote: post #118

Earlier quoted context omitted.

What you say is true, but misses an important consideration: yesterday, only tinfoil hats believed they couldn't trust third-party companies with their privacy. Today, everyone knows that the only way to have privacy is to handle it personally, from their local computer. The whole PRISM scheme worked because people supposed the government respected their privacy. Now that it's been proven false, I expect people to us…

Self signed certificates throw up all kinds of nasty "you're taking lots of risks" in browsers (if they're allowed at all). I would not expect that they will be more broadly used than before, particularly since installing a self-signed certificate locally is very hard to do for the average person.

And looping back to the tin-foil hatters, many of us have called into question why all browsers have, over time, decreased their support for self-signed certificates. There are modes wherein Firefox will not even offer the "proceed anyway" option [1]. Conspiracy theories abound, but the browsers' marginalization of self-signed certificates has always struck me as devious.

Yes, please do alert users that self-signed certificates are potentially sourced by nefarious organizations. But in most cases, they are used by small companies and individuals to simply encrypted content from trusted servers. So allow them to be permanently trusted.

Perhaps we will see an increase in interest in web-of-trust alternatives?

[1] https://bugzilla.mozilla.org/show_bug.cgi?id=435013

Re: As Feds Demand the Keys, Preparing for the Death of Public-Key Encryption

#178

Post by dlitz »

coldtea wrote: post #111
rdl wrote: post #20

Sounds like not "the death of public key encryption" but the golden age of building technical controls into hardware/software which cannot be subverted by the operator, even in the face of a state agent with a gun. Assuming the right tech is developed and deployed, this is going to be far better for everyone in a few years. Yes, it will be shitty for a year or two, but by 2020, if we actually have real technical secu…

> Assuming the right tech is developed and deployed, this is going to be far better for everyone in a few years. A, the old "let's use technology to solve a political issue" idea. Sadly, it does not work. For one, the government has all the technology available for it too, including dedicated, full-time paid researchers. Second, they can outlaw any of those things at whim.

I think it's important to do both. We can't solve political issues using only technology, but it can also be helpful to build our infrastructure in a way that would make it cost-prohibitive to outlaw these technologies.

For example, we could deprecate and eventually disallow TLS ciphersuites that don't provide forward secrecy, just like we did with single-DES, the NULL cipher, and "anonymous" (unauthenticated) encryption modes.

Re: As Feds Demand the Keys, Preparing for the Death of Public-Key Encryption

#179

Post by Amadou »

downandout wrote: post #123
fab13n wrote: post #118

Earlier quoted context omitted.

What you say is true, but misses an important consideration: yesterday, only tinfoil hats believed they couldn't trust third-party companies with their privacy. Today, everyone knows that the only way to have privacy is to handle it personally, from their local computer. The whole PRISM scheme worked because people supposed the government respected their privacy. Now that it's been proven false, I expect people to us…

> Today, everyone knows that the only way to have privacy is to handle it personally, from their local computer. I agree with you, but I think you have far too much faith in ordinary Americans. I invented some widely used anti-phishing technology, and I can tell you that spending a few months analyzing actual incidents where otherwise intelligent people did ridiculously unsafe things on the Internet will give you a n…

That's the great thing about software, especially Free software - all it takes is a handful of us to make systems where strong security is transparent and enabled by default and it will proliferate to all the regular people.

Re: As Feds Demand the Keys, Preparing for the Death of Public-Key Encryption

#180

Post by fab13n »

downandout wrote: post #123
fab13n wrote: post #118

Earlier quoted context omitted.

What you say is true, but misses an important consideration: yesterday, only tinfoil hats believed they couldn't trust third-party companies with their privacy. Today, everyone knows that the only way to have privacy is to handle it personally, from their local computer. The whole PRISM scheme worked because people supposed the government respected their privacy. Now that it's been proven false, I expect people to us…

> Today, everyone knows that the only way to have privacy is to handle it personally, from their local computer. I agree with you, but I think you have far too much faith in ordinary Americans. I invented some widely used anti-phishing technology, and I can tell you that spending a few months analyzing actual incidents where otherwise intelligent people did ridiculously unsafe things on the Internet will give you a n…

OK, I should have written "everyone that matters"; the point is to have a critical mass of expensive-to-eavesdrop communications, so that the NSA cannot routinely exploit much more than teenager gossips traded through Facebook.

Moreover, even if only the 10% best informed people use PRISM-proof communications, it's a safe bet that NSA's alleged targets (whatever the current definition of "terrorist" might be) are among them, so the argument that they're doing that to catch "terrorists" doesn't hold water anymore.

I believe the tech community is concerned about this, because it threatens the robustness of Internet. Today, nobody in the business can pretend with a straight face that top-level certification authorities are trustworthy; so I expect the next generation of security protocols, the successors of the (transparent and enabled by default) SSL, to treat governments as opponents.

I also believe that companies will change their security patterns, e.g. stop trusting American third parties such as Microsoft if they have competitors with political connections in Washington.

Post reply on HN