Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

You have a moral obligation to use crypto

blog.easydns.org

Post reply on HN
Print view View original

51–60 of 92 posts

Re: You have a moral obligation to use crypto

#51

Post by peterwwillis »

If encrypting our communications were a moral imperative, wouldn't someone have suggested our telephone calls or postal mail be encrypted some time in the past 40 years? We've had the capability to do so as private citizens for years, but who the hell cares? And it's not like your bank is going to start sending your bank statements in the mail with a one-time pad.

If we didn't have to think about crypto, everyone would be using it. It is just not easy to ensure the secrecy and integrity of all your data. And Joe Blow does not really care so much about his security or integrity to go out of his way to use more crypto.

Re: You have a moral obligation to use crypto

#52

Post by userbinator »

upofadown wrote: post #38
userbinator wrote: post #31

Earlier quoted context omitted.

A 3rd thing, which I've done, is for a private site to collaborate with a small group of people I know in real life. You give them a hardcopy of your CA cert and then they can verify the details when adding it to their browsers.

The real interesting thing about that use is that it makes it impossible for the NSA and the like to strong arm someone else for the keys. With what we know about the current environment, being your own CA is actually the most secure approach.

As long as you're careful to really keep your private keys private; the root of trust gets shifted from a hierarchy of corporations to individuals you know and (personally) trust. I like this "real trust" model a lot more than the current one of a central authority and "being told who to trust", and I think all the advocates of "if you want to use HTTPS you should buy a cert from a CA" are missing this point.

Re: You have a moral obligation to use crypto

#53

Post by dfc »

maxerickson wrote: post #49
dfc wrote: post #46

Earlier quoted context omitted.

Yes. I can not imagine any other conception of moral obligation. How would you come up with an obligation to do X or not do Y without an underlying belief structure?

I was asking about the second half of the sentence. (But to answer your question in terms of what I am getting at, you would work backwards from what you were comfortable with and then tell yourself that it was your underlying belief structure, whether that were meaningfully true or not)

I see. I guess I took it for granted that everyone understood moral obligation to mean a commandment to act a certain way due to moral principles. Depending on how you define "comfortable with" we might be using different language to talk about the same thing. I am uncomfortable with immoral behavior? I do not think you are advancing moral relativism/nihilism?

I do not think most people use moral reasoning to guide (even semi-consitently) their actions. However I assumed that anyone who says "You have a moral obligation to do X" was speaking in a philosophical context and not using it as a euphemism or "Crypto is /<oo1."

Re: You have a moral obligation to use crypto

#54

Post by anovikov »

robertfw wrote: post #24

Reposting my comment on the blog: I can't comment on which encryption schemes are still strong, but one advantage to using protection for general use is providing strength in numbers. Right now, using Tor or strong encryption is a bright beacon saying "this person has something to hide!" and the NSA et al hone in by default. If, however, using Tor and strong encryption was the norm, it is easier for those who need it…

That won't work because Tor is too slow. I'd use only if i was a terrorist - it's too slow even for pedophiles. If we want people to use crypto en masse, we have to give them something faster.

But the general idea is correct.

Re: You have a moral obligation to use crypto

#55

Post by Pxtl »

Then everybody implements crypto, and then we get another 20 articles on Hacker News about how "your crypto is wrong and broken and you're a terrible person!".

I'd be interested in joining the fight to hide information from the NSA if it didn't seem functionally impossible for folks who haven't made it into a career.

Re: You have a moral obligation to use crypto

#57

Post by schoen »

Zigurd wrote: post #35
tptacek wrote: post #33

Earlier quoted context omitted.

I think I understand. Any acknowledgement that Google has done more to secure Internet traffic for normal users than any other company would require you to concede something, and thus feel bad.

"Normal users" don't need their stuff hidden from government surveillance? Nope, not going to concede that. Stop being obtuse and address the point of the article: Unless encryption is routine, it isn't effective against dragnet surveillance.

I think the difference between you and tptacek here is basically about this:

http://benlog.com/2014/01/03/there-are-3-kinds-of-crypto/

Google has done an enormous amount to improve and deploy what Ben Adida called "b2c crypto" -- typically turning it on months to years ahead of its main competitors, and actively supporting work on making it stronger. But they've done almost nothing to encourage the use of "p2p crypto" in Adida's sense, at least not as a product feature.

I support the widespread routine use of p2p crypto, but I think Google deserves credit for what it has done. That includes making b2c crypto "routine" for most products, which does have direct effects on dragnet surveillance.

Re: You have a moral obligation to use crypto

#58

Post by Zigurd »

schoen wrote: post #57
Zigurd wrote: post #35

Earlier quoted context omitted.

"Normal users" don't need their stuff hidden from government surveillance? Nope, not going to concede that. Stop being obtuse and address the point of the article: Unless encryption is routine, it isn't effective against dragnet surveillance.

I think the difference between you and tptacek here is basically about this: http://benlog.com/2014/01/03/there-are-3-kinds-of-crypto/ Google has done an enormous amount to improve and deploy what Ben Adida called "b2c crypto" -- typically turning it on months to years ahead of its main competitors, and actively supporting work on making it stronger. But they've done almost nothing to encourage the use of "p2p crypto…

Of course Google deserves praise for that and 97 other things. But it is completely unapropos to what the article posted here is about. It does not really have an effect on dragnet surveillance because Google can be ordered to simply allow the government to let it happen.

There is some value in that foreign governments with their own NSA wannabes could get thwarted.

Re: You have a moral obligation to use crypto

#59

Post by jmnicolas »

Pxtl wrote: post #55

Then everybody implements crypto, and then we get another 20 articles on Hacker News about how "your crypto is wrong and broken and you're a terrible person!". I'd be interested in joining the fight to hide information from the NSA if it didn't seem functionally impossible for folks who haven't made it into a career.

This.

I have a web-app project for which encryption would be ideal.

However I have already a hard time finding an encryption capable database.

PostgreSQL has a pg-crypto but it looks like an after fought module.

Right now the best solution I can find is each user gets an encrypted SQLite database on my server. But what happens when 2 or more users need to share data that are in their respective databases ?

Re: You have a moral obligation to use crypto

#60

Post by abemassry »

ronaldx wrote: post #22

OK. I'm prepared to agree with the headline in principle. However, here's the deal/problem: I am willing to encrypt outgoing mail only in cases where I can identify that the recipient are capable of decrypting it (with 0 friction at any stage). It's (still) more important to me that my e-mail is read by the recipient, than that it's not read by any other party.

I'm working on this small project, it might be less friction, probably not zero. I'd be interested if you had any thoughts on how to improve it. It's using GPG for end to end encryption.

https://github.com/abemassry/wsend-gpg

Post reply on HN