Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

How not to report on the encryption ‘debate’

cjr.org

Post reply on HN
Print view View original

11–20 of 40 posts

Re: How not to report on the encryption ‘debate’

#11

Post by yanazendo »

hellodolly wrote: post #6
yanazendo wrote: post #3

Hello, I'm #ISIS. I use #POWSTEG encryption. Mike Spectre is a Ph.D. student at MIT. He is one of the co-authors of Keys Under Doormats, which represents the crypto guild's best answer they could come up with. https://dspace.mit.edu/bitstream/handle/1721.1/97690/MIT-CSA... https://www.schneier.com/blog/archives/2015/07/the_risks_of_... Mike Spectre only wanted to have small-chat with me today. He was unwilling to rev…

Nobody cares about your political motives; kindly stop ransacking the web accounts of people more intelligent than yourself. This man, "yanazendo," has hacked the Gmail account of some guy, and is now sending idiotic messages harassing people.

Lulz I think Trump and Hilary care. https://twitter.com/gmike/status/673037061629198336

Re: How not to report on the encryption ‘debate’

#12

Post by yanazendo »

hellodolly wrote: post #8
yanazendo wrote: post #4

Earlier quoted context omitted.

This is the #HACK I asked Spectre to review https://medium.com/@yanazendo/twttr-pwned-27a6af538247#.j090...

Copying the 2002 strategies of Anonymous doesn't make you a hacker; it makes you a loser. Stop using hashtags; this isn't Twitter. It's clear you love being addressed as a terrorist organization, but you're just some script kiddie in a basement who's about to have his internet unplugged.

P.S. #SPECTRE offered intelligent commentary on my hack. https://twitter.com/gmike/status/673383988963053568

Re: How not to report on the encryption ‘debate’

#13

Post by meowface »

I think this article is great, but something did stand out for me.

I'm a huge supporter of universal end-to-end encryption, but Feinstein's point is making me feel some cognitive dissonance:

>"I think with a court order, with good justification, all of that can be prevented."

There are cases where I would want law enforcement to be able to read encrypted communications in an emergency situation, with a valid court order. If someone is being held hostage, for example. Of course I don't want intelligence agencies having this same access; just very specific requests during exigent circumstances, with judge approval. A real judge in a real court, not a secret FISA court.

But to do that you need some kind of key escrow already set up with the government, and if you have that, there's nothing stopping law enforcement and intelligent agencies from spying on what they want when they want.

Right now this isn't a huge problem since a lot of people still communicate in plaintext, or things that are encrypted but logged/intercepted by a central location (Skype). But eventually more and more things will move to end-to-end encryption.

What is the right way to handle this?

Re: How not to report on the encryption ‘debate’

#14

Post by yeukhon »

yanazendo wrote: post #10
hellodolly wrote: post #8

Earlier quoted context omitted.

Copying the 2002 strategies of Anonymous doesn't make you a hacker; it makes you a loser. Stop using hashtags; this isn't Twitter. It's clear you love being addressed as a terrorist organization, but you're just some script kiddie in a basement who's about to have his internet unplugged.

Lulz I'm an expert in cyber-kinetic nuclear warfare https://www.ll.mit.edu/mission/cybersec/publications/publica...

You do know HN is hosted on the U.S. soil, so HN can totally report you to FBI for a criminal investigation, right?

Re: How not to report on the encryption ‘debate’

#15

Post by ohthehugemanate »

meowface wrote: post #13

I think this article is great, but something did stand out for me. I'm a huge supporter of universal end-to-end encryption, but Feinstein's point is making me feel some cognitive dissonance: >"I think with a court order, with good justification, all of that can be prevented." There are cases where I would want law enforcement to be able to read encrypted communications in an emergency situation, with a valid court or…

I wish that with a court order, we could read the thoughts of a suspect, too... But that's not possible, either.

Remember that a police force doesn't need infinite, perfect access to all of a target's communications to catch them. Think about the case we're describing: we have enough information to convince a judge that this person is a suspect. In order to get evidence to convict, you can:

* hack into their devices to retrieve stored data or install malicious software like keyloggers * bug their place of living and work for video, audio, and WiFi capture * interview/interrogate them, and everyone they associate with * search their place of living and work * place tracking devices * watch their every move with drone or human surveillance * have a human or drone tail them * record all the metadata from their Internet communication * record the contents of any unencrypted communication

We actually have all the access we need, particularly since we're allowed to hack into the target's devices. The only thing we CAN'T do, is include the target in bulk communication capture schemes. We actually have to pick targets and spend resources on them.

To be honest, I might be OK with that practical limit even WITHOUT a warrant requirement. If a police force believes that a suspect is worth spending their limited resources on, they must be worth something. If adding someone to a watch list is free, they'll do it to everybody.

Re: How not to report on the encryption ‘debate’

#16

Post by mikeyouse »

meowface wrote: post #13

I think this article is great, but something did stand out for me. I'm a huge supporter of universal end-to-end encryption, but Feinstein's point is making me feel some cognitive dissonance: >"I think with a court order, with good justification, all of that can be prevented." There are cases where I would want law enforcement to be able to read encrypted communications in an emergency situation, with a valid court or…

I'm of the same frame of mind.. There was an article from earlier this year about the suspect in a child-porn case who successfully encrypted his machine which has completely prevented prosecution:

http://ottawacitizen.com/news/local-news/0407-password

As tools become better, is the price we pay for strong encryption that criminals who are mildly technical can get away with their crimes? That's hard to stomach if it's the 'right' answer..

Re: How not to report on the encryption ‘debate’

#17

Post by dlitz »

meowface wrote: post #13

I think this article is great, but something did stand out for me. I'm a huge supporter of universal end-to-end encryption, but Feinstein's point is making me feel some cognitive dissonance: >"I think with a court order, with good justification, all of that can be prevented." There are cases where I would want law enforcement to be able to read encrypted communications in an emergency situation, with a valid court or…

The right way to handle this is to recognize that sometimes, technology that has all of the magical properties that you want simply does not exist, or cannot exist. Secure, global key escrow is one of those things.

Re: How not to report on the encryption ‘debate’

#18

Post by jlgaddis »

apatters wrote: post #7
marshray wrote: post #2

OK, so we have another well written article explaining how attempts to demonize encryption and put it back in the bottle are misguided, and the spokespeople for the authoritarians and intelligence community are being disingenuous on cable TV. But most of us already knew this. So what I'm asking is: * Are these well reasoned words affecting/effecting policy? * How will we know?

Most of us who read Hacker News already know this, but it is important to keep publishing and reinforcing the message for everyone else!

But is anyone hearing the message other than us?

Re: How not to report on the encryption ‘debate’

#19

Post by meowface »

mikeyouse wrote: post #16
meowface wrote: post #13

I think this article is great, but something did stand out for me. I'm a huge supporter of universal end-to-end encryption, but Feinstein's point is making me feel some cognitive dissonance: >"I think with a court order, with good justification, all of that can be prevented." There are cases where I would want law enforcement to be able to read encrypted communications in an emergency situation, with a valid court or…

I'm of the same frame of mind.. There was an article from earlier this year about the suspect in a child-porn case who successfully encrypted his machine which has completely prevented prosecution: http://ottawacitizen.com/news/local-news/0407-password As tools become better, is the price we pay for strong encryption that criminals who are mildly technical can get away with their crimes? That's hard to stomach if it'…

It's really tricky. I don't want people to be forced to self-incriminate and give up their password. I don't want encryption to be banned. I don't want people to only be permitted to use government-approved encryption with escrow. I don't even want intelligence agencies to research vulnerabilities in existing cryptographic algorithms and implementations, because they have no reason to not use that for dragnet surveillance.

But obviously, I don't want CP or terrorism subjects to evade detection and prosecution because of encrypted drives or communications.

Re: How not to report on the encryption ‘debate’

#20

Post by jacquesm »

yeukhon wrote: post #14
yanazendo wrote: post #10

Earlier quoted context omitted.

Lulz I'm an expert in cyber-kinetic nuclear warfare https://www.ll.mit.edu/mission/cybersec/publications/publica...

You do know HN is hosted on the U.S. soil, so HN can totally report you to FBI for a criminal investigation, right?

Where a website is hosted has very little to do with what you can and can not report to the FBI and whether or not they decide to turn something into a criminal investigation would require that there is a crime first.

Posting dumb comments in a forum is not a crime (and it probably should not be or youtube.com will be out of an audience).

Post reply on HN