Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Encryption Is Not a Crime

privacyguides.org

Post reply on HN
Print view View original

101–110 of 222 posts

Re: Encryption Is Not a Crime

#101

Post by benmmurphy »

wulfstan wrote: post #88
01HNNWZ0MV43FF wrote: post #62

Earlier quoted context omitted.

Users can ignore the expiration date on a TLS cert. Cryptography doesn't enforce time constraints, business logic does. somewhere a piece of code would have to say "here I've got this key, which can decrypt this text, but I'm not going to" and that decision is not protected by math.

I'm not sure I follow. Obviously the application itself needs to support the business logic described, in the same way as your web browser needs to notice that a certificate has expired and tell you there's a problem with a website you're visiting. What I'm exploring is why requiring certain applications to support the same sort of thing to decrypt user data in certain circumstances to support law enforcement is a pr…

the closest you can get to what you want is a trusted third party who would help derive the final key. so the key could not be revealed to law enforcement without cooperation of the trusted third party who would verify policies like time, etc. it may also be possible to have the 'trusted third party' be a piece of tamper proof hardware. i think generally people are suspicious of these schemes because it relies on 'trust'.

also, i think apple has a scheme similar to this for protecting the passcode from being brute forced when recovering from iCloud backup. however, if this scheme breaks it doesn't reveal the encryption key i believe it just allows the passcode that protects the encryption key to be brute forced which I guess may or may not result in the encryption key being revealed.

Re: Encryption Is Not a Crime

#102

Post by chupasaurus »

huslage wrote: post #40
kubb wrote: post #4

There's an abstract argument template that I've noticed floating around. It goes like this: 1. There's a thing T in the world, and that thing has negative outcomes X, Y, Z, and positive outcomes A, B, C. 2. Some people believe that Y and Z are so bad, that they want to partly compromise C to diminish them. 3. However that will never work! And they'll definitely also take B if we let them mess with C. 4. Besides, C is…

That's a template, yes. But why is it bad?

Because only the first part adds something to the discussion. Starts with the the problem, then goes about only one of the possible solutions (which usually is the low-hanging one), states why it's bad and ends with refuting the existence of a problem.

Re: Encryption Is Not a Crime

#103

Post by rdm_blackhole »

HDThoreaun wrote: post #58
ziddoap wrote: post #30

Earlier quoted context omitted.

> You should engage with the arguments the other side makes. The arguments are "Protect the children.", "Catch terrorists.", "Catch criminals.". Those arguments have been engaged with for decades. They are purely emotional arguments. Anyone who still pushes those arguments forth is most likely doing so with ulterior motives and cannot be reasonably "engaged" with.

For what its worth the anti-encryption/anti-privacy laws have caught terrorists in the UK. My company provides data storage for their dragnet and handles various requests and Ive seen first hand 4 different instances where the UK gov watching everyones internet activity led to terrorists being caught.

This number by itself means nothing as the other variables are unknown.

How many terrorists were not caught by these systems? How many would have actually done these actions instead of just talking about it? How many could have been caught with just standard police work?

Without knowing these variables then there is no way to say if these systems are particularly good at catching terrorists.

Re: Encryption Is Not a Crime

#104

Post by wulfstan »

jagger27 wrote: post #87
wulfstan wrote: post #57

Earlier quoted context omitted.

Yes, but if a court decides you have committed a crime, and law enforcement show sufficient cause to obtain a warrant, they can seize your secret and - if it's relevant - use it to show your state of mind when the crime was committed.

Did you not read 1984?

Yes, several times.

But in the same way that as a society we allow physical privacy (and freedom!) to be removed under certain circumstances, we should consider allowing digital privacy to be removed in the same way. 1984 imagines a world where the authorities can enter your physical space at any time because they feel like it. But I don't lie awake worrying about that because I live in a society where I feel the social contract is largely upheld by the authorities.

Re: Encryption Is Not a Crime

#105

Post by throawayonthe »

gruez wrote: post #93
arnonejoe wrote: post #84

Earlier quoted context omitted.

I don’t understand this. If you live in the US and use a service like ProtonMail, has a crime been committed? Are there any examples here in the US or anywhere else of arrests/prosecutions being made over encryption? I’ve never heard of any??

He's probably talking about authoritarian regimes like China or whatever.

[dead]

Re: Encryption Is Not a Crime

#106

Post by kgwxd »

i5heu wrote: post #34

I do not like these framings of "not a" because it always sounds so suspicious like "we are not a cult". It puts the idea into the world that it could be a crime and maybe that it is the status quo. Much better IMHO is something like "Encryption is a fundamental right.", "Encryption protects everyone.", "Without encryption there is no democracy." and so on. Maybe "Don’t let them take your right to privacy."

"Speech is not a crime"

Re: Encryption Is Not a Crime

#107

Post by wulfstan »

AAAAaccountAAAA wrote: post #64
wulfstan wrote: post #29

Playing devil's advocate here... What is wrong with: * an expiring certificate * issued by the device manufacturer or application creator * to law enforcement * once a competent court of law has given approval * that would allow a specific user's content to be decrypted prior to expiry There are a million gradations of privacy from "completely open" to "e2e encrypted". Governments (good ones!) are rightly complaining…

Because it is not realistic to except a government to always be "good". Courts are just going to rubber-stamp warrants, like they have done with present-day "lawful interception" warrants. And the keys are inevitably going to leak, if they are used routineously to investigate common crime.

Apple's iOS firmware encryption key hasn't leaked, as far as I am aware. Do you know otherwise?

There are already very good solutions for ensuring that key leakages are very difficult to do and limited in effect.

Re: Encryption Is Not a Crime

#108

Post by geocar »

loftsy wrote: post #15

Something is a crime if society determines that it should be so. Nothing more. Clearly the pressure on government to write these laws is coming from somewhere. You should engage with the arguments the other side makes.

> Something is a crime if society determines that it should be so. Nothing more.

According to The New Oxford Companion to Law, the term crime does not, in modern criminal law, have any simple and universally accepted definition.

Society also determined it was ok to use a firehose on black people, so I think the best we can say is that the term Crime has nothing to do with Morality, and people who conflate the two need to be looked at with suspicion.

> You should engage with the arguments the other side makes.

I don't. I think most arguments about crime require one-side to act in bad-faith. After all: The author doesn't actually mean that Encryption isn't illegal in some jurisdictions, they mean that it shouldn't be. You know this. I know this. And yet you really think someone needs your tautological definition of crime? I don't believe you.

Re: Encryption Is Not a Crime

#109

Post by marcosdumay »

01HNNWZ0MV43FF wrote: post #54
i5heu wrote: post #34

I do not like these framings of "not a" because it always sounds so suspicious like "we are not a cult". It puts the idea into the world that it could be a crime and maybe that it is the status quo. Much better IMHO is something like "Encryption is a fundamental right.", "Encryption protects everyone.", "Without encryption there is no democracy." and so on. Maybe "Don’t let them take your right to privacy."

I wish Americans still believed in American freedoms Encryption is free association and free speech. Talking to someone about what I like without eavesdroppers Transitioning gender is also free speech, freedom of expression. Presenting how I like and not how some wannabe king wants me to

I'm not sure the US population ever really believed in fundamental freedoms.

They had an apartheid up to 60 years ago. There are living people from that time, and you can't believe in any human right and have an apartheid at the same time.

Re: Encryption Is Not a Crime

#110

Post by jmclnx »

Seems to be geared towards Apple, but informative nevertheless.

To me, the only sure end-end encryption is gnupg, where you personally create the keys and distribute.

Post reply on HN