So I guess we have a moral imperative to fork Chrome to actually enforce cert pinning even against locally-installed roots, then?
Enforce cert pinning? No. Notify when it is overridden by locally-installed roots? Yes.
The Moral Character of Cryptographic Work
21–30 of 96 posts
Re: The Moral Character of Cryptographic Work
#22They lead one to ask if our inability to effectively address mass surveillance constitutes a failure of our field. I believe that it does. I call for a community-wide effort to develop more effective means to resist mass surveillance. What's funny is that you could talk to any number of law enforcement officials who believe that the moral failing is on the cryptography community for not providing a "backdoor" into en…
> Morality is, unfortunately, subjective. Part of the argument is in convincing your opponent that your morality is superior to theirs. Or, perhaps, that their stance violates their own sense of morality. Why? I can't just live morally and let my "opponent" do what they think is right? I feel very strongly that people should decide what they think is right and fight for it. I feel no need to convince other people tha…
> I feel very strongly that people should decide what they think is right and fight for it.
> I feel no need to convince other people that my morality is superior to theirs.
Those two statements are in direct contradiction. Fighting for your morality is convincing others of its superiority. Those two things are the same thing.
Re: The Moral Character of Cryptographic Work
#23From the abstract: Cryptography rearranges power: it configures who can do what, from what. I'd argue that the reverse is really the issue that needs more attention. Online systems that do not provide strong cryptography rearrange power, as compared to their offline equivalents. It was not feasible to scan all phone calls for keywords in 1970, since that required effort from humans to do the patching and listening. T…
+100
What powerful tool is I incrementalism that the whole population has forgotten that we used to be private individuals.
The unification of the human race by the Internet now threatens the relevance of overgrown governments and banks. That's why they fight us.
Re: The Moral Character of Cryptographic Work
#24They lead one to ask if our inability to effectively address mass surveillance constitutes a failure of our field. I believe that it does. I call for a community-wide effort to develop more effective means to resist mass surveillance. What's funny is that you could talk to any number of law enforcement officials who believe that the moral failing is on the cryptography community for not providing a "backdoor" into en…
> Morality is, unfortunately, subjective. That is only true if there are no universal preferences: things like self ownership, all things being equal, is always preferable to slavery.
Universality doesn't necessarily have anything to do with morality.
If I want to kill all other people and I successfully kill everyone but myself, my preference has become universal but fulfilling that preference has not become any more moral.
Personally, I don't think morality is all that subjective, but more an emergent property of community identity. (Thus is inherently shared rather than inherently personal). I would way that Morality is, fortunately, relative.
Re: The Moral Character of Cryptographic Work
#25They lead one to ask if our inability to effectively address mass surveillance constitutes a failure of our field. I believe that it does. I call for a community-wide effort to develop more effective means to resist mass surveillance. What's funny is that you could talk to any number of law enforcement officials who believe that the moral failing is on the cryptography community for not providing a "backdoor" into en…
> Morality is, unfortunately, subjective. That is only true if there are no universal preferences: things like self ownership, all things being equal, is always preferable to slavery.
Sure, but whether or not there are universal preferences is also subjective.
Re: The Moral Character of Cryptographic Work
#26Earlier quoted context omitted.
> Morality is, unfortunately, subjective. Part of the argument is in convincing your opponent that your morality is superior to theirs. Or, perhaps, that their stance violates their own sense of morality. Why? I can't just live morally and let my "opponent" do what they think is right? I feel very strongly that people should decide what they think is right and fight for it. I feel no need to convince other people tha…
> I feel very strongly that people should decide what they think is right and fight for it. > I feel no need to convince other people that my morality is superior to theirs. Those two statements are in direct contradiction. Fighting for your morality is convincing others of its superiority. Those two things are the same thing.
> Fighting for your morality is convincing others of its superiority.
Unless your morality includes letting others come to their own conclusions about what is right. In that case, trying to convince others that they should let others pick their own morals would be self-contradictory.
Re: The Moral Character of Cryptographic Work
#27For anyone here who doesn't know who the author is, Phil Rogaway is one of the most important academic cryptographers; he's responsible for OAEP, PSS, OCB, UMAC, FPE, and the constructions behind XTS, the universal standard for disk encryption. The meat of the paper is in Sections 2 (where the unintended power dynamics of some modern academic crypto research projects is discussed) and 4 (where he provides suggestions…
This is a very good paper and it's disappointing that it didn't get higher on HN. That being said I disagree with some of paper's points. I don't believe that cryptographers should take on moral responsibility for how they perceive their work may or may not be used. If a malware writer uses XTS to lock up a hard drive should Dr Rogeway be morally responsible for that since he helped create the constructions for XTS?…
Are you arguing that the scientists who developed the first atomic bomb share no moral responsibility for the (positive or negative) effects of its use?
Dr. Rogeway is morally responsible both for the use of his encryption for cyber ransom and for the use of his encryption to allow private democratic and economic discourse.
If you think the negative effects of publicly available encryption outweigh the positive effects, it would be immoral to be working on making better encryption publicly available.
Obviously, there is a complicated moral calculus behind which effects are foreseeable/likely relative to your other available actions and their foreseeable/likely effects.
Re: The Moral Character of Cryptographic Work
#28They lead one to ask if our inability to effectively address mass surveillance constitutes a failure of our field. I believe that it does. I call for a community-wide effort to develop more effective means to resist mass surveillance. What's funny is that you could talk to any number of law enforcement officials who believe that the moral failing is on the cryptography community for not providing a "backdoor" into en…
Are you implying that "law enforcement officials" have moral standing, especially in the US? Torture, racism, fraud, corruption, brutality, are what springs to mind, along with a total lack of will to reform. To hell with that.
I would say that it is precisely the moral standing of LEOs that makes the torture, racism, fraud, corruption and brutality so much more egregious of an offense than when committed by any other armed gang.
Re: The Moral Character of Cryptographic Work
#29So I guess we have a moral imperative to fork Chrome to actually enforce cert pinning even against locally-installed roots, then?
...as opposed to Firefox, Edge, and Safari which all do the same?
Re: The Moral Character of Cryptographic Work
#30Earlier quoted context omitted.
> Morality is, unfortunately, subjective. That is only true if there are no universal preferences: things like self ownership, all things being equal, is always preferable to slavery.
Universality doesn't necessarily have anything to do with morality. If I want to kill all other people and I successfully kill everyone but myself, my preference has become universal but fulfilling that preference has not become any more moral. Personally, I don't think morality is all that subjective, but more an emergent property of community identity. (Thus is inherently shared rather than inherently personal). I…
As a foundation for morality it does, violation of a universal principle being an immoral act. Your hypothetical situation depends on the dimension of time, I'd say that universality has no such constraint: the concept of a perfect circle exists regardless of a physical example ever having existed.