Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

The Government Is Lying to Us About Cybersecurity

fee.org

Post reply on HN
Print view View original

21–27 of 27 posts

Re: The Government Is Lying to Us About Cybersecurity

#21

Post by jogjayr »

unabst wrote: post #4

At the end of the day, when the police can't get into a room, they can break the door down. Same with guns. The police are okay with gun ownership because they have the right to gun citizens down. Not to judge, but that's the balance. Same with why we tortured. It counterbalances their vulnerability to secrets. If torture didn't work, Kiefer Sutherland would never have gotten anywhere. But if everyone were against to…

> If torture didn't work, Kiefer Sutherland would never have gotten anywhere. But if everyone were against torture, the show wouldn't have existed.

If you want to see a fictional counterpoint to the "torture works" argument, I'd encourage you to watch Burn Notice. It has a blacklisted CIA operative who fights crime in Miami and one of his mottoes is "Torture doesn't always get you the truth. It gets you the quickest lie that will stop the torture" (he does a voiceover narration). Instead of torture he uses deception, misdirection, and other tradecraft to extract secrets. For example, he kidnaps his target and holds him in a dark warehouse, then has himself beaten up by an associate and put in the warehouse as a "fellow" captive, thus gaining his confidence (it's much better on-screen, I've probably forgotten some details).

Re: The Government Is Lying to Us About Cybersecurity

#22

Post by senectus1 »

unabst wrote: post #4

At the end of the day, when the police can't get into a room, they can break the door down. Same with guns. The police are okay with gun ownership because they have the right to gun citizens down. Not to judge, but that's the balance. Same with why we tortured. It counterbalances their vulnerability to secrets. If torture didn't work, Kiefer Sutherland would never have gotten anywhere. But if everyone were against to…

that's daft.. you might as well ban writing on burnable materials and while you're at it burn fire...

Re: The Government Is Lying to Us About Cybersecurity

#23

Post by ironmagma »

LordKano wrote: post #20
BlackFly wrote: post #6

Earlier quoted context omitted.

Of course there is an answer to unbreakable encryption, the same answer to in person conversations at a private location: bug the location where the communication takes place. You don't need a back door on communications if you are "looking over the shoulder" of someone as they type it in. If the person is a suspect, then they can get a warrant to plant a bug.

Their complaint about this is that it's hard to do that. Well, that's good. I think that law enforcement SHOULD be hard. It should be hard and complicated and time consuming. One of the worst things I can imagine is idle law enforcement officers. Bored cops will find something to do. Whether it's going from car to car and ticketing anyone who is 12.1 or more inches from the curb or ticketing people for spitting on th…

> Whether it's going from car to car and ticketing anyone who is 12.1 or more inches from the curb or ticketing people for spitting on the sidewalk, no good can come from idle police.

So... enforcing our existing laws? What's the point of having those laws if they're never enforced?

Re: The Government Is Lying to Us About Cybersecurity

#24

Post by nitrogen »

gtcode wrote: post #19
AnimalMuppet wrote: post #16

Earlier quoted context omitted.

Well, it shows that there is a non-zero probability of the key being leaked or breached. And if the key can open everything , that's a consequence big enough that we need to think seriously about it happening. "Trust us, we'll keep it secret" has been empirically proven to be not as true as they want us to believe.

Agree 100% about carefully considering consequences of crafting a skeleton key into our most prized technologies. The tech community, at least the most vocal subset in these parts, can keep pushing back against LE's cries for such a key, and it's clear there is merit to such an argument. It just seems to be somewhat provincial from a neutral perspective, however. Taken from the "other side", it does not seem universa…

What you describe as "neutral" is a false compromise between the reality of technology and math, and the inanity of thinking a backdoor is a good idea.

Re: The Government Is Lying to Us About Cybersecurity

#25

Post by gtcode »

nitrogen wrote: post #24
gtcode wrote: post #19

Earlier quoted context omitted.

Agree 100% about carefully considering consequences of crafting a skeleton key into our most prized technologies. The tech community, at least the most vocal subset in these parts, can keep pushing back against LE's cries for such a key, and it's clear there is merit to such an argument. It just seems to be somewhat provincial from a neutral perspective, however. Taken from the "other side", it does not seem universa…

What you describe as "neutral" is a false compromise between the reality of technology and math, and the inanity of thinking a backdoor is a good idea.

No, that's not true, the argument for a backdoor isn't purely technical. LE's perspective is almost certainly predicated on a universal (amongst the good) desire to reduce suffering. This part is downplayed or ignored.

Can you prove that there is no such thing as a "perfect" backdoor? Can you show that the existence of a skeleton key introduces risk beyond losing the key? Has this been formally proven?

That might be a good starting point, and I apologize if my understanding is wrong, but can't one build a skeleton key into encryption that cannot be broken with any greater likelihood than otherwise would be possible by compromising the encryption itself? If the surface area of attack is doubled at most, that seems a viable trade-off. Yes, it's potentially a huge SPOF if designed sub-optimally (I'd suspect that there is a way to build something akin to a one-time use set of segregated skeleton keys), but that risk needs management like all risks.

(redact)

Re: The Government Is Lying to Us About Cybersecurity

#26

Post by LordKano »

ironmagma wrote: post #23
LordKano wrote: post #20

Earlier quoted context omitted.

Their complaint about this is that it's hard to do that. Well, that's good. I think that law enforcement SHOULD be hard. It should be hard and complicated and time consuming. One of the worst things I can imagine is idle law enforcement officers. Bored cops will find something to do. Whether it's going from car to car and ticketing anyone who is 12.1 or more inches from the curb or ticketing people for spitting on th…

> Whether it's going from car to car and ticketing anyone who is 12.1 or more inches from the curb or ticketing people for spitting on the sidewalk, no good can come from idle police. So... enforcing our existing laws? What's the point of having those laws if they're never enforced?

Reinforcing their role as revenue generators instead of peace officers.

Re: The Government Is Lying to Us About Cybersecurity

#27

Post by Stefan-H »

gtcode wrote: post #25
nitrogen wrote: post #24

Earlier quoted context omitted.

What you describe as "neutral" is a false compromise between the reality of technology and math, and the inanity of thinking a backdoor is a good idea.

No, that's not true, the argument for a backdoor isn't purely technical. LE's perspective is almost certainly predicated on a universal (amongst the good) desire to reduce suffering. This part is downplayed or ignored. Can you prove that there is no such thing as a "perfect" backdoor? Can you show that the existence of a skeleton key introduces risk beyond losing the key? Has this been formally proven? That might be…

"Can you show that the existence of a skeleton key introduces risk beyond losing the key?" The fact that losing the key is a possibility is risk enough. Once PFS is implemented, the only way (barring crypto attacks) you can break an TLS session secured with it is to have compromised the systems at the time of the communication. A skeleton key now means that there is a possibility of offline decryption with just having a copy of the communication and the skeleton key. This key is handled by humans now, instead of machines and a protocol. That is far more than double the attack surface area.
Post reply on HN