Modern encryption is really just math. Cryptography in consumer and off-the-shelf products (which Barr is targeting with his discussion) theoretically _could_ be modified in such a way that the government could decrypt it. The two ways of which I can think are (1) Encryption "backdoors" -- fancy math known only to the government; this would require new encryption ciphers or (b) key escrow. Both approaches have their shortcomings and I'm against both, but it's plausible that the government might try it anyway. All that said, because encryption is just math, any individual or group could employ their own encryption by implementing one of any known existing ciphers -- one without a known "fancy math back door" and refuse to follow the "key escrow" guidelines. In these discussions about the government being able to decrypt stuff, are we, in effect, suggesting that certain math be made illegal? If that's really what's being proposed, I'd urge people to consider "Illegal Numbers" and how effective that's been. https://en.wikipedia.org/wiki/Illegal_number
Attorney General William P. Barr Delivers Address Conference on Cyber Security
71–80 of 230 posts
Re: Attorney General William P. Barr Delivers Address Conference on Cyber Security
#72He claims encryption is "warrant proof" which is not true. You can have a court order someone to open the lock. They want the ability to dig through people's stuff without them knowing. That's what it's really about.
Sure, but I can just refuse to decrypt my data. They can just break physical locks.
They can't force me to tell them where I've physically hid things.
Re: Attorney General William P. Barr Delivers Address Conference on Cyber Security
#73Earlier quoted context omitted.
Sure, but I can just refuse to decrypt my data. They can just break physical locks.
This is what a lot of people in our community seemingly refuse to recognize. For all intents and purposes, encryption is a unbreakable lock that can serve to perfectly hide valuable criminal evidence. Such a thing wasn't possible when our laws were written and has never before been possible in the physical world. Its existence has potential to be a huge shift in how we enforce the law. Regardless of our views on encr…
You act as if the court has no option if someone won't decrypt something they hold the keys too. This is why contempt charges are a thing.
The government has done an astounding job of showing they are untrustworthy with access to our personal information, or frankly even their own information as the OPM breach makes painfully apparent.
Re: Attorney General William P. Barr Delivers Address Conference on Cyber Security
#74If the US Government succeeds in requiring a backdoor then so will every other government. Does anyone really think China won’t immediately demand backdoors?
Not just governments, but various mafias, several corporates, random masonic offshoots, and the occaisional creative individual presumably have backdoors into all sorts of stuff. This isn't about creating backdoors, this is about being allowed to use them within the public legal framework.
Re: Attorney General William P. Barr Delivers Address Conference on Cyber Security
#75If the US Government succeeds in requiring a backdoor then so will every other government. Does anyone really think China won’t immediately demand backdoors?
China already does require backdoors of both local Chinese firms and foreign firms with HQs in China, although the requirement may not be "technically official" (it can certainly be interpreted that way from their 2017 law, though).
I think it's disgusting how supposed "democracies" have been trying to emulate China, both in terms of surveillance and censorship. UK is one of the worst offenders here -- sometimes they didn't even hide the fact they were using China as a role model.
There used to be a time when the U.S. government and other countries would condemn China for this sort of stuff.
Re: Attorney General William P. Barr Delivers Address Conference on Cyber Security
#76Earlier quoted context omitted.
This is what a lot of people in our community seemingly refuse to recognize. For all intents and purposes, encryption is a unbreakable lock that can serve to perfectly hide valuable criminal evidence. Such a thing wasn't possible when our laws were written and has never before been possible in the physical world. Its existence has potential to be a huge shift in how we enforce the law. Regardless of our views on encr…
Cryptography has existed for over 3000 years [1], steganography [2] has been documented in use over 2000 years ago and it's possible it has been used much longer (the entire point is we wouldn't know). If encryption is being used to hide "valuable criminal evidence", how is that different from someone hiding evidence by burying it somewhere or simply destroying it? We don't detain random people and force them to give…
This- encryption + deletion of the key is basically destroying evidence. Which is already illegal and our justice system already has to deal with. No special casing necessary.
Re: Attorney General William P. Barr Delivers Address Conference on Cyber Security
#77Earlier quoted context omitted.
Except it’s not a discussion worth having. If you have a back door, it’s there for everybody not just the people it’s intended for. Additionally, there’s not going to be a way to force people to use the encryption that happens to have a backdoor. It’s an algorithm. People who don’t obey the rules will just use a more secure method when they need to protect something. This is why there’s no point to having the convers…
Do you realize how condescending it is when someone comes to you with a problem and your answer is that "is not a discussion worth having"? Warrants losing their power in the digital age is a problem and our community's refusal to recognize that just pushes the government down alternative routes to something like PRISM. Also focusing on enforcement is making the perfect the enemy of the good. What percentage of commu…
Do you realize how PRISM is the very reason that the government cannot be trusted?
>What percentage of communication in this country flows through either Apple, Google, Facebook, or Amazon?
You make it sound like data collection and snooping on innocent people is the whole point of it. If backdoors are required on communication that goes through Apple, Google, Facebook, and Amazon then nobody's going to use the communication on those services for illicit activity that the government would care about. They would use something else.
>But I recognize that there is a problem and that we should be open to talk about ways to fix that problem.
There is no talk to be had, because the entire idea is silly. If the US government can mandate backdoors then so will every other government. This would make everyone vulnerable.
Re: Attorney General William P. Barr Delivers Address Conference on Cyber Security
#78Earlier quoted context omitted.
This is what a lot of people in our community seemingly refuse to recognize. For all intents and purposes, encryption is a unbreakable lock that can serve to perfectly hide valuable criminal evidence. Such a thing wasn't possible when our laws were written and has never before been possible in the physical world. Its existence has potential to be a huge shift in how we enforce the law. Regardless of our views on encr…
The problem is that there's no way for the government to actually enforce this 100% - sure, on the average person, but we have to assume that someone engaged in espionage / terrorism / etc. is going to take additional precautions. The threat doesn't go away by doing this.
Nothing assumes 100% perfection as a requirement. We might not like it but if, say, popular services had a way to satisfy warrant requests that would mean that most cases would be satisfied with a warrant even if a small percentage required something else, just as the existence of very hard to open safes doesn’t mean most criminals use them.
To be clear, I’m opposed to widespread access and would want a warrant at a minimum but honesty compels me to note that there are crimes which would be solved if someone used, say, SMS but not Signal and we should consciously accept that as the cost of not living in a surveillance state rather than pretending it’s not true.
Re: Attorney General William P. Barr Delivers Address Conference on Cyber Security
#79Modern encryption is really just math. Cryptography in consumer and off-the-shelf products (which Barr is targeting with his discussion) theoretically _could_ be modified in such a way that the government could decrypt it. The two ways of which I can think are (1) Encryption "backdoors" -- fancy math known only to the government; this would require new encryption ciphers or (b) key escrow. Both approaches have their…
This is all true, but I think encryption backdoors are more possible than people think.
The target here is not nerds able to pull code from GitHub or run open source or enterprise software. The target here is consumer stuff by companies like Apple and Google. The government doesn't want it to be easy to do end-to-end encryption.
For the average user, easy equals possible. The average user has neither the time nor the expertise to roll their own solution or run nerd tools. Look at how PGP/GPG's complexity and absolutely horrible UX (even for technical users!) has prevented e-mail encryption from ever taking off.
This reminds me of what a government guy told me about crypto export controls. Yes, they know that crypto export controls won't stop nerds using GitHub. What they want to do is to stop IBM, Google, Apple, Cisco, Juniper, etc. from selling ready-made polished crypto products to blacklisted countries.
In both cases I think the target is large corporations not individuals and the goal is to make crypto hard and keep it out of the hands of the average user or less-technical foreign organization.
That being said I still don't think it'll work. Just pointing out the thinking that's going on here.
Re: Attorney General William P. Barr Delivers Address Conference on Cyber Security
#80Earlier quoted context omitted.
Sure, but I can just refuse to decrypt my data. They can just break physical locks.
This is what a lot of people in our community seemingly refuse to recognize. For all intents and purposes, encryption is a unbreakable lock that can serve to perfectly hide valuable criminal evidence. Such a thing wasn't possible when our laws were written and has never before been possible in the physical world. Its existence has potential to be a huge shift in how we enforce the law. Regardless of our views on encr…
> For all intents and purposes, encryption is a unbreakable lock that can serve to perfectly hide valuable criminal evidence. Such a thing wasn't possible when our laws were written and has never before been possible in the physical world. Its existence has potential to be a huge shift in how we enforce the law.
This is untrue. The equivalent thing that anybody has been able to do for a thousand years is keep their written down secrets in an undisclosed location. If the police don't know where you keep them and you don't tell them, they have never been able to read them. Finding an anonymous storage unit among millions is no easier than guessing the user's password.
But you could put them under covert surveillance ahead of time to find the location, you say? You can do the same thing to get their password then.