Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

NSA-proof encryption exists. Why doesn’t anyone use it?

washingtonpost.com

Post reply on HN
Print view View original

81–90 of 138 posts

Re: NSA-proof encryption exists. Why doesn’t anyone use it?

#81

Post by JshWright »

Xcelerate wrote: post #47
cube13 wrote: post #36

Earlier quoted context omitted.

>This has come up in the past on HN. As I understand it the newspaper story is bull. Pretty much. The same effect that causes stars to twinkle limits the resolution of space-based spy satellites imagery of the ground. http://en.wikipedia.org/wiki/Astronomical_seeing

That's for distant stars though, isn't it? I mean, just with Google Maps you can see the mirrors on a car. Newsprint isn't that much of a step up.

While it's true that the stars are very distant, the only atmosphere that the light passes through is same atmosphere the satellites have to peer through (resulting in the same amount of distortion)

Re: NSA-proof encryption exists. Why doesn’t anyone use it?

#82

Post by betterunix »

pavel_lishin wrote: post #5
maaku wrote: post #4

Earlier quoted context omitted.

And where is the private key stored? On Google or Microsoft's server? What then would be the point? (I assume you'll answer that it'll be done client-side, but JavaScript cryptography is a whole mess of fail. But that's a separate issue.)

And if it is stored client-side, what happens when the user inevitably loses their key? You and I might have backups in multiple places, and on an encrypted USB stick in a bank vault, but my dad doesn't, and the next time he spills wine on his laptop, there goes literally all of his e-mail.

Issue the user two smartcards, one for daily use, one that can be used to create a new daily use smartcard. Tell the user to keep the backup smartcard in a safe place.

Yes, someone will inevitably lose both. You just need to ensure that that is a rare event, and that there are alternative systems in place (i.e. that losing access to one system does not prevent people from living their lives).

Re: NSA-proof encryption exists. Why doesn’t anyone use it?

#83

Post by kelnos »

david_shaw wrote: post #25

> NSA-proof encryption exists. Yup. Except it's not that easy. Let's say that you're using OTR to provide very strong end-to-end encryption for a conversation between yourself and a buddy, Bob. Maybe he's in a hostile area, and you're worried that if his government sniffs his traffic, that he could be executed for speaking to Americans. Data in transit that is intercepted, if configured correctly, is almost certainly…

His OTR key (and, if using Pidgin, account credentials in plaintext if stored) is plainly available on the disk. You now have the private key.

Not true, actually. OTR provides perfect forward secrecy. Gaining access to the private key does not give you access to previous conversations.

Re: NSA-proof encryption exists. Why doesn’t anyone use it?

#84

Post by davvolun »

tedks wrote: post #56
david_shaw wrote: post #25

> NSA-proof encryption exists. Yup. Except it's not that easy. Let's say that you're using OTR to provide very strong end-to-end encryption for a conversation between yourself and a buddy, Bob. Maybe he's in a hostile area, and you're worried that if his government sniffs his traffic, that he could be executed for speaking to Americans. Data in transit that is intercepted, if configured correctly, is almost certainly…

Remember that post a little while ago about how most logical fallacies aren't actually logical fallacies? Here, you are committing an actual logical fallacy. It's called "shifting the goalposts." The article is in response to a dragnet surveillance program, where everyone's communications are watched and presumably datamined. It's very easy to do this, because nothing is encrypted, and everyone uses services that exp…

Not to mention, if we (US citizens) are actually so concerned with how hopeless encryption would be to protect us from government gestapo, versus reasonable encryption to protect data-in-transit, we're truly and hopelessly fucked. It's a disturbingly good, and ironic, argument to stand up against the illegality and unconstitutionality of the NSA's program.

Re: NSA-proof encryption exists. Why doesn’t anyone use it?

#85

Post by betterunix »

sweis wrote: post #64
ohazi wrote: post #45

Earlier quoted context omitted.

This is the real reason why cryptography hasn't caught on. It's opt-in by nature - No matter how hard you try, you can't send someone an encrypted message if they don't have a public key for you to use.

Actually, yes you can. Check out identity-based encryption and Voltage Security. It's currently in use by Wells Fargo, ADP, and other large enterprise customers. The catch there is that IBE requires a centralized, trusted key-issuing service where you need to enroll to receive your message. If that's compromised, then game over.

You do not need a single key-issuing service for IBE:

http://www.argreenhouse.com/society/wcan06/wcan06s4p3.pdf

Of course, you would need to be judicious about which group of key issuers you are willing to trust, but this method will at least reduce the risk. The other nice thing about this is that even if some key issuing service is compromised, the sender can force the receiver to switch services (compare to the TLS model, where dropping a CA is basically a coordination game problem).

Re: NSA-proof encryption exists. Why doesn’t anyone use it?

#86

Post by betterunix »

unimpressive wrote: post #35
crazy1van wrote: post #29

Because the vast majority of people like privacy in theory but not enough to spend the hour it would take to learn how to encrypt their email and documents. Seriously, how many HN users have spent hours complaining about privacy on here but still don't encrypt their own email? This isn't to excuse anything illegal the US gov't might be doing, but if it matters as much to people as they say you'd think they'd have at…

>Seriously, how many HN users have spent hours complaining about privacy on here but still don't encrypt their own email? I would think that most HN users would be willing to encrypt their email, but know they can't convince their friends/family/etc to do so. Encryption takes two to tango.

To put things in perspective: at CRYPTO at some point in the past, I had a student stipend. I needed to send some documentation via email. I asked the person responsible, a prominent cryptography researcher (who will not be named), if they had a public key. The answer was, "No, I really should set one up but I'm just too busy."

When not even the researchers who run a top-tier cryptography conference are bothering, you know that it is not just about non-technical folks being clueless.

Re: NSA-proof encryption exists. Why doesn’t anyone use it?

#88

Post by ErsatzVerkehr »

Xcelerate wrote: post #21

I have a question that perhaps a cryptography expert could answer for me. My father told me when he was young, he visited Oak Ridge National Labs on a trip, and while there, they told him they had satellites that could read the print on a newspaper. At the time, it wasn't classified information; it was just something that nobody knew. Approximately 15-20 years later, satellites with that capability became well-known.…

> they had satellites that could read the print on a newspaper.

This is physically impossible, for the reasons given by marssaxman below; specifically, the resolution of an imaging system is limited by diffraction. In order to read a newspaper from orbit, you would need a ridiculously large aperture. Furthermore, you've certainly seen declassified Cold War satellite and aerial (U-2) imagery. You know what it looks like. Do you seriously believe they had something else that could read newspapers?

Re: NSA-proof encryption exists. Why doesn’t anyone use it?

#89

Post by ErsatzVerkehr »

cube13 wrote: post #36
lordgilman wrote: post #30

Earlier quoted context omitted.

This has come up in the past on HN. As I understand it the newspaper story is bull. As for advancements in technology the answer is likely no - producing that technology requires an entire toolchain/industry that the NSA is unlikely to replicate with its size. The only shot the NSA has at pulling ahead of us is with entirely mathematical things like crypto (which they did at least in the 70s with differential cryptan…

>This has come up in the past on HN. As I understand it the newspaper story is bull. Pretty much. The same effect that causes stars to twinkle limits the resolution of space-based spy satellites imagery of the ground. http://en.wikipedia.org/wiki/Astronomical_seeing

Not just "seeing" (atmospheric turbulence), but also diffraction.

Re: NSA-proof encryption exists. Why doesn’t anyone use it?

#90

Post by ErsatzVerkehr »

marssaxman wrote: post #72
Xcelerate wrote: post #34

Earlier quoted context omitted.

> As I understand it the newspaper story is bull Could you clarify what you mean by this? And yeah, I should have been more clear in my original question; I was lumping mathematical advances under "technology".

The resolution of a lens at a given wavelength is determined by its diameter (Rayleigh function). We know how big the launch vehicles are, so we can estimate the largest size a spy satellite's mirror could be, and we can use that to compute the maximum resolution a satellite could have; it turns out to be something around 5-10 cm. In order to resolve a newspaper from near-earth orbit, you'd need a lens bigger than th…

Would it be possible to improve the resolution of optical imagery using a synthetic aperture?
Post reply on HN