The Government Is Lying to Us About Cybersecurity
1–10 of 27 posts
Re: The Government Is Lying to Us About Cybersecurity
#2The second supposed "lie" is possibly the closest to reality. Although there are plenty of people who would agree that there is something of a difference between "not encrypted" and "encrypted, but the NSA has a a separate key that can decrypt it". Like everyone who thinks TLS isn't completely broken.
The third is simply a conspiracy theory. Don't be surprised if the press, and anybody who isn't already on your side, laughs at you if show up with an argument about how it's all a plan by the NSA/Congress/Disney to control money/brains/Hitler's secret moon base.
Packaging such weak arguments in the language of "lies" weakens your position if you're trying to defend the public's right to strong encryption. Because people will focus on your assumptions that they know to be wrong, such as the government being on some super-secret mission to get your bitcoin or whatever. And they will extrapolate from there.
Instead, start from shared assumption, and build good will, before making actual, strong arguments. One such basis would be acknowledging that, yes, some hypothetical, completely ethical, FBI agent may today have a harder time, because where they would previously find lots of incriminating documents in nicely labelled binders, today a search may often just result in an USB stick with binary gibberish.
Once you've build some rapport, this would be a real argument: I don't trust judicial oversight, because it has been abused too often by, for example, the FISA court and national security letters. Moreover, the government's surveillance powers were previously limited in two less-excplicit ways than judicial oversight, namely the costs and manpower involved with physically searching a place, and surveilling people, as well the nature of such actions as being publicly visible. But these safeguards do not apply to electronic surveillance, making it too likely that such powers will be used in massive operations without probable cause.
Re: The Government Is Lying to Us About Cybersecurity
#3Neither are from security professionals, and both really downplay the risks associated with having escrow of keys. The number of leaks and breaches across the various government orgs shows that it is near impossible to maintain the security of keys held in escrow.
Re: The Government Is Lying to Us About Cybersecurity
#4Same with guns. The police are okay with gun ownership because they have the right to gun citizens down. Not to judge, but that's the balance.
Same with why we tortured. It counterbalances their vulnerability to secrets. If torture didn't work, Kiefer Sutherland would never have gotten anywhere. But if everyone were against torture, the show wouldn't have existed.
They have an answer to locked doors, suspects with guns, and terrorists with secrets that -- at minimum -- make sense to them regardless of their effectiveness or consequences to society or our ethical reputation.
The main problem with encryption is there is no workaround. There is no counterbalance. The lock is unbreakable, and there is no one to shoot or torture when all they have is the device itself (and no one to torture always, if they're abiding by the law).
This scares law enforcement. This whole campaign is driven by fear, but they cannot admit fear, so it's all rationalizations and confabulations -- which work by the way -- hence they're keeping at it. And when those with power empathize with this fear in between the lines, they will sign off on these lies.
Re: The Government Is Lying to Us About Cybersecurity
#5Re: The Government Is Lying to Us About Cybersecurity
#6At the end of the day, when the police can't get into a room, they can break the door down. Same with guns. The police are okay with gun ownership because they have the right to gun citizens down. Not to judge, but that's the balance. Same with why we tortured. It counterbalances their vulnerability to secrets. If torture didn't work, Kiefer Sutherland would never have gotten anywhere. But if everyone were against to…
You don't need a back door on communications if you are "looking over the shoulder" of someone as they type it in. If the person is a suspect, then they can get a warrant to plant a bug.
Re: The Government Is Lying to Us About Cybersecurity
#72 rebuttals listed from Schneier's post mentioned in the article linked here are worth a read. https://www.washingtonpost.com/news/volokh-conspiracy/wp/201... and https://www.lawfareblog.com/thoughts-encryption-and-going-da... Neither are from security professionals, and both really downplay the risks associated with having escrow of keys. The number of leaks and breaches across the various government orgs shows that…
Re: The Government Is Lying to Us About Cybersecurity
#8The first supposed "lie" here isn't even mentioned. I guess the criticism fits an (unmentioned) statement that the government is trying to improve cybersecurity. But while I have heard that in general terms, I don't remember it coming up in the crypto debate–and would be surprised, considering I can't think of the logic that would connect the two. The second supposed "lie" is possibly the closest to reality. Although…
From https://en.wikipedia.org/wiki/ECHELON
> In 2001, the Temporary Committee on the ECHELON Interception System recommended to the European Parliament that citizens of member states routinely use cryptography in their communications to protect their privacy, because economic espionage with ECHELON has been conducted by the U.S. intelligence agencies.[7]
My guess is that the real benefit that the NSA provides is largely economic and military espionage. terrorism hasn't been reduced or increased regardless of NSAs activity, and the folks that run the show are not stupid.
Re: The Government Is Lying to Us About Cybersecurity
#9At the end of the day, when the police can't get into a room, they can break the door down. Same with guns. The police are okay with gun ownership because they have the right to gun citizens down. Not to judge, but that's the balance. Same with why we tortured. It counterbalances their vulnerability to secrets. If torture didn't work, Kiefer Sutherland would never have gotten anywhere. But if everyone were against to…
If you find a bad person and get someone to follow them with a really good camera you'll likely get the code (especially for a phone ). If you are at a mall in a high tech country I was told that you can read what they write on their phones ( No source, and if not think about the future ).
So you will need some police work but that's actually how it has been used for most part of the last hundred years, where you can't just look stuff up on a computer.
So yes there is no real guarantee that you can crack a phone. But if we learned anything from the dark markets it's that it's very hard to never makes mistakes.