More Encryption Is Not the Solution
queue.acm.org
More Encryption Is Not the Solution
1–10 of 88 posts
Re: More Encryption Is Not the Solution
#2Because we are technical people, it's very tempting to think of a technical solution to the problem. This author is right on the money though. Against a state level actor there is little hope of securing your own person and effects, and thus, your technical solution.
Re: More Encryption Is Not the Solution
#3In general, the points are OK. Small detail which the author got wrong: According to the now famous Prism slides, Skype was a part of that program before it was sold to Microsoft. It seems that MSFT engineers didn't need to change the architecture just for that feature.
That also proves that the end users can't assume that they can get any idea when some company starts to be the part of such a program, even if now everybody likes to feel smart and more secure in his abilities to spot the difference: "look it was the architecture change."
Re: More Encryption Is Not the Solution
#4The main issue is governments can't be trusted, a technical solution (which may not be encryption) is that only option we have.
Re: More Encryption Is Not the Solution
#5He made a point saying the privacy problem will not be solved with more encryption. The problem is that there is no way to stop a terrorist plot or illegal activity without the ability to know of it's existence.
The author says the solution can only be on the politics side, but frankly I see a dilemma and don't see how to solve it.
The author makes an interresting parallel with the privacy loss we have at work and we accept. But I know I accept it because there are rules and higher authority that can punish abuse. The problem is that this doesn't exist with states spying.
If there was an authority who could punish states who abuse the information gathered for surveillance, then I beleive we could reconcile the need of surveilance for collective security interest and trust in privacy.
We may need some more decades to reach such evolution stage.
Re: More Encryption Is Not the Solution
#6Encryption is not the silver bullet, I agree with that.
All the points he makes are possible scenarios. After Snowden, almost nothing that can be done seems unlikely to have been done. Heck, even the movie "The Net" looks like prophecy come true now.
It's weird to think that encryption is not as secure as we all believed but it still makes it more difficult for the Big Brother to watch over all of use.
In the end, encryption is only completely useless if each and every provider reports to the government. It's a shame and disgrace for the western world that we even assume that this could become a reality.
Re: More Encryption Is Not the Solution
#7Because we are technical people, it's very tempting to think of a technical solution to the problem. This author is right on the money though. Against a state level actor there is little hope of securing your own person and effects, and thus, your technical solution.
I agree that a political solution is strongly preferable, but I'm not sure if that's ever going to happen. The only reason that the NSA can listen in on your Facebook, Google, Skype (etc) activity is because:
1. These communication tools are operated by a company under American jurisdiction, that can therefore be strong-armed into cooperation
2. These communication tools store your data unencrypted
3. The world outside that company has no way of figuring out what is happening inside (i.e. no transparency)
I am therefore of the opinion that the only viable technical solution to Prism has to be
a. Completely decentralized
b. Fully (end-to-end) encrypted
c. Open source
If our communication tools were decentralized, encrypted and open source, then the NSA would have had a much harder job listening in. What needs to happen is that we need to build those systems, and basically divorce Facebook the company from Facebook the tool.
We need to change the playing field, and remove the capability to listen in on our communications. The internet is an amazing tool, but it's still in its infancy. It could very well be that, decades from now, we will look back at this period and wonder how it was even possible that the NSA was listening in on every single person in the world. We're not there yet, but it's not impossible.
Re: More Encryption Is Not the Solution
#8"if a nation-state decides that somebody should not have privacy, then it will use whatever means available to prevent that privacy."
One thing a lot of these discussions miss is that the entire point of doing privacy and anonymity correctly is that you are never on a list of people that any particular nation state wants to deny privacy to. That your True Name (to borrow the idea from Vinge’s story of the same name) is never the target, is never even interesting.
I personally don't advocate a world where everything I do is encrypted and anonymized, I think that that is as unachievable and sacrificing as living an entirely private life. Use gmail, skype, facebook, twitter, send non-encrypted messages about christmas to your friends and family, etc.
But what we do need is an online equivalent of a private life as well. And people need to be educated in the tools and techniques that can make this possible when necessary. Use tor, hidden services, pgp, i2p etc Use completely different online identities, ways of speaking and never login to a HN account associated with your real identity from that private space. Create and participate in hidden online communities, but don’t center those communities around your real life family and friends (ie facebook-esque hidden service would be a very bad idea).
The idea is not to challenge, fight or oppose nation states with surveillance capabilities, that's a losing proposition; the idea is to create a space away from them.
Re: More Encryption Is Not the Solution
#9I agree that if the privacy laws are strong, and anyone from any agency breaks those laws, he should be severely punished. In such a society and such an environment, you'd still be free to use services however you want.
Unfortunately, the current environment lets even the intelligence chief get away with blatantly lying to Congress about who's he spying on and why. I agree that a policy solution is definitely preferable in the long run, but for now we should protect ourselves however we can, until we get to turn the "surveillance state" into a "privacy state".
Re: More Encryption Is Not the Solution
#10This author reaches pretty far. The NSA paid Microsoft to acquire Skype? You can't just materialize multiple billions of dollars on a public company's income statement.