4 ms·
The really interesting thing about point 1 is that with encryption, there's really extremely little personal risk to being unlawful when it comes to encryption.
by ntucker 11y ago
The really interesting thing about point 1 is that with encryption, there's really extremely little personal risk to being unlawful when it comes to encryption. That's why this is a losing game of chess for them. Encryption is just math, and you don't need anybody's permission to do math. You can take a system that the government has mandated be broken and you can do good encryption inside that system by layering it. And good people who simply want to be safe will do this. And so will terrorists. Outlaw good encryption and a whole sub-industry of deniable encryption tools will emerge. And they will have achieved nothing except that our companies won't be allowed to officially support strong encryption, so they'll be disadvantaged in the marketplace. It's a really backwards move.
- leeoniya 11y agoIf your hardware contains unflashable firmware with a back door to direct memory access, then there is no encryption you can trust to perform on the device itself. For example, your baseband processor in your mobile phone which is a binary blob, protected/signed so not to violate FCC regulations and disrupt networks. Such firmware can be mandated from manufacturers without outlawing encryption directly but making it useless nevertheless.
- riscy 11y agoThe ability for any software to reliably recognize whether an encryption algorithm is being performed or not is not possible (not computable). It can always be hidden.
- leeoniya 11y agoyou don't need to detect encryption. with full memory access, you just take the plaintext.
- ntucker 11y agoMy point is that you don't have to do the encryption on the device. You can send/store encrypted data via compromised devices and channels.
- mirimir 11y agoYes. And you can obfuscate it. You can even encode it using packet timing, which is very hard to detect. It's also very inefficient, on the order of 1%, but that's enough for text over HD video. See True Names by Vernor Vinge.
- DanBC 11y agoYou can't trust the device - it's compromised. So even if you use encryption with that compromised device the plain text still leaks.
- mirimir 11y agoNot if the encrypted text was created on a trusted device. Consider that, as it is now, encrypted data on the Internet traverses numerous untrusted devices. For an extreme example, see https://github.com/maqp/tfc-otp https://github.com/maqp/tfc-otp
- DanBC 11y ago> Consider that, as it is now, encrypted data on the Internet traverses numerous untrusted devices And those untrusted devices leak considerable amounts of that data! You know that it doesn't matter how good the encryption is if one of the computers in the chain is full of malware. I genuinely don't understand the point you're making, especially in reference to this parent: https://news.ycombinator.com/item?id=11271745 https://news.ycombinator.com/item?id=11271745 For your OTP example: I know what the cipher text is. I slurped that. I don't know what the key is, or the plain text is, until you decrypt it, at which point I know both because I have access to your memory because your computer is compromised.
- 11y ago
- mirimir 11y agoWell, then you get proper hardware.
- deleted 11y ago[deleted]
- qb45 11y agoWhere are you sourcing those "proper" cell phone radios which don't contain secret binary blobs? I want one too.
- mirimir 11y agoYou nuke the radio, and use a standalone cell modem. The cell modem may be compromised, but it can't touch the device that's handling encryption.
- narrowrail 11y agoSpeaking of which, where is the flip phone with integrated 4G modem and wifi that can be used as a hotspot?
- plugnburn 11y agoWhy doesn't a cheapest Android smartphone with a 3G modem (say Alcatel 4009D) fit? Because it's not 4G? Well, here's the real tradeoff: security, comfort, cheapness. Pick two.
- narrowrail 11y agoMostly because I believe the device can be more cheaply made if it does not have to run a full-featured OS such as Android. No browser, no color screen, just like my old Nokia candy bar phone; no GPU at all would be required.
- AnthonyMouse 11y ago> Such firmware can be mandated from manufacturers without outlawing encryption directly but making it useless nevertheless. So the obvious first response to this is that it doesn't actually work. Have you seen the security of these vendors? Apple takes it more seriously than most because they're using it to maintain control over the App Store and yet people still root iPhones. Mandate it by law on vendors who don't even want to do it and it will be completely broken in two days. And completely broken against not only the user. Let's not forget the situation with wifi routers -- "only the manufacturer can issue updates" quickly turns into "security updates are not available from anyone anymore" with the consequent catastrophic nightmare following directly. But let's pretend we're uninformed pedestrians who don't know that for a minute. How is this idea not even more outrageous than banning encryption to begin with?
- peatmoss 11y ago> uninformed pedestrians Using "pedestrians" as a pejorative is something I've not seen in a while. What century is this?
- leeoniya 11y agoit is politically more palpable and "sounds" less outrageous to the public than outlawing encryption. which means it is more likely to make it into law and get support.