6 ms·

Author of the post here. (Thanks, Jeremy.) There are many details I avoided in the essay that people will get sidetracked on. Such as whether Apple is actually

Author of the post here. (Thanks, Jeremy.) There are many details I avoided in the essay that people will get sidetracked on. Such as whether Apple is actually doing it right or not. This is discussed and speculated on elsewhere. And right now I'm far more worried about a world in which they're legally prevented from trying. When the FBI starts talking about our kids getting kidnapped, I think bills start getting drafted. There are tangents I think HN would've cared about, but which would've been a distraction. For related controversy, Keybase - which I work on - lets users symmetrically encrypt their asymmetric keys, and store that data on our servers. We also let you do crypto in JS. Many hate this! Many love it! But I want to be legally allowed to write this kind of software and release it without a backdoor. It's hard enough when we all fight about implementation details and security vs. convenience. It'll be a real crap show when we know for certain that security has lost. I'll go program video games or something. Or just play them.

panarky 12y ago
The Powers that Be are conducting a coordinated disinformation campaign to keep and expand their backdoor access by scaring the bejesus out of the public. Apple will become the phone of choice for the pedophile. What happens when they blame strong cryptography for the next gut-wrenching tragedy involving innocent kids and a bombing / school shooting / kidnapping / pedophile? Your arguments will be swept away by a tsunami of grief, hatred and blind patriotism. Is it possible to make an equally emotional argument in favor of the freedom to be secure? Secure information deserves the same prestige and protection as the Four Freedoms. https://en.wikipedia.org/wiki/Four_Freedoms https://en.wikipedia.org/wiki/Four_Freedoms
- GHFigs 12y ago
  What happens when they blame strong cryptography for the next gut-wrenching tragedy involving innocent kids and a bombing / school shooting / kidnapping / pedophile? Pedophiles (or more specifically: child pornographers) routinely use strong cryptography and effectively nobody cares.
  - pdpi 12y ago
    The point the OP is making is that nobody cares because nobody has been told to care. All it takes is a well-timed news article on how some Bad Guy used Irresponsible Unbreakable Crypto to change that.
    - GHFigs 12y ago
      Do you believe that your beliefs are dictated by single "well-timed news articles" directed by "the powers that be"?
      - thawkins 12y ago
        They can be, thats what the whole concept of memes is all about. It happens.
      - pdpi 12y ago
        Dictated? No. Profoundly influenced? Yes, yes I do. I think that I'm more than capable of detecting most forms of propaganda, but I hold no illusions as to my ability to judge _everything_ that comes my way in a fully informed manner. I can look back and see cases where too little information, bad information, or even just a misunderstanding lead me to believe in things that just weren't true. And I'm pretty sure I'm not the only one.
      - Ar-Curunir 12y ago
        It's not about the technically educated minority (though even they are vulnerable to falsehoods perpetrated via propaganda), but the vast majority of people who aren't aware of how computer security works and believe that the government is always working only in their interests.
- PythonicAlpha 12y ago
  That is likely the tragedy of freedom: There are no emotional arguments for it. It seems to me, politicians and other people have long sought for the most emotional arguments to wipe away the wings of freedom -- and thus making the victims of pedophiles, bombing and kidnapping victims again! (BTW: In Germany, pedophiles where also used as argument for internet censorship. Organisations of those victims protested against these attempts, because they clearly saw, that this legislation did not help (and where never intended to) those victims or help to prevent anything.)
- VLM 12y ago
  "What happens when they blame strong cryptography for the next gut-wrenching tragedy" The topic changes but the story never does. We still have rock music, teenagers, acid, dungeons and dragons, hippies, video games, atheism, firearms, meth, Islam, gays, texting while driving, basically all the good things in life, and we'll always have thousands of things in the future that are not cool with the conformist old people and will be blamed for everything bad whenever possible, and aside from a lot of journalist click bait nobody will really care.
  - jordanpg 12y ago
    Also worth noting that in the case of cryptography, virtually no one "blaming strong cryptography" for anything actually understands much about complex cryptographic protocols aside from what they know from watching television. It's even more of a whitewashed canard than those other things you listed.
  - Jweb_Guru 12y ago
    Uh, is it just me, or does "texting while driving" not belong in that list? Do you really think people care about it because they're "conformist old people"?
  - CPLX 12y ago
    Man that brings back fond memories of being a teenager driving down the highway blasted on meth. Thankfully texting hadn't been invented yet.
- aqme28 12y ago
  I hate to make this kind of argument but it isn't hard: If a hacker gets access to this golden key, they can use data gleaned from your child's phone to stalk or hurt them.
  - opendais 12y ago
    Ah, but see, if you say it like that...its a "what if" scenario people might think "Well the Government won't let that happen." I think this argument is about as fair as the "pro-government" portions of the media are being and is literally true in the case of cloud backups: When a hacker gets access to the golden key, every pedophile will have all of your children's pictures to masturbate to. Oh, and stalk them with their location history. Do you want that? EDIT: I kinda felt dirty writing this.
  - zoips 12y ago
    The problem is that the general public is going to take "unbreakable encryption" at face value. So don't worry, unbreakable encryption prevents the hacker from getting access to the golden key, because without the golden key even the government can't break into things. The whole thing feeds on itself.
    - Arnor 12y ago
      So here's what we do guys: put the golden key in the black box!
  - glathull 12y ago
    I was about to say almost exactly this. A country in which encryption requires a golden key is the country all pedophiles will want to move to. Also, I agree that it's shitty, but sometimes you can only fight fear tactics with scarier fear tactics.
  - bigiain 12y ago
    Aren't there already documented cases of domestic abuse enabled by Find My iPhone? How much would you bet that whoever knew about and exploited the bug that leaked all those private celeb pictures didn't also have access to all the power of Find My iPhone as well?
- jessaustin 12y ago
  ...the next gut-wrenching tragedy involving innocent kids and a bombing / school shooting / kidnapping / pedophile? It's frustrating that TPTB don't actually care about these cases at all, apart from their political potential. Amber alerts are usually issued in response to non-custodial parent custody disagreements, which phenomenon is 95% driven by divorce lawyers, and involves very little risk that isn't created by the police themselves. In the rare actual stranger-danger case, "authorities" routinely allow multiple hours to pass between the kidnapping and issuing the alert. Of course by that time the child is beyond help. http://www.kansascity.com/news/government-politics/article342422/After-Springfield-girl%E2%80%99s-death-a-quicker-Amber-Alert-system-is-sought.html http://www.kansascity.com/news/government-politics/article34...
  - anigbrowl 12y ago
    Complete nonsense - you're equating imperfections that result in failure of a system with complete disinterest. For each anecdotal example of failure, as you cite here, it is equally easy to find anecdotal examples of success, eg: http://edition.cnn.com/2013/08/13/justice/amber-alert-hannah/ http://edition.cnn.com/2013/08/13/justice/amber-alert-hannah... I don't see any evidence here for your contention about the proportion of alerts issued in divorce proceedings, or a systemic pattern of indifference on the part of law enforcement. Also, the government spends quite a lot of effort on the investigation and prosecution of child pornography, as documented here, for example: http://www.justice.gov/usao/waw/press/categories/childporn.html http://www.justice.gov/usao/waw/press/categories/childporn.h... To what degree this should be a factor in encryption policy is open to debate, but your charge that 'TPTB don't actually care about these cases at all' is baseless and does a disservice to the people who investigate such crimes.
- pronoiac 12y ago
  Encryption doesn't kill people, people kill people.
- nosuchthing 12y ago
  99% of all terrorists and rapists use shoes. Do the math. Shoes = Evil.
  - tmzt 12y ago
    Don't be alarmed, we have an entire agency devoted to that now.
joshavant 12y ago
Some feedback for you: Thanks for conveying this in an easy-to-read style with simple examples. This makes it far easier to send to our non-technical friends, who struggle to understand what this is all about. Unfortunately, it always seems like these kinds of tricky technical issues are communicated by the mainstream media using oversimplified, easy-to-understand language (often, in support of government entities) and, on the other end of the spectrum, us nerds end up talking about it, by default, in unapproachable language and format.
enobrev 12y ago
Fantastic article, and a case well made. Thank you for writing it. I have one small criticism: "On June 20, 2011 Dropbox let anyone on the site login as any other user". This can easily be misconstrued as though it were a malicious free-for-all open-access day sponsored by Dropbox, which would be an unfair perspective upon what was obviously a very nasty security bug.
emotionalcode 12y ago
> I'll go program video games or something. Or just play them. [post-post-edit[[The funny thing is, I wrote this before reading the last portion of your post. No joke. I'm pretty sure the more our privacy is invaded, the more singular an entity a collective mind becomes. (half joke).]]] It still doesn't fix that I feel like we are one step away from the complete loss of thought privacy. I'm 28. I grew up essentially connected to a computer. Half of my personality exists always, in a computer. My entire social life is on the computer, for the entire history of my history. The image I see my existence as is literally half mechanical (I study a lot of math and computer science and code a lot) and half physically organic, and potentially half abstract mental 'thought idea stuff' (extra halves for pointing out that the world is a wibbly, world place). Should the government have been allowed in the past, to have meticulously documented my childhood, my adolescence, my adulthood? Should they have access to my baby photographs? To my first boyfriend? To our first conversations? How does that affect who I choose (or chose) to grow into? Is every step I take a step out of a fear of not conforming to both the present ideal of 'lawful person' but also to all worlds of the potential future ideal? When did I become aware of this, as a child? When did I decide I was cognizant enough to have made this decision? Was it when I turned 18, or was it when technology reached a certain age for the entire population? Do I have to think about every possible way that people can perceive my actions, in order to make sure I stay the way I see myself - which is fundamentally on the basis that I am a good person?
- transpy 12y ago
  Interesting questions. I think that if you try to answer those questions, you've got an interesting essay right there.
  - bigiain 12y ago
    And if you get carried away with that essay, it'd probably make an interesting dystopian near-future science fiction story...
- jamiepenney 12y ago
  > Do I have to think about every possible way that people can perceive my actions, in order to make sure I stay the way I see myself - which is fundamentally on the basis that I am a good person? This is the money quote for me. No matter how hard I try, I can't seem to get this through to people: No, I'm not a criminal now. I don't plan to become a criminal in the future. I control my own actions, but I don't control the how my actions are perceived by other people. Should I be arrested because some combination of my purchases today and words written when I was 17 point to me committing a terrorist act? More to the point, should I have to worry about what someone is going to think if a computer flags my metadata as "worth investigation" and they start trawling through the entirety of my online life? What effect does that have on general conversation on the internet? I think the thing I'm most afraid of is how do I explain this to my kids? In 10 years when they start forging their own life online, how do I sit down and explain that everything they do is monitored, and they need to be careful about everything they say and do on the internet? How do I explain that it didn't used to be like that, but we failed to stop it? It sounds melodramatic to type it out, but we've had an unprecedented amount of freedom to communicate with people around the world, and now that's being taken away.
p01926 12y ago
Thanks for your comprehensive response to a genuinely chilling editorial. The way WaPo used a synonym to dismiss the whole issue doesn't inspire confidence. Surely the closest analogies, though, for this mythical "golden key" are the many cracked DRM technologies. These weren't weakened by government fiat, but were still rendered worse-than-useless quickly.
MarkMc 12y ago
Your article didn't address this argument in favour of a 'secure golden key': If the user forgets their password, they can still recover their data. My guess is that the vast majority of the general public trust Google to keep their data secure more then they trust themselves to remember a password.

panarky 12y ago

The Powers that Be are conducting a coordinated disinformation campaign to keep and expand their backdoor access by scaring the bejesus out of the public. Apple will become the phone of choice for the pedophile. What happens when they blame strong cryptography for the next gut-wrenching tragedy involving innocent kids and a bombing / school shooting / kidnapping / pedophile? Your arguments will be swept away by a tsunami of grief, hatred and blind patriotism. Is it possible to make an equally emotional argument in favor of the freedom to be secure? Secure information deserves the same prestige and protection as the Four Freedoms. https://en.wikipedia.org/wiki/Four_Freedoms https://en.wikipedia.org/wiki/Four_Freedoms

GHFigs 12y ago
What happens when they blame strong cryptography for the next gut-wrenching tragedy involving innocent kids and a bombing / school shooting / kidnapping / pedophile? Pedophiles (or more specifically: child pornographers) routinely use strong cryptography and effectively nobody cares.
- pdpi 12y ago
  The point the OP is making is that nobody cares because nobody has been told to care. All it takes is a well-timed news article on how some Bad Guy used Irresponsible Unbreakable Crypto to change that.
  - GHFigs 12y ago
    Do you believe that your beliefs are dictated by single "well-timed news articles" directed by "the powers that be"?
    - thawkins 12y ago
      They can be, thats what the whole concept of memes is all about. It happens.
    - pdpi 12y ago
      Dictated? No. Profoundly influenced? Yes, yes I do. I think that I'm more than capable of detecting most forms of propaganda, but I hold no illusions as to my ability to judge _everything_ that comes my way in a fully informed manner. I can look back and see cases where too little information, bad information, or even just a misunderstanding lead me to believe in things that just weren't true. And I'm pretty sure I'm not the only one.
    - Ar-Curunir 12y ago
      It's not about the technically educated minority (though even they are vulnerable to falsehoods perpetrated via propaganda), but the vast majority of people who aren't aware of how computer security works and believe that the government is always working only in their interests.
PythonicAlpha 12y ago
That is likely the tragedy of freedom: There are no emotional arguments for it. It seems to me, politicians and other people have long sought for the most emotional arguments to wipe away the wings of freedom -- and thus making the victims of pedophiles, bombing and kidnapping victims again! (BTW: In Germany, pedophiles where also used as argument for internet censorship. Organisations of those victims protested against these attempts, because they clearly saw, that this legislation did not help (and where never intended to) those victims or help to prevent anything.)
VLM 12y ago
"What happens when they blame strong cryptography for the next gut-wrenching tragedy" The topic changes but the story never does. We still have rock music, teenagers, acid, dungeons and dragons, hippies, video games, atheism, firearms, meth, Islam, gays, texting while driving, basically all the good things in life, and we'll always have thousands of things in the future that are not cool with the conformist old people and will be blamed for everything bad whenever possible, and aside from a lot of journalist click bait nobody will really care.
- jordanpg 12y ago
  Also worth noting that in the case of cryptography, virtually no one "blaming strong cryptography" for anything actually understands much about complex cryptographic protocols aside from what they know from watching television. It's even more of a whitewashed canard than those other things you listed.
- Jweb_Guru 12y ago
  Uh, is it just me, or does "texting while driving" not belong in that list? Do you really think people care about it because they're "conformist old people"?
- CPLX 12y ago
  Man that brings back fond memories of being a teenager driving down the highway blasted on meth. Thankfully texting hadn't been invented yet.
aqme28 12y ago
I hate to make this kind of argument but it isn't hard: If a hacker gets access to this golden key, they can use data gleaned from your child's phone to stalk or hurt them.
- opendais 12y ago
  Ah, but see, if you say it like that...its a "what if" scenario people might think "Well the Government won't let that happen." I think this argument is about as fair as the "pro-government" portions of the media are being and is literally true in the case of cloud backups: When a hacker gets access to the golden key, every pedophile will have all of your children's pictures to masturbate to. Oh, and stalk them with their location history. Do you want that? EDIT: I kinda felt dirty writing this.
- zoips 12y ago
  The problem is that the general public is going to take "unbreakable encryption" at face value. So don't worry, unbreakable encryption prevents the hacker from getting access to the golden key, because without the golden key even the government can't break into things. The whole thing feeds on itself.
  - Arnor 12y ago
    So here's what we do guys: put the golden key in the black box!
- glathull 12y ago
  I was about to say almost exactly this. A country in which encryption requires a golden key is the country all pedophiles will want to move to. Also, I agree that it's shitty, but sometimes you can only fight fear tactics with scarier fear tactics.
- bigiain 12y ago
  Aren't there already documented cases of domestic abuse enabled by Find My iPhone? How much would you bet that whoever knew about and exploited the bug that leaked all those private celeb pictures didn't also have access to all the power of Find My iPhone as well?
jessaustin 12y ago
...the next gut-wrenching tragedy involving innocent kids and a bombing / school shooting / kidnapping / pedophile? It's frustrating that TPTB don't actually care about these cases at all, apart from their political potential. Amber alerts are usually issued in response to non-custodial parent custody disagreements, which phenomenon is 95% driven by divorce lawyers, and involves very little risk that isn't created by the police themselves. In the rare actual stranger-danger case, "authorities" routinely allow multiple hours to pass between the kidnapping and issuing the alert. Of course by that time the child is beyond help. http://www.kansascity.com/news/government-politics/article342422/After-Springfield-girl%E2%80%99s-death-a-quicker-Amber-Alert-system-is-sought.html http://www.kansascity.com/news/government-politics/article34...
- anigbrowl 12y ago
  Complete nonsense - you're equating imperfections that result in failure of a system with complete disinterest. For each anecdotal example of failure, as you cite here, it is equally easy to find anecdotal examples of success, eg: http://edition.cnn.com/2013/08/13/justice/amber-alert-hannah/ http://edition.cnn.com/2013/08/13/justice/amber-alert-hannah... I don't see any evidence here for your contention about the proportion of alerts issued in divorce proceedings, or a systemic pattern of indifference on the part of law enforcement. Also, the government spends quite a lot of effort on the investigation and prosecution of child pornography, as documented here, for example: http://www.justice.gov/usao/waw/press/categories/childporn.html http://www.justice.gov/usao/waw/press/categories/childporn.h... To what degree this should be a factor in encryption policy is open to debate, but your charge that 'TPTB don't actually care about these cases at all' is baseless and does a disservice to the people who investigate such crimes.
pronoiac 12y ago
Encryption doesn't kill people, people kill people.
nosuchthing 12y ago
99% of all terrorists and rapists use shoes. Do the math. Shoes = Evil.
- tmzt 12y ago
  Don't be alarmed, we have an entire agency devoted to that now.

joshavant 12y ago

Some feedback for you: Thanks for conveying this in an easy-to-read style with simple examples. This makes it far easier to send to our non-technical friends, who struggle to understand what this is all about. Unfortunately, it always seems like these kinds of tricky technical issues are communicated by the mainstream media using oversimplified, easy-to-understand language (often, in support of government entities) and, on the other end of the spectrum, us nerds end up talking about it, by default, in unapproachable language and format.

enobrev 12y ago

Fantastic article, and a case well made. Thank you for writing it. I have one small criticism: "On June 20, 2011 Dropbox let anyone on the site login as any other user". This can easily be misconstrued as though it were a malicious free-for-all open-access day sponsored by Dropbox, which would be an unfair perspective upon what was obviously a very nasty security bug.

emotionalcode 12y ago

> I'll go program video games or something. Or just play them. [post-post-edit[[The funny thing is, I wrote this before reading the last portion of your post. No joke. I'm pretty sure the more our privacy is invaded, the more singular an entity a collective mind becomes. (half joke).]]] It still doesn't fix that I feel like we are one step away from the complete loss of thought privacy. I'm 28. I grew up essentially connected to a computer. Half of my personality exists always, in a computer. My entire social life is on the computer, for the entire history of my history. The image I see my existence as is literally half mechanical (I study a lot of math and computer science and code a lot) and half physically organic, and potentially half abstract mental 'thought idea stuff' (extra halves for pointing out that the world is a wibbly, world place). Should the government have been allowed in the past, to have meticulously documented my childhood, my adolescence, my adulthood? Should they have access to my baby photographs? To my first boyfriend? To our first conversations? How does that affect who I choose (or chose) to grow into? Is every step I take a step out of a fear of not conforming to both the present ideal of 'lawful person' but also to all worlds of the potential future ideal? When did I become aware of this, as a child? When did I decide I was cognizant enough to have made this decision? Was it when I turned 18, or was it when technology reached a certain age for the entire population? Do I have to think about every possible way that people can perceive my actions, in order to make sure I stay the way I see myself - which is fundamentally on the basis that I am a good person?

transpy 12y ago
Interesting questions. I think that if you try to answer those questions, you've got an interesting essay right there.
- bigiain 12y ago
  And if you get carried away with that essay, it'd probably make an interesting dystopian near-future science fiction story...
jamiepenney 12y ago
> Do I have to think about every possible way that people can perceive my actions, in order to make sure I stay the way I see myself - which is fundamentally on the basis that I am a good person? This is the money quote for me. No matter how hard I try, I can't seem to get this through to people: No, I'm not a criminal now. I don't plan to become a criminal in the future. I control my own actions, but I don't control the how my actions are perceived by other people. Should I be arrested because some combination of my purchases today and words written when I was 17 point to me committing a terrorist act? More to the point, should I have to worry about what someone is going to think if a computer flags my metadata as "worth investigation" and they start trawling through the entirety of my online life? What effect does that have on general conversation on the internet? I think the thing I'm most afraid of is how do I explain this to my kids? In 10 years when they start forging their own life online, how do I sit down and explain that everything they do is monitored, and they need to be careful about everything they say and do on the internet? How do I explain that it didn't used to be like that, but we failed to stop it? It sounds melodramatic to type it out, but we've had an unprecedented amount of freedom to communicate with people around the world, and now that's being taken away.

p01926 12y ago

Thanks for your comprehensive response to a genuinely chilling editorial. The way WaPo used a synonym to dismiss the whole issue doesn't inspire confidence. Surely the closest analogies, though, for this mythical "golden key" are the many cracked DRM technologies. These weren't weakened by government fiat, but were still rendered worse-than-useless quickly.

MarkMc 12y ago

Your article didn't address this argument in favour of a 'secure golden key': If the user forgets their password, they can still recover their data. My guess is that the vast majority of the general public trust Google to keep their data secure more then they trust themselves to remember a password.