I think it has become abundantly clear that a fully peer to peer, encryption required (non-optional), no single central server infrastructure solution is the answer.
No points to tap.
No point in tapping the data.
If they want to capture conversations it's time to go back to the proper old ways of actually spying on high-value targets.
This discussion should never be framed as a choice between legal solutions and technical solutions. They are complementary.
The legal approach is correct and easy for the public to understand. Explained correctly it is also popular. The government used to have to do things like get a warrant and investigate specific crimes. They couldn't listen to everyone's phone conversations all the time and they shouldn't be able to do this on the Internet either. Digital dragnets are illegal and unconstitutional.
The technical approach is also correct. If you're building something that makes it harder for criminals inside the government to commit more crimes, you're doing work that is profound and in the best interests of society. Anyone with passion and technical skill can participate in this work. It's the right thing to do.
Both efforts help each other. Keep the government in line and accountable to the people. Make it harder for people inside the government to do the wrong thing. All approaches deserve support and should leverage each other's work. They should cooperate with law-abiding, constitutionally empowered government authorities as well. There are good guys in the government too.
Technical and legal solutions are not complementary, they're relatively unrelated. Legal rules addressing behavior are about what we "should" do. Technical rules are about what we "can" do. Technology is about implementation and enforcement, law is about what we consider to be the correct result.
But the main place where law and tech come together is enforcement. For law to work at all, it has to be enforced relatively evenly. Technology may make a law's enforcement impossible or easy, but it does not make it more or less "right" in the abstract.
And legal is about what recourse we can seek afterwards, when we understand we've messed up the implementation and security had failed.
Relying on legal protections alone is absurd. Relying on technology without any legal recourse for failures maybe somewhat less so, but still not suitable for this "real" world we live in. Not without reconsidering our approaches and attitudes to way too many things.
> And legal is about what recourse we can seek afterwards, when we understand we've messed up the implementation and security had failed.
Not at all. Legal rules are about what we "should" do, what's right and what's wrong. However, legal rules need to be enforced to be effective. If you create a legal rule that's impossible to enforce and everyone flouts it, not only does your rule not get enforced, but it also creates doubt in the entire legal system.
So legal rules ought to consult with what's possible and impossible, but they should not be dictated by them.
This is a case of the government trying to force Facebook to essentially strip out their technology; saying technology is the solution here is kinda ignorant of the actual issue
I think that’s close, but until a technical solution to this comes around, we’ve got to look elsewhere.
An easy target is saying the government is too powerful. That would be a mistake. If Facebook were more powerful than the government, we would no be in any better hands.
The problems with the US government are that it does not work for the people.
It would be painfully short-sighted to say this debacle goes to show the gov and private companies are not too involved with one another. This will be handled with some deal that will deepen the coupling and citizens will not have a say. That’s how most things in our lives get handles. Without regard for us, that is.
Private interests have eroded our state of civility. Citizens voices mean nothing and that is all that’s going on here.
We need our government back. Nothing else is going to solve this, unless of course we can actually address the technical issue that you raised. That would be nice.
A government that was our government would simply not step over this line. It’s possible; not easy, but possible.
I am not sure what you are onto. People are still voting for about every election so the realization that the government is not what they wanted is not anywhere in the public psyche.
Id say it would be better to decentralize governments so that you dont have any great accumulation of power anywhere, and by bringing government closer to communities you automatically bring back power to the people.
Decentralizing government would not have the effect of stopping power consolidation. It just means power gets accumulated by the megacorporations, which is an even worse outcome.
A country that's going to mandate backdoors/access to such communications, are going to outlaw communication methods they can't backdoor.
Say Apple makes a federated end-to-end encrypted messenger app, the government will still go to Apple and say "let us read all the messages, otherwise you can't sell your devices". THAT is the problem, and it can't be solved by more technology and shouting "BLOCKCHAIN!"
If a largish group of users could create end-to-end encryption not with a single company but with "readily available materials", then stopping it could be harder.
So it's a combination of state dictate and the practical ability of users to defy that. This isn't saying I'm optimistic, I'm rather pessimistic on any ability of a wide home-grown encrypted-messaging milieu to appear - if few are aiming for this, those few can easily be picked-off. But I don't think we should just give up on any part of this.
Possession of encryption software could be treated the same as possession of drugs. On the next stop and search you would only had to handover your phone. If police password will not work it will be confiscated. If encryption software is found you go in the dock. It is the future. Society accepted ridiculous laws to jail people for having a plant, they'll accept jailing for programs. Only terrorists, thieves and adulterers encrypt their messages ;-)
The War on Drugs is considered a failure and in parts of the world like NSW, Australia made prostituion legal in 1979 in both cases because criminalising things most people use generally doesn't work and all you do is randomly jail people for doing the exact same thing as a large proportion of the population.
I fail to see the point, without encryption, there's no modern web, no e-commerce, no smartphones, absolutely everything relies on it like water. Unless you want to go back to pre-2000's technology of course.
Of course e-commerce will be fine, because browser vendors will obtain licenses to ship TLS modules and as a condition of such will include the .gov root cert.
It's trivial when you can pass arbitrary legislation.
Back in the 90s we had to deal with US gov restrictions on encryption export. Software companies and organisations fell into line. It was a big deal when 128-bit keyed Netscape became available globally in 1997, per State Dept approval, but even then the full-strength server-side SSL was still restricted to 'approved' entities.
And even 56-bit server SSL was only exportable with us.gov key escrow.
I used to use Apache with the 40-bit SSL option. Pathetic strength but no-one was going to risk jail-time by breaking laws.
The difference being that there's way too much necessary legitimate use of cryptography to stop now, and as the traffic is encrypted, you can't tell what traffic isn't legitimate. Plus steganography and plenty of places accessible on the net that aren't the United States.
This isn't meatspace, the dynamics are quite different.
There is nothing you cannot legislate for. For example use of encryption could be licensed, just as drugs are. If you don't have prescription, you go down.
Possession of encryption software could be treated the same as possession of drugs.
Well, then clearly it would quickly become ubiquitous. I mean, if a war on encryption that was just like the war on drugs were to be launched, why my local stream bed might "place burned passwords here" on the tin-can that currently reads "used needles here." (put there by the other homeless people).
There's a difference between running a Tor exit node and encrypting a personal conversation.
At least in the US, if a US citizen is part of a potentially incriminating conversation, the government's going to have a hard time forcing a court to force the citizen to decrypt the conversation.
Lawyers, correct me if I'm wrong, but it seems like a conversation wouldn't be subject to the vagaries of "combination to a safe"-production loopholes.
Its not laws since the US government and probably others have already shown with the NSA and the like that they have no respect whatsoever for the existing laws and nobody actually seemed to care one bit about that.
The issue is the government wanting to strip the encryption going forward. In other words, even the most decentralized & encrypted app can still have NSA_RemoteConn.Log(dat) written into it's source code
Stripping encryption is one thing, sure. But for the backdoor, you'd have to have the clients phone nsaserv.spy/writeremoteconnlog then or sure, write some record on the client's device. You can't "tap" encrypted communications unless you can figure out how to factor integers then you'd get a Field's medal.
Or, ofc, get people to adopt insecure protocols. That we know (or have good suspicion) they've tried.
This actually feels more like what I would expect police work to be like given the situation.
They most certainly do not have cause to demand access to swaths of comms no matter whose comms they're after and most assuredly when that access actually entails enabling access to all of the comms.
I posit there is no authority that should be able to demand this as a matter of the right to human existence. Law, order, society and government should not have ultimate authority on private communications no matter what the tech is capable of. We, as humans in a modern world, can speak and if desired do so in private. This is our right as individuals and if encryption helps us accomplish and enforce that right then so be it.
If they have probable cause then they need to beat feet or beat heads but either way they need to get to work. And by work I do not mean trying to impose a different reality than the one that we currently have - where math is fact, compute is cheap and source is open.
What's it going to be? 100 go free or six lines from everyone?
set up the device to wipe itself after $x number of incorrect attempts. keep giving the wrong password after every whack from the wrench. then you have plausible deniability. "how can i possibly think straight when you keep hitting me with that wrench?" just need to make $x a value small enough that you can survive the wrench.
No good, it is already standard for forensic teams to clone and checksum a hardrive before attempting to look through files. The clone is sent to evidence and any password attempts will be made on a copy. The "original" copy will be kept safe and any number of passwords can be used against nth iteration of copying the clone.
Isn't this the purpose of the secure enclave on iPhones? Taking the drive away from the secure enclave makes the drive useless and the enclave only allows a few password attempts.
This is exactly this. It also allows a weak password (4 digits PIN) to de ok. The enclave which holds the actual encryption keyd will refuse to hand them over if the right trigger is hit (too many attempts, too high a rate,...)
In practice, chances are those 5 are all rigged. They are rigged because you have so far trusted:
- That there are no tricks in the algorithm or its practical implementation
- That there are no tricks in the key generation algorithm or its practical implementation
- Hundreds of contributors to the software implementation of those algorithms
- The guy that compiled the software into binary form and distributed it
- The compiler used to compile the software and all the libraries and dependencies the software has
- Hardware manufacturers
So, common sense tells me that because you have trusted so many people, in practice, it is very unlikely you can have end-to-end encryption or any real ambition to have privacy.
This does not even consider more aspects, like your operating system, your sources of entropy, etc.
P2P routing is hard (nat bypass only really works on 80-90% of networks which is not good enough and Tor is unviable for mass adoption), and decentralized identifiers are generally not liked by users
Other than that, it's doable.
Spam protection and censorship (necessary for mobile app stores) can be distributed as opt-out blacklists. If it gets to be a huge problem then a "enter this password to add me" type thing could work too.
I've been compiling a bunch of ideas as such for fully P2P decentralized/encrypted chat, but I'm stuck at the two issues I mentioned earlier.
Intermediary is not the best word here. What if you could use a storage infrastructure to implemented a protocol for storing and retrieving packets across NAT and disconnected devices. If the role of storage is similar to the raw networks transport via ISP, then it is not more centralized than using an ISP.
Keep in mind they do have the infrastructure in place(carriers and oems) to directly tap on cellphones. While a federated encrypted chat services are a step in the right direction, we won't get truly 'free' communication device until an open source hardware to software solution exists.
Plus a client which is under complete control of the user - a phone could never be and a laptop running Linux with Intel me stripped-out might be if you're lucky.
I believe it's substantially more difficult, legally. CALEA for data-in-transit and judicial interpetations for data-at-rest mean it isn't as strictly protected as personally-controlled data.
So it's definitely covered by a different legal regime, to set aside the technical bits.
Slack literally stands for Searchable Log of All Content and Knowledge. It’s incredibly useful and transformative for what it is. It’s about the furthest thing possible from private.
At what point does the technical community stop trying to technically interfere with the efforts of law enforcement, and start trying to change the laws that make law enforcement behave this way?
> At what point does the technical community stop trying to technically interfere with the efforts of law enforcement, and start trying to change the laws that make law enforcement behave this way?
Law enforcement and government are addicted to power to an unhealthy degree. Convincing people to voluntarily give up power is rarely successful.
You seem to believe majority support is enough to make something happen. It is not.
The Public Option has 75% popular support. Medicare-For-All has 59% popular support.
After President Franklin Pierce's child died gruesomely in a train wreck, it was believed, even by his own wife and family, that it was God's punishment for him seeking authority and power.
I didn't live in the past, but my reading of it leads me to believe that, at least through US history, it seemed that the public consciousness in the past has had very real skepticism of authority.
Perhaps that is the opposite today in many parts of the developed world. For example, a German guy recently looked me dead in the eye, smiled, and said sincerely: "But why would anybody not trust their government?"
Pierce was part of the first generation of U.S citizens and would have grown up with stories of British ruled colonies, which could have helped foster the skepticism of authority you mention.
The Public Option has 75% popular support. Medicare-For-All has 59% popular support. [HR] Yet we have neither. Brexit was decided on an embarrassingly close vote: 51.9%
So we have two seemingly popular things that haven't happened and one that has happened but was not so popular (but it turns out that it was more popular than was suspected by anyone beforehand). I'm afraid that is politics. If it helps, I am not a fan of Brexit but will have to live with it anyway.
There is no conspiracy and I don't think that it is fair to accuse your police and government of being arseholes (to put words in your mouth!) Sometimes we simply have to accept that our personal will does not always dovetail with that of the majority - that is how democracy works. To be fair though, there is also nothing wrong with getting a good rant in on HN.
If you feel really strongly about healthcare, why not emigrate to the UK? Our NHS is bloody amazing and only costs: https://www.gov.uk/national-insurance/how-much-you-pay - roughly 12% of your salary. There is a lower band and an upper band so it is not 12% of everything you earn and it also covers unemployment payments and other things.
> Sometimes we simply have to accept that our personal will does not always dovetail with that of the majority - that is how democracy works.
That's true. But said acceptance doesn't need to translate to acceptance of the laws that the misguided majority enacts - you can sabotage those instead, Underground Railroad style.
> There is no conspiracy and I don't think that it is fair to accuse your police and government of being arseholes (to put words in your mouth!) Sometimes we simply have to accept that our personal will does not always dovetail with that of the majority - that is how democracy works. To be fair though, there is also nothing wrong with getting a good rant in on HN.
You've clearly never dealt with either in the US for a protracted period of time.
Yes, they very much are. Their response to them breaking the law and/or making a mistake is "Fuck off, sue us."
> If you feel really strongly about healthcare, why not emigrate to the UK? Our NHS is bloody amazing and only costs: https://www.gov.uk/national-insurance/how-much-you-pay - roughly 12% of your salary. There is a lower band and an upper band so it is not 12% of everything you earn and it also covers unemployment payments and other things.
A) You are moving the goal posts from the original discussion.
B) I was born here. I'm not leaving just because I don't win every battle.
> Brexit was decided on an embarrassingly close vote: 51.9%
> The four most recent readings - taken by BMG Research and Survation between November and January - have, on average, once the 8% who said "don't know" are left to one side, put Remain on 52% and Leave on 48%.
Now that it isn't being influenced by an outside party, it is no longer narrowly winning.
To be honest, I don't think people should cry they have a mandate from the people with less than a 55% majority.
Now that it isn't being influenced by an outside party, it is no longer narrowly winning.
My original point about Brexit being very close still stands and I would suggest that your Remain on 52% and Leave on 48% are still very close given the sheer pain of the separation that has become apparent since the original vote (you try listening to the news here - its bloody boring.) If you had waved say 60% Remain, I might take notice.
> At what point does the technical community stop trying to technically interfere with the efforts of law enforcement, and start trying to change the laws that make law enforcement behave this way?
This sounds like a highly irresponsible tactic if your actual goal is to help people.
There is no reason to believe that the state will afford the kind of changes you're describing, and even if it does, no reason to believe that it will obey the new laws in question.
While you are busy keeping yourself safe by staying within the lines of a tyrannical coloring book, real people are suffering the consequences of surveillance.
Even if this were possible: why constrain the internet, whose constituency is international and impetus is mathematical, to the confines of some ridiculous tantrum-throwing government and its childish ideas of control? What's the benefit?
Probably at the point where elected officials start to care. They won't care until their voters care, and most voters don't seem to care about or understand the issue here since it does not affect most of them in any meaningful/measurable way.
I think they care. A majority of the country did not want NN to be repealed but it was. The problem is their vote means little and understandably, many tune out and don't vote or choose between lesser of two evils.
A majority of the country has no idea what new neutrality is nor do they care. The only way you get to polls indicating a preference either way is by describing the regulations to the recipient first.
I dunno, despite the supposed popularity of repealing the Affordable Care Act, the GOP, having control of all parts of the legislative process, couldn't get it done.
Changing the law means nothing if it gets changed back the following decade.
Technical solutions tend to be more permanent.
Your solution is equivalent to saying "why are we focused so much on pretecting ourselves from hackers? We should instead change society such that nobody even WANTS to be a hacker!"
There's no guarantee that the client you install on your device is built from the same source code that is publicly available, unless you build the client yourself from that source code. I suspect no one is doing that at this point (since Noise died with CopperheadOS).
Right, for the masses, but for focused enterprise, like a well resourced gang, for instance, refortifying your security is just another build away. Add on some sneakernet transport and side-load instructions and the only people affected by a weakened platform is everyone else.
Forward Security is about creating a single session key and then ensuring that it isn't trusted after the session.
This is a good best practice and SHOULD be used everywhere.
It does not prevent any attacker, government or otherwise, from making client implementations do things like:
* add in third party key distribution (backdoor the conversation)
* send a 'backup' of keys or other details to a central server
* directly man in the middle by only establishing a "secure" connection to a middle server
* compromise the situation in other ways; E.G. using a flawed "random" source
BTW, if you can't build the client your self from source, how do you KNOW the above isn't being done?
It's strange for the same issues with China there is 'outrage', and then for the exact same things here we see hand waving and 'technical' solutions.
What technical solution is going to protect the human being from the indignity of security personnel presuming the right to going through your personal papers and thoughts? And this is already in effect in US airports with no pushback.
It is this denial by many about what is happening at home and the absence of mainstream protests and push back that has allowed the the rise of surveillance capitalism, the NSA, secret courts, secret orders, secret processes and brazen surveillance demands by governments.
The worse it becomes the more the need to posture and distract by seeking to hold others accountable for the very things you are neck deep in.
Easily tapped central server(s) is my nutshell theory of why rightwing extremists aren't being kicked off of Twitter. Third-party doctrine, and all that.
I honestly can't tell what groups are being banned, nor what the rules are. Isis isn't banned but random right winger is. Jimmy Dore and Kyle Kulinski have pointed out seemingly random left wingers getting banned, Sarah Jeong gets a blue check. It all seems so random and incoherent. I am genuinely lost.
I don't think anyone should be censored/sanctioned. ISIS, Alex Jones, Antifa, let them all speak as far as I'm concerned. But to the extent that there are currently censorship rules in place, I genuinely do not understand them. Enforcement seems genuinely random and arbitrary.
Sarah Jeong mocks white racists, no ban, fine.
Candace Owens copy/pastes Sarah Jeong's tweets, gets banned, not fine.
A world in which Alex Jones gets banned but ISIS does not is total insanity.
To reiterate, I don't want any of the above to be banned/censored. However, in an world in which the above facts exist, I am suggesting I do not understand what the rules are at all. It seems random and arbitrary.
Some people are working on this problem. You might be interested in looking at the Matrix standard [0] or some of the things built using it like Riot [1], a Slack-like web client supporting text, voice and video communication for one-on-one or group contexts.
I think it has become abundantly clear that a fully peer to peer, encryption required (non-optional), no single central server infrastructure solution is the answer.
No points to tap.
No point in tapping the data.
If they want to capture conversations it's time to go back to the proper old ways of actually spying on high-value targets.
This discussion should never be framed as a choice between legal solutions and technical solutions. They are complementary.
The legal approach is correct and easy for the public to understand. Explained correctly it is also popular. The government used to have to do things like get a warrant and investigate specific crimes. They couldn't listen to everyone's phone conversations all the time and they shouldn't be able to do this on the Internet either. Digital dragnets are illegal and unconstitutional.
The technical approach is also correct. If you're building something that makes it harder for criminals inside the government to commit more crimes, you're doing work that is profound and in the best interests of society. Anyone with passion and technical skill can participate in this work. It's the right thing to do.
Both efforts help each other. Keep the government in line and accountable to the people. Make it harder for people inside the government to do the wrong thing. All approaches deserve support and should leverage each other's work. They should cooperate with law-abiding, constitutionally empowered government authorities as well. There are good guys in the government too.
Technical and legal solutions are not complementary, they're relatively unrelated. Legal rules addressing behavior are about what we "should" do. Technical rules are about what we "can" do. Technology is about implementation and enforcement, law is about what we consider to be the correct result.
But the main place where law and tech come together is enforcement. For law to work at all, it has to be enforced relatively evenly. Technology may make a law's enforcement impossible or easy, but it does not make it more or less "right" in the abstract.
> Technical rules are about what we "can" do.
And legal is about what recourse we can seek afterwards, when we understand we've messed up the implementation and security had failed.
Relying on legal protections alone is absurd. Relying on technology without any legal recourse for failures maybe somewhat less so, but still not suitable for this "real" world we live in. Not without reconsidering our approaches and attitudes to way too many things.
> And legal is about what recourse we can seek afterwards, when we understand we've messed up the implementation and security had failed.
Not at all. Legal rules are about what we "should" do, what's right and what's wrong. However, legal rules need to be enforced to be effective. If you create a legal rule that's impossible to enforce and everyone flouts it, not only does your rule not get enforced, but it also creates doubt in the entire legal system.
So legal rules ought to consult with what's possible and impossible, but they should not be dictated by them.
This is a case of the government trying to force Facebook to essentially strip out their technology; saying technology is the solution here is kinda ignorant of the actual issue
technology owned by a single company you can coerce is the issue.
I think that’s close, but until a technical solution to this comes around, we’ve got to look elsewhere.
An easy target is saying the government is too powerful. That would be a mistake. If Facebook were more powerful than the government, we would no be in any better hands.
The problems with the US government are that it does not work for the people.
It would be painfully short-sighted to say this debacle goes to show the gov and private companies are not too involved with one another. This will be handled with some deal that will deepen the coupling and citizens will not have a say. That’s how most things in our lives get handles. Without regard for us, that is.
Private interests have eroded our state of civility. Citizens voices mean nothing and that is all that’s going on here.
We need our government back. Nothing else is going to solve this, unless of course we can actually address the technical issue that you raised. That would be nice.
A government that was our government would simply not step over this line. It’s possible; not easy, but possible.
I am not sure what you are onto. People are still voting for about every election so the realization that the government is not what they wanted is not anywhere in the public psyche.
Id say it would be better to decentralize governments so that you dont have any great accumulation of power anywhere, and by bringing government closer to communities you automatically bring back power to the people.
Decentralizing government would not have the effect of stopping power consolidation. It just means power gets accumulated by the megacorporations, which is an even worse outcome.
Is it? You kind of lost me. Isn't the actual issue math?
The issue is laws.
A country that's going to mandate backdoors/access to such communications, are going to outlaw communication methods they can't backdoor.
Say Apple makes a federated end-to-end encrypted messenger app, the government will still go to Apple and say "let us read all the messages, otherwise you can't sell your devices". THAT is the problem, and it can't be solved by more technology and shouting "BLOCKCHAIN!"
Laws are an issue and enforceability is an issue.
If a largish group of users could create end-to-end encryption not with a single company but with "readily available materials", then stopping it could be harder.
So it's a combination of state dictate and the practical ability of users to defy that. This isn't saying I'm optimistic, I'm rather pessimistic on any ability of a wide home-grown encrypted-messaging milieu to appear - if few are aiming for this, those few can easily be picked-off. But I don't think we should just give up on any part of this.
Possession of encryption software could be treated the same as possession of drugs. On the next stop and search you would only had to handover your phone. If police password will not work it will be confiscated. If encryption software is found you go in the dock. It is the future. Society accepted ridiculous laws to jail people for having a plant, they'll accept jailing for programs. Only terrorists, thieves and adulterers encrypt their messages ;-)
> Possession of encryption software could be treated the same as possession of drugs
It's too late for that, every machine, every browser, every user is using encryption software all the time.
"It's too late to criminalize prostitution, every is already having sex"
"It's too late to criminalize possession of drugs. Half the country takes pharmaceuticals!"
The War on Drugs is considered a failure and in parts of the world like NSW, Australia made prostituion legal in 1979 in both cases because criminalising things most people use generally doesn't work and all you do is randomly jail people for doing the exact same thing as a large proportion of the population.
Sure, it's a failure. But you can still be jailed over it.
I fail to see the point, without encryption, there's no modern web, no e-commerce, no smartphones, absolutely everything relies on it like water. Unless you want to go back to pre-2000's technology of course.
Of course e-commerce will be fine, because browser vendors will obtain licenses to ship TLS modules and as a condition of such will include the .gov root cert.
It's trivial when you can pass arbitrary legislation.
Back in the 90s we had to deal with US gov restrictions on encryption export. Software companies and organisations fell into line. It was a big deal when 128-bit keyed Netscape became available globally in 1997, per State Dept approval, but even then the full-strength server-side SSL was still restricted to 'approved' entities.
And even 56-bit server SSL was only exportable with us.gov key escrow.
I used to use Apache with the 40-bit SSL option. Pathetic strength but no-one was going to risk jail-time by breaking laws.
< no one was going to risk jail time
I did at that time, it was just another law to ignore.
The difference being that there's way too much necessary legitimate use of cryptography to stop now, and as the traffic is encrypted, you can't tell what traffic isn't legitimate. Plus steganography and plenty of places accessible on the net that aren't the United States.
This isn't meatspace, the dynamics are quite different.
There is nothing you cannot legislate for. For example use of encryption could be licensed, just as drugs are. If you don't have prescription, you go down.
Possession of encryption software could be treated the same as possession of drugs.
Well, then clearly it would quickly become ubiquitous. I mean, if a war on encryption that was just like the war on drugs were to be launched, why my local stream bed might "place burned passwords here" on the tin-can that currently reads "used needles here." (put there by the other homeless people).
And who would use that system, if it were so closely associated with status as a federal criminal?
You're forgetting that the average user doesn't care enough to sacrifice ease of use for greater political benefit.
There's a difference between running a Tor exit node and encrypting a personal conversation.
At least in the US, if a US citizen is part of a potentially incriminating conversation, the government's going to have a hard time forcing a court to force the citizen to decrypt the conversation.
Lawyers, correct me if I'm wrong, but it seems like a conversation wouldn't be subject to the vagaries of "combination to a safe"-production loopholes.
Its not laws since the US government and probably others have already shown with the NSA and the like that they have no respect whatsoever for the existing laws and nobody actually seemed to care one bit about that.
The issue is the government wanting to strip the encryption going forward. In other words, even the most decentralized & encrypted app can still have NSA_RemoteConn.Log(dat) written into it's source code
Stripping encryption is one thing, sure. But for the backdoor, you'd have to have the clients phone nsaserv.spy/writeremoteconnlog then or sure, write some record on the client's device. You can't "tap" encrypted communications unless you can figure out how to factor integers then you'd get a Field's medal.
Or, ofc, get people to adopt insecure protocols. That we know (or have good suspicion) they've tried.
It's this: https://xkcd.com/538/
This actually feels more like what I would expect police work to be like given the situation.
They most certainly do not have cause to demand access to swaths of comms no matter whose comms they're after and most assuredly when that access actually entails enabling access to all of the comms.
I posit there is no authority that should be able to demand this as a matter of the right to human existence. Law, order, society and government should not have ultimate authority on private communications no matter what the tech is capable of. We, as humans in a modern world, can speak and if desired do so in private. This is our right as individuals and if encryption helps us accomplish and enforce that right then so be it.
If they have probable cause then they need to beat feet or beat heads but either way they need to get to work. And by work I do not mean trying to impose a different reality than the one that we currently have - where math is fact, compute is cheap and source is open.
What's it going to be? 100 go free or six lines from everyone?
set up the device to wipe itself after $x number of incorrect attempts. keep giving the wrong password after every whack from the wrench. then you have plausible deniability. "how can i possibly think straight when you keep hitting me with that wrench?" just need to make $x a value small enough that you can survive the wrench.
No good, it is already standard for forensic teams to clone and checksum a hardrive before attempting to look through files. The clone is sent to evidence and any password attempts will be made on a copy. The "original" copy will be kept safe and any number of passwords can be used against nth iteration of copying the clone.
Isn't this the purpose of the secure enclave on iPhones? Taking the drive away from the secure enclave makes the drive useless and the enclave only allows a few password attempts.
This is exactly this. It also allows a weak password (4 digits PIN) to de ok. The enclave which holds the actual encryption keyd will refuse to hand them over if the right trigger is hit (too many attempts, too high a rate,...)
It is not the answer.
What are the building blocks for encryption?
1) An cryptographic algorithm
2) Some form of key generation
3) A software implementation of 1) and 2)
4) A binary distribution of 3)
5) A computer that executes 4)
In practice, chances are those 5 are all rigged. They are rigged because you have so far trusted:
- That there are no tricks in the algorithm or its practical implementation
- That there are no tricks in the key generation algorithm or its practical implementation
- Hundreds of contributors to the software implementation of those algorithms
- The guy that compiled the software into binary form and distributed it
- The compiler used to compile the software and all the libraries and dependencies the software has
- Hardware manufacturers
So, common sense tells me that because you have trusted so many people, in practice, it is very unlikely you can have end-to-end encryption or any real ambition to have privacy.
This does not even consider more aspects, like your operating system, your sources of entropy, etc.
1-5 have worked so far for Bitcoin.
What’s stopping those with the capability of subverting bitcoin from choosing not to do so?
It's a card that they only get to use once per capability, unless it's in a discrete manner.
P2P routing is hard (nat bypass only really works on 80-90% of networks which is not good enough and Tor is unviable for mass adoption), and decentralized identifiers are generally not liked by users
Other than that, it's doable.
Spam protection and censorship (necessary for mobile app stores) can be distributed as opt-out blacklists. If it gets to be a huge problem then a "enter this password to add me" type thing could work too.
I've been compiling a bunch of ideas as such for fully P2P decentralized/encrypted chat, but I'm stuck at the two issues I mentioned earlier.
Can routing be solved through an intermediary acting like an always-on mailbox? Along the lines of http://cweb-services.com/protocols.html
Using an intermediary would make it not decentralized unfortunately :(
Intermediary is not the best word here. What if you could use a storage infrastructure to implemented a protocol for storing and retrieving packets across NAT and disconnected devices. If the role of storage is similar to the raw networks transport via ISP, then it is not more centralized than using an ISP.
Keep in mind they do have the infrastructure in place(carriers and oems) to directly tap on cellphones. While a federated encrypted chat services are a step in the right direction, we won't get truly 'free' communication device until an open source hardware to software solution exists.
Plus a client which is under complete control of the user - a phone could never be and a laptop running Linux with Intel me stripped-out might be if you're lucky.
Even if you got to that level of encryption, the devices themselves forming the Ps in P2P will become the tap points.
Nobody has a 100% open smartphone stack from the baseband up to the application.
Moving away from a centralized infrastructure and having fully P2P doesn't necessarily mean there's no points to tap, does it?
It's just mildly more difficult than a subpoena to Facebook asking for all messages.
I believe it's substantially more difficult, legally. CALEA for data-in-transit and judicial interpetations for data-at-rest mean it isn't as strictly protected as personally-controlled data.
So it's definitely covered by a different legal regime, to set aside the technical bits.
Or at least something like iMessage, end-to-end encrypted.
The article is about the question if the government can force companies to backdoor their end-to-end encrypted apps, so that's not a solution.
Isn’t this what Slack is?
Slack literally stands for Searchable Log of All Content and Knowledge. It’s incredibly useful and transformative for what it is. It’s about the furthest thing possible from private.
OK, this is all news to me. I have to go delete a bunch of stuff.
It's my recollection that Slack is emphatically not p2p, has that changed?
Slack is multi-tenant hosted SaaS. Single point of failure.
You're thinking of Signal.
Reevaluate the value of the target.
I don't know what government is doing snooping on facebook messenger. I would be blindsided if real crime was happening that way.
Real crime happens on SMS all the time. Why wouldn’t it happen on Facebook messenger which is one of the most popular SMS replacement apps?
BBM was very popular for illicit purposes when it was in its heyday at RIM.
People moved onto other messengers like WhatsApp for those purposes.
Heck people use snapchat expiring messages to relay info on illicit activities.
It is not farfetched at all people are using FB messenger, signal, anything for that purpose.
At what point does the technical community stop trying to technically interfere with the efforts of law enforcement, and start trying to change the laws that make law enforcement behave this way?
> At what point does the technical community stop trying to technically interfere with the efforts of law enforcement, and start trying to change the laws that make law enforcement behave this way?
Law enforcement and government are addicted to power to an unhealthy degree. Convincing people to voluntarily give up power is rarely successful.
You seem to believe majority support is enough to make something happen. It is not.
The Public Option has 75% popular support. Medicare-For-All has 59% popular support.
Yet we have neither.
After President Franklin Pierce's child died gruesomely in a train wreck, it was believed, even by his own wife and family, that it was God's punishment for him seeking authority and power.
I didn't live in the past, but my reading of it leads me to believe that, at least through US history, it seemed that the public consciousness in the past has had very real skepticism of authority.
Perhaps that is the opposite today in many parts of the developed world. For example, a German guy recently looked me dead in the eye, smiled, and said sincerely: "But why would anybody not trust their government?"
Pierce was part of the first generation of U.S citizens and would have grown up with stories of British ruled colonies, which could have helped foster the skepticism of authority you mention.
The Public Option has 75% popular support. Medicare-For-All has 59% popular support. [HR] Yet we have neither. Brexit was decided on an embarrassingly close vote: 51.9%
So we have two seemingly popular things that haven't happened and one that has happened but was not so popular (but it turns out that it was more popular than was suspected by anyone beforehand). I'm afraid that is politics. If it helps, I am not a fan of Brexit but will have to live with it anyway.
There is no conspiracy and I don't think that it is fair to accuse your police and government of being arseholes (to put words in your mouth!) Sometimes we simply have to accept that our personal will does not always dovetail with that of the majority - that is how democracy works. To be fair though, there is also nothing wrong with getting a good rant in on HN.
If you feel really strongly about healthcare, why not emigrate to the UK? Our NHS is bloody amazing and only costs: https://www.gov.uk/national-insurance/how-much-you-pay - roughly 12% of your salary. There is a lower band and an upper band so it is not 12% of everything you earn and it also covers unemployment payments and other things.
> Sometimes we simply have to accept that our personal will does not always dovetail with that of the majority - that is how democracy works.
That's true. But said acceptance doesn't need to translate to acceptance of the laws that the misguided majority enacts - you can sabotage those instead, Underground Railroad style.
> There is no conspiracy and I don't think that it is fair to accuse your police and government of being arseholes (to put words in your mouth!) Sometimes we simply have to accept that our personal will does not always dovetail with that of the majority - that is how democracy works. To be fair though, there is also nothing wrong with getting a good rant in on HN.
You've clearly never dealt with either in the US for a protracted period of time.
Yes, they very much are. Their response to them breaking the law and/or making a mistake is "Fuck off, sue us."
> If you feel really strongly about healthcare, why not emigrate to the UK? Our NHS is bloody amazing and only costs: https://www.gov.uk/national-insurance/how-much-you-pay - roughly 12% of your salary. There is a lower band and an upper band so it is not 12% of everything you earn and it also covers unemployment payments and other things.
A) You are moving the goal posts from the original discussion.
B) I was born here. I'm not leaving just because I don't win every battle.
> Brexit was decided on an embarrassingly close vote: 51.9%
https://www.theguardian.com/world/2018/jan/10/russian-influe...
http://nymag.com/daily/intelligencer/2018/06/britains-russia...
http://nymag.com/daily/intelligencer/2018/06/top-brexit-back...
https://www.bbc.com/news/uk-politics-43336351
> The four most recent readings - taken by BMG Research and Survation between November and January - have, on average, once the 8% who said "don't know" are left to one side, put Remain on 52% and Leave on 48%.
Now that it isn't being influenced by an outside party, it is no longer narrowly winning.
To be honest, I don't think people should cry they have a mandate from the people with less than a 55% majority.
Now that it isn't being influenced by an outside party, it is no longer narrowly winning.
My original point about Brexit being very close still stands and I would suggest that your Remain on 52% and Leave on 48% are still very close given the sheer pain of the separation that has become apparent since the original vote (you try listening to the news here - its bloody boring.) If you had waved say 60% Remain, I might take notice.
Yeah but your statements are largely irrelevant to what I was saying. A heavily influenced vote with borderline +/-2% isn't what I was discussing.
> To be honest, I don't think people should cry they have a mandate from the people with less than a 55% majority
Can I ask what 55 is? (for instance, in India 66 is a special percentage required for some bills).
https://ballotpedia.org/California_Proposition_39,_Supermajo...
It is a bit nuanced but there are several forms of fund raising and such that require a 55% majority to pass.
We have other things that require a 2/3rds majority as well.
Thanks, that's the sort of thing I was looking for.
"If you feel really strongly about healthcare, why not emigrate to the UK?"
I get paid better over here, and the weather in the UK is shit.
> At what point does the technical community stop trying to technically interfere with the efforts of law enforcement, and start trying to change the laws that make law enforcement behave this way?
This sounds like a highly irresponsible tactic if your actual goal is to help people.
There is no reason to believe that the state will afford the kind of changes you're describing, and even if it does, no reason to believe that it will obey the new laws in question.
While you are busy keeping yourself safe by staying within the lines of a tyrannical coloring book, real people are suffering the consequences of surveillance.
Even if this were possible: why constrain the internet, whose constituency is international and impetus is mathematical, to the confines of some ridiculous tantrum-throwing government and its childish ideas of control? What's the benefit?
Probably at the point where elected officials start to care. They won't care until their voters care, and most voters don't seem to care about or understand the issue here since it does not affect most of them in any meaningful/measurable way.
I think they care. A majority of the country did not want NN to be repealed but it was. The problem is their vote means little and understandably, many tune out and don't vote or choose between lesser of two evils.
A majority of the country has no idea what new neutrality is nor do they care. The only way you get to polls indicating a preference either way is by describing the regulations to the recipient first.
I dunno, despite the supposed popularity of repealing the Affordable Care Act, the GOP, having control of all parts of the legislative process, couldn't get it done.
The opinions of politicians can change on a whim.
Changing the law means nothing if it gets changed back the following decade.
Technical solutions tend to be more permanent.
Your solution is equivalent to saying "why are we focused so much on pretecting ourselves from hackers? We should instead change society such that nobody even WANTS to be a hacker!"
So we should give up trying to help people in oppressive countries and just shop them to the authorities?
I guess when we decide to stop complaining about technically inept government, and start working for government and running for office ourselves.
"it could make similar arguments to force companies to rewrite other popular encrypted services such as Signal and Facebook’s billion-user WhatsApp"
Umm... Signal is open-source, so unless they outlaw encryption across the board, the worst-case scenario is someone just has to fork it.
There's no guarantee that the client you install on your device is built from the same source code that is publicly available, unless you build the client yourself from that source code. I suspect no one is doing that at this point (since Noise died with CopperheadOS).
Right, for the masses, but for focused enterprise, like a well resourced gang, for instance, refortifying your security is just another build away. Add on some sneakernet transport and side-load instructions and the only people affected by a weakened platform is everyone else.
Facebook's Haxl team openly discusses their ability to wiretap Messenger at scale for anti-spam.
https://www.youtube.com/watch?v=sT6VJkkhy0o
Users should be given the option to use peer to peer strong encryption with friends they whitelist.
*a different department of the US government. We already know that the NSA wiretaps Messenger at will extrajudicially via PRISM and other programs.
Would [perfect] forward secrecy prevent a government from asking an entity from decrypting intercepted and recorded transmissions?
Forward Security is about creating a single session key and then ensuring that it isn't trusted after the session.
This is a good best practice and SHOULD be used everywhere.
It does not prevent any attacker, government or otherwise, from making client implementations do things like:
BTW, if you can't build the client your self from source, how do you KNOW the above isn't being done?"Law enforcement agencies forcing technology providers to rewrite software to capture and hand over data that is no longer encrypted"
Would this, or could this, fall under compelled speech? Especially if an employee is using the product themselves?
It happens because Facebook's design is fundamentally flawed for the security.
How is it fundamentally flawed?
It's strange for the same issues with China there is 'outrage', and then for the exact same things here we see hand waving and 'technical' solutions.
What technical solution is going to protect the human being from the indignity of security personnel presuming the right to going through your personal papers and thoughts? And this is already in effect in US airports with no pushback.
It is this denial by many about what is happening at home and the absence of mainstream protests and push back that has allowed the the rise of surveillance capitalism, the NSA, secret courts, secret orders, secret processes and brazen surveillance demands by governments.
The worse it becomes the more the need to posture and distract by seeking to hold others accountable for the very things you are neck deep in.
Article on HN: "The government shouldn't be trying to do this, we need encryption, decentralized services"
Article on Reddit: "Delete Facebook! Fuck Zuckerberg."
One is a consumer’s answer, the other one is a creator’s answer.
Makes sense, as these are the respective target audiences of the two communities.
Both reasonable reactions, just different takes.
Easily tapped central server(s) is my nutshell theory of why rightwing extremists aren't being kicked off of Twitter. Third-party doctrine, and all that.
I honestly can't tell what groups are being banned, nor what the rules are. Isis isn't banned but random right winger is. Jimmy Dore and Kyle Kulinski have pointed out seemingly random left wingers getting banned, Sarah Jeong gets a blue check. It all seems so random and incoherent. I am genuinely lost.
You are definitely lost if you think Sarah Jeong should be sanctioned.
I don't think anyone should be censored/sanctioned. ISIS, Alex Jones, Antifa, let them all speak as far as I'm concerned. But to the extent that there are currently censorship rules in place, I genuinely do not understand them. Enforcement seems genuinely random and arbitrary.
Sarah Jeong mocks white racists, no ban, fine.
Candace Owens copy/pastes Sarah Jeong's tweets, gets banned, not fine.
A world in which Alex Jones gets banned but ISIS does not is total insanity.
To reiterate, I don't want any of the above to be banned/censored. However, in an world in which the above facts exist, I am suggesting I do not understand what the rules are at all. It seems random and arbitrary.
Face to face still the most secure. No tech involved. Just saying.
Not everyone has the means to walk over and talk in person, grandpa
I know. Just know it’s a compromise. I’m late 30’s BTW
The other day i posted a rant on p2p here on HN and everyone was like, huh! Use whatsapp.
We need to build our own p2p and e2e secure chat client like whatsapp which works on every platform.
Sure, it's possible - skype was exactly this before except for the e2e part.
Why we techies can't? Let's make a group and dissect the problem in our free time. Who is up for it?
Some people are working on this problem. You might be interested in looking at the Matrix standard [0] or some of the things built using it like Riot [1], a Slack-like web client supporting text, voice and video communication for one-on-one or group contexts.
0: https://matrix.org/docs/guides/faq.html
1: https://about.riot.im/what-is-riot/
Wut? Go to Github and cobble a MitM proxy.
Reading the comments here reminds me of how silo’ed this community is, philosophically speaking.