News for hackers. Stuff that matters.
Re:More encryption means less privacy by rocqua on Tuesday August 09, 2016 @12:49PM (#12255910)
I think a very important point was raised though.

Before crypto, basically all guarantees where conditional on a judge's say so. With crypto this changes. The issue also comes up, in a clearer way, with crypto currencies. There is no way to deal with fraud or mistaken tranfers in bitcoin.

That loss of intervention hurts, and we gotta think about it. Even though no government has given a satisfactory solution, that doesn't mean there isn't a problem in need of solving.

Re:More encryption means less privacy by Retric on Tuesday August 09, 2016 @01:58PM (#12256483)
Until very recently 99.99% of conversations where completely private and society functioned just fine. Even with crypto everywhere the governments have far more access to what people say and do than they had for thousands of years.

People with power pretend if they just had more power everything would be better. But, reality is if everything on a computer where private not much would change.

Re:More encryption means less privacy by ori_b on Tuesday August 09, 2016 @02:10PM (#12256583)
> Until very recently 99.99% of conversations where completely private and society functioned just fine.

Until very recently, most conversations were plausibly deniable, and off the record. The internet and cryptography changes that.

Edit: [Both plausibly deniable in the formal/cryptographic sense, and in the informal "You're misremembering, there's no record in writing of me saying that" sense]

Re:More encryption means less privacy by djsumdog on Tuesday August 09, 2016 @03:49PM (#12257265)
> The internet and cryptography changes that.

By Internet, I think you mean phonographs, magnetic tapes and pocket recorders.

Cryptography brings some of that back.

Re:More encryption means less privacy by Taek on Tuesday August 09, 2016 @05:55PM (#12257992)
To get access to those, you needed warrants, and you didn't get to listen in on every conversation, only targeted conversations. On the Internet, you have full access to pretty much everything I've ever said to somebody.

They aren't equivalent.

Re:More encryption means less privacy by dpark on Tuesday August 09, 2016 @03:25PM (#12257125)
> Until very recently 99.99% of conversations where completely private and society functioned just fine.

In fairness, until very recently it was also extremely difficult for two people to privately plot to murder hundreds. Technology has changed the balances on a lot of scales.

To be clear, I'm not advocating for government back doors in encryption here. But I am saying we should not pretend that encryption just puts things back "the way they were". It most definitely does not.

Re:More encryption means less privacy by Silhouette on Tuesday August 09, 2016 @03:47PM (#12257255)
I take your point, but I think it's important to distinguish two issues that are raised by modern technology here.

One is about information. Modern technology allows new kinds of communications and learning and collaboration. It also means that for the first time it is technologically feasible for governments and other powerful organisations to monitor entire societies pervasively.

Another is about automation and efficiency and scale. Modern technology allows individuals or small groups to do many wonderful things. It also potentially allows individuals or small groups to cause far more damage than they could before, whether that is physical, emotional, economic, or any combination of those.

There is a certain amount of overlap. For example, some of the implications of widely distributed surveillance are concerning, but some of the implications of not just monitoring but actively influencing large groups of people by modifying (overtly or otherwise) the information and communications they receive are downright terrifying.

However, I think these are two quite separate issues in principle, and they each introduce risks of their own along with the benefits. Encryption is the counter to one form of risk in the communications area, and in that sense it does roughly speaking bring back the privacy that everyone used to enjoy automatically. Restoring that privacy necessarily means that bad people can use those communications channels to discuss doing bad things as well, but they could discuss those things in other forums instead if they needed to. We need other ways to control the risks of new technologies enabling larger scale threats, regardless of what we do about communications and encryption.

Re:More encryption means less privacy by woah on Tuesday August 09, 2016 @03:49PM (#12257264)
What are you talking about? There have been plenty on bombings and shootings for hundreds of years.
Re:More encryption means less privacy by dpark on Tuesday August 09, 2016 @04:49PM (#12257613)
200 years ago there were "plenty" of bombings and mass shootings orchestrated by groups of 1 or 2 people that resulted in hundreds of lives lost? Can you provide a few examples of this?
Re:More encryption means less privacy by Retric on Tuesday August 09, 2016 @05:22PM (#12257791)
That's a rather artificial limitations, few modern plots are from 1 or 2 people with hundreds killed. Historical examples are generally things like fires not bombings / mass shootings. As an example of the risks: https://en.wikipedia.org/wiki/Great_Fire_of_Meireki for example was extremely deadly, though estimates of ~100,000 dead where probably exaggerated.

We have also forgotten a lot of this crap. EX: 40 to 81 people killed from a time bomb in 1875. https://en.wikipedia.org/wiki/Alexander_Keith,_Jr. Note, this was for insurance money not terrorists, but I don't think the dead care.

Some historical examples where donations where probably accidental. The Delft Explosion of 1654 killed 100-200 people. In 1769 ~3000 people where killed when a depo @ Bastion of San Nazaro in Brescia was struck by lighting. A lighting also sparked another detonation in 1856 killing ~4,000.

Re:More encryption means less privacy by dpark on Tuesday August 09, 2016 @07:30PM (#12258403)
> That's a rather artificial limitations, few modern plots are from 1 or 2 people with hundreds killed.

I've heard small conspiracies called out to justify mass surveillance. You don't really need mass surveillance of your own citizens unless you are concerned about very small conspiracies. Bigger conspiracies can be uncovered with more traditional detective work.

Freak fires are also not a great example. An arsonist cannot cause hurricane force winds to assist and push a fire through a city. This is effectively an act of God. The time bomb is a better example, though again I would ask for evidence that this was a fairly common event the way mass shootings and similar terrorist attacks have sadly become.

Re:More encryption means less privacy by Retric on Tuesday August 09, 2016 @08:06PM (#12258583)
200 years ago world population was 1/10th what it is today making most events more common now. Something like 5% of everyone ever born is alive right now.

In terms of most kills by a single person one sniper is credited with ~700 kills and a mounted knight in plate was expedition to equal 100 peasants on average so 200+ in exceptional cases seems reasonable especially considering the Spanish conquest of South America where in the 1500's where ~300,000 vs 2000 and the 2000 won with minimal casualties. https://en.m.wikipedia.org/wiki/Spanish_conquest_of_the_Inca...

Re:More encryption means less privacy by dragonwriter on Tuesday August 09, 2016 @07:33PM (#12258412)
> I've heard small conspiracies called out to justify mass surveillance.

The fact that something is a convenient and effective narrative for propaganda purposes doesn't mean it is a significant and common threat.

Re:More encryption means less privacy by joveian on Tuesday August 09, 2016 @05:59PM (#12258010)
Not to mention smallpox and other infectious diseases where one person could kill thousands easily, even if unintentionally (with some instances intentional).
Re:More encryption means less privacy by flashdance on Tuesday August 09, 2016 @04:58PM (#12257658)
Re:More encryption means less privacy by dpark on Tuesday August 09, 2016 @05:04PM (#12257691)
Over a dozen involved, zero lives lost (excepting the conspirators).
Re:More encryption means less privacy by serge2k on Tuesday August 09, 2016 @03:34PM (#12257180)
> until very recently it was also extremely difficult for two people to privately plot to murder hundreds. Technology has changed the balances on a lot of scales.

Was what McVeigh did highly technical?

Re:More encryption means less privacy by clock_tower on Tuesday August 09, 2016 @04:30PM (#12257488)
It was dependent on having modern technology, like a truck and cheap fertilizer; it's a lot harder to kill 168 people (and wound almost 700) with an oxcart and a crossbow. Even with a carriage and black powder you need a _lot_ of people to be in on the plot. (Black powder was not cheap, not deniable, and not easily transported or concealed.)
Re:More encryption means less privacy by CaptSpify on Tuesday August 09, 2016 @04:53PM (#12257631)
What about poison? or fires? I'm sure there's other means I can't think of right now

Modern tech has made it a bit easier, but it was still fairly easy throughout most of history.

Re:More encryption means less privacy by dpark on Tuesday August 09, 2016 @05:02PM (#12257677)
It was not easy to get enough poison to kill hundreds. You get some hemlock, dump it in a well, and it dilutes enough that a dozen people get stomach aches and one elderly person dies. It's feasible to pull this off on a larger scale, but you'd need a lot of poison, and therefore a lot of resources.

Fires? I'm not sure it was that easy to set an out of control fire that would consume enough of a town to kill hundreds. Does everyone just fail to notice as you splash pitch on buildings all day leading up to the final act of starting the fire at night?

Re:More encryption means less privacy by OtterCoder on Wednesday August 10, 2016 @01:22AM (#12259651)
Pitch, or indeed much premeditation at all, wouldn't be necessary in a village with five foot alleyways and dried grass roofs. Additionally, tar was a common caulking material. Oh, and running water/chemical foam wasn't usually a thing. And, you know, no trained quick response teams, or well maintained roads and swift transit systems to escape on, or any way to tell the difference between the smoke that always hung around the fireplace and the smoke from the roof being on fire... I could go on.
Re:More encryption means less privacy by EGreg on Tuesday August 09, 2016 @06:40PM (#12258206)
Face it people -- terrorism is a problem of technology.
Re:More encryption means less privacy by mindslight on Tuesday August 09, 2016 @06:48PM (#12258238)
Exactly. Primarily the technologies of mass media and democracy.

Of terrorism, the newscasters on TV who sensationalize the act and the politicians who fan the flames for their own benefit are just as guilty as the person who blew themselves up.

(Though obviously, only the latter is guilty of murder)

Re:More encryption means less privacy by DavidWanjiru on Tuesday August 09, 2016 @05:19PM (#12257766)
When you talk about two people plotting to kill hundreds, do you mean any two people or do you mean two people who are otherwise physically apart but are brought close together by technology? Coz if the medium of communication used by your two would be mass murderers is VoTA (0), that technology is as old as human beings.

0. Voice over The Air. :-)

Re:More encryption means less privacy by JoeAltmaier on Tuesday August 09, 2016 @03:55PM (#12257310)
Mandela spent 20 years in jail for plotting to blow up a hotel, I believe? And that was nearly a century ago.
Re:More encryption means less privacy by dpark on Tuesday August 09, 2016 @04:41PM (#12257564)
Your timeline is skewed. Mandela was born nearly a century ago. His involvement in bomb conspiracies was in the 1960s, about a half century ago, when most conversations were not guaranteed private. Wire taps have been around as long as phones.
Re:More encryption means less privacy by Retric on Tuesday August 09, 2016 @04:14PM (#12257395)
Gunpowder plot of 1605 is a rather famous counter example: https://en.wikipedia.org/wiki/Gunpowder_Plot
Re:More encryption means less privacy by dpark on Tuesday August 09, 2016 @04:58PM (#12257656)
That's really not a counterexample to my point. This was a conspiracy involving over a dozen people. It's a plot that unraveled because someone leaked the details.

This is why technology has changed the balance. You don't need dozens of people to gather enough explosive material to pull this off today. And with fewer people involved, traditional detective work is harder, and those involved are less likely to leak details.

Re:More encryption means less privacy by Retric on Tuesday August 09, 2016 @06:29PM (#12258162)
There are plenty of accidental detonations that killed hundreds which could have easily been caused by just one person as noted in another post. Though, wartime sabotage is not exactly terrorism.

Again, if you want to kill lot's of people disease, and fire where the most common historical examples. It's actually much harder for a lone person to kill thousands today than it was 500 years ago due to effective methods of firefighting.

Re:More encryption means less privacy by cbsmith on Tuesday August 09, 2016 @01:30PM (#12256238)
> Before crypto, basically all guarantees where conditional on a judge's say so.

Sadly, they weren't.

> With crypto this changes.

Actually, with crypto it is much harder to claim that a judge's authorization isn't required to even try to subvert the privacy intent.

> There is no way to deal with fraud or mistaken tranfers in bitcoin.

There's no way because legally the system (for the most part) considers it outside the scope of fraud laws.

> That loss of intervention hurts, and we gotta think about it.

TLS doesn't create a real loss of intervention. It requires that the intervention be far more explicit and/or targeted.

Re:More encryption means less privacy by rocqua on Wednesday August 10, 2016 @04:03PM (#12264422)
> with crypto it is much harder to claim that a judge's authorization isn't required to even try to subvert the privacy intent.

No doubt, but the issue is that a judge's authorization can be ineffective in the face of crypto.

> TLS doesn't create a real loss of intervention. It requires that the intervention be far more explicit and/or targeted.

That targeted intervention is really easy to block for those who want too. All it takes is not revealing a key/passphrase.

> There's no way because legally the system (for the most part) considers it outside the scope of fraud laws.

Not just that though, it is also impossible because the conditionals introduced by a court system are very hard to encode in a crypto system, even more so if you want to do this and be able to retain trust.

Re:More encryption means less privacy by cbsmith on Wednesday August 10, 2016 @07:44PM (#12265460)
> No doubt, but the issue is that a judge's authorization can be ineffective in the face of crypto.

Only when it should be. Crypto just means you need a secret to access the data. If you can't compel the secret, why should you be able to compel the data?

> That targeted intervention is really easy to block for those who want too. All it takes is not revealing a key/passphrase.

You say that like it is an easy thing. Try keeping your key/passphrase protected against an adversary that can replace/intercept your keyboard, your touch screen, your mouse, your network, etc. It's just a lot more intrusive and a lot more work, which is why it has to be far more explicit and targeted.

> > There's no way because legally the system (for the most part) considers it outside the scope of fraud laws. > Not just that though, it is also impossible because the conditionals introduced by a court system are very hard to encode in a crypto system, even more so if you want to do this and be able to retain trust.

Those conditionals were all choices made by the legal system. Those rules can always be changed if so desired. If they aren't... maybe it is because they shouldn't be. ;-)

Re:More encryption means less privacy by wongarsu on Tuesday August 09, 2016 @01:15PM (#12256114)
>There is no way to deal with fraud [...] in bitcoin

Don't we have an extensive legal system to deal with fraud? The fact that a lot of payment providers elect to deal with fraud themselves probably shows that that legal system isn't working as smoothly as it should; but that's really something that should be fixed in the legal system, not in the payment channel.

Re:More encryption means less privacy by sliverstorm on Tuesday August 09, 2016 @01:21PM (#12256170)
Part of the way the legal system deals with fraud is by recovering money (where possible). With bitcoin, unless the destination wallet can be obtained, that is not possible.

With cash, you seize the cash. Bank accounts can be frozen, Credit card transactions canceled, wire transfers flagged (http://www.npr.org/sections/money/2016/01/29/464859624/episo...).

Re:More encryption means less privacy by icebraining on Tuesday August 09, 2016 @01:23PM (#12256183)
With cash, unless the wallet in which it resides can be obtained, that is not possible. I fail to see the difference.
Re:More encryption means less privacy by mediaman on Tuesday August 09, 2016 @01:29PM (#12256236)
I agree, the legal system doesn't do well when it comes to recovering cash from entities that can hide it. You can get a legal judgment against a company, but if it's fly-by-night, it winds up being a worthless piece of paper, and can become very difficult to recover.
Re:More encryption means less privacy by bronson on Tuesday August 09, 2016 @01:52PM (#12256434)
It's much harder to hide 500,000 dollars in small bills than it is to hide Bitcoin.
Re:More encryption means less privacy by superuser2 on Tuesday August 09, 2016 @05:04PM (#12257688)
Law enforcement has well-developed capabilities to surreptitiously follow the movement of people and objects through the physical world and wield whatever force necessary to sieze them where desired.
Re:More encryption means less privacy by cbsmith on Tuesday August 09, 2016 @01:49PM (#12256399)
The law does actually have ways of extracting cash from people even when it can't locate the cash in question. It's harder, and less effective, but overall it works more than it doesn't.
Re:More encryption means less privacy by icebraining on Tuesday August 09, 2016 @01:52PM (#12256429)
Yes, but that works the same for Bitcoin.
Re:More encryption means less privacy by cbsmith on Tuesday August 09, 2016 @08:56PM (#12258778)
Looks like they have other ways of handling it with Bitcoin: https://www.usmarshals.gov/assets/2016/bitcoinauction/index....
Re:More encryption means less privacy by cbsmith on Tuesday August 09, 2016 @02:54PM (#12256920)
It could work the same for Bitcoin. It actually works better with Bitcoin as there actually is a complete transaction log.

However, the law has frequently decided it can't treat Bitcoin like it treats cash, which has created problems...

Re:More encryption means less privacy by gonvaled on Tuesday August 09, 2016 @03:33PM (#12257174)
Hiding a wallet is much easier. You can even have several copies of it, so that you can hide it so well that you do not even care if you lose it.
Re:More encryption means less privacy by rocqua on Wednesday August 10, 2016 @04:05PM (#12264434)
Bitcoin moves much faster and much further that cash though.
Re:More encryption means less privacy by mindslight on Tuesday August 09, 2016 @01:47PM (#12256378)
This point is a tired falsehood. There have always been phenomena with physical rules that supersede any human decision. The legal system recognizes and works with such boundaries - some even end up codified in our highest laws such as the 5th amendment.

We're only in this present quandary because of professionally irresponsible "web 2.0 services" that siloed up user data for their own surveillance goals, creating enticing targets for governments' desires of control.

Re:More encryption means less privacy by EGreg on Tuesday August 09, 2016 @02:11PM (#12256595)
When everything is decentralized, it's going to be much harder to enforce any rules about no-crypto. For now things like social networks are cenetralized, leading to all these temptations to mine the data. It's not just government who wants youd data - it's every organization!

http://magarshak.com/blog/?p=169

Re:More encryption means less privacy by Semiapies on Tuesday August 09, 2016 @01:03PM (#12256014)
Before crypto, basically all guarantees where conditional on a judge's say so

Tell that to J. Edgar Hoover.

Re:More encryption means less privacy by rocqua on Wednesday August 10, 2016 @04:06PM (#12264439)
That just shows they were conditional on things beyond a judge's say so. I.e. security can also be broken by people willing to break the law.
Re:More encryption means less privacy by Semiapies on Wednesday August 10, 2016 @07:13PM (#12265339)
One day I will actually see someone write a response starting with "that just shows" that doesn't boil down to "My being wrong shows that I'm actually right. Somehow."
Re:More encryption means less privacy by bsder on Tuesday August 09, 2016 @05:21PM (#12257782)
> There is no way to deal with fraud or mistaken tranfers in bitcoin.

This is a social problem of bitcoin. The bitcoin people consider this a feature.

However, it can be dealt with at an exchange. "MyBitcoinExchange(tm) only allows transfers to other members of MyBitcoinExchange(tm) and yourself. All transfers will be escrowed for 5 days to ensure that they are not fraudulent."

The problem is: nobody in bitcoin would use that exchange.

People who want non-traceable will stay away. People who are using it to sequester wealth out of countries will stay away. People who want fast liquidity will stay away. etc.

So, who's left? Um, people who are perfectly adequately handled by existing credit cards, thanks.

Re:More encryption means less privacy by Taek on Tuesday August 09, 2016 @05:53PM (#12257983)
> With crypto this changes.

It shouldn't. Listening in on a conversation should be illegal whether or not the conversation is encrypted. But we realized that if we weren't encrypting our conversations that our rights were being illegally infringed upon, so we started taking matters into our own hands.