The Encryption Debate Isn't About Stopping Terrorists, It's About Solving Crime

Re:The Encryption Debate Isn't About Stopping Terrorists, It... by pdkl95 on Monday April 09, 2018 @04:08PM (#16796522)

Any plan that relies on NOBUS ("NObody But US") information - like a global private key - is a brittle design that will fail catastrophically when the keys become public (either Snowden-style, or accidentally disclosed like the TSA master keys[1]). Why should we ignore prior experience and assume such an important, linchpin secret will somehow stay known to "nobody but us" this time?

[1] https://boingboing.net/2015/08/21/make-your-own-tsa-universa...

[ Parent | on HN ]

Re:The Encryption Debate Isn't About Stopping Terrorists, It... by vbezhenar on Tuesday April 10, 2018 @03:42AM (#16799739)

Google HTTP security relies on Google TLS private key. Does it make a brittle design? Keys are supposed to be protected. In this case key could be assembled by a few subkeys with different people holding control over it, so they should come to an agreement before deciphering anything.

[ Parent | on HN ]

Re:The Encryption Debate Isn't About Stopping Terrorists, It... by sitharus on Tuesday April 10, 2018 @08:50PM (#16807129)

Yes it relies on Google keeping their key (or keys - there's nothing wrong with having multiple valid certificates for a domain, especially if you're the registrar) private. Google keep their key private, Amazon keep their key, Stripe keep their key. If you want to attack any provider you have to recover that provider's key.

Now if you mandate everyone use a government key or escrow their key with the government there's now a single place to attack. Also this place is affected by government whims, staff pay freezes, cutbacks, layoffs. All you need is one disgruntled employee or contractor with access and you now have access to _everything_.

[ Parent | on HN ]