News for hackers. Stuff that matters.
Re:DOJ plans to strike against encryption while the Techlash... by dropoutcoder on Wednesday February 26, 2020 @02:37PM (#22426447)
If you were forced to design an exceptional access system that minimized abuses and risks of compromise, how would you do it?
Re:DOJ plans to strike against encryption while the Techlash... by JoshTriplett on Wednesday February 26, 2020 @03:01PM (#22426712)
Leave whatever jurisdiction was attempting to force me to build something unethical, and after being safely out of that jurisdiction, disclose absolutely everything I can about the attempted coercion.
Re:DOJ plans to strike against encryption while the Techlash... by dropoutcoder on Wednesday February 26, 2020 @03:05PM (#22426758)
In that case you would not be forced, at least in a more extreme application of the word.

Regarding ethics, my opinion is that it’s unethical to offer strong E2EE to the masses at scale, without considering the needs of LE.

Re:DOJ plans to strike against encryption while the Techlash... by CKN23-ARIN on Wednesday February 26, 2020 @06:12PM (#22428516)
LE in which jurisdiction(s)? If the E2EE is widely used, the "needs" of local LE will be varied and often contradictory.
Re:DOJ plans to strike against encryption while the Techlash... by JoshTriplett on Wednesday February 26, 2020 @06:48PM (#22428809)
This is one of many excellent arguments against such backdoors. The US would like backdoors into everyone's communications, and doesn't want anyone else to have them. China would like backdoors into everyone's communications, and doesn't want anyone else to have them. Every country and jurisdiction would like backdoors into everyone's communications, and doesn't want anyone else to have them.
Re:DOJ plans to strike against encryption while the Techlash... by dropoutcoder on Wednesday February 26, 2020 @08:02PM (#22429333)
In America, our govt
Re:DOJ plans to strike against encryption while the Techlash... by tbyehl on Wednesday February 26, 2020 @03:56PM (#22427236)
Why should Law Enforcement have a seat at the table in the design of anything?

Should my sneakers be made more uncomfortable so I can't run away too fast?

Should they be able to remotely disable my car?

Remotely open the blinds to my home's windows?

Should I not be able to install a front door that resists attempts at forced entry?

What's the line where Law Enforcement's wants merit consideration?

Re:DOJ plans to strike against encryption while the Techlash... by dropoutcoder on Wednesday February 26, 2020 @04:19PM (#22427445)
If it comes to pass that the department of justice insists on implementation of Exceptional access it would be who’ve the civil libertarians to work towards a better compromise. Hedge your bets.
Re:DOJ plans to strike against encryption while the Techlash... by tbyehl on Wednesday February 26, 2020 @05:32PM (#22428162)
So, I failed to actually state what I was trying to probe from you:

Why do you view it as unethical to not consider Law Enforcement needs wrt strong end-to-end encryption?

Re:DOJ plans to strike against encryption while the Techlash... by dropoutcoder on Wednesday February 26, 2020 @05:47PM (#22428292)
Having exceptional access is important to keeping and improving society. It’s unethical to ignore and fight LE’s ongoing needs regarding such access. E2EE at scale, unchecked, is an extreme viewpoint with trade offs that I consider unethical at best, and fundamentally dangerous at worst.
Re:DOJ plans to strike against encryption while the Techlash... by JoshTriplett on Wednesday February 26, 2020 @06:04PM (#22428439)
You haven't explained why, you're just re-asserting what the comment you replied to was expecting you to explain.
Re:DOJ plans to strike against encryption while the Techlash... by dropoutcoder on Wednesday February 26, 2020 @07:55PM (#22429290)
I did
Re:DOJ plans to strike against encryption while the Techlash... by unionpivo on Wednesday February 26, 2020 @03:35PM (#22427038)
As someone from ex comunist/socialist state, I am completely fine with LE not having too much power. I think them being able to break all encryption in use is way too much power. Its not if, it's when it will be abused, and how many people die for it. And LE's can do a lot more damage than all terrorist combined.
Re:DOJ plans to strike against encryption while the Techlash... by dropoutcoder on Wednesday February 26, 2020 @03:45PM (#22427143)
Thanks for that. The goal is to design a system that prevents abuses. A technological solution to the ape problem would be helpful.
Re:DOJ plans to strike against encryption while the Techlash... by JoshTriplett on Wednesday February 26, 2020 @03:56PM (#22427234)
Current systems prevent most abuses, and many people are working on improving it to prevent more abuses.

As an excellent example, Certificate Transparency has almost completely mitigated the potential abuse of compromising a certificate authority and using it to MITM traffic. Similarly, "binary transparency" or "software transparency" will hopefully eliminate the abuse of delivering a "special binary" to just one person that others have not received.

Part of the threat model is the belief that any system with a backdoor has any hope of "preventing abuses". The backdoor is the abuse, leaving aside all the misuses of it that will happen.

Re:DOJ plans to strike against encryption while the Techlash... by dropoutcoder on Wednesday February 26, 2020 @04:17PM (#22427423)
Minimize or eliminate misuse through fundamental rethink of the solution.
Re:DOJ plans to strike against encryption while the Techlash... by alasdair_ on Wednesday February 26, 2020 @03:10PM (#22426810)
It depends on whether the access is to be to encrypted data at rest or something like a realtime wiretap, and if there needs to be a way to prevent the spied-on party knowing they were being spied on or not.

One way to do data-at-rest (e.g. a locked phone) is to require physical access to the phone along with some kind of expensive, destructive procedure (e.g. an electron tunneling microscope and shaving away the housing of the secure enclave area).

Also, I'd assume that any competent target would just layer their own encryption on top of the existing stuff, so the whole system would only be good for catching unsophisticated criminals (and spying on the general public).

Or I'd just subpoena the iCloud backups and have Apple decrypt them, which they can already do.

Re:DOJ plans to strike against encryption while the Techlash... by dropoutcoder on Wednesday February 26, 2020 @03:25PM (#22426930)
For clarification, the goal is to provide a way for the government to decrypt encrypted comms that pass through the internet.
Re:DOJ plans to strike against encryption while the Techlash... by banads on Wednesday February 26, 2020 @04:43PM (#22427680)
This is like asking how to design a type of water that isn't wet, fire that doesn't burn, or a gun that only kills bad guys.

The inherent nature of encryption is to keep information secret.

Re:DOJ plans to strike against encryption while the Techlash... by dropoutcoder on Wednesday February 26, 2020 @05:03PM (#22427851)
Two parties or three, how can three parties keep a secret versus two
Re:DOJ plans to strike against encryption while the Techlash... by banads on Thursday February 27, 2020 @08:09AM (#22432880)
The only way is to share keys
Re:DOJ plans to strike against encryption while the Techlash... by dropoutcoder on Thursday February 27, 2020 @03:22PM (#22437380)
Currently but maybe there’s another way

Too much at stake

Balance of power

God bless America

I’m concerned

Programmer geniuses often can’t see the forest for the trees

This one issue will have a profound impact on our ability to work towards a more civil society

Hopeful that the geniuses will be willing to work towards a better compromise rather than simply resist on theoretical principles

Re:DOJ plans to strike against encryption while the Techlash... by banads on Friday February 28, 2020 @10:35AM (#22443430)
>Programmer geniuses often can’t see the forest for the trees

Indeed, this is true. Likewise politicians often know nothing of how trees and forests actually work; and make absurd proposals which primarily serve their interests and pretend to care about a saving a few trees while endagering the entire forest.

Weakening everyone's security in order to weaken a small minority of criminals' security by default results in a net decrease in society's overall security