Falling Into the Encryption Trap
http://lauren.vortex.com/archive/001108.html
This is a difficult discussion for me. It borders on embarrassing,
because I'm forced to admit that I was unable to foresee some of the
ramifications of encryption-related polices I've been promoting for
many years.
I could make the excuse that I did not anticipate an onrush of largely
hyperbolic paranoia as has been triggered post-Snowden, but I should
have realized that some sort of similar event would be adequate to
trigger similar issues.
My concern started taking shape about a month and a half ago when
discussions were bouncing around the Net regarding Mozilla's supposed
intention to (at some point in the future) refuse to allow Firefox
browser connections to sites not running SSL/TLS, or at least
restricting "features" available to them. Mozilla's actual stance on
this is currently not entirely clear, but it appears that their
longer-term plans at least are moving in this direction.
Two days ago when I posted "When Google Thinks They're Your Mommy"
( http://lauren.vortex.com/archive/001107.html ), regarding the Chrome
browser's refusal to connect to a major corporate site that other
browsers would connect to, I triggered a mass of users sending me
similar stories about "encryption enforcement" complications -- and
not just about Chrome.
There were people complaining about Chrome blocking sites, Firefox
blocking sites, new versions of browsers preventing users from
accessing network-connected home devices -- that were difficult or
impossible to replace and only ran on local networks. On and on. I had
let loose an unexpected avalanche, about an issue I incorrectly
thought was only now beginning to gradually affect larger numbers of
users.
And last night I had a nightmare.
I saw two parents desperately trying to access a misconfigured
medical-related site for their sick child, being blocked by Chrome
"for their own protection" -- and then trying to install another
browser in panic after being informed by a Google help page that
Chrome wouldn't help them, and that using another browser was their
only alternative.
This is what comes of reading my own blog posts sometimes -- waking up
in cold sweat from a very dark dream.
What's happened of course is that post-Snowden there's been a mantra
that we're all being spied on all the time, and not only should all
Internet connections be encrypted, but users should not be
permitted -- no matter what the situation -- to access sites that are not
encrypted to the standard that the crypto-gurus feel is adequate, even
when the situation is triggered by temporary misconfiguration rather
than purposeful configuration decisions at a site.
The argument is that man-in-the-middle attacks are so powerful and so
pervasive (the former can certainly be true, the latter is definitely
arguable) that even someone viewing kitten videos must use
encryption -- if for no other reason than to protect them from some evil
entity injecting an exploit into their weak connection.
Obviously if you're Google and continuously transferring gazookabytes
of user data between datacenters, you're a big target and you want
those circuits to be as rigorously encrypted as is practicable.
The reality though is that the overwhelmingly vast majority of user
system exploits aren't based on subversion of the connections at all,
but rather on endpoint attacks -- usually tied to phishing and other
"social engineering" techniques when available multiple factor
authentication systems have not been deployed.
Like I said, I've spent many years promoting the concept of universal,
opportunistic Internet encryption.
But in some of the attitudes I see being expressed now about "forced"
encryption regimes -- even browsers blocking out fully-informed users
who would choose to forgo secure connections in critical situations --
there's a sense of what I might call "crypto-fascism" of a kind.
And that worries me. That's the stuff of nightmares.
It's one thing for a site to specifically and clearly indicate that it
will only accept secure connections of a particular class and quality,
proclaiming that it feels such restrictions are absolutely necessary
in their context.
It's something else entirely though for a browser to unilaterally
declare a site's security to be unacceptably weak (perhaps by choice
or often by misconfiguration -- both of which we can agree need to be
fixed) to the extent that the browser absolutely refuses to allow the
user to connect, regardless of how crucial the situation and
irrespective of the fully-informed expressed will of the user to
connect in any case.
Some encryption and Web standards experts might assert that this is
simply a situation where a rather technically fascistic attitude is
necessary to protect users overall, even if individual users in some
circumstances might be horribly injured in the process. I've already
had someone quote Spock to me on this one ("The needs of the many
outweigh the needs of the few.")
Leaving aside for the moment that "the few" at Internet scale could
easily still be many millions of warm bodies, I don't buy Spock's
supposed logic in the context under discussion here.
Yes, we want to encourage encryption -- strong encryption -- on the
Net whenever possible and practicable. Yes, we want to pressure sites
to fix misconfigured servers and not purposely use weak crypto.
But NO, we must not permit technologists (including me) to deploy Web
browsers (that together represent a primary means of accessing the
Internet), that on a "security policy" basis alone prevent users from
accessing legal sites that are not specifically configured to always
require strongly encrypted connections, when those users are informed
of the risks and have specifically chosen to proceed.
Anything less is arrogantly treating all users like children incapable
of taking the responsibility for their own decisions.
And that would be a terrible precedent indeed for the future
of the Internet.
--Lauren--
Lauren Weinstein ([email protected]): http://www.vortex.com/lauren
Founder:
- Network Neutrality Squad: http://www.nnsquad.org
- PRIVACY Forum: http://www.vortex.com/privacy-info
Co-Founder: People For Internet Responsibility: http://www.pfir.org/pfir-info
Member: ACM Committee on Computers and Public Policy
Lauren's Blog: http://lauren.vortex.com
Google+: http://google.com/+LaurenWeinstein
Twitter: http://twitter.com/laurenweinstein
Tel: +1 (818) 225-2800 / Skype: vortex.com
_______________________________________________
pfir mailing list
http://lists.pfir.org/mailman/listinfo/pfir
