Re: [Cryptography] What if Responsible Encryption Back-Doors Were Possible?

2018-12-07 Thread grarpamp
On 12/6/18, Bill Cox  wrote:
> As for responsible encryption policies, I believe:
>
> 1) It is possible, but _hard_ and _expensive_ to build it securely.
> 2) No one wants to be in a position where a mass murderer has encrypted
> data that cannot be revealed to law enforcement.
> 3) Governments will always over-reach and go for mass-surveylence that
> violates everyone's privacy.
>
> I wont go into tech details, but if Bitcoin can protect billions in online
> value, there are systems that can unlock back-doors without too many
> failures to make the system a bad idea.  Check out what Oasis Labs is up
> to, for some good ideas (that remain to be proven).  The problem is that
> while the public wants tech companies to help law enforcement in extreme
> cases, no one wants to simply let governments around the world spy on
> absolutely everything we do.
>
> IMO, the only acceptable solutions to this problem will require distributed
> trust (like Bitcoin), such that users' devices can participate in decisions
> on how their data is used, distributed widely enough that no single entity
> can unilaterally decrypt a user's data  Data policies will need to be
> automated, like smart-contracts on something better than the total-crap
> Ethereum VM.  When a backdoor is used (or used too often), it should make
> the news, because a bunch of different interested folks would notice the
> transaction(s) on the blockchain.  Secret mass surveylence should be
> impossible, as a key requirement for the system design.  Publicly visible
> mass surveylence should be prohibited by the smart contracts, and the
> public should hold governments accountable for overreach.
>
> If the public can monitor the access policy and frequencey of use of these
> backdoors, then the tech companies will have a way out of the ethical
> delema law enforcement always tries to put them in: secretly snooping on
> users for the government (like we saw with Yahoo).
>
> Anyway, I feel very strongly that folks out there should start thinking
> along these lines.  We'll have to cooperate to make it happen.


Please tell us when you develop or find such a distributed backdoored
cryptosystem that you feel is strong enough to protect *your own secrets*
from access by others...

all the salacious messages pics and videos of that BDSM affair you had,
all the edits you've made to your resume, the source and fact
of your last weed order because the PTSD from your stint as a
secret CIA torturer has you about to lose it, all the crap you nicked,
your bank accounts, your speech and politik, that weird thing you
do with the stuffed groundhog, your kids, your health, etc. Or the fact
that you're a complete nothing with nothing to say if that's the case.

You'd have a better chance of eliminating Government Surveillance
through Anarchism than you would finding such a cryptosystem.

> the only acceptable solutions to this problem

Stalemate status quo is an acceptable solution,
no change to implement backdoors needed...

People have been using codes since thousands of years,
as relatively strong and without backdoors in their day back
then, as they are now today, and society has done just fine
all along.

If you want distributed for yourself, use secret sharing system.
Trying to develop and force that upon others will just come back
upon you and you know it.

Strong crypto is a tool, not the problem.
Melting down the tool isn't going to help.
It just reverts you to former centuries.

Backdoors are stupid.
Get over it.

> the public should hold governments accountable for overreach.

Never in the history of all Governments past has that ever worked,
therefore any apparent working today is extremely likely to fail.
Kings will Govern and Force their backdoors in your backdoor
until you depose them. Next time that happens, do the one thing
that hasn't been tried in history... don't prop them up in the first place.
The change in thinking needed to do that will likely eliminate
most of the extant problems you seek to "fix" with backdoors.

> moderators

Lol, bcc'd.


What if Responsible Encryption Back-Doors Were Possible?

2018-11-30 Thread grarpamp
-- Forwarded message --
From: hbaker1 
Date: Fri, 30 Nov 2018 01:31:51 -0500 (EST)
Subject: Re: [Cryptography] What if Responsible Encryption Back-Doors
Were Possible?
To: John Levine , cryptogra...@metzdowd.com

-Original Message-
>From: John Levine 
>Sent: Nov 29, 2018 1:40 PM
>To: cryptogra...@metzdowd.com
>Subject: [Cryptography] What if Responsible Encryption Back-Doors Were 
>Possible?
>
>On the Lawfare blog, an interesting piece by Josh Benaloah here.
>
>https://www.lawfareblog.com/what-if-responsible-encryption-back-doors-were-possible
>
>If you are tempted to respond, please read the whole thing first.  In
>particular, do not waste everyone's time by replying "but they're not!"
>We know that.
>
>R's,
>John

I attended this "conference" and all of its sessions.

The whole thing was a setup, IMHO.  I think that they were trying to
gather possible arguments against backdoors so that they could be
prepared for future discussions with politicians.  They also wanted to
tell these politicians that there were *some* in the crypto community
that thought we all really should leave our keys under the front door
mat.

A group of US ex-intel hangers-on, plus some brits, some aussies, and
perhaps a kiwi; more or less the 5i's.  They may also have invited
some press.  Some of these folks flew on to Australia to wreak more
havoc, as best I can gather.

One result of this wannabe conference can apparently be found in the
recent activity in Australia to mandate back doors.  These folks
apparently wanted to find one of the 5i govts to pass the first test
law requiring these back doors, and Australia must have volunteered.

Magical thinking by all.

BTW, with perhaps a handful of exceptions, no actual crypto people
attended this conference, which was merely held at the same
*location*, so that some of the prestige of a Crypto Conference would
rub off on this sham.

The only reason I knew about this conference was that I ran into one
of the participants while parking my car for Crypto, and talked with
him while walking over to the main venue.

Apparently, I was the only one there who questioned this whole thing,
and I asked about the "C" word (Constitution).  I simply said that
some of us had pledged to uphold the Constitution, and the reason why
*individuals* make such pledges is that they are expected to
understand the Constitution well enough to make their own assessment
about possible unconstitutional activities and refuse to engage in
those activities.  Recall that "simply following legal orders" didn't
absolve anyone at Nurenburg, so trusting these 5i's to interpret
Constitutionality isn't going to be much of a defense, either.

BTW, the "Lawfare" blog is about as close as one can get to "the
unclassified (apologist) voice of the Deep State" & I suspect that Ben
Wittes would consider this tag line to be high praise!
___
The cryptography mailing list
cryptogra...@metzdowd.com
http://www.metzdowd.com/mailman/listinfo/cryptography