Slashdot Mirror
Neglecting the Lessons of Cypherpunk History
Nicola Hahn writes Over the course of the Snowden revelations there have been a number of high profile figures who've praised the merits of encryption as a remedy to the quandary of mass interception. Companies like Google and Apple have been quick to publicize their adoption of cryptographic countermeasures in an effort to maintain quarterly earnings. This marketing campaign has even convinced less credulous onlookers like Glenn Greenwald. For example, in a recent Intercept piece, Greenwald claimed:
"It is well-established that, prior to the Snowden reporting, Silicon Valley companies were secret, eager and vital participants in the growing Surveillance State. Once their role was revealed, and they perceived those disclosures threatening to their future profit-making, they instantly adopted a PR tactic of presenting themselves as Guardians of Privacy. Much of that is simply self-serving re-branding, but some of it, as I described last week, are genuine improvements in the technological means of protecting user privacy, such as the encryption products now being offered by Apple and Google, motivated by the belief that, post-Snowden, parading around as privacy protectors is necessary to stay competitive."
So, while he concedes the role of public relations in the ongoing cyber security push, Greenwald concurrently believes encryption is a "genuine" countermeasure. In other words, what we're seeing is mostly marketing hype... except for the part about strong encryption.
With regard to the promise of encryption as a privacy cure-all, history tells a markedly different story. Guarantees of security through encryption have often proven illusory, a magic act. Seeking refuge in a technical quick fix can be hazardous for a number of reasons.
"It is well-established that, prior to the Snowden reporting, Silicon Valley companies were secret, eager and vital participants in the growing Surveillance State. Once their role was revealed, and they perceived those disclosures threatening to their future profit-making, they instantly adopted a PR tactic of presenting themselves as Guardians of Privacy. Much of that is simply self-serving re-branding, but some of it, as I described last week, are genuine improvements in the technological means of protecting user privacy, such as the encryption products now being offered by Apple and Google, motivated by the belief that, post-Snowden, parading around as privacy protectors is necessary to stay competitive."
So, while he concedes the role of public relations in the ongoing cyber security push, Greenwald concurrently believes encryption is a "genuine" countermeasure. In other words, what we're seeing is mostly marketing hype... except for the part about strong encryption.
With regard to the promise of encryption as a privacy cure-all, history tells a markedly different story. Guarantees of security through encryption have often proven illusory, a magic act. Seeking refuge in a technical quick fix can be hazardous for a number of reasons.
Crypto everywhere isn't going to stop you specifically being watched, but it will stop strategic dragnet interception, and force a return to tactical decrypts.
In the current political environment, encryption is not the answer. If you've been paying attention, there have been a number cases where a person was ordered to unlock the contents of a laptop or other device under the threat of being put in prison if they refuse. And that is the real problem. If you create some super-duper-encryption that is impossible to break, the various corrupt government agencies will simply declare you to be a terrorist, who can't possibly have any legitimate need for that encryption, and you will be ordered to decrypt or go to prison, and nobody will even know you are in prison thanks to secret laws enforced by secret courts.
Until THAT issue is addressed, encryption truly is just snake oil and feel-good public relations.
The author says that "cryptography is underhanded", but you will look in vain to find any technical meaning of that phrase anywhere in the article. What he really means is that the major corporations (Google, Apple, et al.) are underhanded because they are working with state spies to cripple algorithms and put in back doors, etc.
But trying to cripple cryptography this is something we already are aware of, and there are ways to shore up the technology to make it much, much harder for government to spy on us in bulk. Even using weak, crippled cryptography forces the spies to expend computing resources. Cryptography is all about raising the cost of spying, when dealing with government, not with preventing spying.
"We receive as friendly that which agrees with, we resist with dislike that which opposes us" - Faraday
Re "True, there are numerous ways to hide things, but if you intend to make it secure and you do understand the system because you designed it, it is quite possible to make it secure"
The device and the network has origins with the Communications Assistance for Law Enforcement Act.
https://en.wikipedia.org/wiki/...
Trying to build a better app over that voice, text and network logging ready system is interesting.
An app can encrypt but the data has to be entered?
Get the plain text as it is entered? Then the new app can be as powerful as it wants and totally tested. The plain text is still ready on any network.
Domestic spying is now "Benign Information Gathering"
I am far from being an expert on encryption, but the danger is not that PGP will be broken; it's that there are weaknesses in the entire "ecosystem" that allow for side-channel attacks. That's part of what that NSA paper, linked to in the article, is discussing. If there is something that can be exploited in the user's operating system or in the hardware, then that becomes the weak link in the chain.
Then, there is the whole issue that you touch on: namely, the caveat of encryption's efficacy "if used right." The same is true of condoms and even oral contraceptives. Sadly, human beings are very bad at scrupulously adhering to the injunction to "use as directed."
quiquid id est, timeo puellas et oscula dantes.