Slashdot Mirror
Crypto Experts Blast Gov't Backdoors For Encryption
loid_void writes with a link to a New York Times report about some of the world's best-known cryptography experts, who have prepared a report which concludes that there is
no viable technical solution which "would allow the American and British governments to gain "exceptional access" to encrypted communications without putting the world's most confidential data and critical infrastructure in danger." From the article:
[T]he government’s plans could affect the technology used to lock financial institutions and medical data, and poke a hole in mobile devices and the countless other critical systems — including pipelines, nuclear facilities, the power grid — that are moving online rapidly. ...
“The problems now are much worse than they were in 1997,” said Peter G. Neumann, a co-author of both the 1997 report and the new paper, who is a computer security pioneer at SRI International, the Silicon Valley research laboratory. “There are more vulnerabilities than ever, more ways to exploit them than ever, and now the government wants to dumb everything down further.”
The authors include Neumann, Harold Abelson, Susan Landau, and Bruce Schneier.
You cannot, under any circumstances, convince the government that having a backdoor into all those things is a bad thing.
The Clipper chip was designed by the NSA and had a government-sponsored backdoor. Unsurprisingly, it failed.
Yes... how many times must it be said? Ignorance is strength!
“He’s not deformed, he’s just drunk!”
Who doesn't know that backdoors are there for everyone who finds them and not just those who put it there?
Who would buy a lock from a company that made a master key that was good in all of their locks? Of course, they would promise to only release that key to authorized people. However, it is certain that eventually it will get into criminal hands. At that point, there is lots of money to be made from selling the key. Of course, lock companies could make lots of money off this proposal, but not the one who made the master key. The government might as well give up on a web based economy and go back to paper banking if they start giving out keys to all of the transactions.
And "War is Peace"? Check. https://en.wikipedia.org/wiki/...
"Freedom is Slavery": working on it.
When Phrack republished the NSA Employee Security Manual to demonstrate how porous NSA was for its own security, it backed off.
This is just the same old crap with Edward Snowden or the OPM caper as a counter-example, rather than Phrack.
Security Now #506 "Law Enforcement Backdoors"
Delves into the subject in detail and even covers the recent session of congress in which the idea was proposed and debated.
I thought it was funny (Also kind of sad) that the FBI rep to Congress basicly just kept repeating: "Yeah but we HAVE to have it!"
The operation of the Demons behind the NSA and GCHQ was never better revealed than when they used their friends that own media outlets like this one (ie., DICE) to ruin the reputation of TRUECRYPT in the eyes of the beta sheeple. Good encryption is EASY. The maths and coding methods have been known for the longest time now. But good solutions are meaningless if the vast majority of people only have access to broken-by-design pseudo-encryption.
While every Alpha who cares knows Truecrypt is as perfect as ever on older versions of Windows, the success of the co-ordinated NSA/GCHQ attack on Truecrypt and its core developers is that first-class general straightforward encryption methods are missing on Windows 8 and Windows 10. The SYNTHETIC push to move to 'new' low function, black-box ridden OSes is 100% designed to remove all forms of control users have over their own computers.
Windows users, for instance, simply wanted a BETTER XP- one built with the expectation that the computer would have resources including 4-core CPUs, gigs of RAM and accelerated rendering. They did not want nor need the hyper-dumbed-down approach typified by Windows 8 and Windows 10- but the demons ensured their propagandists brainwashed BETA SHEEPLE into howling their hatred of anyone attempting to hang onto computing with the practicality of XP programs.
Clean elegant coding and applications allows for clean, elegant encryption. The DIRTY black-box coding represented by 'modern apps' (be they on Win 8, Android or iOS) makes sane encryption IMPOSSIBLE by-design. But sheeple have to be convinced to WANT this terrible state of affairs, so Slashdot spends more time demonising Iran and Russia than ever it spends discussing ways to defeat Apple, Microsoft and Google.
And remember, kids, no so-called 'encryption' provided by ANY commercial entity has any value at all. Worse, these same entities will sell your PRIVATE DATA to the most disgusting criminals for maximum exploitation. The British Government even has this as official government IT policy. Bill Gates and Rupert Murdoch tried to do the same with their inBloom (named after a term Victorian pedophiles used to describe their child targets) database that records all life information on every American child (and is now a core function under the general umbrella of NSA total surveillance).
No sir, perhaps it is bliss but certainly not strength.
fillerfillerfillerfillerticktockticktocktick
the government can get a backdoor built in to encryption then criminals will find it and exploit it, and besides that how can consumers be assured that the government employees accessing your encrypted data isn't corrupt too and going to exploit it too
Politics is Treachery, Religion is Brainwashing
Either the UK government is dangerously incompetent, or fatally stupid. Resignation time, either way. Do you want to be ruled by incompetent or stupid fools?
Discussing this as a "backdoor" conflates this with the usual hidden backdoor which is a bad thing. Putting in a backdoor that is freely accessible and leaves no trace of its accession is ill advised. But I fail to see why there are no technological means to secure keys for multiple parties. you can even have crypto so multiple parties must agree so for example like my safe deposit box the bank and I both have to agree that I am me.
Now that's a different question of whether
1) I might encrypt the data on my own or use a thrird party client that uses googles services but keeps things encrypted in passage. That defeats the abililty to side door googles encryption.
2) I might off shore my data to someplace outside such laws (do I trust them is another matter).
3) the dent this might cause in googles popularity outside the US--I actually doubt this since de facto it has been the case in the past that the NSA had free range of google and no one cared deeply. But Will china also demand that google also let it have side door access as a condition of doing bussiness there? Still while a mess it's not technologically difficult.
4) an even stickier issue might be who all has to agree to unlock the data. Google+NSA. Google+China. those are doable. but Google+NSA+China is a problem. China might not want the NSA peeking at chinese national accounts without it's permission. Nor perhaps North Korean or any number of disputed places the NSA is interested in.
So there's a political mess here and some ways consumers can defeat it, but I fail to see why someone like Bruce Schneir would say there's no technical means to do this at the level of google or apple or major sites when there plainly is.
Some drink at the fountain of knowledge. Others just gargle.
Hey, congratulations, today you're one of today's lucky 10,000!
The "ignorance is strength" quote comes from the book 1984 by George Orwell. It is a brilliant and very readable work of fiction that depicts a future in which the trends of corruption in government have run unchecked. Many elements of it have proven to be quite prophetic of the modern day, making it a very relevant warning of things to come.
Read it. You will enjoy it and be smarter for it too.
!@#$^%#@^$ I screwed the lucky 10,000 link up in the post and hit submit too quickly. grrrrrrr
Adding a backdoor that is secure is very easy to implement. The government just needs to publish a public key. You then encrypt your private key using that public key and include it with whatever you encrypted. This would be much like the lock box on a house that holds the front-door key that only real estate agents showing the house are supposed to be able to access. And there's no reason it would be limited to just one. Opening a connection to a server in Turkey? Better include lock boxes for both your own government and the Turkish authorities.
The only big hole is the security of the government's private key (or more likely, keys).
The tricky part is that this government lock box has to be added to the common protocols. And how many different protocols would have to be updated? TLS, ssh, PGP, etc. What are the odds of introducing flaws that allow for new attack vectors when introducing the back door? For example, could you trick a victim's computer into thinking it needed to include the lock box for some jurisdiction that you control?
Now while the technical side of this could be made to work, as a public policy, it's a horrible idea. Let's not just say it can't be done and forget about it. We need to fight this as bad policy.
If the government cannot keep it's list of spies secret, what makes anyone think they can manage to keep a permanent backdoor quiet? Every malevelont actor in the world will try to find it, pay for it, etc. Such an opening would potentially be worth Dr. Evil kind of money.
It's just as stupid as that jackass Hatch from Utah wanting to blow up PCs that download music. Legislators are fools. And worse, most are old fools.
MR. POTATO HEAD! Backdoors are not secrets!"
The only kind of backdoor I'm interested in is the one on a nubile girl's bottom.
Not backdoor. Comey wants you from the front, all the better to see you writhe and squirm.
If one ways to damage from the two groups: terrorists and criminals having secure encryption or governments having a backdoor to all encryption, hands down far more damage is done to civil rights and liberty by governments worldwide. I'd rather find other ways to curtail terrorism and crime than let governments have tools for oppression of civil rights and liberties.