Slashdot Mirror
Crypto Experts Blast Gov't Backdoors For Encryption
loid_void writes with a link to a New York Times report about some of the world's best-known cryptography experts, who have prepared a report which concludes that there is
no viable technical solution which "would allow the American and British governments to gain "exceptional access" to encrypted communications without putting the world's most confidential data and critical infrastructure in danger." From the article:
[T]he government’s plans could affect the technology used to lock financial institutions and medical data, and poke a hole in mobile devices and the countless other critical systems — including pipelines, nuclear facilities, the power grid — that are moving online rapidly. ...
“The problems now are much worse than they were in 1997,” said Peter G. Neumann, a co-author of both the 1997 report and the new paper, who is a computer security pioneer at SRI International, the Silicon Valley research laboratory. “There are more vulnerabilities than ever, more ways to exploit them than ever, and now the government wants to dumb everything down further.”
The authors include Neumann, Harold Abelson, Susan Landau, and Bruce Schneier.
You cannot, under any circumstances, convince the government that having a backdoor into all those things is a bad thing.
The Clipper chip was designed by the NSA and had a government-sponsored backdoor. Unsurprisingly, it failed.
Yes... how many times must it be said? Ignorance is strength!
“He’s not deformed, he’s just drunk!”
Who doesn't know that backdoors are there for everyone who finds them and not just those who put it there?
Who would buy a lock from a company that made a master key that was good in all of their locks? Of course, they would promise to only release that key to authorized people. However, it is certain that eventually it will get into criminal hands. At that point, there is lots of money to be made from selling the key. Of course, lock companies could make lots of money off this proposal, but not the one who made the master key. The government might as well give up on a web based economy and go back to paper banking if they start giving out keys to all of the transactions.
And "War is Peace"? Check. https://en.wikipedia.org/wiki/...
"Freedom is Slavery": working on it.
When Phrack republished the NSA Employee Security Manual to demonstrate how porous NSA was for its own security, it backed off.
This is just the same old crap with Edward Snowden or the OPM caper as a counter-example, rather than Phrack.
No sir, perhaps it is bliss but certainly not strength.
the government can get a backdoor built in to encryption then criminals will find it and exploit it, and besides that how can consumers be assured that the government employees accessing your encrypted data isn't corrupt too and going to exploit it too
Politics is Treachery, Religion is Brainwashing
Discussing this as a "backdoor" conflates this with the usual hidden backdoor which is a bad thing. Putting in a backdoor that is freely accessible and leaves no trace of its accession is ill advised. But I fail to see why there are no technological means to secure keys for multiple parties. you can even have crypto so multiple parties must agree so for example like my safe deposit box the bank and I both have to agree that I am me.
Now that's a different question of whether
1) I might encrypt the data on my own or use a thrird party client that uses googles services but keeps things encrypted in passage. That defeats the abililty to side door googles encryption.
2) I might off shore my data to someplace outside such laws (do I trust them is another matter).
3) the dent this might cause in googles popularity outside the US--I actually doubt this since de facto it has been the case in the past that the NSA had free range of google and no one cared deeply. But Will china also demand that google also let it have side door access as a condition of doing bussiness there? Still while a mess it's not technologically difficult.
4) an even stickier issue might be who all has to agree to unlock the data. Google+NSA. Google+China. those are doable. but Google+NSA+China is a problem. China might not want the NSA peeking at chinese national accounts without it's permission. Nor perhaps North Korean or any number of disputed places the NSA is interested in.
So there's a political mess here and some ways consumers can defeat it, but I fail to see why someone like Bruce Schneir would say there's no technical means to do this at the level of google or apple or major sites when there plainly is.
Some drink at the fountain of knowledge. Others just gargle.
Hey, congratulations, today you're one of today's lucky 10,000!
The "ignorance is strength" quote comes from the book 1984 by George Orwell. It is a brilliant and very readable work of fiction that depicts a future in which the trends of corruption in government have run unchecked. Many elements of it have proven to be quite prophetic of the modern day, making it a very relevant warning of things to come.
Read it. You will enjoy it and be smarter for it too.
Adding a backdoor that is secure is very easy to implement. The government just needs to publish a public key. You then encrypt your private key using that public key and include it with whatever you encrypted. This would be much like the lock box on a house that holds the front-door key that only real estate agents showing the house are supposed to be able to access. And there's no reason it would be limited to just one. Opening a connection to a server in Turkey? Better include lock boxes for both your own government and the Turkish authorities.
The only big hole is the security of the government's private key (or more likely, keys).
The tricky part is that this government lock box has to be added to the common protocols. And how many different protocols would have to be updated? TLS, ssh, PGP, etc. What are the odds of introducing flaws that allow for new attack vectors when introducing the back door? For example, could you trick a victim's computer into thinking it needed to include the lock box for some jurisdiction that you control?
Now while the technical side of this could be made to work, as a public policy, it's a horrible idea. Let's not just say it can't be done and forget about it. We need to fight this as bad policy.
MR. POTATO HEAD! Backdoors are not secrets!"
If one ways to damage from the two groups: terrorists and criminals having secure encryption or governments having a backdoor to all encryption, hands down far more damage is done to civil rights and liberty by governments worldwide. I'd rather find other ways to curtail terrorism and crime than let governments have tools for oppression of civil rights and liberties.