Slashdot Mirror
US Congressional Committee Concludes Encryption Backdoors Won't Work (betanews.com)
"Any measure that weakens encryption works against the national interest," reports a bipartisan committee in the U.S. Congress. Mark Wilson quotes Beta News:
The Congressional Encryption Working Group (EWG) was set up in the wake of the Apple vs FBI case in which the FBI wanted to gain access to the encrypted contents of a shooter's iPhone. The group has just published its end-of-year report summarizing months of meetings, analysis and debate. The report makes four key observations, starting off with: "Any measure that weakens encryption works against the national interest".
This is certainly not a new argument against encryption backdoors for the likes of the FBI, but it is an important one... The group says: "Congress should not weaken this vital technology... Cryptography experts and information security professionals believe that it is exceedingly difficult and impractical, if not impossible, to devise and implement a system that gives law enforcement exceptional access to encrypted data without also compromising security against hackers, industrial spies, and other malicious actors...
The report recommends that instead, Congress "should foster cooperation between the law enforcement community and technology companies," adding "there is already substantial cooperation between the private sector and law enforcement." [PDF] It also suggests that analyzing the metadata from "our digital 'footprints'...could play a role in filling in the gap. The technology community leverages this information every day to improve services and target advertisements. There appears to be an opportunity for law enforcement to better leverage this information in criminal investigations."
This is certainly not a new argument against encryption backdoors for the likes of the FBI, but it is an important one... The group says: "Congress should not weaken this vital technology... Cryptography experts and information security professionals believe that it is exceedingly difficult and impractical, if not impossible, to devise and implement a system that gives law enforcement exceptional access to encrypted data without also compromising security against hackers, industrial spies, and other malicious actors...
The report recommends that instead, Congress "should foster cooperation between the law enforcement community and technology companies," adding "there is already substantial cooperation between the private sector and law enforcement." [PDF] It also suggests that analyzing the metadata from "our digital 'footprints'...could play a role in filling in the gap. The technology community leverages this information every day to improve services and target advertisements. There appears to be an opportunity for law enforcement to better leverage this information in criminal investigations."
not only will the FBI & Police be able to get in but also criminals will crack it and get in too, it would be better if the keeper of the keys would cooperate with the FBI & Police and unlock the devices on a per-user basis when a search warrant is demands it so, that way innocent people dont have to worry and quit shopping on line and changing their credit card numbers, and the FBI & Police can still do their investigations
Politics is Treachery, Religion is Brainwashing
While most people start thinking, "oh what a breath of fresh air, the government getting it right for once," I worry, "have aliens infiltrated our government? Because it seems like they are listening experts and making logical conclusions." ;)
Anons need not reply. Questions end with a question mark.
I think we've all seen how good the FBI is at keeping secrets. Any encryption backdoor would be in the wild in a week. In the week before it got loose it would be mostly a political weapon.
That's our life, the big wheel of shit. - The Fat Man, Blue Tango Salvage
you really must like koolaid every so much 'cause you sure have drunk the lot.
Therefore, we will implement back doors immediately. Circumventing said backdoors will, like most bullshit victimless crimes, carry fines and sentences exceeding that of manslaughter.
The backdoors are starting to impact international trade, making US products less appealing. China has also had problems with backdoors, but this allows different countries to become more competitive while the US remains politically divided (preventing them from competing globally in the future, over the long-term).
It almost sounds like they listened to reason for once? Hearing the expert testimony of many experts in the field, enduring the BS babble of the FBI, and came to a logical conclusion?
Now I'm worried that the bodysnatchers have gotten into congress...
I work for the Department of Redundancy Department.
Richard Burr is not a Democrat.
Ooh, moderator points! Five more idjits go to Minus One Hell!
Delendae sunt RIAA, MPAA et Windoze
Because to hell with the experts, he knows more than the experts. SAD!
Ooh, moderator points! Five more idjits go to Minus One Hell!
Delendae sunt RIAA, MPAA et Windoze
Only took them a quarter of a century... (the Clipper Chip plans must have been an internal project for 1-3 years before it was unveiled publicly)
(captcha: "snoops". lol)
All those "smart" people on the McLaughlin Group talked about how apple and the like would put that in their phones that would let the government in while keeping it otherwise safe. Yes I'm being sarcastic. (I've never seen a better example of the "Murray Gell-Mann Amnesia effect" in my life FWIW.)
Did you know 80 to 90% of the moderators on slashdot wouldn't recognize a troll even if one dragged them under a bridge.
Having encryption that can be broken makes it easier for police and FBI to catch criminals, and easier for foreign nations and companies to find out information that the government, police, army, or private companies, want to keep confidential. That should be obvious to everyone but is likely to be ignored by FBI and police because it is a problem, but they don't see it as their problem.
The NSA has argued for a very long time that good encryption is overall better for national security. If there had been a few known cases where criminals got away with crimes because they cracked information held by police or FBI then police and FBI might learn.
I'm sure cryptography experts did in fact say it's infeasible or impractable. That's what those of us who work in the field say about things we think nobody can do (probably). For instance, it's currently infeasible to crack 2048 bit Diffie-Hellman. We tend to avoid saying something is impossible, because as soon as you say that someone's likely to do it :) Theoretically, it's trivial to crack Diffie-Hellman, it's not cracked because of the PRACTICAL difficulty of doing so.
There's nothing theoretically preventing a master key from working just fine, only PRACTICAL problems of a) keeping the government key secret (while it's used) and b) selecting ciphers and implementations that won't be hacked ten years from now. The practical issues mean it's impractical to have a government master key.
While most people start thinking, "oh what a breath of fresh air, the government getting it right for once," I worry, "have aliens infiltrated our government? Because it seems like they are listening experts and making logical conclusions." ;)
You see this a lot.
A stock thing for Congress to do when there's a lot of public pressure over some crisis is to take the pressure off themselves by commissioning a study. By the time the study is finished the crisis is old news and the pressure is gone. The results of the study can then be safely ignored and the Congresscritters can continue to vote the same way as always.
The only thing the study results are usually used for is occasional speech sound bites for proponents of the side that agrees with the conclusions. Since the conclusions don't actually matter, the study groups don't have to be packed to come up with a desired result. So sometimes they come up with something accurate and useful. But it's still noise as far as actually changing anything politically sensitive. About the best thing it does is occasionally help a legislator understand an issue better and/or formulate a better way to present his position.
One example of this is the Second Amendment. Congress commissioned a study on whether the framers intended it to protect an individual right of members of the civilian population to arm themselves as they see fit. The study went deep and came to a resounding conclusion that this was exactly the point. This was reported in 1982.
Then Congress and the executive branch completely ignored the study and continued legislating and enforcing ever more gun restrictions - to this day, nearly 35 years later. Most of the federal level legal changes that favor those who want to buy guns and use them for self defence have come from the Supreme Court, which came to the same conclusion by their own procedures.
Bantam Dominique roosters crow a four-note song. Once you've heard it as "Happy BIRTHday" you can't NOT hear it that way
While I applaud the sentiment about backdoors in encryption (not that I believe for a minute that it will have any effect on what the TLAs do), I can see this being used to push for even more unconstitutional collection of metadata.
To say that I'm stunned is pure understatement!
Chas - The one, the only.
THANK GOD!!!
A master key to our backdoor sounds great for the sheriff and law enforcement, until a criminal forges one and sells them on the blackmarket. Then all the bad guys have keys to everyones backdoor.
What a wank.
"Congress should not weaken this vital technology (cryptography)".
You can't seriously even think of congratulating them on the simple act of recognizing objective reality? Really?
Congress, in all its almighty powers, can't do SHIT about the technology, it's already here. Congress can't weaken it, can't strengthen it, and in fact, can't even talk about cryptography without their collective brains spilling out their ears.
Congress, could, if it were as braindead as it recent performance might indicate to the observant, attempt to make it illegal and unusable in the USA.
And even try to force it's "trading partners" to impose the same restrictions on their own citizens.
But the rest of us, non-US-allied nations, just sit here on the sidelines and watch you shit-for-brains pat yourselves on the back for nothing at all.
Ra-ra USA idiocracy i-wanna-ma-guns pie for the holidays...
What will happen instead is that only state licensed encryption will pass through your ISP's mandatory deep packet inspection (goodbye TOR, Freenet, and VPN). All other types will be dropped and reported to the proper authorities.
“He’s not deformed, he’s just drunk!”
Why is parent downmodded? It's a reasonable question.
...fuck off, and rediscover traditional investigative techniques, instead of relying on the fascist relationships it has with corporations to get the easy access to illegal surveillance it's been reliant on for too long.
Well, it was just a working group. We have no idea whether what they concluded will have any effect on Congress as a whole.
Additionally, they seem to want the companies themselves to have keys... At least that's how I read the bit about law enforcement working to maintain good relationships with tech companies.
So I'm going to hold off on rejoicing, for the time being.
#DeleteChrome
... Hobbits are not Orcs.
(apologies to all the Ents out there. You are not as slow as congress.)
Congress..... did something... right?
Non sequitur: Your facts are uncoordinated.
China has back doors, but they are not as obvious about it. Since they control manufacturing, one wonders if chips are given additional functionality before being fabbed.
only PRACTICAL problems of a) keeping the government key secret (while it's used)
This is what makes it totally impossible. They couldn't keep big secrets like the nuclear bomb - one would think it'd be nice if others really had to do all the development all the way from basic principles. Failing on the big secrets, how could you expect them to keep smaller secrets like a master key that allow full control of one series of phones from one particular brand? Doesn't seem as interesting a secret to keep as "details of a nuke" so it'll get out even easier.
Other governments will want their own keys - negotiated, bought, cracked or stolen. So will the mafia, so will hackers in general.
Sudden outbreak of common sense ....
China has back doors, but they are not as obvious about it. Since they control manufacturing, one wonders if chips are given additional functionality before being fabbed.
I recall that the newest nook tablet has a backdoor. No idea if it was intentional or not.
This seems to be the right answer. My theory is that their ignorance has clouded their poor judgement.
Too bad it's too late. You don't "forgive and forget" when it comes to security, when you fuck up that's it.
What you read is that they are going to stop trying to backdoor encryption and use metadata to fill in the gaps.
The real concern should be 'The report recommends that instead, Congress "should foster cooperation between the law enforcement community and technology companies," adding "there is already substantial cooperation between the private sector and law enforcement."'
^ Intel signed ME/GPU firmware and AMD TEE, plus whatever future exploitable firmware is made available.
They are just saying backdoors for line-level or on-device encryption won't be backdoored, nothing about not putting in exploits elsewhere in the chain, just not in the encryption algorithms/software themselves.
I guess I got my Christmas wish granted. A government finding about "computer stuff" that not only makes sense, it even seems they finally got it.
They ... they might really have understood the problem. I still cannot believe it, it really sounds like they not only went by some hunch or an "expert" recommendation without buying into it, it really seems they finally, FINALLY understood the underlying problem.
I ... I'm kinda scared, government understanding computers, what comes next? If we're not careful, they might even stop wasting taxpayer money. And what kind of government would that be? And more important, what could we ridicule about them and what should we then complain about? Did anyone think about that? What should we feel superior about anymore if the government starts to understand computer problems?
Won't somebody PLEASE think of us professional smug know-it-alls?
We used to have a Bill of Rights. Now, with the rights gone, all we have left is the bill.
Fascinating. What did the study say about the utter uselessness of the militia (as demonstrated by the burning of the Capitol in 1814), the intentions of the Founders not to have a military in peacetime, and the current lack of any organized militia, that being necessary to the security of a free state? Do you imagine that any part of warfare has changed since 1789? Do you feel that muskets and automatic machine guns should be treated identically by legislation? How are we doing on the citizen-farmer thing that the Founders were also in favor of? Is it possible that the conditions under which the 2nd Amendment were drafted have little or nothing to do with the society that has resulted?
I believe that it is only consistent, that if one wishes to argue the Founders' perspective on the second amendment, that if they argue in favor of an individual right to bear arms, they must also argue against the United States maintaining a standing army in peacetime. Furthermore, the Founders would probably not have considered our police forces as anything other than a standing army targeted against the People; certainly no such thing existed during their lifetimes. I am sure your mental gyrations will be fascinating to watch.
Those who advocate genocide deserve every protection afforded by law, and none afforded by common human decency.
Do you think the GOP, the Republican Senators and Congresscritters want Trump listening in on their communications the way he did on Clinton?
Do you think they want *their* emails on Wikileaks, everytime they have the tiniest disagreement with Trump?
Do you think they want having access to their daughters selfies and sexting?
It seems to me, the Republicans spent all that effort undermining democracy, gerrrymandering, disinfranchising, and even taking Putin's lead and using the emails he provided as political capital. And Trump came along and hijacked their election rigging machine. They are not one uniform group yet. I'm sure Trumps 'backer' will now spend a lot of hacker time ensuring compliant Congress members and compliant Senators, and Trump will nip in the bud any attempts at cyber defense. But that if for the future, today, we have these nominally Republican people, and their usurper of power, and they will try to hold onto their privacy against Trump and Putin, even as the NSA is turned and CIA is turned on them.
They already have some other back door in place or are about to implement a we can force you to surrender it all without a court order type law.
I know. But even THIS level of common sense is just jaw-dropping.
I'm just afraid I've been dropped onto Bizarro World or into the Mirror Universe or something...
Chas - The one, the only.
THANK GOD!!!
One example of this is the Second Amendment. Congress commissioned a study on whether the framers intended it to protect an individual right of members of the civilian population to arm themselves as they see fit. The study went deep and came to a resounding conclusion that this was exactly the point. This was reported in 1982.
Then Congress and the executive branch completely ignored the study and continued legislating and enforcing ever more gun restrictions - to this day, nearly 35 years later. Most of the federal level legal changes that favor those who want to buy guns and use them for self defence have come from the Supreme Court, which came to the same conclusion by their own procedures.
Well, it's kind of telling when you live in a country where "constantly carrying lethal force, and being ready to use it to kill any random schmuck" seems a normal rational decision.
To us on in more peaceful countries, you sound like someone asking to introduce a new amendment in your constitution to make it legal for everyone to drive a tank around just to be able to defend themselves against any potential threat - like an invader or a terrorist ramming the crowd with a truck.
And don't start about "being able to oppose a government going rogue". They are much better solution to this problem, starting from limiting the deciding power of your Government : There's this thing called a *direct* democracy, maybe you should try it.
(Or maybe you should actually start writing congress to give you the right to drive a tank around to be able to oppose a government going rogue", and you next step should be yet another amendment for a "people's right to bear nukes")
"Sufficiently advanced satire is indistinguishable from reality." - [Tips: 1DrYakQDKCQ6y52z6QbnkxHXAocMZJE61o ]
... Americans walk into the Lions den eyes & ears wide shut! Can't be accident that eves-dropping Amazon voice-scrapper primes another big current story. An historically minded friend suggests CCing ... all good Trump-voters do ... a 9mm proves very efficient. she continues 'Shoot every AMAZON listening device you encounter - - - BANG - - self-defense, mind just as you shoot-out RED-LIGHT DODGING sensors to fuck local city council.' Now you're on-the-way to liberty. That Janes got-a-gun ...
Apparently Congress switched to bottled water at some point in the past, and started chelation therapy for all that lead poisoning they were suffering from, because this news shows that their brains are starting to work correctly again, they're listening to their tech advisers, and coming to the correct conclusions about encryption. Now if we can just get the FBI to switch to bottled water and chelation therapy, we can get their brains working correctly again, and they'll see that what they've wanted all this time is just flat-out insane.
And then don't forget the cat and mouse game that will continue when the golden key turns out to reveal that the plaintext is actually steganographed ciphertext with a novel non-golden-keyed form of encryption. Sure, most of these new novel forms of encryption will be nothing to the NSA. But then market forces will propel those with the most to gain from secure communications developing the most secure ciphers. And at that point, none of the idiots are going to admit that the whole farce was a waste of time to begin with, since they were able to leverage the FUD to secure themselves some cushy government paychecks for a few decades.
Joy to the world folks.
I'm sure cryptography experts did in fact say it's infeasible or impractable. That's what those of us who work in the field say about things we think nobody can do (probably). For instance, it's currently infeasible to crack 2048 bit Diffie-Hellman. We tend to avoid saying something is impossible, because as soon as you say that someone's likely to do it :) Theoretically, it's trivial to crack Diffie-Hellman, it's not cracked because of the PRACTICAL difficulty of doing so.
Since the government's position is that "limited" is any duration of time which is bounded, I do not know what they are complaining about. Under that definition, any encryption key can be cracked in a limited amount of time.