Hot answers tagged

325

"If lack of encryption allows FBI to catch terrorists, then lack of encryption allows criminals to loot your emails and plunder your bank account." The rational point here is that technology is morally neutral. Encryption does not work differently depending on whether the attacker is morally right and the defender morally wrong, or vice versa. It is all ...


79

I would take their argument and replace "cryptography" with "locks and keys on our houses" and see if they still agree: If more terrorists and criminals would be caught by not having locks and keys on our houses, I would not blame warrantless searches by government and companies in our homes.


67

Explain it with questions: Do you close the door when you poop? Why? Everybody poops, you aren't doing anything special in there, so what do you have to hide? If someone leaves a pile of poop downtown in the middle of the road does that mean we must all poop with door open? Simply because the pile of poop was gathered in a bathroom?


57

The thing I haven't yet seen anyone mention is: Ordinary criminals are far more common than terrorists. While crypto might help a terrorist evade the FBI (for a while, anyway) it also helps protect you from ordinary criminals who want to steal your money and hijack your computer for their own ends. The question is, will you concretely give up your safety ...


57

In addition to the points mentioned by Lucas Kauffman I would elaborate on point two: 2.This algorithm generates one extra unique decryption key when used. This key is then sent via a secure channel (i.e. HTTPS or equivalent) to an NGO with the sole duty of guarding these keys. As soon as the tool gets confirmation that it is delivered, the tool ...


45

Imagine if, during the civil rights era, people had access to things like email and smartphones. People like the organizers of the Montgomery bus boycotts would have a little pocket computer that could tell the authorities where they’d been, who they talked to, and what they were talking about. The authorities, at the time, considered these people ...


43

The Zodiac killer ciphers are an interesting case. As there were four ciphers sent to the local papers, I will address each in turn. They do share some common traits however. They are each their own cipher, so the 'solution' used for cipher 408 cannot be applied to the other messages. Each message has a unique character count. The Zodiac Killer sent these ...


34

The NSA convinced IBM that 56 bits was "enough": But whereas Lucifer had a key that was 112 bits long, the DES key was shortened to 56 bits at the request of the National Security Agency. from Practical UNIX & Internet Security In the development of DES, NSA convinced IBM that a reduced key size was sufficient from Data Encryption Standard - ...


34

Would an encryption scheme that generates an extra key to be securely stored offsite be a safe backdoor? No. Simply no. A backdoor is never considered safe. What you are describing is commonly known as a key escrow. Note that there have been issues with key escrows: On a national level, this is controversial in many countries due to ...


31

My response here is likely many in a sea of answers, but here's the breakdown of why encryption is good, why it's vital, and why breaking it is pointless. - Congress investigation found not a single terrorist plot was stopped by the NSA. So it's all taxpayer's cost for no profit See here. FBI Coleen Rowley at the London's whistleblowers conference ...


26

To explain "cryptography" in your scenario requires an understanding of the value of "private communications". It's not about the technology, but about the benefit to society of being able to communicate privately, even from the eyes of your neighbours (i.e. those charged with governing the society). This is more of a philosophical debate than a technical ...


25

bcrypt would be a somewhat better approach because it is designed to be (programmably) slow. Using a large enough salt and a reasonable complexityFactor, bcrypt(salt + number, complexityFactor) should yield a viable hash and you avoid "rolling your own cryptography", which could possibly turn out to be a difficult sell. To increase security you just crank ...


22

You're assuming that they're actually encrypted. A lot of crazy people have written things that nobody understands. Just because the author thinks they're in code doesn't necessarily mean that the code can be reversed.


17

There are potentially other privacy issues you're not considering yet. By design your app makes it easy to see who is connected to a certain target. So an attacker creates one contact on their phone (the activist/informant/terrorist/victim they are interested in) and then connects to many other users through your app, to create a list of the target's ...


16

This is kind of a twisted point to make to anyone who's not familiar with the most trivial details of encryption and security, but I think it stands. Zach still said it best. Encryption is the equivalent of keeping your pants on when you visit the Internet. It should be basic, and it's not our fault that banks and stores are willing to forgo a "no shirt, no ...


16

I agree with the "It protects your bank transactions" answer, but I'd like to add a few thoughts: Even if the government banned encryption or forced a backdoor, it wouldn't stop terrorists. Encryption isn't a physical good- it's a mathematical process. Banning encryption would be like banning adding or multiplying (or large semiprime numbers)- criminals ...


15

When a legitimate law enforcement organization has need of a key to decrypt, it sends a formal request to the NGO. The NGO first analyzes the request based on the importance of the request. the NGO allows decryption when the suspect is strongly incriminated by other evidence, and only in the case of terrorism, murder or abuse of a minor (which are ...


15

I think that a word combo "Safe Backdoor" needs medical attention ;) There's NO "GOOD NGO" and NO UNCORRUPTED GOVERNMENTS - Ed Snowden proved it in depth and in full. The answer to this question is an old Apple's official statement, that said : "it's technically impossible to create a key that will work only in a hands of good guys and in a rightful ...


13

Use the same terrible logical argument that the RIAA used in their anti-piracy propaganda pieces from the early/mid 2000s. You use an armored car to securely move money, encryption is that armored car for transactions on the internet. --or-- You keep your valuables in a safe, so you want to keep your data encrypted. --or-- You keep your front door ...


11

Yes, it is (a bit) flawed. The problem is that the space is too small, so even with the multiple rounds and salts, it's relatively easy to bruteforce. Open Whisper Systems had a witty system where they provided an encrypted bloom filter that can be queried locally using blind signatures. They explain the process (as well as providing a good discussion of ...


9

Key size was reduced to 56 bits because IBM wanted to fit LUCIFER on a single chip. LUCIFER then became DES. Because of the promising results produced by the LUCIFER project, IBM embarked on an effort to develop a marketable commercial encryption product that ideally could be implemented on a single chip. The effort was headed by Walter Tuchman ...


9

The way I like to explain things to people is through movies. Last night I watched the movie Sneakers. The entire plot of the film is about a "little black box" that can break any encryption anywhere. SPOILER After stealing the box from the University Professor who invented it, it gets into the hands of the bad guys- the head honcho himself explaining ...


8

Your friend is correct in that private key encryption is not the tool for the job. This answer on Cryptography.SE does a good job of explaining why. Some highlights: Any public-key encryption schemes is bound to increase the size of the data that it enciphers. While there are more efficient schemes, it is safe to say that a symmetric scheme is ...


7

Asymmetric cryptography has two common use cases: Encryption: You process a message or file with the public key of somebody else. Only he/she can decrypt it with his/her private key. Signature: You process a message or file with your own private key. The message or file itself can be transmitted unencrypted. It is common to process/sign only a hash of the ...


7

I am going to take a bit of a different turn to answer the question. It is impossible to prevent the use of encryption, so everyone should use it. If for some reason encryption were to be banned, what would prevent people from using the current algorithms and transmit data? All data is is bytes so you could not even prove that it was encrypted in the ...


6

How can we do this in a cryptographically secure way and respecting the users' privacy (i.e. without sharing the numbers in plain-text between them or with a server)? tldr: You can't. Hashing is great for certain uses, but this is probably not one of them. The reason is that an attacker would know that there are only 10 billion possibilities (for ...


6

Some disclaimer-like thingy. Others have made very good points which were partly repetitions of the ones others made before and I don't want to repeat them. So I'm just going to add a little extra which happens to be too long for a comment. Also, I realize that this answer doesn't included a whole lot of technical details. That's simply because the ...


6

Either you give the public key to Bob when you physically meet him and mutually verify identities (as at a key-signing party), or Bob verifies your public key through a trusted introducer (e.g. a Certification Authority) This is the "Infrastructure" part of PKI.


5

Let's do some tests! I started with a naive bash implementation, and calculated 10k numbers in 33 seconds: #!/bin/bash phone="2125551212" salt="abcdefghijklmnopqrstuvwxyz" shasalt() { echo "$* $phone $salt" | sha512sum; } for f in {1..10000} do shasalt $(shasalt $(shasalt)) >/dev/null # or write to a file... ((phone++)) done echo ...


5

Try thinking just as much of how you present as much as what you present I'm going to present my argument with a few attention grabbing words here... but in truth what you need to do is start a discussion much life we do here. A good way is to grab their attention. If a knife is used to kill a man, is that knife evil? Obviously the answer to that is no. ...



Only top voted, non community-wiki answers of a minimum length are eligible