Hacker News Reader

> I would say that getting a Gun in the US or even in Europe (especially since the eastern European and Balkan states have joined (officially or unofficially Schengen) is by far easier than setting up your own secure crypto from scratch.

No, it is far easier to download an openbsd cd image from canada than it is to physically carry a gun.

OpenBSD cd image would give you absolutely nothing when it comes to defending against state level actors sorry. And you are assuming that in their proposed reality that would be as easily achievable as it is today, you'll be surprised how effective can a crackdown be once a government sets its mind to it.

So nothing in the current OpenBSD images would be banned then?

Hence 'download from Canada'.

You are living in a delusion, they can't crack the standard encryption that comes with openssh, and that is the type of thing they want to ban.

People can easily hide data streams inside video-streams/ text-files/images to circumvent trivial screening. The government won't be able to do anything effective without massive costs and draconian measures. Not to mention people outside the US can carry on however they like anyway.

You've missed the 2nd half of my post I see, I said that if any even half arsed measures are going to be in place the crackdown will become more effective with time. If you can stall or slow down the evolution of open encryption sufficiently so state actors can catch up then that's effectively makes that encryption useless. Today for example the NSA can break weak DSA configurations, and factor weak RSA keys in 2-3 years they'll gain other capabilities.

What will happen if say we do wake up to a post quantum world with much of our asymmetric cryptography being worthless. Do you really see people being able to develop a new RSA level family of algorithms at a hackaton?

If you can't increase the work that needed to be done to break your encryption at the same rate as your adversary increases their capabilities you are going to lose and lose badly.

And draconian measures and extreme costs is just what they are proposing, I'm not advocating that it's going to be effective at first or cheap, but dismissing it as even if they want too they will never be able too is just as foolish as voting for Trump ironically to give him a sympathy vote.

Go ask people from East Germany, pre-Glasnost Russia and even some countries that exist today how easy it is going to be to evade surveillance enmass.

You should never be dismissive of threats no matter how far fetched or unlikely they are or how incapable your opponent at executing them might be, this is probably one of the more important lessons one can take from history.

There are a variety of algorithms which are safe in a post-quantum crypto world. Developing and deploying them will take time, but they exist. Making them safe will take longer, but it will happen.

The threat you describe sounds like a race. But in fact, it's more like a switch. Right now the world is pre-quantum. When the switch is flipped, to post-quantum, a lot of algorithms will break. But not all of them.

See http://pqcrypto.org/ for some interesting reading.

Post-Quantum Cryptography, Bernstein, 2009: http://www.e-reading.club/bookreader.php/135832/Post_Quantum...

Regarding your point, I don't think that people here are being dismissive of your ideas. You're quite right. But there are reasons to be positive about the future, while highlighting the negatives. Isn't it so interesting that certain algorithms can be safe in a pqcrypto world?

Notice where the algorithms spring up from. You mention a hackathon, but that's not where these algorithms root. They're from universities. And universities are interesting. If the legislation will face resistance, it will probably be from academics, like in the last crypto war.

Today there won't be much issues, I'm talking about a reality in which your Government (doesn't matter if it's the US, UK, Germany or China) is not only not helping you to build strong crypto (which they always done so in the past), but actually is working against you.

How easy would it to work on open encryption software if we'll have to revert to the Pre Bernstein V. United States era (which wasn't so long ago) and one that might actually be more heavily regulated than (restriction on actual work on encryption and related field rather than exporting software) before? Heck Phil Zimmermann almost ended up going to jail when PGP was "leaked" outside of the US, and this isn't East Germany, this is the US in the mid 90's.

https://en.wikipedia.org/wiki/Bernstein_v._United_States

And I'm saying, yes, you're right. But have hope. That's something to watch out for going forward, but we can go forward.

This thread's article is interesting, because it's the first step toward a world you describe. But reason has a way of prevailing. Not always, but usually.

One thing that's missing now, that someone here might want to cook up, is a good explanation. The topic of crypto is difficult. Not just because it's hard like calculus, but because there are a lot of subtleties. Old analogies to locks and doors aren't really applicable. What we need is a way of highlighting what's going on, why people should care, and what they can do.

> you'll be surprised how effective can a crackdown be once a government sets its mind to it.

Effective like prohibition was? Or the war on drugs? All that will happen is people will stop using macOS and Windows because that is all the US government can pressure.

Are you trying to compare the amount of people that can distill moonshine or smuggle drugs to the amount of people capable of writing secure encryption software?

The effectiveness of limiting proliferation is tied directly to the difficulty and the scarcity of the human capital involved, this is why restricting the proliferation of small arms which can be build by anyone with some machining experience is near impossible, but limiting the proliferation of say nuclear arms and technology is quite possible.

It would surprise me if the NSA (or any other agency) doesn't have a list of all or most software engineers and mathematicians which are capable of designing crypto, that mailing list isn't that big.

No, the number of people who can copy a file.

I've yet to hear anything about state level actors surreptitiously accessing an OpenBSD system.

Are you claiming that OpenBSD never had or has exploits that the NSA could or can use to access systems running it? Because if so that would be a heck of a lofty claim.

Given the context, he probably meant cracking a private key given just the public key and accessing servers at will.

Give that context as well then, what type of private key? because quite a few they did managed....

> I won't go that far, I would say that getting a Gun in the US or even in Europe (especially since the eastern European and Balkan states have joined (officially or unofficially Schengen) is by far easier than setting up your own secure crypto from scratch.

This is laughable. Getting a gun legally or illegally is harder than downloading a basic Tails live cd.

> Just look at how hard it was to get decent (for the time) encryption software when the US and most countries treated it as highly regulated commodities, and that was without an intentional crackdown on everyone who writes and distributes such software.

Um, I assure you that the US Government was quite serious about preventing encryption export.

You are also ignoring history. It was far harder to get an operating system image, period. It was more cost effective for me to drive to a store and buy a physical CD than download over an internet connection in 1996. The retail channel is fairly easy to control--nobody is going to spend the money to press CD's and publish something that will get them raided by US marshals.

This has changed. Dramatically. Between higher bandwidth and bittorrent, you probably couldn't stop the distribution on an OS image, nowadays.

I agree. Also ,just the knowledge that someone is using illegal encryption(non backdoored) is very valuable from an intelligence standpoint since it directly points on highly suspicious people,and also reducing legal blocks towards their inquiry.

And it seems possible to build a system that detects such illegal usage ona web scale.