Hacker News Reader

Comment by mediocrejoker | Hacker News Reader

> Just like they control the sale of explosives, for public security, they can also require Microsoft, Apple and Google to put in a master-key. And I don't see a problem with that.

The problem is that there's no good way to control that master key. What do you do with it? Lock it on an encrypted USB drive in a fire proof safe bolted to the floor under the google headquarters?

That works until a police agency wants to use it. And then another.

How many people do you think you can reasonably give this key to before someone who isn't "supposed" to have it gets their hands on it?

What happens when a criminal gets his hands on the master key that unlocks every encryption made by apple, google and microsoft?

View on HN

Regulate encryption like you regulate heavy weapons. You can carry a gun, but you can't carry an assault rifle. But you can get special permission for special cases.

Yes, the master key for your SMSes will be leaked pretty quickly, but every business with a legitimate use for encryption will be able to use it. In the end your bank account will not get hacked, terrorists will continue using strong encryption, but law enforcement will be pacified.

Regulating math is not something that usually has a good outcome. See the 1897 Indiana Pi Law for a good lesson in unintended consequences.

https://en.wikipedia.org/wiki/Indiana_Pi_Bill

Didn't the US try that one already?

I believe so: https://en.m.wikipedia.org/wiki/Clipper_chip

I was thinking more of https://en.wikipedia.org/wiki/Pretty_Good_Privacy#Criminal_i..., actually, but that's a good example too.

You can't take a gun, put it into a machine, push a button, and have the machine make you a million guns. If you could, gun control would go from difficult and incomplete to downright impossible. That's how encryption is now.

Are you familiar with Defense Distributed, DEFCAD, and the Ghost Gunner? That stuff is already here. Every time I hear someone talk about banning "high capacity magazines" I think how trivial something like that is to 3d print...

I've heard about them a little. This stuff is definitely getting easier, but there's still a world of difference between the difficulty of replicating a gun and the difficulty of replicating a copy of crypto code.

"every business with a legitimate use for encryption" is "every business" (SSL and SSH, remember?). "Every business" is "every person", given sole corporations.

> In the end your bank account will not get hacked

Equifax are still trying to explain to congress whether or not they are encrypting data: https://www.wsj.com/articles/equifax-ceo-to-congress-not-sur...

> terrorists will continue using strong encryption

Terrorists don't generally use encryption, surprisingly. There have been very few incidents recently where the authorities have found themselves with data they were unable to decrypt that might be relevant. The only one I can think of is https://en.wikipedia.org/wiki/2015_San_Bernardino_attack

Many banks send 2FA codes via SMS, so I question how my bank account will not get hacked if the master key for SMSes gets leaked "pretty quickly".

> Regulate encryption like you regulate heavy weapons.

They were at one time. Encryption was regulated under the ITAR laws until 1997.

https://en.wikipedia.org/wiki/International_Traffic_in_Arms_...

Reply on news.ycombinator.com