Hacker News Reader

Comment by Asooka | Hacker News Reader

Regulate encryption like you regulate heavy weapons. You can carry a gun, but you can't carry an assault rifle. But you can get special permission for special cases.

Yes, the master key for your SMSes will be leaked pretty quickly, but every business with a legitimate use for encryption will be able to use it. In the end your bank account will not get hacked, terrorists will continue using strong encryption, but law enforcement will be pacified.

View on HN

"every business with a legitimate use for encryption" is "every business" (SSL and SSH, remember?). "Every business" is "every person", given sole corporations.

> In the end your bank account will not get hacked

Equifax are still trying to explain to congress whether or not they are encrypting data: https://www.wsj.com/articles/equifax-ceo-to-congress-not-sur...

> terrorists will continue using strong encryption

Terrorists don't generally use encryption, surprisingly. There have been very few incidents recently where the authorities have found themselves with data they were unable to decrypt that might be relevant. The only one I can think of is https://en.wikipedia.org/wiki/2015_San_Bernardino_attack

Regulating math is not something that usually has a good outcome. See the 1897 Indiana Pi Law for a good lesson in unintended consequences.

https://en.wikipedia.org/wiki/Indiana_Pi_Bill

You can't take a gun, put it into a machine, push a button, and have the machine make you a million guns. If you could, gun control would go from difficult and incomplete to downright impossible. That's how encryption is now.

Are you familiar with Defense Distributed, DEFCAD, and the Ghost Gunner? That stuff is already here. Every time I hear someone talk about banning "high capacity magazines" I think how trivial something like that is to 3d print...

I've heard about them a little. This stuff is definitely getting easier, but there's still a world of difference between the difficulty of replicating a gun and the difficulty of replicating a copy of crypto code.

Many banks send 2FA codes via SMS, so I question how my bank account will not get hacked if the master key for SMSes gets leaked "pretty quickly".

> Regulate encryption like you regulate heavy weapons.

They were at one time. Encryption was regulated under the ITAR laws until 1997.

https://en.wikipedia.org/wiki/International_Traffic_in_Arms_...

Didn't the US try that one already?

I believe so: https://en.m.wikipedia.org/wiki/Clipper_chip

I was thinking more of https://en.wikipedia.org/wiki/Pretty_Good_Privacy#Criminal_i..., actually, but that's a good example too.

Reply on news.ycombinator.com