Inside The Federal Bureau of Way Too Many Guns | Hacker News Reader

Inside The Federal Bureau of Way Too Many Guns

gq.com

Someone should come up with a way of cryptographically storing those records so that you can go from model+serial -> purchaser without the ability to do the reverse. That way the feds get what they say they want, but in a way that isn't isomorphic to "gun registry".

This article also does an incredibly poor job of describing why people want to avoid a gun registry.

> Someone should come up with a way of cryptographically storing those records so that you can go from model+serial -> purchaser without the ability to do the reverse. That way the feds get what they say they want, but in a way that isn't isomorphic to "gun registry".

Serial number ranges are fairly well-known for gun manufacturers. What stops the feds from brute-force querying the whole database?

Federal law enforcement agencies have a long, sordid history of bending if not outright breaking the law, so “we specifically made a law so they couldn’t do that” isn’t a sufficient answer.

> This article also does an incredibly poor job of describing why people want to avoid a gun registry.

It’s pretty obviously written with a bias if not an outright agenda in favor of more gun control. Fairly representing opposing viewpoints is increasingly unfashionable in journalism these days, in favor of an attitude of “we know best and it’s our job to tell you what to think”.

> What stops the feds from brute-force querying the whole database?

What if the encryption was such that it took a computer ~ five minutes to decrypt the name?

That’s still a speed up over the current system, but makes brute forcing impractical as decrypting 100 million records would take about a thousand years of compute. It would also enable auditing of who is doing the decrypting and who is being decrypted.

> What if the encryption was such that it took a computer ~ five minutes to decrypt the name?

Perhaps if there was a way to future-proof (unknown-capability-of-NSA-proof), this could work. I can imagine the theatrics the media would put on if this slowed the police down enough to fail to prevent a murder... I prefer the “no records at all” approach.

NSA isn’t likely to tacitly compromise whatever unknown capabilities they have in order to participate in domestic law enforcement. I’m much more worried about ATF-proofing and FBI-proofing the system than NSA-proofing it.

Also, to be blunt, 1,000 compute-years is no barrier to the NSA anyway.

Congress should pass these kinds of no-database laws more often, and mandatory destruction of records at the end of any mandatory retention periods.

Reply on news.ycombinator.com