Hacker News Reader

Comment by danbruc | Hacker News Reader

I'd rather prefer they store my encrypted data forever over storing my unencrypted data for five years. Yes, they might be able to break the used cipher during my lifetime but there is at least a (good) chance that they will never see my data in plain. Therefore I have to completely disagree with the headline.

View on HN

XKCD once had a very salient comic on this point: https://xkcd.com/538/

The idea being, you think they can't break your encryption, but they can just break your fingers one by one until you tell them the password.

It's not really useful in defending this point because the threat doesn't scale.

The NSA can't hire enough heavies to break fingers of every person sending and receiving encrypted data (assuming they could even find the people sending and receiving it without first decrypting).

Could be a new jobs program.

The difference is, if the assumptions/reassurances about the math/crypto/physics hold, I can be _reasonably_ sure that if they haven't broken my fingers or hit me with a wrench, they've probably not read my email/files. That knowledge of whether they have or haven't "broken my crypto" is of value.

So you're saying: don't force the NSA to get a court order and force you to reveal the unencrypted data, just hand it over to them now so they can look at it any time they want?

Only if you care about your fingers.

At this point, no one has to worry about that if they aren't being individually targeted. I think most people just want to avoid being sucked up in a dragnet along with everyone else and having their communications permanently on record.

HTTPS with perfect forward secrecy is passwordless :P Right?

True, but that only applies to data in flight. For everything you want to store and look at again you better have a key - otherwise you could just delete everything and arrive at essentially the same result.

All perfectly true, but you've at least made it a bit harder for someone to break your encryption without your knowledge and monitor your communications on an ongoing basis.

AKA "rubber hose cryptanalysis".

I agree with this, especially if you keep in mind that there will probably be a large gap between being able to decrypt today's data in individual cases and being able to crunch it on a large scale.

Reply on news.ycombinator.com