Comment by revelation | Hacker News Reader

Comment by revelation | Hacker News Reader

This thread perfectly demonstrates why injunctions on free speech are evil. We could be reading their paper now instead of contemplating what this piece of low-effort journalism could have possibly meant.

The rash of high tech car robberies, I think, used the OBD port to reprogram the car to recognize their fake key. Like a dealer would. So they didn't break the actual crypto, as is claimed here.

The software that is referenced here could be the software VW distributes to dealerships to reprogram the car when a customer lost their key. So thats certainly one possible way to find out how the crypto system works, by the interaction of the software with the car.

The article also mentions decaping the actual ICs that do the crypto. Thats a very time intensive way to find out how a crypto system works, but it may be the only one when you are dealing with fixed master keys and propietary algorithms. If the keys alluded to here are actually master keys, burned into every car, then they should certainly be published along with the other results, since they are an integral part of the system.

Suppressions of freedom of speech are evil, but not only because they prevent us gaining knowledge. It also punishes innocent activities to protect others against fourth parties - an obvious injustice.

"Finding in Volkswagen's favour, Mr Justice Birss said he recognised the importance of the right for academics to publish, but it would mean 'that car crime will be facilitated'."

If "crime would be facilitated" is to be the criterion of suppressing communications, there can be no digital security and no freedom of speech.

Oh for the days when Western governments had to invoke the threat of terrorism with weapons of mass destruction in order to suppress academic speech.

If I found out your bank account details, would you be happy for me to publish them?

A poor analogy but in general terms, if it is in the public's interest, yes.

Security by obscurity is flawed.

So freedom of speech is only morally necessitated if it's deemed to be in the public interest? That sounds like you're setting a restriction on speech.

That's not what you asked, you asked "would you be happy".

Yes, it was a rhetorical question meant to illustrate that there are some things for which it's not evil to publish. Another example would be the names and locations of victims of spousal abuse that are in refuges.

In any case, if you're being that pedantic, why didn't you notice that I actually asked revelation that question, and not DJN?

If something is in the public's interest, it generally makes sense to disclose it to the public.

For example, if a car manufacturer (or bank) makes public claims that their system is secure, yet they use 56-bit DES keys to encrypt data, then I think the public should know.

Your "account number" analogy was off because it's is generally not in the public interest to reveal a private citizen's account number.

However, if an account number (email address or ip address) was being used frequently to commit crime, say in an advance fee fraud, then it makes sense to blow the lid on the said account number. That's what I meant by "in the public interest".

Security by obscurity means hiding the algorithms, not the keys. In this example account numbers, etc. are the keys

Unfortunately, it is how most of the banking world right now works. It is quite easy to initiate transactions and create accounts knowing a few basic numbers about you - bank account numbers, name, date of birth, SSN number (I'm talking about the US of course), home address. And it is very hard to change or hide many of these numbers and data items. The system is very fragile right now, and the only reason why it works is that overwhelming majority of users aren't crooks and losses from the crooks are small enough to be covered without triggering move to a more resilient system.

There are millions of people who are deeply, deeply unhappy every time information about birth control is published. Is that the standard we want free speech to be held to?

If there's a good chance that the bad guys already have these and that the only way to force the banks to fix their vulnerabilities is to publish them, then yes.

Yes? ^^;

(Preferably to me first, but still.) If you've got them, then chances are I'm screwing up somewhere. I'd like to know so that I can do something about it.

Reply on news.ycombinator.com