Tim Berners-Lee: Spies' cracking of encryption undermines the web

The title is somewhat unclear, but the issue TBL has is not the cracking itself — as he notes this is a risk and race the internet normally faces — but the deliberate weakening and introduction of flaws into cryptosystems for the purpose of later snooping:

> it's naive to imagine that if you introduce a weakness into a system, you will be the only one to use it. A lot of the IT industry feels that's a betrayal. [...] The two governments have elevated the fight against organised hacker gangs and militarised cyber-attacks from states such as China to the rank of a top national security priority. Yet at the same time their spying branches have actively aided cybercriminals by weakening encryption.

and the effect this has on users through lowered confidence in the privacy of exchanged information.

>>if it is breakable, then it is not good enough.

And if the agencies are steering people towards crypto they know is broken but the public do not?

There is no free lunch. Securing your communications against every possible attack has a cost. If the cost is so high that even the intended recipient cannot pay it, that may be as bad or worse than transmitting in the clear.

It will always be an arms race between defenders and attackers, because the cost of everything changes over time. You will always have to worry about some genius getting struck by a satori that makes your entire encryption scheme worthless.

The problem is akin to someone in the shipbuilding business worrying about the discovery of a beam that can reduce the strength of a 1-cm thick steel plate to 1-cm thick toilet paper--and the effect is not attenuated by normal matter. The inventor could build a facility in the hinterlands that could instantly and tracelessly sink any steel ship, anywhere in the world.

That is what encryption designers are up against. TBL is upset because intel agencies have been quietly quashing non-vulnerable schemes and/or actively promoting vulnerable ones, paying no heed to the possibility that their enemies might also have some geniuses, or that their own geniuses' ideas might replicate and leak outside of their info-fortress.

I do find this an interesting notion. Because the internet transcends national boundaries and government jurisdiction, it encourages people to think of themselves as part of a global humanity, without loyalty to a specific government or group, and without loyalty to those who try to invade privacy for corporate or nationalist reasons. It's easy to forget that the concept of nation states and nationalism is a relatively new one and not necessarily worth of respect. Perhaps the internet and sharing and protecting our own data will help to obsolete nations and encourage people to be loyal to ideas, not brands or polities.

Go take your misinformed whining somewhere else. HTML5 does not have DRM. It merely standardized an API to allow media content to talk to a content decryption module. But there is no actual DRM in there.

You are right, though, that this will have a pretty big impact on the average user's web experience. Namely, it will let them view protected content without requiring proprietary plugins (e.g. Flash, Silverlight, etc). So it's pretty good for the average web user.