James X. Dempsey, vice president of the Center for Democracy and Technology, an Internet policy group, said the proposal had “huge implications” and challenged “fundamental elements of the Internet revolution” — including its decentralized design.First reaction: "ugh".
“They are really asking for the authority to redesign services that take advantage of the unique, and now pervasive, architecture of the Internet,” he said. “They basically want to turn back the clock and make Internet services function the way that the telephone system used to function.”
Wait, they expect that the liberal base is going to enthusiastically go to the polls in November, for this?Look how many Obama supporters not only forgave his vote for telecom immunity, but actually went around insulting and condescending to anyone who complained. "The perfect is the enemy of the good! blah blah blah"
Our leaders have an average IQ of 6. We're apparently not much brighter if a proposal this blatantly unconstitutional gets any legs at all.What's unconstitutional about it? Remember the commerce clause. The government probably pass a law saying that if you sell or otherwise profit from software with crypto, you have to provide and intercept mechanism of some sort. The Supreme court has actually decided that the commerce clause applies to things you do as an individual by yourself (The test case for this was growing wheat)
The next step would be to ban the import of non-compliant cryptographic software and prevent the sale of any software that includes non-compliant cryptoThe next step is to get the EU on board -- they seem to love spying on their populace. And then Crypto products come from where, exactly? China?
This gets complicated though, say that the BES server is located in The Netherlands and used by American citizens in the US to communicate? The messages are routed through RIM's NOCs in Canada, but not decrypted there. Who is the service provider? Is it RIM for selling the product and maintaining the network, or whoever controls the BES servers. If it is RIM, then all that will happen is that they or a competitor will modify their architecture to prevent being defined as a service provider.Those are technical problems and ones that wouldn't be too hard to solve. The idea that because this is somehow "hard to do" with existing infrastructure is some kind of protection is absurd. Look at Sarbanes Oxley, which cost businesses a ton of money to implement. Or the additional burdens that the Patriot Act placed on banks and financial institutions.
Several privacy and technology advocates argued that requiring interception capabilities would create holes that would inevitably be exploited by hackers.What could possibly go wrong?
Steven M. Bellovin, a Columbia University computer science professor, pointed to an episode in Greece: In 2005, it was discovered that hackers had taken advantage of a legally mandated wiretap function to spy on top officials’ phones, including the prime minister’s.
“I think it’s a disaster waiting to happen,” he said. “If they start building in all these back doors, they will be exploited.”
If you can't crack a message, can you prove it's a message? (That a string of bits is an encrypted message and not simply someone's favorite string of bits?)In a perfect world, (mathematically speaking), no. One of the properties of strong crypto is that the ciphertext is indistinguishable from random data. In reality, there still has to be some method to transport those bits to the intended recipient, even if that method doesn't explicitly specify the recipient. (Like a public-key encrypted message posted on a message board, for instance.)
By extension, shouldn't the government be allowed to compel a service provider to give it open access to an individual's communications pursuant to said warrant?The problem is, what if there is no service provider? How would it work then? The government would need the ability to undetectably decrypt all communications between individuals.
Still, you can always apply your own encryption on top of anything the network adds. The 5th amendment guarantees you can't be required to give up your own encryption key, but those same protections don't apply to network operators; they're mere middlemen.Unless I read this wrong, that's not what this is suggesting. According to what the linked article suggests, the idea is that they would require "Developers of software that enables peer-to-peer communication must redesign their service to allow interception." You apply your own encryption with what software? That software company would be required to maintain a mechanism by which your messages could be decrypted, in the event of a wiretap order. I guess you can implement your 2048-bit RSA and 256-bit AES with a pencil and paper, but honestly, I don't have that kind of time.
Use a minimum of 2048-bit RSA and 256-bit AES and your communications are secure from eavesdropping. SSL/TLS FTW.
« Older The BBS scene in China. Here, here and here.... | Small Change: Why The Revoluti... Newer »
This thread has been archived and is closed to new comments
posted by phrontist at 4:07 AM on September 27, 2010 [29 favorites]