Crypto Restrictions Are Taking Over the World 370
zeke writes: "An article on SecurityFocus details how forced key escrow and other crypto restrictions have taken root around the world, in countries like France, South Africa, the Netherlands and the UK. Ironically, this leaves the United States -- the birthplace and graveyard of the Clipper Chip -- as one of the few bastions of unregulated encryption."
only US citizens can read this: (Score:2, Funny)
W$LTJLW$#JT
LSDJFLK$JLK$^J%@LK^JL#^
decode that message with the decoder ring you got with your SS#, and get the coorinates for osama.
Re:only US citizens can read this: (Score:2, Funny)
Re:only US citizens can read this: (Score:2)
Re:only US citizens can read this: (Score:2)
if you have an NMB power supply, it is a ticking time bomb... oh, and if you have other systems plugged into the same surge protector that doesn't have filtering between the outlets, all the other computers will be fried too. that is $2500 of experience for free.
U.S. Encryption (Score:3, Insightful)
Besides, we all know the NSA's top top top secret quantum computer can break any encryption quickly...
Re:U.S. Encryption (Score:2)
Top secret quantum computer?
The one made by Microsoft [slashdot.org]?
Re:U.S. Encryption (Score:2, Funny)
The one made by Microsoft?
No, not that one. The one which Microsoft doesn't even know the source code for. They just plugged it in and because it began working, it had solved the problem of its own programming.
It only works successfully because they haven't tried to fix it, and as soon as they look at the code it will quit working because that is now the predetermined outcome.
Re:U.S. Encryption (Score:2)
You're question is stuck in the classical physics realm and doesn't even apply to the NSA's quantum computer. All of the possible frames exist simultaneously in a superposed state.
The computer resovles directly to the actual outcome and prints your final score. This allows you to play more Quake than ever before possible, without wasting any of your valuable real life time.
Quantum Quake (Score:2, Funny)
Unfortunately, this just means that a quantum computer quickly determines if you won or lost. It doesn't help you play any better nor worse, merely to calculate your ranking faster.
Of course, you have to use the mod which lets you carry around sealed boxes which you open whenever you meet an opponent. You can play faster with Smell-O-Vision, as you can tell faster if a cat is dead or not.
And Canada (Score:3, Interesting)
That's one of the reasons for which Openbsd is developed there.
Re:And Canada (Score:3, Interesting)
We have a specific exemption for open source or free software. Commercial apps still have regulation (although less ornerous than the US)
Re:And Canada (Score:2, Insightful)
Re:And Canada (Score:2, Funny)
Re:And Canada (Score:4, Interesting)
I'm playing Devil's Advocate here, I'm not saying it's right. I think the mentality might be along the lines of "Yah well it sure sucks that we weren't able to bust Al Capone on anything but IRS dodging."
It's very possible that they're looking for ways to define 'accomplice'. Let me put it another way: Lots of people were involved in executing 9-11. But besides the hijackers (that died), how can we punish the other people involved? Well, if they used illegal encyrption to communicate, they could be arrested and pulled out of the plan of the next attack.
Again, I'm playing Devil's Advocate here. I'm explaining what their reasoning probably is, I'm not saying that I support it or that it'd even work. I'm saying that I could see some old powerful fart using reasoning like that.
Re:And Canada (Score:2)
Re:And Canada (Score:2)
In some scenarios yes, in some no. My guess is that with a law like this, it'd be easy to sniff out Osama sympathizers and get them the h377 out of our country.
Problem is I'm not sure that I'd be willing to give up personal freedoms just so they could do that. Too bad they don't enact laws like a contract. "This law is only good for one year and is up for renewal afterwards."
Heh.
Re:And Canada (Score:2)
Kindof like the shazz that started happening in NYC when they "cracked down" on jaywalking.
Re:And Canada (Score:2)
Im not right about anything. Heh. Who knows what's going on in the minds of the people that propose these things. I'm really curious what their real agenda is.
" Kindof like the shazz that started happening in NYC when they "cracked down" on jaywalking."
What shazz was that? I'd go look it up, but I'm curious about your PoV on it.
Re:And Canada (Score:2)
So, the cops arrest him for jaywalking, and bring him to the station, where they discover that he had an outstanding warrant. In this case, it was very fortunate that the cops could arrest him, 'cause he was really a crook. But the idea behind the arrest is kindof messed up. Like 90% of New Yorkers jaywalk every day. Just follow anyone you suspect until they jaywalk and you can arrest them?
Iduno. Maybe it's not that messed up, but it struck me pretty bad.
Re:And Canada (Score:2, Interesting)
Who says they`re after organized criminals? I always assumed these `anti terrorist` laws will be used to harass the general public, in the same way that drug laws have been (or the anti-terrorist laws in the UK, come to that, unless you can point me in the direction of some black IRA members).
Re:And Canada (Score:2)
Criminals use codes and obscurity as well, but they also use encrpytion.
Re:And Canada (Score:5, Informative)
Electronic Frontier Canada's Crypto Page [mcmaster.ca]
A Notice to Exporters, part of the Canadian Export and Import Permits Act: "Export Controls on Cryptographic Goods" [dfait-maeci.gc.ca]
A speech by John Manley from 1998, then the Minister of Industry: Canada's Cryptography Policy [ic.gc.ca]
The Canadian government's cryptography website: Cryptography/Cryptographie [ic.gc.ca]
I have somewhat of a stake in Canada's crypto laws, as I've been writting and maintaining a strong cryptography extension for PHP which uses the Crypto++ library. Of course, my code itself contains absolutely no cryptographic code, it just links to the aforementioned library, but still...
J
Germany ... (Score:5, Insightful)
Re:And Canada (Score:2, Interesting)
Re:And Canada (Score:2)
ostiguy
Re:And Canada... Ireland (Score:2, Informative)
The ECommerce Act
in Ireland approaches it as follows: Not perfect, but I have seen worse. There are also expressions that people are entitled to use the strongest available forms of encryption, and should be encouraged to do so
Re:And Canada (Score:2)
Encription at TIPS (Score:2, Funny)
Which turns out to be ok (Score:3, Funny)
What about recent H2K2 stuff? (Score:3, Insightful)
So what can we do about it? Could Peek-a-Booty or the Six/Four protocol be used as springboards into more user-friendly crypto applications? Are there any other free/OSS projects to bring crypto to the masses? (Because God knows your average user couldn't figure out PGP or GPG if his life depended on it.)
We could argue the other side of the coin... (Score:2)
Probably just wishful thinking but I'd love to see it tried.
Re:We could argue the other side of the coin... (Score:5, Insightful)
'The terrorists' are the guys that have the finance to develop and use illegal-level encryption (it's not really the biggest crime they'll commit). Same goes for other big time criminals. They have more to lose with low encryption (which the police can read) than high encryption (which wiull just give them a $20 fine)
Only small-time criminals with no resources and normal citicens will be forced to downgrade their encryption, making it easy for big brother to read their email....
Re:We could argue the other side of the coin... (Score:2, Interesting)
The lawmakers don't understand the technology so if someone gives them a case where restricting encryption actually benefits the "evil hacker terrorists" by being able to spy on us because we all have weak encryption. (and yes regulation or not the terrorist's encryption will be just fine)
Its a case of playing the same game the lawmakers do, it doesn't really have to do with what the terrorists can get their hands on.
Re:We could argue the other side of the coin... (Score:2)
Fair enough, and yeah, they could be.
> Are we arguing that the "the terrorists" (tm) could be hacking into communication networks and gaining vital information from everyday conversation? It seems just as plasable.
I'm not sure if anyone's argued that. Personally, I'd find that argument pretty far-fetched.
We're talking about guys who use the Journal of Irreproducible Results (a source of "science geek humor") as a source for their nuclear weapons plans.
We're talking about guys who can't seem to figure out that soggy fuses in shoes won't light reliably. (Thankfully.)
We're talking about guys whose only successful operation above the level of truck-bombing was to steal a piece of 20th-century technology (jet aircraft turned into flying bomb) using 11th-century technology (knives and physical intimidation) and the knowledge that up to September 10, 2001, passengers had been trained to cooperate with hijackers in the hope of eventual release.
So no, I don't think Al-Queda is capable of intercepting useful communications from US citizens.
And furthermore, given NSA's public statements on their difficulty in dealing with the deluge of data they intercept -- it's pretty obvious that "the terrorists" (or even terrorist states) lack the technology to use such information, even if they had a live stream of every byte passing through MAE-East.
While it's never wise to underestimate one's enemy, and while securing government, military, or corporate communication systems (whether you suspect terrorist monitoring thereof or not!) is a Good Thing, it seems pretty obvious to me that our enemies simply aren't capable of intercepting much .gov, .mil, or .com traffic, let alone Joe and Jane Sixpack or Slashdotter's. Encrypting your emails doesn't secure 'em against the terrorists, because the terrorists aren't intercepting your unencrypted mails.
A high-tech war in which everyone needs secure comms could be kinda fun. But it's not the kind of war we're fighting today. (Maybe in 50+ years when nanotech takes off, and microscopic self-replicating listening devices become ubiquitous, and maybe against a nation with enough nanotech designers to make it interesting. But not today, and not against this enemy.)
BBC got an artical as well (Score:2, Informative)
We`re all doomed!!! doomed i tells ya!!
Irony? (Score:3, Insightful)
It may not be free beer (no EU-style social safety net), but you have all the opportunity that you can make for yourself.
Re:Irony? (Score:2)
USA: 699
Russia: 644
UK: 125
Germany: 95
Japan: 40
Do you believe in death after life?
I wonder about e-commerce (Score:3, Interesting)
Consider that most users aren't even really aware that they are encrypting their internet traffic. It's done by behind-the-scene transactions between their browser and the remote web site. The user never invokes any encryption software, and never sees the keys.
Will we eventually see cases where a poor baffled user is arrested and charged with illegal encryption, when what they really did was order a pair of socks from llbean.com?
Re:I wonder about e-commerce (Score:2)
I seriously doubt it, because that form of encryption is mostly illusory. The government can read/MitM that traffic anyway, so why bother arresting anyone over it?
Web crypto's transparency is the very weakness that keeps it from being a threat to the government. The user doesn't do anything to verify public keys. At best, they might know whether it has been signed by some "certificate authority" who happens to be some faceless corporation whose integrity (or lack thereof) is a complete mystery. And most users don't even know that much, or what all the built-in assumptions in the system are.
Web crypto is a joke. There's no reason to arrest someone for using it. I kind of doubt that any sort of transparent crypto that doesn't need at least some user attention, will be worth worrying about, because it'll be too easy to MitM.
Zimmerman had the right attitude (paranoia) about MitM attacks, and that's why PGP/GPG is so cool. Now there's something for government to worry about.
Re:I wonder about e-commerce (Score:2)
Probably, but it'll because they want the user for something else.
People always get the local governments they deserve.
E.E. "Doc" Smith
What does this kind of crypto law say about the residents of the EU?
Re:I wonder about e-commerce (Score:2)
I know that sounds like a troll, but think about it this way;
It's usually the job of the police, to investigate crimes, not prevent them.
Cryptography makes the job of investigating more difficult.
So the police are constantly hampered by encryption.
Cryptography also makes theft of information more difficult, but how do you measure that?
You don't call the FBI every time someone doesn't steal your credit card, and say "good job, thanks".
If there was a government body charged with protecting the public from criminals,
instead of catching and punishing criminals, then cryptography would be as mainstream as locks.
-- this is not a
Re:I wonder about e-commerce (Score:3, Insightful)
And, I suppose, the main effect of anti-encryption laws will be to make it easy for ISPs to spy on both sorts of commercial traffic. All it would take would be a few bribes to the right person in your local ISP, and you could get the credit card or bank account numbers of all their customers.
Of course, considering some of the recent financial scandals in the US, it might not be long before we have anti-cryptography laws passed to that this sort of interception is possible. I wonder how much it would cost per senator to make commercial encryption illegal?
(I hope I'm just joking
You dont need encryption.. (Score:3, Interesting)
But yeah there are bad encryption laws in other places like here in the UK. Its worrying.
You know what they say... (Score:2)
Re:You know what they say... (Score:2)
From the other side (Score:2, Insightful)
Re:From the other side (Score:5, Insightful)
What exactly makes you think criminals and terrorists are going to hand over thier keys for escrow?
I don't think this is an invasion of privacy so much as a complete waste of money and a source of unneeded complexity.
Re:From the other side (Score:2)
This is an argument most governments do or will try to use in order to spy on their citizens and it is completely bogus.
Re:From the other side (Score:2)
I suggest getting up to speed on current events. The goal of the terrorists with respect to what they want our societies to look like has a lot in common with the goals of our "democratically" elected officials.
America already has imprisonment without trial, the reason why our crypto is still unregulated enough to be useful is that even our boneheads have figured out that without encryption, e-commerce is impossible, and that could cost a lot of their campaign contributors a lot of money.
I can see a day coming very soon where I won't be making statements like this publically because of a reasonable fear of "disappearing".
We can be outraged, but do we have another method they can use?
We don't have to in order to demostrate that the authorities want to take our civil liberties in exchange for even more insecurity than we had to begin with.
The only use a central repository of database keys for a government is to give the government a tool with which its honest citizens can be attacked and another charge to hang on a suspected terrorist, as if conspiracy to commit murder, etc. isn't enough.
Something to bear in mind is tradition of Freedom (Score:5, Insightful)
Well, those countries don't have a history of providing their citizens with the almost absurd levels that the US does. In Britain, you don't have nearly the same rights that you do in the US, and while the Netherlands is a socially permissive country in many respects, it's also very tough on law and order for those things that it deems are social problems (just because in Amsterdam you can buy pot and sex doesn't mean you can kill someone in Utrecht). And South Africa has hardly had any history whatsoever of having solid personal freedoms. So while you can look at the problem pragmatically ("the US looked at the issues and realized that they're unworkable"), you can't just look at it from a US-civil-liberties perspective ("no one should be willing to give a government that much power").
The problem, as the author correctly identifies, is that anything along the lines of key recovery is completely unworkable in practice at all. While it might look nice sitting in a piece of legislation, it's impossible to enforce. Cryptography isn't something like a gun, that's physically manufactured, it's a bunch of mathematical equations (remember the whole RSA on a T-Shirt campaign?). You can't stop the providers of something based on mathematics, and you can't force everybody in teh world to start keeping track of other people's keys, or else they'll just start using "illegal" encryption.
And that's the real kicker: regardless of whether you want your citizens to have the power to encrypt things such that you can't have acccess to them, you can't stop them in any way. All you do by attempting is instantly incriminating a pretty significant portion of your population to access information that you can still get elsewhere (like keystroke loggers that the FBI uses to get passwords, or search warrants for hardware encryption devices, which are both pretty effective IMHO for key recovery purposes). You can't outlaw mathematics (the whole US issue highlighted that), so you really shouldn't try.
The UK has less rights than the US? (Score:4, Informative)
The UK has far more employment rights than the US has.
also the right to medical treatment.
the right to life (no death penality).
The right to get arrested without being put in handcufs.
Hell I can even crack a joke with the police if they get stopped, and give them a bit of hastle e.g. Have you got any ID? so long as i don't break any serious law or take the piss to much.
I can buy tin foil, baking soda, spoons, bongs etc.... without feer of being arrested.
I can have a open bottle in the car.
I can cross the road.
When I was younger I had even more rights, maybe the UK is just trying to catch up with the poor human rights policy in the US.
Re:The UK has less rights than the US? (Score:2)
Re:The UK has less rights than the US? (Score:2)
** UK employers can fire women who get pregnant
False - I have no idea where you got that one from. As part of the EU we have very protective work regulations, much more so that the US. For instance, it is illegal for your employer to lower your salary without your consent (and they are not allowed to fire you because you refused a pay cut). So while all you guys in the US get pay cuts, we're OK
** that the police can arrest people in crowds of more than three
not simply because you're in a crowd, there has to be some other factors involved, threatening behaviour, violence, causing a disturbance etc.
** that the police can make you give your crypto key to them, and jail you if you don't
true, this is the problem being discussed here!
** that licensing laws make it so you can't buy alcohol between 11:30pm and noon, without a special extension
The hours are more like 11:00pm to 10:00am, but otherwise true. Many popular bars, clubs etc get extensions through to 3 or 4 am. Licensing laws are currently under review, and most people believe they will be relaxed soon.
** that most stores will be closed, by law, on a sunday
false, almost all are open, but many with restricted hours (typically 10am-4pm).
** that you can only return goods that are faulty, and you aren't garuanteed a refund
Shops _may_ accept a return if the goods are not faulty, it's up to them. Most do. On the flip side we have legally enforced mandatory 1 year warranties on ALL purchases, unlike the US. My view, if you buy something and change your mind, you should have thought harder before purchasing. It amazes me that in the US manufacturers are allowed to get away with 30 day warranties on expensive items.
Re:The UK has less rights than the US? (Score:2)
Re:The UK has less rights than the US? (Score:3, Informative)
As a Brit living in the US (still undecided on whether I'll switch citizenship so hopefully free of undue bias) I'll have a stab at answering this one...
Re:The UK has less rights than the US? (Score:2)
Pretty much all the laws prohibiting Sunday sales have been repealed. The only one that remains common (about 1/2 the states) is the law forbidding auto sales on Sundays. Most people seem to appreciate this law, because it means that they can look around the car lot on a Sunday and not have to fear the salesmen.
Re:The UK has less rights than the US? (Score:3, Interesting)
Although, I would point out that any nation without an actual constitution or any viable or realistic checks on its Prime Minister can hardly be considered to be a place where you can be guaranteed your rights (as anti-terrorism legistlation passed to try to deal with teh Northern Ireland conflict can attest to).
Re:Check and Balances on Prime Minister ... ha ha (Score:2)
- Voter turnout in Britain keeps sinking;
- The UK also has a First Past the Post system for individual constituencies;
- There isn't universal enfranchisement for choosing party leaders (witness the farce that resulted in IDS' selection as Conservative Party leader)
You end up with a situation where it's entirely possible for a prime minister to be chosen by what is actually a quite small number of people, because each point above increases the chance that a non-majority will choose the Prime Minister.If you mean to say that the selection of the Prime Minister in the last UK General Election happened as a result of the outcome of the last UK General Election with no judicial intervention (which would have made little sense anyway since there is no independant judiciary in the UK), then I suppose I'll agree with you. :-)
Re:Check and Balances on Prime Minister ... ha ha (Score:2, Funny)
(Sorry, somehow the "not installed by a judiciary" triggered this in my brain)
Re:The UK has less rights than the US? (Score:2, Insightful)
also the right to medical treatment."
Forcing someone to hire you or keep you employed is not a "right". It's a violation of another persons right not to employ you if they don't want to. Forcing someone to pay for your medical care is not a "right", it's a violation of another persons right not to pay for your medical care.
The failure to understand that there is no such thing as a "right" to force another person to perform an action that is advantagous to yourself is the reason real rights are being erroded on both sides of the Atlantic.
Re:The UK has less rights than the US? (Score:3, Insightful)
"Of course it is. That's what a (civil) right is: a constraint on other people's behavior as it relates to you. This is distinct from a liberty, which is your freedom to do various things as you please."
Your definition of a "right" is in fact a negation of the concept of rights. just because the government abitrally gives someone a privellege and calls it a "right" dosen't make it one. 50 years ago the state I live in assigned Whites the privillege of constraning the behavior of minorities, and defended this injustice under the banner of states rights. Those laws were just a big a violation of real rights as the so called civil rights laws are.
" We hold these truths to be self-evident, that all men are created equal, that they are endowed by their Creator with certain unalienable Rights, that among these are Life, Liberty and the pursuit of Happiness. --That to secure these rights, Governments are instituted among Men, deriving their just powers from the consent of the governed"
Notice the source of rights, "endowed by their Creator"?. It dosen't matter if you consider the "creator" to be a devine power, or natural laws, rights are NOT the creation of governments, which only exist to protect rights. The US government could no more magicly create a "right" not to be discriminated against in 1964, than the slave states could magicly create a "right" to own another human being between 1776 and 1865.
Allowing the government to assume the power to create "rights" is very dangrous, because at the same time you are giving them the power to repeal rights, real ones like "Life, Liberty and the pursuit of Happiness" one of which you have allready claimed can be constrained by the arbitary civil "rights" created in 1964.
Well, actually, no. (Score:2)
Fortunately, things have loosened up a bit since, but the ideological descendents of the Puritans (insert name of your favorite religious fundamentalist here) are ever with us...
Re:Well, actually, no. (Score:2)
The Puritans weren't big on individual liberties or religious freedom. Luckily they weren't the ones who wrote the Constitution or ran the government for the first little while there. Jefferson, Adams, Franklin, and Paine were all non-Christian (ranging from agnostic to Deist to Unitarian), and Washington and Madison both campaigned heavily against any government support of particular religions (Washington also put a lot of energy into defending the appointment of non-Christian chaplains in his army).
Freedom of religion was a real concern to them, and certainly wasn't the sham "freedom of any religion you want, as long as it's Christian" that a lot of right-wingers seem to promote today. And it did, indeed, include freedom _from_ religion if that was your personal belief.
Jefferson published an interesting work called the Jefferson Bible which is basically the New Testament with all of the miracles removed; it's just the life of Jesus as a moral man, not as the son of God.
It wasn't just them, either; at the time of the Revolution only 7% of colonists were members of any organized church (though around half the remainder were "somewhat practicing"). The times of the Puritans, where only members of 1 religion had formed your entire colony, were long gone.
It's interesting to note in these times that one of the first things Madison signed as president was the Treaty of Tripoli, which stated in part:
As the government of the United States of America is not in any sense founded on the Christian Religion - as it has in itself no character of enmity against the laws, religion or tranquility of Musselmen, - and as the said States never have entered into any war or act of hostility against any Mehomitan nation, it is declared by the parties that no pretext arrising from religious opinions shall ever produce an interruption of the harmony existing between the two countries.
Sumner
Re:US is totally NON-free (Score:2)
Yes, the US has a vast number of people imprisoned for what are, IMHO, completely racist, culturally insensitive, and immoral laws. Yes, that rate is extremely high.
Do I think that stuff like citizencorps is a particularly good idea? Nope. Do I think it infringes on my civil liberties? Well, actually, no, unless the fact that Bob down the hall turns me in for buying a hardware cryptography device gives the police special powers. The fact that it might is what makes me nervous.
But I think that my point is that when it comes to limiting governmental interference in my privacy (not private life, by the way, considering the number of states where Sodomy is still a crime), and guaranteeing those limitations, we're doing pretty well.
But of course you've found some functional society with more rights and Freedom, so I'd be interested in hearing about that paradise.
Re:Something to bear in mind is tradition of Freed (Score:2)
Crypto restrictions will hurt who? (Score:2)
Someone should also let him know that flying planes into building is also a big no-no, so that he will stop doing that too.
Shame Default CAs Arent EZ (Score:5, Insightful)
It seems to me that more widespread use of encryption enables a lot more benefits than it does drawbacks.
AFAICT, the big problem is that every control freak organization in the world, be it government or corporate, wants to be the one owning the Certifying Authority for public keys used in private transactions.
My default install of Mozilla (doesn't practically everyone in the world use default installations, especially for things like IE?) shows a list of Certifying Authorities with names like the names of companies that meter my credit card usage.
It would be nice if there were an easy way to build up miniature webs of trust and local CA's for individuals and small groups to establish private communication. "A click of a button" easy is what's needed...
And yes, the same technology that can be used for selling pedophiles kiddie porn and allowing Osama to give remote orders (heh, like he fires up his laptop and satellite uplink in his goatpen!) is also the same technology that would allow dissidents in China to openly discuss and criticize their government.
Re:Shame Default CAs Arent EZ (Score:2)
Isn't the whole point of "free speech" nations that you can speak your mind without hinderence. This is what encryption allows but on a global scale. I can say what I want to who I want.
Now, empower some Certifying Authority and suddenly they control my power of free speech.
Re:Shame Default CAs Arent EZ (Score:3, Interesting)
In that environment, I can give you my self-signed certificate along with some digital signature over a nonce, and you'll have my public key. As of that point in time, you can be assured that your communications with whoever gave you that certificate will be private, and only the people with the private key corresponding to that certificate will be able to read them. So you have great privacy at that point. The problem is that you can't trust that I am who I said I am when I gave you that certificate. (note that I'm intentionally ignoring MITM attacks here, because those are also trust attacks, not privacy attacks....in a MITM attack, you are privately communicating with someone, just not the person you thought you were).
All a CA does is say that "we believe that John Smith is the only person in the world that has access to the private key corresponding to the public key in this certificate." They don't have the private key for that person, they don't have any ability to intercept messages, etc.
The real problem with proliferating CA roots is because certificate chains are all-or-nothing: if Verisign is willing to sign the John Smith CA, then anybody that trusts Verisign will trust ANYTHING that the John Smith CA issues in the future, so Verisign had better be pretty damn sure that the John Smith CA is doing exactly what Verisign would in that case. It's binary, and it lasts for what amounts to forever. So because of that, nobody's willing to allow there to be the One True CA, because that CA wouldn't trust anybody else in the world.
In my experience, both Microsoft and Mozilla make it right easy to allow certificates from CAs that it hasn't seen before, and make it pretty easy for an administrator to add a CA to your corporate setup, or for a suitably skilled person to do so. But since it's a Big Decision, I'm glad it isn't "click of a button." My mom has NO business trusting a third-party CA for now. She doesn't even know what PKI is.
no longer very pro-crypto (Score:2)
Then again, I've always had an underdeveloped sense of privacy. It's really never been a big concern of mine, security through obscurity (or maybe apathy...if someone wants to know enough to bother to ask I'll probably tell them)
Re:no longer very pro-crypto (Score:2)
SSL: so my credit card info can't be seen by a third party.
SSH: so my root passwords can't be seen by a third party.
How can you possibly argue against encryption?
Crypto, who needs it? (Score:4, Funny)
Re:Crypto, who needs it? (Score:2)
Why is encryption regulated? (Score:2)
Now just you hold on there a minute... (Score:5, Interesting)
I saw places where it said "..and the police can order you to hand over your keys" or '..such and such a company has to register with the officials', but nowhere did it say '...you can't use encryption'. (I do agree that the key escrow stuff is very bad though.)
Just like a gun, ecnryption can be used for good things (hiding my p0rn from my girlfriend), or bad (emailing terrorism plots to agents.) In this country (USA), if the police have enough evidence, they can go to a judge and get a very specific search warrant. So, if they accuse me of having illegal p0rn (instead of just the good stuff), they can search my computer till the cows come home. But if they find a terrorism plot, they can't use that information.
To follow that point, what is wrong with issuing a search warrant and demanding that I decrypt the data?? I may not like it, especially if I'm guilty or don't want to share my p0rn, but I don't see where that is any different than letting the police go through a drug dealers house looking for drugs. Ok...there is that fifth amendment thing, so maybe a law like that couldn't even be enacted in the US.
And so what if company X has to register with the government. They probably had to get a business permit anyway, and if they do anything novel they probably have patents. Not too many companies survive by being secret about their existance.
So...tell me what is all the hub, bub.....
Here's the problem (Score:2)
But say they want to look for incriminating digital evidence that you're growing or dealing pot. You can't just decrypt the stuff you want them to see and say, "This is not the encrypted data you're looking for. I can go on my way."
No, they're going to decrypt everything. This means that while they might not find evidence of pot, they might find something else. And sure, it may not stand up in a court of law
Registering with the government (Score:2)
But then again, what about the open source projects? Who's providing the crypto? Where are they? Does downloading a program hosted on a server in the US from a computer in South Africa make the server provider a company which had to register? What happens if they haven't? What if I'm just distributing source code? You see, even if you say "okay, well, we'll just screw over RSA but we'll all be fine in our Stallman Warm Fuzzy Blankets," you're ignoring the issues involved in registration laws.
Crypto Restrictions have Helped . . . (Score:2)
Palladium and Encryption (Score:2, Interesting)
If Palladium is implemented, as everyone expects it will, and encryption becomes standard to the operating system does this not mean that the data on the hard drive is therefore protected from intrusion by outside sources? Would this not be a boon for those looking protect their nefarious purposes from prying eyes? This creates a problem for Microsoft and computer manufacturers in general; How to provide "trustworthy computing" to the general public while resassuring the government that data can be retrieved from hard drives when needed.
If Microsoft or the Palladium hardware manufacturers build in a "backdoor" for just this purpose, then the idea of trustworthy computing is lost. Who would trust their sensitive data to a compromised system? Hence the quandary.
DJB vs the United States (Score:2, Interesting)
Regulating encryption won't stop criminals. (Score:2, Informative)
Even if you make transmitting encrypted communication illegal, it's not going to stop criminals. Hiding cyphertext is just too easy. For example, take a 16-bit wave file and use the least significant bit of each sample for your cyphertext. Assuming your cyphertext doesn't have any header data, it will be virtually undetectable. The only thing someone might notice is some very low level white noise in the background that could be attributed to anything.
Similar things can be done with jpegs, mpegs, and a host of other file formats. If government officials had a better understanding of the technology, they wouldn't waste our time with laws that only hurt law abiding citizens and do nothing to curtail crime.
One way to fight back (Score:2)
If you live near Albuquerque NM USA, please visit my journal.
What few freedoms make someone free? (Score:2)
Most everyone understands that there are limitations to freedom. Hell, even a perfect omniscient judiciary couldn't make a totally free society exist (e.g. how to choose between two parties' gripes when both are contradictory? Someone is going to have to lose).
So governments chose which freedoms are best limited and those that need to be preserved. In the end I think it is all arbitrary. You just have to have some system that allows for a decision to be made. Firearms are legal or they aren't. Nazi Memorabilia is legal or it isn't. The same with encryption.
Basically you can limit anything people can do without forever. But that goes against what freedom stands for. In the end countries have to make choices. And I doubt that any one (say France's versus the US versus Japan) are better than any other.
In the end I think it comes down to economic interest. What jobs/corporations/industries does a company need to have strategic overlay in order to survive. Saudi Arabia is concerned about its oil interest and the people who own and work for it, not the nature of the shoe industry in Malasyia. From that point outward the society's policy is formed.
France regulations (Score:2)
Crypto is WORTHLESS ANYHOW... (Score:2)
Its like the old MasterLock commercials, "Sure you can shoot it with a 308 in the middle and itll hold" but take a $5 pair of bolt cutters to it and its dust. Crypto is the same way, the client computers are the weak link, and as goverments spend more time and effort on Electronic Cypto, assuming it is the preffered route.
Well quite frankly it makes it EASIER to disseminate information in the plain REAL world, How hard is it to get a warrant to sniff email, In the US you dont even NEED one !!!!.
BUT let the FEDS TRY to get a warrant to open your snail mail, its damm near impossible.
Paper and Pen , these are going to be the Crypto tools of the next century.
Another reason why closed-source software = evil (Score:2)
Closed-sourced-software (CSS) can easily be regulated, because it often has immobile targets of regulation. Companies can't afford to dick around with defying government regulation.
However, try to regulate OSS / FS. Its not possible. Few things go into OSS / FS that users don't want, and if things go in there that users really don't want, they will eventually be purged (either by a fork, or by users individually who simply delete the offending lines of source code).
Part of the reason OSS / FS is not regulable is because you can't control what users do with it once they get it. A user gets OSS / FS software, and it can include all the DRM and spyware in the world -- doesn't matter if the user doesn't want it; the user can simply delete the offending lines of code, do a little bit of work, and recompile, or (s)he can hire someone else do to do that. It only takes one person to do this and then offer the modifications to the public -- possibly anonymously -- for the offending code to be removed from nearly every install. [it should be noted that this has even occured for CSS (refer to Kazaa, which includes virus', spyware, and adware, all of which were removed in KazaaLite)].
The other reason why OSS / FS can't be regulated is because of its very nature. How do you regulate something for which no one makes any profits, no one need reveal their identity to contribute to, and which is free as in freedom (and usually free as in beer)? You can't. Not effectively anyways. Sure, the government can drag its heels, but there is no effective way to regulate OSS / FS -- not even for an authoritarian state like China. Every move that is made attempting to regulate OSS / FS can easily be countered and alluded by OSS / FS devlopers.
Demand that no one release crytpo software w/o a gov't backdoor, the penalty being multi-million dollar fines and long jail time? Works great on all CSS and businesses. They'll be scared shitless; their execs and programmers too. Doesn't work at all on OSS / FS developers. They simply start developing and posting anonymously, possibly post from a server in another country, possibly move to another country, or publish the code from a public terminal.
This is not to say the government can't be an inconvenience. Taking special steps to post anonymously or posting from a public terminal is a nuisance, as would be (obviously) hosting software on a server outside one's own nation or moving to another nation. Obviously, we should work to make OSS / FS as unregulatable as possible. The CBGTA should not be allowed to in any way touch OSS / FS.
Obviously, one major key to making sure government regulations don't hinder OSS / FS is anonymosity. The government cannot regulate what it can't see. Regulation relies on having a target to be regulated -- i.e., the poster of the code. If one can't see that target, one can't effectively regulate. Another key is distribution. Even if the government can't regulate the developers themselves, it can target the servers they use to post their code to the world, taking it down. The way to deal with this is obviously mirrors, as well as working on distribution through P2P.
IPsec Implementations (Score:2, Funny)
There is still alot of fear that this softening of restictions will eventually rebound.
SUPPORTING INFORMATION
----------------------
Here is a list of some distributions that do include IPsec and their country of origin:
SuSE Linux (Germany)
Conectiva (Brazil)
Mandrake (France)
Best Linux (Finland)
Polish(ed) Linux Distribution (Poland)
Re:Of course its taking root. Its a good idea. (Score:3, Insightful)
Just as there is a considerable difference between nuclear weapons and "munitions-grade encryption".
Encryption doesn't have the power to kill anyone, it just has the power to protect privacy and hide information. While a nuclear weapon has the power to destroy.
If they ban encryption, why not ban locks, doors, window shades, make walls out of glass, and allow video cameras and audio tapes to be placed in every nook and cranny of your house. You have nothing to hide, that's why high-grade encryption is useless right?
Think about it.
God, I love the fact I am a Canadian at times like these.
Re:Of course its taking root. Its a good idea. (Score:2, Insightful)
While I agree with you in principal, in an age where information itself can be a powerful weapon,
encryption is a problematic issue. There are those (of which I am not one) who would argue that
information ought to be subject to the same type of controls as narcotics or radioactive materials,
both of which have valuable and legally sanctioned uses.
Re:Of course its taking root. Its a good idea. (Score:2)
Technically, any attempt to restrict US domestic crypt may have been a violation of the Second Amendment, as well as the obvious First, Fourth and Fifth Amendment violations.
Re:USA the bastion of unregulated crypto?? (Score:2)
Re:USA the bastion of unregulated crypto?? (Score:2)
Re:USA the bastion of unregulated crypto?? (Score:2)
"You childish twit. Canada is nothing of the sort....."
Irony goes right over your head dosen't it?
Re:USA the bastion of unregulated crypto?? (Score:2)
Re:Yeah sure.. (Score:2)
Its not like you cant secure plan without internet/network encryption, maybe it will take a bit longer, maybe it even more secure.
The only point i want to make is when people want to do good they will and if they want to do evil they will also, period. They dont need crypto stuff for that.
Re:UK Regulations? (Score:4, Insightful)
So why exaggerate the situation elsewhere to pretend that the US is doing fine, when in fact legislation in the US as to what you can do with your information and who can spy on you is probably the most restrictive of any 'developed' nation?
Re:mod this up! # (Score:2, Interesting)
Do you see everyone holding hands, brothers smiling?
Well I see rioting, I see bodies in the streets
And the future of the American Dream
I can't take the American Dream
I can't take the American Dream
--American Dream by Screeching Weasel
Re:We're all fools, anyway (Score:2)
I think it is silly to suppose that they have quantum computers or some other exotic super computer.
And with current technology decrypting because completely impractical as long as your key is long enough.
Re: (Score:2)
Re:Crypto (Score:2)
I'm not so sure.