Schneier Slams Australia's Encryption Laws and CyberCon Speaker Bans (zdnet.com) 51
Governments breaking encryption is bad, and "will get worse once breaking encryption means people can die," says one of the world's leading security experts. From a report: "Australia has some pretty draconian laws about forcing tech companies to break security," says cryptographer and computer security professional Bruce Schneier. He's referring to the controversial Telecommunications and Other Legislation Amendment (Assistance and Access) Act 2018, which came into force in December. "I actually don't like that, because stuff that you do flows downhill to the US. So stop doing that," he told the Australian Cybersecurity Conference, or CyberCon, in Melbourne on Wednesday. Schneier's argument against breaking encrypted communications is simple. "You have to make a choice. Either everyone gets to spy, or no one gets to spy. You can't have 'We get to spy, you don't.' That's not the way the tech works," he said. "As this tech becomes more critical to life, we simply have to believe, accept, that securing it is more important than leaving it insecure so you can eavesdrop on the bad guys."
Still not clear enough for politicians (Score:5, Insightful)
It can't be more clear than that, but politicians think that since people can be corrupted, then tech has to be corruptible too.
They have to understand that once you corrupt security, then there is no more security for anyone.
Re:Still not clear enough for politicians (Score:5, Informative)
Either everyone gets to spy, or no one gets to spy.
Surely this equation doesn't account for the bad guys. Ultimately, no one will be spying on lawbreakers.
The law, Australian or otherwise, doesn't prevent someone from obtaining Tails, encrypting documents then storing or communicating them freely online via Tor in a way that completely disassociates the encrypted documents from their real identity or equipment.
So the equation is more like 'everyone gets to spy on everybody except the lawbreakers for whom it's business-as-usual'
Re: (Score:3)
Slashdot is really bad at overlooking this, because we assume that because non-compromised encryption
Re: (Score:2)
Indeed, the purpose of this law was never to go after the bad guys. The purpose of the law is to control ordinary people. Exactly like Australia's gun confiscation.
Citizens are armed, uncensored, outspoken, and the government fears them. Subjects are disarmed, censored, afraid to speak out, and afraid of their government.
Which do you want to be?
Re: (Score:2)
Oh yes, I'm pretty sure the American government is terrified of its citizens /s
Re: (Score:2)
Oh yes, I'm pretty sure the American government is terrified of its citizens /s
Your sarcasm is well justified. No fear whatsoever. That's why they disbanded the Secret Service, took down the fencing around Federal buildings, no longer have no-fly zones around DC and why roads, overpasses, and buildings no longer get closed off whenever a VIP rolls through town.
Re: (Score:2)
Do you realize that pretty much every country in the world does that, right?
Re: (Score:2)
PRISM worked well and without comment by experts and brands.
The new trick is to make it legal
Re: (Score:2)
The tech is corruptible. There is no such thing as a "government only" backdoor. Just like a politician and any other kind of whore, as soon as technology bends over for someone, it bends over for everyone.
Re: (Score:2)
Actually, whores have standards and will refuse unacceptable customers. Politicians don't.
Re: (Score:2)
Politicians don't know anything other than what the security services tell them. It's the spies who are lying to them who are the problem.
Not just the Australians, GCHQ does it too, the NSA seems to be doing it, the FBI has done it.
Re: (Score:2)
Indeed. Qui bono. The scum in the secret agencies are just trying to give themselves ultimate power. As they have tried so many times before. But politicians are routinely not only clueless as to how things work, they are clueless as to their responsibilities here and regarding history.
Re: (Score:2)
They have to understand that once you corrupt security, then there is no more security for anyone.
By now I am deeply convinced that these people are just completely incapable of understanding what a "fact" is and that they do not create technological reality. Hence I think they are completely incapable of understanding this fact. The only sane thing is to vote them out of office as soon as possible.
Democide (Score:3)
Worthy of consideration in trusting governments with "encryption back doors" is that, worldwide, the national government most likely to kill you is your own [wikipedia.org].
Re: (Score:2)
Then I'm glad to be Canadian. I mean sure, death by maple syrup is horrible, but it does start with the sweetest minutes you ever had in your life.
Re: (Score:2)
You should be relatively prepared for the sweetest minutes you ever had including your afterlife, then.
Yes, that was a quite esoteric reference for this context. And it doesn't involve syrup.
Re: (Score:3)
You would almost need to be in Quebec to die from maple syrup. There isn't that many maple syrup trees outside of Quebec.
That would make the Canadian flag funny if Quebec ever succeeded in separating from Canada like they twice tried to do.
https://www.worldatlas.com/art... [worldatlas.com]
Re: (Score:2)
death by maple syrup is horrible
Better than being chewed to death by a beaver.
Re: (Score:2)
The government that has the most impact on a person is by definition the government that has direct jurisdiction over that person. It's simple logic that this is also the government most likely to kill you.
Re: (Score:2)
No, it's actually not "simple" logic.
Most would have the perception that they are more likely to be killed in a war by a foreign country than by their own country's government. It's in the interest of governments (and educational institutions) to further that perspective, including minimizing information about totalitarian internal mass murder. Thus, we have the general narrative of sympathy with totalitarian China and disdain for democracies.
I'm not sure your point, but if you're trying to normalize tota
Re: (Score:2)
No, I'm just saying that I'm not in China (thank $deity) so the chance of their tinpot dictators affecting me is lower than the chance of my government doing so.
Re:GOV LAW ENFORCEMENT REQUIRES FULL ACCESS!!! (Score:5, Insightful)
Let me ask a question, accepting your premises for the moment.
Do you think that serious criminals, who are already breaking the law, would have any problem using illegal encryption that couldn't be broken by the government, or that some programmer working for such criminals wouldn't create the illegal encryption for them to use?
Re: (Score:2)
using illegal encryption
What's illegal encryption?
Re: (Score:2)
using illegal encryption
What's illegal encryption?
In the context of the topic being discussed:
Illegal encryption would be encryption that does not include the government mandated backdoors.
Re: (Score:2)
This isn't encryption. If you can't read it, it only means that you don't understand it.
And this is just a pretty picture of my car.
And on that hard drive is just random rubbish, I deleted it recently and overwrote it with garbage.
Re: (Score:1)
They'd have to be on some "non-internet" network - even then, wireless can be triangulated, and wired - if the wire is found - can be physically followed
Re: (Score:2)
That's an interesting point. They may not know what you have encrypted, but if encrypting anything with illegal encryption is the law, it doesn't matter and you will be caught.
You would have to either some how hide it in plain site or as you said be on a non-Internet network.
Wireless would definitely be the best option since you would clearly provide fraudulent papers to your wireless carrier then it would come down to police directly trying to triangulate where you are. That'd be a good risk to take as a c
Re: (Score:2)
I'd expect the government to tell ISPs to block unbreakable encryption
How's that been working out for them with media piracy? They can't even block all the main torrent sites, let alone the countless other streaming pages, swap forums, p2p apps, usenet channels, irc groups, loaded kodi boxes etc etc. Attempted blocking has had zero impact - the only thing that helped with their piracy problems was the rise of Spotify, Netflix and other cheap & legal streaming services.
It's not possible to "block unbreakable encryption" because it's already available everywhere. You only n
Re: (Score:2)
Practice (Score:2)
Do you think that serious criminals, who are already breaking the law, would have any problem using illegal encryption {...} ?
In theory: yes, well-organised criminal won't give a flying fuck about whether encryption is outlawed, they are already criminals to begin with.
In practice, these type of law aren't though for any extremely well-organised criminal. These laws are written against the stupid small-scale criminals that won't give much thoughs and just whatever is quickly available to them (i.e.: whatever is the default messaging app on their phone).
Without such law, the small petty criminal might *accidentally* be using good e
Re: (Score:2)
Re: Practice (Score:2)
Re: (Score:2)
Re: (Score:2)
Trump's govt or Elizabeth Warren? Biden's? (Score:2)
*Which* government do you want reading your emails and text messages, the Trump administration? Elizabeth Warren's administration, or maybe Clinton? All of the above?
Whatever powers you give to one administration pass on to the next administration, and the one after that.
If you by chance think J. Edgar Hoover was bad, you should see the guy running the FBI two years from now!
simple example (Score:3)
Re: (Score:2)
How long 'til a crook holds the family of a cop hostage so he lends him the key?
Re: (Score:2)
This is not just a premise, it is a demonstrated fact. Long ago GM international actually created a master key for its trucks and buses, though they did stop doing that this past decade. It's not just that every county cop, but then two bit mobsters and other undesirables eventually got a hold of one, too.
Re: (Score:2)
As even the NSA had its malware stolen, this would probably be in the hands of criminals within months. May also go much faster, it only requires one FBI agent on the take.
Time for 512-bit key? (Score:2)
I mean, unless there is an algorithm.
data forwarding rather than encryption backdoor? (Score:1)
Re: (Score:3)
The problem is you cannot ensure that these keys don't get into the wrong hands. A key that can decrypt any and all traffic from businesses of a country is something that is wanted by other governments. And I am fairly sure there is more than one that would send someone having those keys a letter along the lines of "Nice kids you have there, shame if anything bad happened to them. Let's talk about something you could do for us..."
Re: (Score:2)
The problem is you cannot ensure that these keys don't get into the wrong hands. A key that can decrypt any and all traffic from businesses of a country is something that is wanted by other governments. And I am fairly sure there is more than one that would send someone having those keys a letter along the lines of "Nice kids you have there, shame if anything bad happened to them. Let's talk about something you could do for us..."
You understand the security problem but you miss on the perspective of those making these proposals. They understand all the consequences and failings. They count on them. They help provide cover for their own actions. They very much are "the wrong hands". They won't have to worry about threats and blackmail from criminals or spies desiring access as you describe because the plan from the beginning was and is *to sell access to it* while simultaneously using it to secure their own power and control over the
Re: (Score:2)
Indeed. Remember that in fascism, a lot of very bad things (including mass-murder) may be legal. These people have the same mind-set. They are not in favor of freedoms or of conversations happening in private. They are, in fact, deathly afraid of citizens that may communicate and organize in private, because they know that are wearing no clothes and that all their grand promises are hot air.
Re: (Score:2)
Actual experts have pondered this question for decades and have found that nothing can be done to really secure such backdoors. Also keep in mind that, for example, the NSA has had its malware stolen (to pretty bad effects) and the like. Unless only the sender and receiver has access, security must be regarded as generally broken, nothing else makes sense in the real world.
The authoritarians are afraid of free people (Score:2)
Hence they believe they need to be able to look at everything and control everything. These people are the real problem and they do far, far more damage than "terrorists" ever could.