Julian Assange: Cryptographic Call to Arms

http://cryptome.org/2012/12/assange-crypto-arms.htm

by gbrindisi • 14 years ago

355 255 14 years ago

mtgx4• 14 years ago

This is why I'm glad HTTP 2.0 intends to implement SPDY's always-on encryption. It probably won't be long until governments find a way around that, especially the US government, who can pretty easily gain access to companies like Google, Verisign, and even ICANN, but it would be a good first step in the right direction. Hopefully future steps like web crypto will help increase the security of people's conversations online further.

hughw2• 14 years ago

Alway-on encryption is necessary but not sufficient. As long as Facebook or Google have the decrypted information, you are still subject to the transnational dystopia.

The other day I found this fellow's idea for a peer-to-peer social network service: http://code.google.com/p/peer-book/

"Your data is stored in a distributed fashion, across the network, so that even when you turn off your instance of PeerBook, your friends will still be able to view your Profile and send you messages.

"Of course, all of this data is encrypted and backed up several times, so that even if Alice's data is being stored on Eve's machine, Eve will only be able to read it if she is Alice's friend; and Eve will only ever be able to delete her local copy of Alice's data which has no effect on its overall availability to the rest of Alice's friends."

He's got the right idea. I haven't examined the project, and it doesn't seem active.

ef44• 14 years ago

https://github.com/diaspora/diaspora

Egregore7• 14 years ago

It's difficult to work on a project when you don't see the support, the people who would like to use it.

eze• 14 years ago

Will it be an option to serve unencrypted content under HTTP 2.0?

aidenn0• 14 years ago

Forget Google, Verisign and ICANN. Any of these people can generate certificates that completely eliminate the MITM protection of https:

http://www.mozilla.org/projects/security/certs/included/

spindritf• 14 years ago

> The world is not sliding, but galloping into a new transnational dystopia. This development has not been properly recognized outside of national security circles.

I agree with Moxie Marlinspike on that, we were preparing for fascism but got social democracy[1]. Assange is still preparing for fascism.

[1] https://www.youtube.com/watch?v=eG0KrT6pBPk

droithomme• 14 years ago

"Assange is still preparing for fascism."

You mean the guy who is in internal exile in Britain because as a journalist he revealed war crimes committed by Britain's partner the United States? He's the guy who is delusional about the form of government that surrounds him, huh? Glad it's as simple as that.

blablabla123• 14 years ago

To add some more complexity: the reason he is in a dodgy situation in the first place are rape allegations. Looking at some "leaked" parts of his biography this doesn't sound too far-fetched to me.

I definitely appreciate his engagement in disclosing many interesting documents about the micro-social diplomatic environment. But after all, what about the more interesting stuff? Leaked documents from the center of the turbo capitalist universe are still pending. (IIRC those were promised for around last christmas...)

codeulike2• 14 years ago

In that video, Moxie argues for a slightly different focus due to a different situation, but the overall concern is the same.

ahelwer2• 14 years ago

This was a really great talk. Thanks so much for posting it! Lots of things I had not ever considered before, and the OTR model is really neat.

rdl9• 14 years ago

I'd prefer to stick to http://www.activism.net/cypherpunk/manifesto.html

I also find Eric Hughes much easier to rally behind than Julian Assange, although John Gilmore is better still (although largely focuses on drug policy, now). Or John Perry Barlow or Mitch Kapor.

derrida4• 14 years ago

I'd be interested to know what you think of the Cryptoparty 'movement', rdl? Eric Hughes talked in Amsterdam. Would you get involved?

rdl9• 14 years ago

It's too broad in scope for me to be really interested, I think -- meetings more focused on specific problems and solutions to those problems, vs. "the overall concept of cryptography and secure communications" seem more likely to be productive.

There are really no shortage of events like this in the Bay Area. I think "how to help mainstream developers build and operate services securely" would be the only thing I'm really into; end users are too varied and stressful for me. (there are usually a critical number of true tinfoil hat, "I've been marginalized by society and need someone who hack my girlfriend's email" types at open end-user crypto meetings...) At least based on the previous several attempts at this kind of thing (2600, Ian/Len's key signing parties, cypherpunks physical meetings, etc.)

anigbrowl4• 14 years ago

First, recall that states are systems through which coercive force flows. Factions within a state may compete for support, leading to democratic surface phenomena, but the underpinnings of states are the systematic application, and avoidance, of violence. Land ownership, property, rents, dividends, taxation, court fines, censorship, copyrights and trademarks are all enforced by the threatened application of state violence.

As if we lived in a halcyon utopia prior to that. I can't buy into Assange's Manichean view of government, given the pre-governmental state of society as war of all against all, qua Hobbes: "In such condition there is no place for industry, because the fruit thereof is uncertain, and consequently, not culture of the earth, no navigation, nor the use of commodities that may be imported by sea, no commodious building, no instruments of moving and removing such things as require much force, no knowledge of the face of the earth, no account of time, no arts, no letters, no society, and which is worst of all, continual fear and danger of violent death, and the life of man, solitary, poor, nasty, brutish, and short."

Back when Wikileaks first came to prominence, it exposed malfeasance by private actors as often as states, notwithstanding the desire of those private actors to keep their doings private or even encrypted; Trafigure being a prime example (http://en.wikipedia.org/wiki/Trafigura).

States can certainly be destructive of liberty, but the absence of a state (either literally or by legal limitation ) does not necessarily yield liberty; often it results in mere libertinism.

contingencies4• 14 years ago

Assange speaks truth. You cannot deny the fundamentals of the state are violence. The US speaks already of a capacity for instant global weapon strikes within the hour. You claim it is wrong to question the system, implicitly suggesting there is no alternative. But anthropology shows clearly that premodern societies had more free time, greater material and economic equality. (Try 'Debt: The First 5000 Years').

You attack a perspective, quoting on a tangent, without contributing anything meaningful except the notion that government can have value: but of course! Nobody denies this.

Assange and other politically engaged hackers like him seek improved systems of governance: greater protection of fundamental freedoms, greater availability of additional freedoms, greater truth and transparency.

Relax, nobody wants to topple your car and burn your house down.

blueprint• 14 years ago

I don't at all disagree with you but for the benefit of the others I'd like to ask you, what do you mean by truth? (What do you indicate by the term of truth?)

edit: To say something is truth if it's true is too circular - as a definition it doesn't have matters that can be confirmed by others so isn't so helpful to convince them.

ef44• 14 years ago

> But anthropology shows clearly that premodern societies had more free time, greater material and economic equality.

I already disagreed with the grandparent comment, but I need to criticize this too: those metrics are terrible, and we shouldn't be looking to the past for the good old days.

Free time: only if you don't consider all the free time lost by all the people who died as children (extremely high premodern child mortality).

Material and economic equality: being equally poor is not really a solution anyone would like.

anigbrowl4• 14 years ago

You claim it is wrong to question the system, implicitly suggesting there is no alternative.

No I didn't. How can you expect me to engage with the rest of your comment in any serious fashion when you just make up claims like this?

ef44• 14 years ago

Your argument is a non sequitur: states are necessary, therefore states are not systems through which coercive force flows.

If you want to argue that states are necessary, fine. But call a spade a spade. Can you imagine a state that doesn't wield violence? That's what a state is.

The lack of clarity on this issue leads to a lot of bad conclusions. When we argue that the state should solve any particular problem, we are explicitly saying the problem needs to be solved by coercive force. Maybe that's necessary. But let's not have any illusions about how states work and how laws are enforced.

baddox6• 14 years ago

> Can you imagine a state that doesn't wield violence? That's what a state is.

That's part of what a state is, but it's more than that. A state is a violent organization that has managed to convince the vast majority of society that its violent actions are acceptable. In any conceivable society (state or no state), you will have violence. The difference between "criminals" (druglords, thieves, rapists, etc.) and "government" is that the vast majority of society condemns the violence of the former but accepts (and often even praises) the violence by the latter.

anigbrowl4• 14 years ago

Your argument is a non sequitur: states are necessary, therefore states are not systems through which coercive force flows.

I did not say that at all. I am OK with states being systems through which coercive force flows, because I think channeling and supervising said force usually results of less of it flowing than otherwise would.

Can you imagine a state that doesn't wield violence? That's what a state is.

It's hardly the only distinguishing feature. States also build infrastructure, promulgate laws, provide forums for resolution of disputes and so forth. Your argument as made here is both narrow and immature.

BoredAstronaut2• 14 years ago

How do you measure the is-ness of the state? By it's budgetary expenditures? Many existent states (like Canada) have relatively small military budgets. For them, wielding or even threatening to wield violence is not their primary reason for being. Their primary reason for being is to ensure the health and welfare of their citizens, and they do so not by threat of violence, but by collection and distribution of taxes and passing of laws.

The vast majority of people in most democratic societies do not require the threat of arrest and imprisonment to follow the majority of laws. Assuredly there are minor disagreements about which the validity of certain laws, and many people cheat a little here and there. But when the majority of citizens believe that the majority of the law, and the state which imposes it, is unjust, you have an authoritarian government, and a revolution is inevitable.

It might also be worth noting that even if, based on budgetary spending, the US government is primarily an institution of the force and its display, most of that is happening outside of US soil. Most of it, in fact, is deployed in protecting sea lanes for the benefit of shipping and the people who rely on it: namely, everyone on Earth. I'm not American, and I don't like everything about America, but I'm damn grateful for the fact that the American government is funding the security of the machinery which keeps food and goods flowing around the world, since a lot of people where I live (Canada) would have difficulty surviving the Winter (and maybe even in Summer) without it.

To what extent global commerce and trade are just or unjust is another question, but I suggest it can be addressed on a case-by-case basis, and that the vast majority is far more beneficial than detrimental to everyone involved.

graeme• 14 years ago

This is a complete straw man. Assange wasn't calling for the abolition of government, nor did he say they're the only ones who do bad things.

Further, Hobbes' state of nature has zero grounding in empirical fact. Which historical state of nature does it refer to?

burkean• 14 years ago

> Which historical state of nature does it refer to?

Hobbes' state of nature is probably an ahistorical argument. That all men used to live under a state of nature is not necessary to Hobbes' argument. It is a thought experiment, showing the consequences of there not being a state, and allowing him to infer the rights of the people within the state. In terms of history, Hobbes would have had in mind cases contemporary to him when state authority collapsed and violent chaos took hold -- the English Civil War etc.

He is not arguing from history, and to dismiss his argument on that ground alone might risk disengaging from what Hobbes' was trying to get at.

unimpressive2• 14 years ago

I think that more focus, at least in the short term; needs to be put on making crypto accessible to windows users. As an example, consider the following project website:

https://www.gpg4win.org/

An invalid security certificate, and even that only if you go out of your way to specify https. If the vast majority of users saw this, they'd go running; including myself. I can't in good conscious recommend crypto that doesn't have it's own security certificates under control.

I have as yet not seen any less shady open implementations of PGP out there.

Of course, because of the proprietary nature of windows, it is totally possible for them to have back doors which will break your encryption, but I'm fairly sure that there are ways to verify, even without source code; that Microsoft isn't pulling any funny business.[0]

[0]: Besides, I'd prefer a situation where politically unsavory backdoors have to be used to read your data, as opposed to it being plain text and free for all.

rdl9• 14 years ago

I feel pretty safe predicting that most communications are moving to mobile, vs. desktops. Even if you have a desktop, most of your communications will happen on a mobile device.

The thing we really need (and what I'd fund if I had a spare $Xmm or so) is a great crypto API and solution to the user key management problem for iOS and Android, hooked into apps. It's technically easier to do on Android. On iOS, you're kind of stuck due to the core apps (mail, messages, etc.) being first-party Apple). It basically would take Apple deciding they cared about this issue, then building it into the OS in a way which didn't actually require trusting Apple completely, to work very well. Android has some steps toward this with some NSA projects, and wouldn't even necessarily require a full forking.

Some way to do tokenization and thus fairly transparent encryption on the client (phone) inside apps like the Facebook App, Twitter, etc. would also be nice. That's both a technical challenge and a UI/UX problem.

Silent Circle (from Jon Callas, Phil Zimmerman, Vinnie Moscaritolo (the PGP team...) and some Navy SEALs and defense contractors I knew from Iraq) actually seems like a pretty viable choice for sms, email, and voice right now. It unfortunately doesn't integrate into the social networks and other services people use, though.

unimpressive2• 14 years ago

I feel pretty safe predicting that Desktop computing will be around for a while yet.

I also feel pretty safe in saying it's not an either or thing, we can have both; and should.

rattus3• 14 years ago

Silent Circle appears to be for people who both

1) Want military-grade(ish) hardened coms

and also

2) Aren't willing to set it up themselves, but trust a service provider to do it for them

I read their docs a bit ago and don't really get it. I didn't really get Whisper Systems offering either as it appeared to have a broken trust model on a variety of levels.

If I cared about this kind of thing, and I really don't, I'd likely want to own all parts of the transport system and have the only available threat surface be the encryption algorithm as much as possible http://www.voip-info.org/wiki/view/Asterisk+encryption

Might it all be pointless without massive amounts of traffic padding based on this attack? I wouldn't know. http://link.springer.com/article/10.1007%2Fs10207-010-0111-4...

mtgx4• 14 years ago

I think this is very relevant here - interview with the NSA whistleblower, William Binney, on how NSA is storing every post people are making online, so they (and FBI) can use it later:

http://www.youtube.com/watch?v=TuET0kpHoyM

No wonder NSA and FBI want warrantless access to private companies by lobbying for new laws like CISPA, and trying to build backdoors in services like Facebook, Skype, Twitter etc. They want to know absolutely everything you do online, besides your public posts:

http://www.wired.com/threatlevel/2012/05/fbi-seeks-internet-...

I don't know if they are doing it out of malice/power grabbing/control, or purely as a way to make their jobs more "efficient". But their #1 priority should always, always, be respecting the Constitution, and not trying to skirt around it. And I think they've forgotten all about that long ago.

revelation• 14 years ago

I think the point is democratic states should (need) not have intelligence agencies with unlimited powers. They corrupt the state as they establish themselves as a central pillar of power (next to the military and the government).

They don't even have any historical roots in western political systems. The country with the claim to that is Russia (http://en.wikipedia.org/wiki/Okhrana), where they were commonly used to quell internal unrest and combat opposition.

hythloday• 14 years ago

The role of an internal secret police goes back at least as far as the Roman Frumentarii[0] and I think you can trace a direct lineage from Walsingham's[1] operations to the CIA/NSA.

[0] http://en.wikipedia.org/wiki/Frumentarii [1] http://en.wikipedia.org/wiki/Francis_Walsingham#Entrapment_o...

xfs• 14 years ago

They don't mean to grab particular information about every individual. They want to ensure completeness of their data mining results.

bluedanieru3• 14 years ago

Forget about the Constitution. Rather, they should respect basic human rights and the principles of the Enlightenment. All this focus Americans put on their Constitution makes it easier for their government to become oppressive, because it encourages complacency. As though you could write the perfect set of laws, that you could define the perfect set of operating principles for your government, and in that way free yourself of tyranny forever and guarantee a free and open society for you and all your descendants. No, the price of liberty is eternal vigilance.

wissler3• 14 years ago

Insightful. I'm curious as to what you think are the basic human rights and the principles of the Enlightenment.

cpeterso• 14 years ago

I don't disagree, but courts are much more likely to enforce laws that are written down and (implicitly) agreed to by US agencies.

rmc6• 14 years ago

Forget about the Constitution. Rather, they should respect basic human rights and the principles of the Enlightenment. All this focus Americans put on their Constitution…

It's part of the American mythos/story/narrative, that the USA constitution/bill of rights/founding fathers were some sort of genius people who were the first to come up with this brilliant and perfect text.

wololo• 14 years ago

(in case anyone missed the reference, "the price of liberty is eternal vigilance" is attributed to Thomas Jefferson)

Myrmornis• 14 years ago

> their #1 priority should always, always, be respecting the Constitution

Presumably their #1 priority can be specified in a more rational way without random worshipping of some old document? Other countries, not blessed with the Constitution of the USA, also have intelligence and law enforcement agencies.

javert• 14 years ago

No. The Constitution defines the proper form and responsibility of American government. If the Constitution falls, we no longer have legitimate government. That's historical fact.

Other governments' law enforcement agencies follow the laws of their own countries (or don't). Are you saying they shouldn't do that?

artichokeheart• 14 years ago

"But their #1 priority should always, always, be respecting the Constitution, and not trying to skirt around it. And I think they've forgotten all about that long ago."

That's the irony of the whole American security apparatus. They are in place, nominally, in order to protect American citizens rights to live with the freedoms inherently granted to them by the Constitution.

consciousness• 14 years ago

^ This -- nailed it.

Ankaios• 14 years ago

This doesn't detract from your point, but I thought I should correct something just because there are a lot of overseas readers here who might not be very familiar with the US Constitution:

The Constitution does not grant freedoms to citizens. Instead, it delegates specific powers from the citizens to the federal government.

frozenport• 14 years ago

The FBI's actions aren't in any way different then Google. Who also crawl the Internet and download every post people make.

b6• 14 years ago

I'm sorry, but you couldn't be more wrong. The NSA's dossiers are automatically being built from data they're getting via the expensive hardware they forced telecom companies to install, not scraped data from the web.

If your email, or SMS, or voice call, or fax, or IM, or whatever else they care about and know how to parse, ever goes through any of their boxes, it's stored and associated with your entity forever, and may be used to glean unknown levels of insight about you, or used against you in criminal cases.

wildranter2• 14 years ago

Sure they aren't, the difference lies on what they do with the data.

While Google will use that data to show you harmless text advertisement, the FBI might use it to backup a phony case against you, that can ultimately put an end to your freedom.

I'd say that's an incredible difference. Wouldn't you too?

dguido• 14 years ago

You know, people keep repeating this assumption that the NSA stores every post that people make online. Maybe someone should do a quick back of the envelope calculation to see how feasible that actually is?

My guess is that it's nowhere near possible given the amount of network traffic coming into/out of the US and current hard drive storage technology. IMHO the extreme amount of volume and limitations of storage space should create a necessity to be at least somewhat targeted in scope.

Not sure why people don't use common sense a bit more often...

nodata• 14 years ago

So somebody else should do a calculation, and based on the result of that calculation which you didn't do, people should use common sense more often?

yardie2• 14 years ago

> the extreme amount of volume and limitations of storage space.

Speak for yourself then. I've already got 10TB of storage at home in a case the size of a shoebox. It's got my entire life in it (at least every file I've created since university), but most of it is storing my movie and music collection. So, realistically your entire life can fit in a 1TB drive once you exclude videos and transcode audio. 2-4TB if you're a person of interest.

Do know that 1 Backblaze 4U-server holds 135TB. They are building a datacenter in Utah with 100,000sqft[1] of rackspace. 20,000 racks per floor (I don't know if there are multiple stories) gives you 29.7 petabytes if they used a Backblaze solution.

So yes, if the US govt wanted to record everything you did everyday they are more than capable of doing it, now.

[1]http://www.wired.com/threatlevel/2012/03/ff_nsadatacenter/

rmc6• 14 years ago

Think of Google. The have downloaded and stored lots of the internet. How else can they search it?

So if we know at some level that it's possible, could the NSA do it?`

Ntrails• 14 years ago

I wonder how many times goatse.cx appears in that database.

georgeorwell7• 14 years ago

This kind of over-the-top writing confirms what I already thought, which is that despite whatever good he might do in terms of exposing corrupt governments in the world, Julian Assange is just desperate for attention.

Being this paranoid he should be advocating "post-quantum cryptography", i.e. cryptographic methods that are secure even once somebody develops a quantum computer.

https://en.wikipedia.org/wiki/Post-quantum_cryptography

mtgx4• 14 years ago

Nice username you got there. So you're saying this all conspiracy theory stuff? I think we've gotten way passed the point where the fact that the government monitors everyone online is just a conspiracy theory.

georgeorwell7• 14 years ago

Thanks :) I don't think it's a conspiracy theory, I just think that the way he frames it is a bit overly dramatic. Personally I just try to stay relatively anonymous and I operate under the assumption that whatever I say or do is basically public information. I can't be bothered with encryption when I'm talking to my friends because those conversations usually consist of things like, "Where do you want to eat?"

dsl• 14 years ago

Absolutely an attention whore.

A few people took on the risk of giving him a treasure trove of stolen documents (the VAST majority of which did had zero positive impact in being released), and he turned it into a soapbox.

scarmig2• 14 years ago

A sufficiently motivated government has a nearly infinite amount of tools available for breaking encryption. Ignoring the possibility that it might know proprietary weaknesses to various systems (a hypothesis that is unknowable), there's just so much you need to secure at each node in a computer system.

Are you personally sure no backdoors exist in the physical hardware you use? In the operating system you use? In the compiler used to build your OS? In any of the applications on your system? Are you sure that there's not a hardware keylogger on your keyboard, and do you check every day before sitting down that there's not one? Are there any secret cameras pointed at your keyboard, or sensitive microphones hidden nearby that can distinguish what keys you hit?

And once you're sure of all that, are you just as sure everyone you communicate with is equally diligent?

And, while we're at it, have you come up with a solid patch to prevent the well-known rubber hose vulnerability that exists in all cryptographic systems?

That doesn't mean the crypto-anarchist project must fail. Encryption is invaluable: while the vast majority of other technological advances--sedentary agriculture, writing, maths, roads, sewage systems, paper, the telegraph, electricity, the light bulb, cars, "computers," satellites, Google--have all increased the legibility of the world to the State, encryption does the opposite. The panopticon isn't an existing, established system but instead an equilibrium point that the State has to constantly push us toward: anytime the economic cost of that push is increased, it gives us more opportunities for creating spaces of genuine human autonomy.

But once you recast crypto-anarchism in that more moderate and stronger form, encryption moves from "our one hope against total domination" and a "hope that with courage, insight and solidarity we could use to resist" to something more banal: one tool of many. Not even a particularly effective tool: governments don't care about a bunch of nerds throwing PGP parties, and all the encryption in the world hasn't prevented the State from throwing Assange into jail (a pleasant jail with some fine Ecuadorian decor, but a jail nonetheless) and obliterating his organization.

mtgx4• 14 years ago

In Cory Doctorow's talk at Google, he said that all routers today have interception technology in them. It's only a matter of being enabled or not in some countries or in others. But it seems so many have asked for it, that they don't even bother to build routers without that interception technology in them, so now their default router has interception built-in by default.

http://www.youtube.com/watch?v=gbYXBJOFgeI

tptacek3• 14 years ago

Sigh. Routers are an interception technology.

trotsky• 14 years ago

Even using encryption that is trivially defeated is effective at resisting broadly applied surveillance as long as the fact that it's trivially defeated isn't public. That's because you need to restrict the application of the technique to a rather limited circle to maintain secrecy, which more or less guarantees that it's only applied in a targeted fashion.

Egregore7• 14 years ago

My idea is that encryption must be so easy as to be used by all without configuration. It will make much harder mass surveillance, all other methods you cited are much more expensive methods, in most of them you must have physical contact or dedicate an attack against somebody, but to find that somebody you need to follow his correspondence.

acabal• 14 years ago

I agree with the sentiment, but Assange's prose is a little dense. Maybe it's OK for his target audience, as I assume the layman won't be reading cryptome.org.

What we really need is a champion to explain in relatable, plain English why encryption is essential even for mom and dad, and to explain it in a more mainstream venue. I think a big reason why people don't encrypt mail, etc., is because:

1) they don't know why it's important because nobody can explain it to them in relatable terms (like saying: when you send an email, Google keeps a copy forever, and the FBI can read it just by picking up a phone and asking nicely), and

2) if they do know the importance, the practicalities of encryption are explained impenetrably. A blur of acronyms, bad metaphors ("keys?" terrible choice of metaphor, considering how a pair is intertwined and their actual use), and no well-known authority you can trust to explain it all simply.

The problem isn't that people don't care. They would care if they knew the realities of how their communications are stored, processed, and exposed to their governments. The problem is that nobody can explain it to them in a way that's not ridiculously complex or laden with terms like "Platonic realm" and "transnational dystopia".

18hrs• 14 years ago

For this reason I am fond of Jonathan Zittrain. Not that he particularly aligns with Assange but he is very good at presenting these issues in a compelling manner.

belorn3• 14 years ago

Eben Moglen has also made several good talks about the abolishment of privacy, and its effects. I would especially suggest listening to the Berlin talk made this year called "Why Freedom of Thought Requires Free Media and Why Free Media Require Free Technology".

SoftwareMaven3• 14 years ago

The problem isn't that people don't care.

You are right, people care. But not about things that would make reducing government power likely nor encrypting things by default probable.

They care about getting to work in the morning and getting home at night. They care about dinner with the family and a couple hours mindless television. They care about being safe while they do these things, and they've fully bought into the government's mantra of "we will protect you", so, as long as that's happening, they don't care about anything else.

Go talk to just about anyone outside of sites like Reddit or HN about the TSA, and you will be told how good a job they are doing. When the government tells them it is time to randomly drop their pants for the cavity check, as long as they are told it is making them safe, they will willingly oblige.

As much as the government's power grab, the complete lack of concern for it scares the hell out of me.

tptacek3• 14 years ago

The government doesn't have a "mantra" of "we will protect you". It has an obligation to actually protect its citizens, and, in America, does a pretty good job of it.

The notion that reliance on the government for protection is a brainwashed delusion is one of those conversational signifiers that convince normal people that all this encryption stuff has nothing to do with them.

mylittlepony5• 14 years ago

It's a very hard problem IMO. Not just finding the words, but everything. For example, before learning linux to a degree where it wasn't a pain to use as a desktop, I thought it made no sense to waste time learning this or that security feature (like email encryption), because an expert would probably be able to fuck me anyway. Now that I have a better understanding, and I can mentally trace the information from end to end, know where it could be compromised, etc, I started caring, secured everything the best I could, and my friends now call me a paranoid (that didn't stop me from installing Thunderbird and Enigmail in their PC's).

So I think someone should explain to the people in a clear way that you don't need 100% security, but you need to understand when and where your information can get compromised, and what you can do about it. Eg:

- Private message on facebook - you are screwed

- Messenger - you are screwed

- Post on a blog - you are screwed, unless you posted anonymously and hidden your IP (which is not that easy, we know of many geeks who were caught even when they were using Thor, because they didn't fully understand the technology - hint: exit nodes)

- Email - you can encrypt it, and you are safe as long as both computers (sender's and receiver's) stay safe (assuming you store your private key there)

- Data on your computer - you are safe unless malware is installed, or someone gets physical access. You can use full disk encryption, but you will probably have to use Linux (personally, I use Ubuntu), so this is a far fetched goal for the regular Joe. There is also truecrypt for windows, but it's not full disk if I recall correctly.

- Etc.

I'll add a recent anecdote here: Just the other day a friend of mine replied to one of my emails, saying that gmail broke the encrypted email (meaning he couldn't read it, not that gmail decrytped it). In his reply, I received the broken email, and four emails from a private conversation he was having with other people. Something happened in gmail, something went wrong, and I got those emails. They came with headers and everything, he didn't copy/paste those (he wouldn't know how to do that). So there's another reason to encrypt emails: mails server can make mistakes apparently.

mylittlepony5• 14 years ago

Can the downvoter show his face and elaborate? Thanks

Egregore7• 14 years ago

Can you please elaborate on Tor exit nodes vulnerability? As far as I know they can read your passwords if you're not using secure connection, but how can it compromise your identity? I'm assuming the new account was created for an anonymous blog post.

zobzu2• 14 years ago

The main reason I think, is because its hard.

Either you use a 3rd party service to encrypt, its easy and also extremely dumb (since its not end to end encryption).

Either you use PGP or SMIME and guess what: it's too hard. Their design is fine. I especially like GnuPG (PGP), but the UI, even in CLI, is terrible, terrible!

Most people don't even understand that a GnuPG keychain generally contains 2 private keys, not one (one for signing, one for encryption!) or the concept of master signing key and subkeys.

These concepts are relatively simple, but their use is hard. Terribly hard.

Egregore7• 14 years ago

My idea was that public key cryptography should be done under the hood, so I created a easy to use ResoMail, but people still were not interested (or I was a bad marketer).

bwood• 14 years ago

Here's a relevant paper called Why Johnny Can't Encrypt[1], which does an excellent job of defining understanding and usability problems with encryption. It's certainly dated, but I find that its main points are still very true today.

[1] http://www.gaudior.net/alma/johnny.pdf

saraid2163• 14 years ago

I wonder how many people who think it's important think that it's important enough to merit actually being said champion.

easytiger• 14 years ago

how about, without encrypted comms, its like posting a letter by not putting it in an evelope and sticking it to the outside of a bus

betterunix5• 14 years ago

"The problem isn't that people don't care"

I think you are overly optimistic here. Let's put it this way: if people were told that they had to report one crime committed by their neighbors in order to watch the superbowl, what do you think would happen?

"They would care if they knew the realities of how their communications are stored, processed, and exposed to their governments"

I have a lot of friends who know this, some of whom know it in more depth than many HN readers. Guess what? They all stopped bothering to maintain a PGP key. They all carry cell phones, and they do not even take the time to try to disable location services. They are all users of at least one of (Facebook Twitter Google+ GMail LinkedIn). If the people who know these things do not care, what make you think that people do not know these things would care if they became knowledgeable?

TranceMan• 14 years ago

Many governments now have no fear of encryption - trust no one....

IheartApplesDix2• 14 years ago

SHA-1024 Should only take a million square foot datacenter filled with GPUs an hour or so.

beloch2• 14 years ago

Assange certainly has a flair for the dramatic... but he doesn't understand encryption.

http://www.zdnet.com/blog/btl/wikileaks-insurance-file-decry...

Wikileaks has distributed AES encrypted files that it claims are full of government secrets. They have withheld the information needed to decrypt some of those files ( although some keys have leaked from wikileaks, oddly enough) as a deterrent to persecution by governments. There's just one minor problem... This is effectively publication with delay, and it forces governments to go after them hard rather than deterring them.

AES is based on computationally difficult to crack algorithms. If you assume there will be no advances in algorithms, no new types of computers, no weaknesses found in the implementation of AES, etc. then it will take a comfortingly long period of time for these files to be cracked. These assumptions are bad. Cracking algorithms are advancing rapidly. It is astronomically improbable, but not impossible that someone could come up with an efficient algorithm for factoring tomorrow that would render all factoring-based cryptography impotent overnight. The prospect of quantum computing on the horizon also places a time limit on how long these files can remain secure.

When you commit secrets to a current form of encryption based on computationally difficult problems and distribute the cypher text broadly, you have effectively published those secrets with an unknown delay.

This is why governments want Assange so badly. He's not keeping secrets to deter them, he's publishing them with a delay because he doesn't know what the heck he's doing when it comes to encryption. If he used a one-time-pad (Vernam cipher) and kept the key on his person he'd be in a far better position, but he's apparently too stupid to do this. How do you use a one-time pad?

Cipher = message XOR key (XOR = exclusive OR)

10110101... (secret message in binary)

11010111... (true random key)

--------

01100010... (ciphertext)

For this to work, Assange would have to distribute the ciphertext and keep the random key secret, perhaps on a USB key around his neck. This method of encryption has been mathematically proven to completely secure provided the key is truely random and not from a pseudo-random number generator. True random number generators can be bought for relatively cheap these days. If Assange had encrypted the files this way they would be safe from any cryptographic attack, safe from quantum computers, or anything else out there. For all time. The only thing that could unlock these files would have been his USB key. Obviously, this is not a convenient method for online transactions, since transmitting the secret gives eavesdroppers all they need to decode the ciphertext. However, for the use Assange has been putting AES to, one-time pads are perfect.

Why didn't Assange use a one-time pad? The only answer can be that, for all his bluster, he remains utterly ignorant of how encryption works. Thanks to his ignorance the governments of the world have a vested interest in taking him down. Even if someone else picks up where Assange left off, hopefully that someone will understand how encryption works.

jlgreco3• 14 years ago

Did you just s/RSA/AES/ ?

And you are suggesting he use a OTP?

Assange is not the one that does not know anything about cryptography here.

psykotic• 14 years ago

> AES is based on factoring.

And you say _he_ doesn't understand cryptography?

beloch2• 14 years ago

I'm not in classical crypto, so I occasionally mess up and call algorithms based on computational difficult "based on factoring". The end result is the same though. Publication with delay.

plaguuuuuu• 14 years ago

So Assange, who has actually developed part of Truecrypt, doesn't understand encryption. In that case I wonder what the rest of the tc team is smoking to let him contribute :p

The use of AES is clever. It will be crackable at some point in the future for sure - everyone knows this. I'd be willing to put 20 bucks on NSA already having cracked it anyway, even if that makes me one of those tinfoil hat types, but that would make no difference to Wikileaks - in fact it probably plays into Wikileaks' hands.

The fact that the insurance file probably -will- be cracked at some point in the future means that the information will ultimately be public. Perhaps this encourages more prompt action against Assange but it's a matter of weighing up this risk with the perhaps higher priority of eventually releasing the information - even if every mechanism of distributing the key in case of emergency fails, it will be cracked ONE day. I think this strategy is easily plausible enough.

One could claim that Assange's strategy is poor - certainly being under house arrest hasn't been empowering - but saying Assange is ignorant of encryption is ridiculous.

jlgreco3• 14 years ago

Hell, it would not have even been a bad idea for Assange to send them a copy of the key when he initially released the insurance file. If the insurance file has anything of substance, it would work better if they know what is in it. Giving them the key would be giving them proof that you are not bluffing.

codeulike2• 14 years ago

You're talking about the Insurance Files, right? Why would Assange give a toss if the government decrypted that? Its their stuff in the first place. Also, the Insurance Files were an exception to the way Wikileaks usually did business, not a demonstration of their typical use of encryption.

What use would a one-time-pad be with the only key around his neck when he got arrested? He needed a dead-mans-handle type arrangement.

There are lots of things that can be claimed about Assange, but claiming that he doesn't know encryption is not one of them.

ref: http://en.wikipedia.org/wiki/WikiLeaks#Insurance_files

casca• 14 years ago

To anyone reading this, please note that while some of beloch's points are valid, the analysis of AES and the breakability thereof is not. While it's true that at some point it's likely that AES will be broken, it's also true that at some point our solar system will be destroyed.

OTP is theoretically unbreakable, but that would require a key that is as long as the ciphertext, at which point Mr Assange can just keep the data on the USB stick around his neck.

rdl9• 14 years ago

Yeah, the whole point of distributing huge "insurance" data in an encrypted form is that the key is tiny. It's possible to maybe censor distribution of a 10GB file, at least generally, but it would be exceedingly difficult to prevent distribution of a 128-256 bit key. Literally you could shout it from the rooftops.

Nothing remains sensitive forever. It's likely everything in the "insurance file" would be public and mainly of interest to historians in 50-100 years, even without Assange. Most sensitive information in government ceases to be sensitive once everyone involved in the decision-making process is dead, and almost all of it is only operationally sensitive or for the lifetime of a piece of technology or particular source.

I mean, if we found out incontrovertible proof about the USS Maine or Gulf of Tonkin being engineered casus belli, who would really care?

guessWhy2• 14 years ago

a) No one time pad is used, because that would make the whole point of publishing the encrypted blob pointless in the first place. The point of publishing it is that the key could be published very easily in an emergency, e.g. using a tweet. If the one time pad key has to be published, he could just keep the data to himself and publish it unencrypted later. Pretty pointless.

b) The argument about deferred encryption may be correct. However this is not related to the relations between Wikileaks and any government. (The argument may also be wrong. It could turn out that decrypting AES is still hard even in 100 years. In any case it is likely to be safe until the data is de-classified anyway.)

munin• 14 years ago

so the purpose of the whole scheme is so that you can publish a very small amount of information that would decrypt the entire blob. a key has these properties.

the 'key' in this case would be a multi-gb random document. how do you publish this quickly?

JulianMorrison• 14 years ago

Your politics is broken too. Publishing with a delay would mean "no use going after wikileaks, it's already out there". Keeping the key would mean "if we close them down, it's over". Given the delay to crack AES might be far longer than it takes stuff to emerge anyhow as declassified obsolete history, that's as good as keeping the key. And they have gone after wikileaks.

rorrr• 14 years ago

If someone figures out how to crack AES or how to factor very efficiently, leaks will be the least of our problems.

doe88• 14 years ago

> If he used a one-time-pad (Vernam cipher) and kept the key on his person he'd be in a far better position, but he's apparently too stupid to do this. How do you use a one-time pad?

A 1.4 GB key... Yeahhhhhh, very practical.

edit: and btw I hope you're also confident on the quality of your RNG to output 1.4 GB of random bytes.

baddox6• 14 years ago

I don't get it. You seem to be inferring that it's impractical to store a couple of gigabytes on your person.

belorn3• 14 years ago

The problem with one-time pads, is that they require a password with the same length as the data you want to encrypt. That mean, if you don't pre-distrubute the key as well, you are in the same boat as if you don't distribute anything at all. To give everyone the one-time pad key, its the same trouble as sending the actually data unencrypted to everyone. As a threat value, pre-releasing xor'ed data has exactly zero value.

One could suggest that he could use something semi-random but well published information instead of random generated blob for a one-time pad. Earth rotational speed, stock market numbers, intensity of the sun radiation comes to mind. In that case, the password would be the exact dates to take data from, something that could be spread faster than gigs of data. The problem with this is, as soon people start to use it, people would start testing those data to decrypt with, and the key-size essentially becomes the size of time ranges of existing data.

nob• 14 years ago

True.

A one-time pad as a consumer encryption has yet to be realized though, even though the programming effort needed to create a system like this is low. It's even easier to use such a system in todays world of 64 GB USB drives. (64 GB could be used as a key for almost a life-time of text correspondance.)

What the public would benefit from is a system that works as follows:

- Program has a create key mode. Lets you specify key size, or use the rest of the capacity (eg. a full thumb stick).

- Creates two of these files (one for each participant).

- Has a simple interface for encrypting/decrypting content based on the key file.

- Each message is prefixed with the offset of the file

- Party 1 starts at the beginning of the file. Party 2 at the end of the file. In order to avoid resending data using the same offset. When they get close to overlapping in the middle, they create a new key.

htf• 14 years ago

In your scheme, the random key is as large as the message. It would be pointless to publish the ciphertext.

harryh2• 14 years ago

Distributing a OTP encrypted ciphertext ahead of time doesn't accomplish anything because the ciphertext can be translated into any plaintext you want by choosing the correct key.

harryh2• 14 years ago

A practical demonstration of this BTW (in scala):

  def otp(s: String, key: String): String = {
    def base64decode(s: String): String = {
      new String(new sun.misc.BASE64Decoder().decodeBuffer(s))
    }
    def xor(a: Char, b: Char): Char = (a ^ b).toChar

    val s2 = base64decode(s)
    val k2 = base64decode(key)

    val sb = new StringBuilder()
    for (i <- 0 to s2.length - 1) {
      sb.append(xor(s2(i), k2(i)))
    }
    sb.toString
  }

  val ciphertext = "LQcGRC0HFR4ME0sjHhkOHBVSGB0ZGhIcWRUPQgsNFkYIHwdE"

  val key1 = "YWJjZGVmZ2hpamtsbW5vcHFyc3R1dnd4eXphYmNkZWZnaGlq"
  val key2 = "eW9jZF5vemoscCpOezlobno/OGlxfzJ7K3R8MXItfShnaGtq"

  otp(ciphertext, key1)
  otp(ciphertext, key2)

So releasing the ciphertext into the wild accomplishes nothing.

CorsairSanglot2• 14 years ago

Here's another excerpt from "Cypherpunks" at Salon:

http://www.salon.com/2012/12/02/julian_assange_the_web_can_c...

You can only buy this book direct from the publisher. Amazon isn't carrying it.

rdl9• 14 years ago

You can also find it on popular torrent sites, as information wants to be free. (I would have bought it if it had been on Amazon, but, well.)

1dc2e5b6f0d5036a182e85ab34da839d15eaf1ed cypherpunks.epub

5d546aaa83aebd43a2342f6dc737d271a34ff684 cypherpunks.mobi

ccaf1c45fc31633c9728dcd2cd4545b55a27be7c cypherpunks.pdf

CorsairSanglot2• 14 years ago

Wait...so your two options are buy from Amazon or pirate? Amazon is basically the worst corporation on the face of the earth. Supporting a small publisher -- especially a small publisher willing to publish Julian Assange, books about Bradley Manning, and books about Wikileaks, is basically a decent thing to do.

lucb1e• 14 years ago

And you can't donate with Bitcoin? What is this?

gasull4• 14 years ago

This is Cryptome, who isn't associated with Wikileaks. You can donate to Wikileaks using Bitcoin.

coopdog• 14 years ago

I think his call to action at the end is too abstract. It's important to understand that there is a problem, but the solution lies in understanding why the government is the way it is and why people vote to have such a government (fear).

The battle is winning the minds of the average person, by showing them that an encrypted, unmonitored, uncensored internet is in their best interests and not something to fear.

Or in the worst case, show that an all powerful (and therefore eventually corrupt) government is the greater of two evils. The proper tool for this is probably cheap, scalable marketing stunts and compelling media that spells this out in layman's terms.

genuine• 14 years ago

> and if all else fails, to accelerate its self-destruction.

Unfortunately, that is how you know if someone has gone off the deep end.

I agree though that we should all be encrypting communication, but our government helped develop the methods of encryption, and some methods have been known to have backdoors: http://www-cs-faculty.stanford.edu/~eroberts/cs201/projects/...

Why it is highly recommended not to implement your own encryption method, we shouldn't be using something that could easily be decrypted by the wrong people either. We need to study methods that we use extremely well, and be aware that encryption susceptible to decryption via brute-force with significant resources are just as dangerous as backdoors.

I also advocate development of wireless mesh networking technology to handle larger adhoc networks. While those that wish to spy could still become a member of an adhoc network, it would significantly complicate things for them.

contingencies4• 14 years ago

It is interesting that this preface has been extracted and hosted on Cryptome. Given the history of Cryptome and Wikileaks; and having had the opportunity back in 2009 to ask Assange in person about his views of Cryptome, I am no doubt his eyebrows would raise as well. I wonder if John Young posted it himself or it was submitted. IIRC part of Assange's concerns around Cryptome were some well reasoned arguments around editorial and source protection policy.

guscost• 14 years ago

TLDR: P ≠ NP

marshray3• 14 years ago

It's not proven that anything in TFA is actually NP.

aurelianito2• 14 years ago

This xkcd strip was never more on-topic than now.

http://xkcd.com/538/

nickpinkston• 14 years ago

Ha - this is what I was thinking the entire time. As long as humans are physical, we will be subject to coercion. I think Assange has good points, but the internet could still be used for plenty of harm even if they couldn't tell exactly what you're saying - even that is doubtful.

gregsq• 14 years ago

Yeah but,

http://en.wikipedia.org/wiki/Rubberhose_(file_system)

aurelianito2• 14 years ago

They will torture you just in case.

strictfp• 14 years ago

I feel that we have to understand that using technology to fight legal battle never is the right answer. As soon as the government sees a particular technology as a hinder, threat or even an inconvenience, they can legislate against it. This holds true for encryption, VPNs and all other technological "saviours" that internet evangelists keep ranting about.

The truth is that the only reasonable thing to do is to become politically active.

If you can't beat them, join them.

AnthonyMouse• 14 years ago

Yes and no. Sure, we have to fight bad laws. Here's the thing: Encryption is legal now, but what good is it if we don't use it?

We need to build and use technologies that respect human rights and we need to fight to make sure that they remain legal. One without the other is nothing. There is no point fighting to keep something legal if you don't have the technology and infrastructure to use it.

fauigerzigerk• 14 years ago

I generally agree with you that there is no technological solution to these issues, not on a broad scale at least. Educating everyone about using encryption isn't going to fly because as soon as it becomes effective, they will legislate against it.

But I wonder what shape any political activism could have. Maybe this cryptography movement should be seen as just that, a way to force a political debate and make any political activism relevant.

yason2• 14 years ago

In maybe five to ten years, the internet will effectively split in two. There will be major, commercial service providers such as Facebook-type social media hubs, major news sites but there will also be an invisible internet that is everything internet used to be, and in addition to that encrypted, anonymous, and untraceable.

How it shows most prominently at the moment is file sharing. Setting the endless copyright debates aside, what happens is that governments and large companies want to interfere with the privacy of what citizens are doing with their own bits. They say copying is theft while citizens consider twiddling their own bits a private matter that's none of anyone else's business. The citizens don't understand that while it's de facto legal to form a sneakernet—the actual legal status probably varies from place to place but nobody has ever been sued for sneakernet filesharing because nobody else never knows about it—it's illegal to form a filesharing network over the internet.

I don't promote or demote filesharing per se: it's just the cutting edge where the future trends will show years before they land elsewhere and that's what it makes it so interesting. A marginal slice of file sharing has already moved to anonymous darknets but in a few years and after a few more bad copyright/freedom-of-speech incidents with bad publicity, there will eventually be a breakthrough and the whole filesharing activity will go underground en masse.

When the masses go for it, the capacity and availability of invisible darknets will raise in orders of magnitude. That means there will be other providers in the anonymous networks as well, websites and services. There already are some, from anonymous wikis, anonymous project pages to anonymous forums but currently those are playgrounds. That is not so in ten years: there will be a major "bazaar" going on underground. While everything is anonymous and untraceable, everything is also secure. An online bank could very well operate in the anonymous network because the traffic is already cryptographically signed, and users can enjoy strong authentication if they wish to or remain a pair of anonymous public/private keys.

At that point the traditional grasp of internet control is lost.

The institutions governing the internet and the copyright and whatnot are faced with a big dilemma: do they dare to ban and make illegal anything that's not specifically permitted on the internet and if so, how to go about it in actuality. Do they lobby for laws that only allow ISPs to let citizens connect to a http proxy that validates all traffic to be "approved"? Do they extend the charges for any use of the invisible internet that is deemed illegal, to cover all users of the invisible internet?

We're still in the shadowdancing mode but the stakes are going higher, and in at most ten years the problem of control versus anonymity will have come out in the public.

We better know what we want, at that point.

chii2• 14 years ago

> When the masses go for it, the capacity and availability of invisible darknets will raise in orders of magnitude.

this is predicated on the assumption that providers are not strangled by their balls by the authorities (who is in turn strangled by the balls by lobbiests/companies/vested interests).

If you could run your own routes with private equipment (such as a mesh like wireless network?), instead of having to sign up to an isp, then i see this as more viable a future.

lucian1900• 14 years ago

Will ISPs be forced to disallow all encrypted traffic? That would be disastrous.

It's already possible to connect to a website over https (with a self-signed cert you've obtained through a second channel) and be pretty much certain no one is snooping. The target you're connecting to doesn't have to be obvious either.

gasull4• 14 years ago

> there will be a major "bazaar" going on underground

I thought most people here had heard of The Silk Road onion service: https://en.wikipedia.org/wiki/Silk_Road_%28marketplace%29

> An online bank could very well operate in the anonymous network because the traffic is already cryptographically signed, and users can enjoy strong authentication if they wish to or remain a pair of anonymous public/private keys.

Or you can use bitcoins to accomplish the same and you don't even need banks.

As William Gibson said, "The future is already here — it's just not very evenly distributed".

belorn3• 14 years ago

The Silk Road will be a tiny tiny spot of activity if every startup is forced to the alternative network. If the "open" internet is based on who can pay the most to get a competitive quality of service, anything competing with existing products will be pushed out of that market.

Bitcoin and the silk road are not the future, but prototypes of it. It will be interesting to see if they become more than that, but they are showing the way forward if society continues to go down the directions currently being perused.

amazingman4• 14 years ago

Or you can use bitcoins to accomplish the same and you don't even need banks.

The longer this fiction persists, the less chance a fundamentally decentralized crypto currency will take hold. Trusted 3rd parties will always be necessary, and that's not a de facto bad thing.

jka3• 14 years ago

Just as a thought experiment, what do you think of an alternative reality in which even more of reality is transparent - including the operations of commercial, political, and other entities? Preferably collated and maintained by the community rather than centralized entities, crucially; somewhat akin to a shared wikipedia.

The thing that worries me about this push towards encryption and anonymity is that it does afford nefarious elements a lot of safe harbor. I imagine it's fairly possible to identify individuals given a few message traces, even in an encrypted anonymous environment, and layfolks simply aren't going to have the skills to cover all their digital tracks - can even expert cypherpunks? Meanwhile, a few malevolent elements in unison could easily co-ordinate and harvest details, with enough cover to be hard to track down (and even harder to prosecute).

An alternative is a world of transparency and openness - with a huge loss of privacy, but also a loss of privacy for those who would push their own causes of power and control, and/or commit crimes.

I honestly don't know what the long-term best path would be - or if there is even a genuine dichotomy between anonymity/privacy at all. I value my privacy, but I also value the opportunity to identify the sources of problems and use the structures of society to deal with them.

yason2• 14 years ago

I don't think the transparent reality would work. For thousands of years people are known to gather in the back of the woods to hatch plans that must be kept secret before the execution. That's just how people want to deal with a part of the things in their lives.

The secret might be a terrorist plan, a plan to open a new business, a plan to rob a neighbouring village or a plan to arrange a surprise birthday party. You never know, but people like their privacy. Even before the internet and telephone people could talk to other people to arrange things to come, while in the outside it just looked like the folks are walking around the town.

A transparent government and officials would be nice but I think that would never happen either. There are always matters that must be processed with confidentiality in the first stages, or the system just wouldn't work. Consider the old-fashioned hard-boiled journalism: people will talk if they can remain anonymous and confidential, and by talking they can prevent something worse from happening.

Limiting the secrecy of government/public sector affairs to a certain, absolute period of time might work, though. Things should be public as soon as they're finished.

I think that equal anonymity and confidentiality is better than the current world where most people are not anonymous and the powers to be can snoop on the rest and yet retain their own confidentiality in their actions.

tomp• 14 years ago

I would prefer a reality/society where everything is public and transparent, however, we cannot do that yet. We would need much more evenly distributed social power and means of production. Maybe robots can enable that in a few decades?

See http://marshallbrain.com/manna1.htm

betterunix5• 14 years ago

"The thing that worries me about this push towards encryption and anonymity is that it does afford nefarious elements a lot of safe harbor"

I have yet to see any evidence that this is true; all I see are anecdotes from law enforcement agencies who are pushing for less crypto, and even those anecdotes only tenuously describe "nefarious" elements. You cannot encrypt a blood stain or a fingerprint, nor can you use an anonymity system to hide the fact that a known terrorist group is increasing the volume of data it sends and receives.

So what nefarious elements do you think are going to avoid prosecution by using crypto? A few years ago, there was a case of a group of child molesters using PGP and anonymous remailers (and possibly other privacy technologies) to communicate and exchange photos of themselves abusing children over Usenet. They were caught, arrested, and prosecuted following a well-coordinated investigation -- otherwise known as "good police work." Only a handful managed to avoid identification or prosecution, and it is worth noting that this was the case with investigations of criminal organizations long before good encryption was widely available. It should hardly be surprising that such a group was ultimately caught: they were sending each other photographic evidence of their own crimes.

It is also worth pointing out that anonymity systems are used by the police to catch criminals. In the case described above, the police used the very anonymity system that the child abusers were using, and were thus able to observe their messages while maintaining the secrecy of their investigation. Similar scenarios have played out with Tor. Criminals who use the Internet will eventually figure out which IP addresses belong to the police; it will be critical for the police to use anonymity systems to mask their IP addresses (this, in fact, is closely related to the reason the Navy created Tor in the first place). It is not so much that society's nefarious elements are more empowered now; it is more that the nature of the game has changed, that new tactics and strategies will be developed by both criminals and the police to utilize and cope with these systems.

I would argue that crypto and anonymity systems have benefited society more than they have harmed it. The same crypto and anonymity technologies used by the group I mentioned above have been used by political dissidents and activists to protect themselves from abusive governments; human rights activists have used such systems to protect the people they work with. Whistleblowers have used such systems in the past, and will have to do so in the future. For people who do not have an army at their command, these sorts of systems are necessary for their protection. If you were going to report Mafia activity to the police, would you rather use Tor/remailers/etc. or would you walk into the police station in person?

There is no such thing as a world of transparency and openness, because crime is part of human nature and because political ambition is part of human nature, and both of these behaviors exploit openness and transparency. I am all for an open government, but even I acknowledge that the government will need to keep some things secret -- military plans, investigations of dangerous criminal enterprises, the locations of witnesses to crimes, and many other things must be kept secret for society's benefit. Open and transparent government does not mean "secret free," it means "secrecy when it is absolutely necessary;" it is the responsibility of citizens to ensure that their representatives in the government are not declaring too many things to be secret, and it is the job of journalists to report to the citizens what is being kept secret from them. The sooner society realizes that, the better.

pemulis2• 14 years ago

> I don't promote or demote filesharing per se: it's just the cutting edge where the future trends will show years before they land elsewhere and that's what it makes it so interesting.

One interesting thing I've noticed that the people behind the best filesharing networks tend to have tremendous success with their later projects.

Napster is the obvious one. After Napster went down, Shawn Fanning co-founded Rupture and Path, and Sean Parker went on to become the first president of Facebook, key investor in Spotify, and managing partner at the Founders Fund.

Kazaa is another great example. After their legal walloping, the founders and development team behind Kazaa regrouped to form Skype.

And then there's The Pirate Bay, which is still rolling merrily along, court rulings notwithstanding. Its team hasn't created any billion-dollar companies yet (we'll see what happens with Flattr), but they created a political party that's won elections in multiple countries, as well as the webhosting company PRQ, which was Wikileaks' home in its early days.

I don't think all of these later successes are a coincidence. Filesharing involves hard technical problems, hard logistical problems, and intense competition. If you were an investor, a blind strategy of giving money to the best pirates you can find seems like it might be surprisingly sound.

rmc6• 14 years ago

they created a political party that's won elections in multiple countries

"won elections" is a bit of a stretch. In countries with multi-seat constituancies and proportional representation, there are often minority/niche candidates.

elmindreda• 14 years ago

The Pirate Bay people didn't create the Pirate Party. There isn't a lot of overlap between the (publicly known admins of) the Pirate Bay, the (no longer existing) Pirate Bureau that gave rise to it and the Pirate Party. This is true both in terms of people, and also frankly terms of politics, beyond the basic realisation that the status quo is untenable.

97-109-107• 14 years ago

I found your comment very interesting. Could I perhaps ask you to take a look on what I've build? It's a student project in a very related field. If so, I'd be delighted to hear from you. lkaslkaslkaslkaslkaslkaslkas@aol.com

lkozma2• 14 years ago

I found your comment more insightful than the article.

amazingman4• 14 years ago

It's not an article. It's a call to action, and also an advertisement.

eternalban• 14 years ago

" ... invisible darknets ..."

Not invisible to governments and corporations, just to your fellow citizen.

The corporate-state "owns" the infrastructure. Get your TCP/pigeons (or whatever network you can throw together) working and we can meaningfully discuss "invisible darknets".

betterunix5• 14 years ago

Meh. Assuming you have some good way to avoid the Warden problem (like, say, sneakernet) you could probably get build some sort of stegosystem for this. It would be very high latency, but then again, so was the original Internet.

jimmytucson• 14 years ago

My initial thoughts are, I don't know if this is the right way to combat widespread warrantless search and seizure, although maybe it is. I'm not sold either way.

Let's say there were some massive breech of probable cause before billions of people used the internet every day. Maybe some king is issuing multitudinous search warrants to go and seize all postal mail correspondence within some large sector of the population. I'm thinking of something "old tymey" here.

Okay. Well, it seems to me, the 18th century version of Julian Assange would essentially argue that people need to start getting good at writing in and decoding cryptograms. What we really need is the 21st century version of James Otis.

I know, it's a very, very unfair analogy. But it explains my point. If this stuff that William Binney is talking about is really going on, wouldn't a legal or a socio-political (not sure if I'm even using that term correctly) response be more lasting and effective than having everybody start writing letters in the form of a NY Times crossword puzzle?

yakiv• 14 years ago

Does it seem strange to anyone that the whole book isn't available for free? This doesn't appear to be intended as mere entertainment. This is supposed to be about maintaining freedom . . . it seems like a case where you'd want to get your ideas out and save the day over earning money from it.

skrebbel• 14 years ago

Strong cryptography can resist an unlimited application of violence. No amount of coercive force will ever solve a math problem.

Not entirely false, but http://xkcd.com/538/

elux• 14 years ago

Long before Wikileaks, Assange worked on a project called "Rubberhose". (A hidden encrypted filesystem designed to offer protection against cryptanalysis by torture.)

http://en.wikipedia.org/wiki/Rubber-hose_cryptanalysis | http://en.wikipedia.org/wiki/Rubberhose_(file_system)

Wired in 2008: "Among other achievements, he [Assange] co-invented Rubberhose deniable encryption, which would let a dissident being tortured reveal one key to unlock a hard drive, while not giving away that there was a second or third password-locked folder of information."

http://www.wired.com/politics/onlinerights/news/2008/07/wiki...

jalada• 14 years ago

Julian Assange: Cryptographic Call to Arms

Related Stories