Re: [saag] CNN Says: Encryption a growing threat to security

[Bernard Aboba <[e-mail]>]

It is important to read between the lines of these statements, which concern data at rest, not in transit. Encryption of data at rest is simultaneously not widely deployed enough and at the same time, difficult to overcome for law enforcement agencies lacking the funding and sophistication of military and surveillance agencies.

Those agencies, who understand the technology and trade offs much better, have either been silent on the subject, or have alumni who now openly oppose the proposals from
Law enforcement. 

We have seen this movie before. It matters little if CNN pretends it is a new release rather than a remake.



On Aug 3, 2015, at 11:41 PM, Yoav Nir <[e-mail]> wrote:
> 
> http://edition.cnn.com/2015/08/01/opinions/rogers-encryption-security-risk/index.html
> 
> If encryption is so dangerous to security, why does the US government use it so much?
> 
> Both the article and the video contain a bunch of nonsense, but I worry a lot about this kind of message being sent to the public by a trusted source such as CNN.
> 
> I think the worst of this is presenting the issue as if this “master key” scheme is in the interest of the public, whereas the only downside is the bottom-line of corporations. So all those tech companies resisting such mandates are just heartlessly putting profits before the safety of the people. It’s a powerful message, and I’m afraid a lot of people, even well-educated ones, are buying it.
> 
> IMO key escrow with a private corporation is marginally worse than key escrow with the government, but both mean that we can’t trust the encryption. In the old Perry Mason novels, private detective Paul Drake would go to his friend at the phone company, slip him some money and get the phone records for whoever Perry Mason suspected. I guess in this brave new world that Mike Rogers is advocating the new Paul Drake would go to his friend at Google and get their TLS keys. In such a world, I don’t know if it’s prudent for my doctor to send me the result of my blood test over HTTPS, or for companies to move personnel records from one data center to another over the Internet. Back to a guy with a briefcase handcuffed to his wrist?
> 
> Yoav
> 
> 
> 
> _______________________________________________
> saag mailing list
> [e-mail]
> https://www.ietf.org/mailman/listinfo/saag

_______________________________________________
saag mailing list
[e-mail]
https://www.ietf.org/mailman/listinfo/saag