h a l f b a k e r yA dish best served not.
add, search, annotate, link, view, overview, recent, by name, random
news, help, about, links, report a problem
browse anonymously,
or get an account
and write.
register,
|
|
|
A few years ago the UK brought in a badly thought-out 'anti-terror' piece of leglislation which allows the police to require people to decrypt any file they have in their possession, or be sent to jail. Unfortunately, if you claim you cannot decrypt it, you are required to prove that you don't have the
key, which is of course impossible.
Therefore, if you are not a terrorist but someone in power suspects that you are, they have a handy tool for getting the 'right' action of putting you in jail. If you believe their promises that this won't happen then you're living with the faeries; anti-terror laws have already been used to spy on schoolchildren.
Obviously, this law is badly broken, but how to fix it when government won't listen? I propose a work-around: make all files decryptable to anything.
The system is based around one-time-pads, which are essentially strings of random bits. There are however dangerous, in that the police may ask you to decrypt them, so you can't afford to have these on your computer if you think you're under suspicion. You do, however, need a one-time-pad decryption program to be present.
Also required is an online service, which supplies innocuous files of any precise size you request. These can either be a scaled-down/cropped/recompressed (and with metainformation stripped) version of an image file you supply, or one of a library of files which are uploaded by the community. (These are only served once each, then deleted.)
The website provides a full user-friendly service, prompting upload of the necessary files and generating the output. So even non-techies will be able to produce a 'one time pad' for the police.
When the police demand that you decrypt a file, you first need to know what it is. The police probably wouldn't supply you a copy, so you'll need to access a backup in a different jurisdicion. Therefore you need to backup almost every file on your system as soon as possible after creation or modification. The only ones you needn't backup are obvious document files, standard program files and encrypted files you'd be willing to decrypt for the police.
So - when police say "give me the password to decrypt 'dfhmnt.dat' you can give them a one-time-pad which can be used to decrypt it into a picture of your house.
(?) Bruce Schneier on RIPA
http://www.schneier...ore_ripa_creep.html
is worried about it [Loris, May 03 2009]
Liberty
http://www.liberty-human-rights.org.uk/
A UK lobbying organisation that deals with privacy and human rights. [Aristotle, May 04 2009]
Preliminary form of access-to-key Notice
http://www.fipr.org...sampleGAKnotice.htm
also note secrecy requirement. No technical help for you, sonny. [Loris, May 04 2009]
m-o-o-t
http://www.m-o-o-t.org/
A system apparently intended to defeat these kinds of law. [Aristotle, May 05 2009]
Fear everything! poster
http://boingboing.n...g-the-london-1.html
"A bomb won't go off because" - noone wanted to blow the place up, actually. [Loris, May 05 2009]
Ho, here are the original posters
http://www.boingboi...e.html#previouspost
Could they be more Orwellian? [Loris, May 05 2009]
overbaked
http://groups.yahoo.com/group/overbaked/
More government or less government? Are people like you responsible for all the world's woes? Discuss it here. [jutta, May 05 2009]
(?) Keep Calm and Carry On
http://forfashion.w...-calm-and-carry-on/
[zen_tom, May 06 2009]
BBC story on (ab)use of anti-terror powers.
http://news.bbc.co..../london/8034315.stm
Just read it. It's self-explanatory. And note that there is nothing mentioned about convictions. [DrBob, May 06 2009]
Times article on government 'data gathering' plans.
http://www.timesonl.../article6211101.ece
All your communications are belong to us! [DrBob, May 06 2009]
(?) Rubberhose
http://iq.org/~proff/rubberhose.org/
[pocmloc, Apr 19 2010]
(?) Why not to use rubberhose encryption
http://iq.org/~prof...rc/doc/beatings.txt
merely gives the rubber-hose-squad a reason to beat you forever [Loris, Apr 19 2010]
Please log in.
If you're not logged in,
you can see what this page
looks like, but you will
not be able to add anything.
Annotation:
|
| |
I think there was a movie (The Life of David Gayle) that said it better... |
|
| |
If you're required to do the decryption, why not have a simple program that prints out some random webpage?
How are they to know that's not what was in the file? |
|
| |
You'd want something that was roughly the same size on disk, but yeah, why not just some random piece of junk data? |
|
| |
//If you're required to do the decryption, why not have a simple program that prints out some random webpage? How are they to know that's not what was in the file?// |
|
| |
You're not required to do the decryption, you're required to supply the key. But using a one-time-pad, the key is the same size as the plaintext (minumum). |
|
| |
//You'd want something that was roughly the same size on disk, but yeah, why not just some random piece of junk data?// |
|
| |
That's the whole point. The file you supply will be the right size and demonstrably decrypt the file they want to something convincing. You can't claim you've decrypted the file if it still looks like garbage. It looked like that to begin with - thats why they're asking you to decrypt it. |
|
| |
//I think there was a movie (The Life of David Gayle) that said it better...// |
|
| |
It did? I've just read a plot synopsis and I can't see how it's at all relevant. |
|
| |
I love the idea+. However, in all cryptographic systems I have seen, entering an incorrect key will only yield the message "incorrect key". You'd have to use/create a system that allows for "alternate" decryption. |
|
| |
Creating the decryption system for one-time-pads is very easy placid. You don't need to worry about 'incorrect key' messages if it just treats all the data as bits. |
|
| |
One-time-pads (OTP) use some very basic operation which is generally reversible. On computers, EOR is a good choice. For example,
here is a 16-bit message ('a') :1100110011001100
here is a 16-bit OTP ('b'): 1000010111011100
the encoded message (a EOR b):0100100100010000 |
|
| |
That's how one time pads are supposed to work. But suppose the police, not knowing any better, ask me to 'decrypt' some random data which I wrote to a file years ago? ("c") : 0010010110010001
I would need to invent another message to make them happy. Here's my plan. I decide on what the message should be - perhaps ('d') :1111000011110000. From that I create a new 'reverse' OTP ("e"=c EOR d): 1101010101100001 |
|
| |
Now the police can apply that to the random data (e EOR d = {c EOR d}EOR d =c), get something which makes sense to them and leave me alone. |
|
| |
//EOR is a good choice//
Wasn't he the character in Winnie the Pooh? |
|
| |
Every time i hear a comment like that, [AWOL], it brings me one step closer to posting a certain idea which has been bubbling under for years now. In fact, that might just have been the final straw. |
|
| |
Oh, dear! You have unleashed the beast [AWOL]. He aw.. He aw... He always threatens this at the slightest mention of A.A. Milne. |
|
| |
you get edgier every day..... I think that loris is going to have a lot of explaining to do when he tries to foist off a bunch of gibberish as a decrypted message. |
|
| |
"Some of my early work, very experimental, you see it seems to be completely random at first but, as you read the raw bits patterns appear. I wasn't using "formats" at that point so I wrote it freehand. I really like 0, and in some strings I used nothing else....." |
|
| |
"Constable Huxley and the Case of the Lone Encrypted Hexadecimal" |
|
| |
[Loris] I invoked the case of David Gayle to describe your modis operandi, more than the idea. |
|
| |
The story goes: we do not agree with this law, so we will concoct a *special case* where we introduce ambiguity only after *proof* of the facts of the case. Basically the illegal act there was the obstruction of justice, which similarily (whether you are guilty of distributing child pornography or state secrets or not), you will be guilty of. |
|
| |
As to the idea: It is quite possible to produce a key (as long as the key length = the message length) that could *decipher* the message into anything. This is a double edged sword. It is possible that you hold other keys on your harddrive (in your current embodiment) that could in fact "decipher" your document into something else. Bear in mind you have been given all these keys over less secure media. The chain is only as strong as its weakest link. |
|
| |
I am not a fan of the idea, nor the intent that it illustrates. |
|
| |
You must also remember that the key to excellent encryption is the obfuscation of the fact that you received a message at all! An oft forgotten gem of cryptology. |
|
| |
So what happens if you are designing/implementing a random number generator and happen to have a file of random data on your harddrive? Do you really get prosecuted just because you can't "decrypt" it? |
|
| |
// it's security measures like the one you're complaining about that catch the real terrorists// |
|
| |
Bullshit. Terrorists are one of the few groups who will refuse to decrypt files when faced with a jail sentence. Nearly every law abiding citizen will give up their keys, so they get to know all our secrets. |
|
| |
Fortunately, it works both ways, as they seem to keep losing laptops with sensitive information . . . |
|
| |
Remember it is one thing to pass a law, it is another thing entirely to get people to use it or get a jury to pass a "guilty" verdict. |
|
| |
However this law is an argument for people to abandon PGP encryption and use PDP (Pretty Dumb Protection) instead. You tend get the please of telling the police that your top secret word, used as a repeating key for an alphabetic code, is the completely unguessable "fish". |
|
| |
//And when the government catches on? Seriously, why would you be in possession of an encrypted file that you cannot decrypt? There may be an isolates case here and there of an innocent person being inconvenienced or worse, but it's security measures like the one you're complaining about that catch the real terrorists. Designing something like this to deliberately interfere with the police is a very illegal, very stupid idea that will get you in a lot more trouble. [-]// |
|
| |
If you have a PC running Windows and you think you (and, say, your mother) can explain every file on it, then you're obviously an end-user who doesn't know what things are like under the hood. You probably haven't even seen any directory outside "My Documents"
You just don't seem to get that it isn't files you have encrypted which are the problem - its random shit your computer has produced during a crappy install, or corrupted data after a crash, or just some obscure program's datafile which the police don't understand. |
|
| |
In fact, I'm inclined to turn your argument around. "There may be an isolates case here and there of an innocent person being inconvenienced or worse" - by terrorism. The number of people "inconvenienced" by such unjust laws could be much greater. |
|
| |
"Security measures like the one [I'm] complaining about" don't catch terrorists, they're just potentially used to 'inconvenience' (=imprison for two years) ordinary people. Even if a real terrorist /was/ threatened with this law, they'd presumably be quite happy not decrypting data and taking a reduced sentence. |
|
| |
I'm not trying to interfere with the police, I'm trying to stop them interfering with law-abiding citizens, including myself. |
|
| |
// [Loris] I invoked the case of David Gayle to describe your modis operandi, more than the idea.// |
|
| |
Still don't see the connection. I could write more but since the synopsis I read included spoilers, I 'd better not. |
|
| |
I'm not proposing up a special case or adding ambiguity, I'm proposing a method by which the unjustly accused can escape an unjust system. |
|
| |
//I am not a fan of the idea, nor the intent that it illustrates.// |
|
| |
Incidentally, I think this idea might even be within the letter of the law. |
|
| |
//You must also remember that the key to excellent encryption is the obfuscation of the fact that you received a message at all! An oft forgotten gem of cryptology.// |
|
| |
I remember that - but that's *so* not the issue. You could consider reading the idea again because it's gone over your head. |
|
| |
Is my proposal particularly workable? Maybe not - I did post it here on the halfbakery, rather than somewhere more serious. But you guys are just so complacent. You can't trust them not to use powers they're got just because the government promises - theres precident to the contrary in this same tranche of anti-terror laws! If you want to see where laws which change "Innocent until proven guilty" into "Guilty until proven innocent" lead, just read 1984. |
|
| |
//So what happens if you are designing/implementing a random number generator and happen to have a file of random data on your harddrive? Do you really get prosecuted just because you can't "decrypt" it?// |
|
| |
Presumably, yes, if they ask you to. Unless you can prove to their satisfaction that it's random data. Of course, any securely encrypted file is indistinguishable from random data, so if your generator is any good, you can't. |
|
| |
Oh, and thanks for calling bullshit. |
|
| |
I don't think this system would allow people to escape
"injustice" but it would allow people to rebel a little if such a law was applied to them. It risks being as implausible as the claims of the angry bloke who argued in court that being asked to take his bin to the edge of his garden path amounted to slavery. |
|
| |
Remember that the "Hunting with Dogs" act didn't actually ban fox hunting as some of the reactionaries were claiming at the time. Oh, and 1984 wasn't a documentary ... |
|
| |
I really can't help you if you can't see the similarity your idea has with the capital punishment conundrum. I am not an advocate of capital punishment, I am not an advocate of anti-privacy (Patriot act). I am saying you are not providing a significant, or relevant, counter-argument by using a subversive means. Is that really so hard to assimilate? |
|
| |
The "what have you got to hide" argument espoused by [21...] and those in office, has no grounds. I have a right to privacy, full stop. Your idea will actually limit that constitutional right. And that is my main problem. You are obstructing justice (in whatever form, rightly or wrongly), you are also creating an environ based on random data (things are best left to facts in the court room). Random data is, what random data does. This is not enough of a fail safe for me. In fact it cloaks those of nefarious action more than it would help me. And if you want to claim that it is not random, only the random of your chosing, then, I fear, you are falling on your own sword. |
|
| |
My suggestion would be for you to go and read a couple of good books on cryptology (not cryptography or cryptanalysis) and perhaps a squizz at Bruce Schneier's thoughts. |
|
| |
//Is my proposal particularly workable?// Yes it most certainly is. Provided you get rid of the leaky faucet of "downloading" random files. Unless you are downloading those under an OTP, in which case, why do that? |
|
| |
In conclusion: The prosecution has nothing to add, your Honour, I fear the rest may have gone over my head... |
|
| |
//I really can't help you if you can't see the similarity your idea has with the capital punishment conundrum. I am not an advocate of capital punishment, I am not an advocate of anti-privacy (Patriot act). I am saying you are not providing a significant, or relevant, counter-argument by using a subversive means. Is that really so hard to assimilate?// |
|
| |
So what you're saying is that we should all obey all laws at all times? Even if they're morally unjust? |
|
| |
Seriously - I'm not trying to be subversive. This isn't an attempt to change the law. Not that it isn't a good idea for British residents to lobby their MPs - but it's the law right now. Until that changes, if the police decide they want you locked up - they can do it whether you've done something wrong or not. This doesn't seem right to me. |
|
| |
//The "what have you got to hide" argument espoused by [21...] and those in office, has no grounds. I have a right to privacy, full stop. Your idea will actually limit that constitutional right.// |
|
| |
But you see - no you don't. Not if you're in the UK, at least. Incidentally what I'm attempting to address is UK based. American constitutional rights don't really come in to it - and even if they did, I don't see how the proposed service would limit them. |
|
| |
//And that is my main problem. You are obstructing justice (in whatever form, rightly or wrongly), you are also creating an environ based on random data (things are best left to facts in the court room). Random data is, what random data does. This is not enough of a fail safe for me. In fact it cloaks those of nefarious action more than it would help me. And if you want to claim that it is not random, only the random of your chosing, then, I fear, you are falling on your own sword.// |
|
| |
Um, what? I'm not introducing random data into your computer. |
|
| |
//My suggestion would be for you to go and read a couple of good books on cryptology (not cryptography or cryptanalysis) and perhaps a squizz at Bruce Schneier's thoughts.// |
|
| |
You've made a distinction there between cryptology and cryptography. Unfortunately the internet does not seem to make that distinction.
The top hit on google for cryptology is Wikipedia. But if you type that word into the wikipedia search you get redirected to cryptography. The first line is:
"Cryptography (or cryptology...)"
I've a passing interest in the field, at least. So I'd be interested to know what it is that you think I'm missing. |
|
| |
But more importantly, this idea doesn't create a new crytographic system. It's not about storing your files securely.
It's about enabling innocent people to fulfil unreasonable demands to the satisfaction of a broken system. |
|
| |
// //Is my proposal particularly workable?// Yes it most certainly is. Provided you get rid of the leaky faucet of "downloading" random files. Unless you are downloading those under an OTP, in which case, why do that?// |
|
| |
Let's go over this again. Imagine a law which allows the government to demand that you provide a password to any file they ask for - and you'll go to prison if you refuse, unless you can prove that you don't have it. Pretend, if it helps your reasoning, that it's an American rule and it applies to you, because the police have taken an interest in you because your sister is of the best friend of a colleague of a suspected terrorist.
The feds therefore seize and remove all your computers (I assume you have at least one, since you're on here), poke around inside for a while, then ask you for the password to a file you've never heard of before - and caution you not to tell anyone about their request.
Perhaps it's corrupted garbage from a crash recovery, or it's some remnant of a virus the virus-checker didn't completely eradicate - but you don't know that and you don't know how to find out (googling tells you nothing).
Now you could try and persuade them that you don't know what it is - but at best they already think it's something you're trying to hide. So what would you do? You can go to jail if it suits your principles I suppose. From what hear you'd have a great time. |
|
| |
//In conclusion: The prosecution has nothing to add, your Honour, I fear the rest may have gone over my head..// |
|
| |
It certainly looks that way. |
|
| |
By the way - if you think I'm making this up, you could check out Bruce Schneier on the subject - see link. |
|
| |
//So what you're saying is that we should all obey all laws at all times? Even if they're morally unjust?// No, eerrm. |
|
| |
//Until that changes, if the police decide they want you locked up - they can do it whether you've done something wrong or not. This doesn't seem right to me.// That is pretty much what I said... I am a privacy advocate. |
|
| |
//Now you could try and persuade them that you don't know what it is - but at best they already think it's something you're trying to hide. So what would you do? // Yep, and that is precisely what your embodiment does not solve... |
|
| |
At this point of misappropriated quotes, misunderstandings, et al, I will willingly accept that this has gone over my head and under your feet. |
|
| |
//I am saying you are not providing a significant, or relevant, counter-argument by using a subversive means. Is that really so hard to assimilate?//
and
////Until that changes, if the police decide they want you locked up - they can do it whether you've done something wrong or not. This doesn't seem right to me.// That is pretty much what I said... I am a privacy advocate.// |
|
| |
So what you've been saying then is that innocent people will suffer until the law is changed - and instead of trying to prevent that, people should lobby instead - and the weight of such miscarrages of justice which will bring about change?
That's one effect I suppose, but given how people tend to respond it'll be a long time changing. |
|
| |
//Yep, and that is precisely what your embodiment does not solve... // |
|
| |
Erm, but it should do. So if it happened to me and my system were in place I could:
gain access to another computer (cybercafe or whatever).
fetch the appropriate file from out-of-juristiction storage
Use the service to create an innocuous, potentially personalised 'one-time-pad'.
Give that 'OTP' to the police.
|
|
| |
I guess it might be helpful for the service to analyse the 'encrypted' (garbage) file to see if it passes tests for randomness. If it doesn't, it would be better to figure out what it really was. You shouldn't really need to if the police are really doing their job in ernest. |
|
| |
Plod: Give me the password for this file "dfgerge.dll".
Loris: That's a code library, you can tell if you look at it with a decompiler.
Plod: Oh year, right, I'm new at this. Okay, give me the password for this file "bifjervo.ini"
Loris: That's an initialisation file, try a text editor.
Plod: Okay smartarse, what about lost+found/corrupt.dat
Loris: Hey, that's a picture of my house from this cool encryptor I was experimenting with. Here's the OTP. Just EOR every pair of bytes and discard the remainer.
Plod: Move along please! |
|
| |
As you're in the the UK I can refer you to Liberty
(see link), where you'll not only find people with a
similar passion about this kind of thing but also
people who can explain lobbying to you. |
|
| |
//And when you get caught (and you will get caught) you get charged with lying under oath, because you can be sure they'll require that you provide a signed and written statement verifying the content of any files you give them.// |
|
| |
But it's literally true if you say that your (garbage) file can be decrypted with the output file you gave them. It's proveable in that the transformation can be shown to have a comprehensible output. If you don't perform the process described, it may be true that you can't decrypt the file - but you can't prove that. |
|
| |
Of course, it's also true that this decryption didn't exist until after they served you, but that's by the by... I'm not actually sure what form of words a Section 49 notice has - the best I could find on the web is a preliminary version (see link). Of course I'm not a lawyer, but it seems to me that this action would fit entirely within the request as written; all they ask for is 'a key'. I particularly like the following: |
|
| |
::Choice of key
6. If you are able to disclose a key or combination of keys which will put the information into intelligible form, no further disclosure is required of you. And if there are several keys or combinations of keys whose disclosure would discharge your obligation, the choice of which to disclose is yours.:: |
|
| |
If they're trying to kill you by the sword, you might as well fight using the sword rather than offering your bared throat. |
|
| |
Regarding lobbying, it's not worth it if you a) don't have money and b) 99%+ of the population are complacent that they have nothing to hide and therefore nothing to fear. |
|
| |
Mess the data up... meeee, mess data up? |
|
| |
Actually I'm making sense from the data. (There's a requirement to 'make it intelligible', see?) |
|
| |
[Arristotle] 1984 may not be a documentary, but "Rubicon:
The Last Years of the Roman Republic" and "Rise And Fall Of
The Third Reich" are both fact, and are clear examples of
what happens when emergency powers overrode the rights of
individuals. |
|
| |
[Loris] getting the general public to worry about encryption is like getting the public to worry about goat yogurt - it's something they don't often use or encounter. |
|
| |
Getting involved, or reading up about, Liberty might be a release of stress for you. Think of it as an "Amnesty International" for privacy issues. If that letter bomber, who got all worked up about the DNA database, had made contact things could have been less tragic. |
|
| |
//Bacon's right... that does seem to Bake this to a crisp.// |
|
| |
Yeah, sure. Except it's totally irrelevant because THIS ISN'T ABOUT ENCRYPTING YOUR FILES SECURELY.
It's about being able to give a satisfactory explanation for files you're legally required to explain - which you would otherwise be unable to do. |
|
| |
Sure, you can use Truecrypt to secure all your documents. But they're not the problem (for the non-terrorist).
You can apparently use Truecrypt to secure your entire drive - but that just makes you look more suspicious. They can force you to hand over the decryption key (or go to jail). After you give them that, you're no better off - because your operating system will have created files which look like randomness, which they can then ask you to decrypt. |
|
| |
//Getting involved, or reading up about, Liberty might be a release of stress for you. Think of it as an "Amnesty International" for privacy issues. If that letter bomber, who got all worked up about the DNA database, had made contact things could have been less tragic.// |
|
| |
I looked at the website. If they have forums of people talking about this sort of thing I didn't find them. I'm not about to put my real name & address on their membership list.
I'm scared about the oversight of the DNA database (and the government's planned uber-database) too, but you don't have to worry about me snapping like that. And I don't appreciate the insinuation. |
|
| |
I like the idea - it makes a nonsense of a hastily drawn-up knee-jerk reaction of a law. |
|
| |
A lot of the "security" laws of the last 10 years need tearing up and re-writing under the cool light of day (rather than under the trembling flashlight of the terrorist-proof bunker) - The financial situation has (hopefully) put an end to the national id card/database thing, but there really is an awful lot more to do in terms of powers of arrest, gagging of newspapers (although that's partly their own fault for reporting crap) active surveillance (both in terms of what's admissable in court, and what's sanctionable under "intelligence") and a whole host of other measures. It wouldn't take much. |
|
| |
I wasn't insinuating, [Loris], just voicing my concern. |
|
| |
//You think the feds can't tell the difference between a deliberately secured file and random bits of code that your computer threw together?// |
|
| |
Theoretically, it is impossible to tell the difference between random and well-encrypted, so yes, they can't. |
|
| |
Regarding wasting police time - if they can do that, then why don't they charge everyone released without charge, or found not guilty? It would be a sort of modern-day witch-trial. I'm still not a lawyer, but my understanding is that- that rule is for when people make false accusations which start an investigation, not for people who get caught up in them. |
|
| |
I should point out that I'm not proposing that this would be the first choice for every section 49 notice that you may receive. If you've got an encrypted file you can decrypt, then the best thing would be to do so. But if you can't - and you can't prove that, or if they're attempting to engineer your conviction because they know (without any evidence - because you're actually innocent) that you're guilty - you've not really got anything to lose. |
|
| |
I double-checked the Liberty site for you, just in case, and found that they actually supported the encryption section of RIPA, because it had least impact on human rights and they believe it would actually be effective as measure against terrorism. |
|
| |
As this section of the RIPA law is your single-issue then yes, Liberty is not for you. |
|
| |
However m-o-o-t (see link) might be more your cup of tea as they seemed to have completed a system to deal with this very measure, which they describe as GAK (Government Access to Keys). They have a different solution, different enough not to make your idea "baked" in HB terms. |
|
| |
If it points out the idiocy of a law that doesn't make sense, by making it impractical to enforce, then it's not such a bad thing. |
|
| |
What we're talking about here is a form of 'thought policing' where having an idea (albeit in digital form) becomes the enforceable property of the state. Yes, I know they have our "best interests at heart" but we don't know who's going to be in charge next - and if the current laws don't get repealed, they'll be available for misuse by whatever group gets into power. |
|
| |
Now not to be all apocalyptical and paranoid, but if this recession thing keeps on going, and people start feeling the pinch, it's not long before you start getting nationalism politics entering the mainstream - all for the good of the country mind, family values, all of that - it doesn't take long before the occasional person is reported for being a little too outspoken, or not agreeing with the patriotic line - a quick raid of their premises to see what they are up to, and, just to save a little paperwork, and to give the boys a bit more time, it's easy to invoke the xyz act where they have to provide a password to decrypt file abc. It's all baby steps - and all of them are completely legal and can't be challenged in law. |
|
| |
It isn't - it's just one issue which I felt I could address. Am I arguing too much? Perhaps, but I tend to do that about everything - and particularly when people don't get distinctions (Bacon Pasta - I'm looking at you).
If you look at my profile you'll see I have ideas from improving hot showers to removing moths from rooms. |
|
| |
If all halfbakery ideas have to be Grand Unified Theories of Everything, I'm out. |
|
| |
// it doesn't take long before the occasional person is reported for being a little too outspoken,// |
|
| |
What's really scary is the way a section of government recently has gone for broke on the fear, uncertainty and doubt. I've read in the last few weeks that they're putting up posters saying "A bomb won't go off because weeks before, a shopper reported someone for studying the CCTV cameras. Don't rely on others: if you suspect it, report it."
Of course, some people are taking the piss, and it couldn't be better deserved. Link. |
|
| |
Okay, you post the invention to fix this whole sorry mess and I'll vote it up, deal? |
|
| |
// Another thing to consider is that the feds can decrypt most computer files.// |
|
| |
There is some weak encyption (WEP, DES etc) but there is plenty of strong encryption in use by the general public. DRM is pretty strong. Windows Media DRM uses a 160 bit ECC key and the largest key cracked so far is 109 bits. 160 bits is about 30 million times harder. |
|
| |
Lets say you buy a new computer and just copy everything onto your new computer. You then diligently erase your old hard drive and donate your old computer to the third world. |
|
| |
Guess what? There is a DRM protected song or two on your new computer with no license key. Maybe it was mainstream music. Maybe you were discussing a plot to nuke Washington. One thing for sure is that the Feds are not going to hear it for decades. Or MI5 (this is a UK law BTW) |
|
| |
Ever think of that? Neither will 99% of law abiding citizens, many of whom will have encrypted files that have become unreadable this way. Sure they could delete their unreadable DRM files, but people are lazy and there have been no government warnings this might be necessary. |
|
| |
Just for the record [21] I didn't ask the government to legislate in this manner - I don't want them to spend so much money on fighting a war on terror that never really existed. I didn't ask for Iraq, I didn't ask for Guantanamo Bay, I didn't ask for any of it - the "war" on terror is finally, 8 years later being viewed as what it should have been in the first place, as a series of criminals being investigated for a series of murders. The war on terror did nothing except legitimise Al Quaida and associaded ideologies - but it was in line with this set of "war on terror" policies that the current legislation was formed. No. I did not ask for that. No. I did not "DEMAND" [it] "IN THE FIRST PLACE" - I didn't ask for any of it at all. Because, when the government puts these types of laws in place, the terrorists won. And that's what I said at the time. We don't need them, they're not necessary, I certainly didn't ask for, nor do I support them. Please, can we get rid of them now, they're not necessary, they're not helpful, they do no good whatsoever. Let's repeal these badly drafted and poorly thought out laws. Please. |
|
| |
Does that clarify my position? I really, really hope so. |
|
| |
[Loris], you've got my bun, I think it's a very good idea. |
|
| |
21Quest, I don't think zen_tom is denying that the attacks you mentioned happened.
What he was denying was that this was anything to do with Iraq. And furthermore, your contention that 'we' demanded the ensuing "War on Terror", in which hundreds of times times more people died and are still dying[1]. In Britain there were huge protests against the second Iraq war, and it ruined Tony Blair's reputation. He had to leave. |
|
| |
And for what it's worth, I didn't vote Labour in the last election, and wouldn't conceive of it in future until the current regime are all gone and the party has pledged in its manifesto not to make the same mistakes again. |
|
| |
Sure I'd like for the system to try to prevent terrorist attacks. By any reasonable means. But I'd rather a few got through (which they will anyway), than live in fear of the system. Torturing people is not reasonable. Changing "innocent until proven guilty" to "guilty until proven innocent" is not reasonable. |
|
| |
[1] The final figures reported just under 3000 people died as a result of the attacks on September 11, 2001. And something over 50 people in the July 2005 London bombings.
Credible estimates of the number of violent deaths in Iraq are over one million. The death toll of the war in Afghanistan seems to be much lower - but still over double the 9/11 at over 8000 by March last year. Using these figures, well over 300 times more people have been killed {/i/n/ /r/e/t/r/i/b/u/t/i/o/n/} as a result of the actions taken. |
|
| |
[Loris] "killed in retribution" seems to be a bit dishonest. Most of those million deaths are due to bombs in marketplaces, drive by shootings, sectarian in-fighting, or random acts of violence. |
|
| |
Although I think "killed in retribution" is far too strong it is reasonable to think that any country - say America, for example - would form some kind of insurgency if they were heavily bombed, invaded and then occupied. |
|
| |
Anyway we are drifting away from the subject of encryption paranoia here. |
|
| |
TÚ¨¢¢MKS..KOte jisfj QªLº.. €§©BTÍ´Lœ (my self portrait in
U/Lc helvetica) |
|
| |
//The war never existed, huh? So the London bombings never happened, eh? Those planes flying into the World Trade Center and the Pentagon, that was a government hoax, was it?// |
|
| |
No, not a hoax, just that (for the purposes of this discussion) the legislative response was overblown. |
|
| |
//and those ever-persistent eco-terrorists who are always blowing stuff up// |
|
| |
That's just it - the threat of "ever-present terrorists" who are "always blowing things up" is massively overblown - you are more likely to be hurt in traffic than injured by a terrorist action - and while I'm glad the government continues to paint white lines on the road, I'm also pleased they haven't resorted to waterboarding cyclists in order to gather intelligence. |
|
| |
//Do you have a better way to stop them?// Yes, by careful and proper policing, just like we had all the time. |
|
| |
It's all a matter of approach - calmness vs panic. |
|
| |
But to return to the idea at hand: Think of it as a Boston Tea Party of sorts - there's an imposition being placed on people that would appear to be without full representation (due to the executive taking lots of quick decisions under "emergency" conditions) - except that here, there's nothing tangible to throw into the sea. |
|
| |
//Although I think "killed in retribution" is far too strong...// |
|
| |
//Honestly, I'd rather torture my brother's enemy, my enemy, than see my brother die. But, to each his own.// |
|
| |
That's not even a realistic analysis. Not only does torturing people not really help (tortured people will tell you what they think you want to hear), but it also bolsters the enemies resolve. That's before we even get to it being morally wrong. |
|
| |
//The laws you rebel against may not be perfect, but the police are using those laws to track down specific people that are already suspected.//
Ha! Get real, 21Q. Time to wake up and smell the coffee (linky).
|
|
| |
[DrBob], at least it seems to be equal opportunity (with respect to race) suspicion and abuse of power. |
|
| |
No mention of encryption though ... |
|
| |
Try the second link!
Regarding the encryption idea, I agree with 4whom's comment. Start with obfuscation of your internet traffic. Then encrypt it. Then store your data on portable media rather than your hard drive. If you object to handing over a decryption key for your files then make sure that the files aren't available to decrypt rather than take the legally (& morally) dubious route of providing false information to the police.
Of course, if they do come after your data in particular then they are bound to ask you if you have any data stored elsewhere. At which point only your conscience or a magnetic storm and subsequent house fire can save you!
Encryption is useful but there is no such thing as perfect encryption. At best, it will merely delay (possibly for decades) access to your data. |
|
| |
Yes, that is an awful lot of data but it is stored whether it is encrypted or not. Call me picky but what would be more convincing (and relevant) would be an actual, draconic and insidious application of the encryption provisions of RIPA. |
|
| |
Without this I'd be prone to agree with [jutta] that maybe the place to debate all this is in overbaked, see her link for details. |
|
| |
I agree with the overbaked thing in respect of the civil rights aspects of this but, in terms of the purpose & usefulness of encryption, I think the idea is worth discussing. After all, it's not just governments that want to nick your stuff (although it is mostly them it seems).
One of the interesting aspects of this is the view that people seem to take that data is some static, permanent thing when, as anyone who has ever managed a database knows, the moment that you enter a record into a database it is instantly out of date, even assuming that it was correct in the first place. Hence my previous comment about encryption as a delaying tactic. You only have to keep people out, whoever they might be, for as long as the data is current or relevant and the best way of doing that is to hide its location and even its existence. Encryption comes as a secondary line of defence.
It's a bit like the final scene from Village of the Damned, where the school teacher carries a bomb into the classroom to do away with the alien children. It takes them longer to work out that something is wrong than to break down his mental 'wall' once they realise that he's up to something. |
|
| |
DrBob, I'm not sure whether you understand that this idea is not about encrypting your files. It's also not about objecting to handing over decryption keys. Its for the point when you positively can't hand over decryption keys - because you don't have them.
By all means - encrypt things you want to keep secret. This idea doesn't cover those files.
I'm not at all convinced your proposal of storing files offsite would help either. They'd demand the keys for access, then you're back at square one. |
|
| |
The file they're asking for is not necessarily encrypted - its more likely 'random'. For example, a datafile of measurements. As a molecular microbiologist I've got lots of DNA sequence files full of A,C,T and Gs. Protein files may look even more suspicious. If they demand I decrypt one of those, what happens? Look at section 5 of the form: |
|
| |
::5. This notice can only be complied with by disclosing a key to the information described in paragraph 2. You must disclose the key [describe form and manner of disclosure] no later than [time]:: |
|
| |
So you can't tell them it's already data - that isn't an accepted response. There is, in fact, no mention of any opportunity for dialogue. You might say - well, they'd be smart enough to not ask about data files, but consider - they think you're a smart terrorist. If you were, you'd steganographically hide information. They want to put you away even if they can't find any evidence. And now the law's on their side. |
|
| |
Secondly, I'd like to contend the notion that this is providing false information to the police.
The system would render the file intelligible, and as such would be a key. Those are the requirements set out, and they're met. The facts that it's one of many keys which would do the same, and was generated after the request was made, are irrelevant. |
|
| |
Is there actually relevant discussion on overbaked? I looked at it and it seemed to be reporting that it was full of religious stuff; I didn't join. |
|
| |
By the way, I have a somewhat related idea about safely using one-time-pad encryption under the current law regime. I'll probably post it at some point. I'm a bit apprehensive of being called single issue again, but I think my record shows I'm more interested in computers in general, security, optimisation and elegancy, saving energy, plumbing and hot showers. |
|
| |
Well you did reject an entire site because you didn't find enough on that one issue. |
|
| |
Anyway I look forward to see what inspired creations you can conjure, to be received with annotations, croissants and fish-bones. |
|
| |
//Well you did reject an entire site because you didn't find enough on that one issue.// |
|
| |
That's not quite true. I said the site didn't have forums, so I couldn't see it helping much. I see now that it does have comments on articles.
And I said I wasn't going to register. That was actually part of a joke - about their membership being first up against the wall - that I redacted before posting because I thought people would take it seriously. |
|
| |
I was actually going to look at it again until you said they were in favour of RIPA, at which point I decided they were a bunch of fucknuts. |
|
| |
I read it all.
I still don't really get it...
and now my head hurts. |
|
| |
I look forward to the sequel but hope it's not a quickening. |
|
| |
Re-read the idea. Get it now.
Although, your idea complies with the written law, I would still argue that it constitutes either withholding information or providing false information. What you are doing, is in effect, scrambling the data, which is clearly in breach of the intent of the law and I doubt very much whether a court would be sympathetic with you. On the other hand, if you found yourself in front of a court for not providing a key when the data wasn't encrypted in the first place then I doubt that you would have too much trouble. If the authorities don't understand the data and don't ask you to explain it then I think that you'll find that that's their problem, not yours. The courts are not the police and, should you ever find yourself in one, I think that you'll find that common sense is in much greater abundance than in the halls of Whitehall. If you are really worried about this sort of thing then I would suggest that a good lawyer would provide better protection. |
|
| |
I had the good fortune to be visited by my Labour candidate MP on Saturday[1]. I mentioned[2] this issue to him. Surprisingly he seemed to agree with me about it being a problem, although his attitude (that this is always a risk with hastily-drawn legislation) didn't exactly inspire confidence. |
|
| |
[1] An election is imminent; he was canvassing.
[2] Perhaps a better word is 'harangued'. |
|
| |
Re. the new link to rubberhose. |
|
| |
Ah, yes... Another program which provides the authorities with plausible guilt. |
|
| |
I found a link at the site itself which explains why it doesn't work for an individual quite nicely. |
|
| |
I totally love this idea. I had the same idea at 4am last night when I couldn't sleep, but you've beaten me to the oven. |
|
| |
//So what happens if you are designing/implementing a random number generator and happen to have a file of random data on your harddrive? Do you really get prosecuted just because you can't "decrypt" it?// |
|
| |
Although it's tempting to conclude that a court might interpret the law in this way, I think in reality the act would only be invoked if the court had a good reason to believe that a file really is encrypted data - for example, if there is the presence of a "decrypt" command in your bash history which references the random data file, but no sign of the key. I don't think random data on its own with no other evidence would result in an invocation or conviction. (The obvious way to protect yourself from leaving a damning data trail would be to only access the data from a live distro with no persistant memory, and turn off the network adapters). |
|
| |
However as others have said, if a daft law like this remains on the books, who knows how the court of a more authoritarian future government might interpret such vague laws. Thankfully with Lib Dems in the back seat and Labour now tied up and locked in the boot, we might actually start recovering some of our civil liberties in the coming years. |
|
| |
// Of course, it's also true that this decryption didn't exist until after they served you // |
|
| |
It does seem a bit legally dubious generating the spoof key after the order has been served, however my idea differs in this regard; as well as having the private data disk P, random data key-disk R, and encrypted cipher-disk C, you would also have a disk of target spoof data (a photo of your house) disk S. As your private data changes in P, a spoof encryption key K which can "decrypt" P to S will be constantly updated, so that you will not have to generate the spoof key after the section 49 order has been served, as the key K is generated constantly as your private data changes. How you decide to hide your real key R, is the tricky part. |
|
| |
// Every time something bad happens in the world, such as all those terrorist attacks you guys have had in the UK, what do people like you start doing? You scream at the government and lay the blame on thick for them not doing enough to prevent it // |
|
| |
We really don't. We yell "Stop invading and pissing off other countries, then they won't feel the need to bomb the shit out of us", we attend anti-war protests, write to our MPs and vote for peaceful parties like the Liberal Democrats and the Greens. |
|
| |
// Encryption is useful but there is no such thing as perfect encryption. At best, it will merely delay (possibly for decades) access to your data. // |
|
| |
The Vernam cipher is actually a "perfect", unbreakable encryption algorithm, and that's what's used here. Whereas most encryption techniques have a cleartext and a short key which is used to scramble the cleartext into ciphertext, meaning the short key could potentially be guessed, with the Vernam algorithm the key and the ciphertext are the same length and each are conceptually the same thing; you absolutely need them both or you cannot recover the data, because each of them comprise an equal part of what makes up the data. It is this property that means it is possible to easily contrive a spoof key in order to make any cleartext you like from a given ciphertext (as long as the data lengths are the same). |
|
| |