US Congressional Committee Concludes Encryption Backdoors Won't Work

[DamianTV]

https://it.slashdot.org/story/16/12/...oors-wont-work

"Any measure that weakens encryption works against the national interest," reports a bipartisan committee in the U.S. Congress. Mark Wilson quotes Beta News:

The Congressional Encryption Working Group (EWG) was set up in the wake of the Apple vs FBI case in which the FBI wanted to gain access to the encrypted contents of a shooter's iPhone. The group has just published its end-of-year report summarizing months of meetings, analysis and debate. The report makes four key observations, starting off with: "Any measure that weakens encryption works against the national interest".

This is certainly not a new argument against encryption backdoors for the likes of the FBI, but it is an important one... The group says: "Congress should not weaken this vital technology... Cryptography experts and information security professionals believe that it is exceedingly difficult and impractical, if not impossible, to devise and implement a system that gives law enforcement exceptional access to encrypted data without also compromising security against hackers, industrial spies, and other malicious actors...

The report recommends that instead, Congress "should foster cooperation between the law enforcement community and technology companies," adding "there is already substantial cooperation between the private sector and law enforcement." [PDF] It also suggests that analyzing the metadata from "our digital 'footprints'...could play a role in filling in the gap. The technology community leverages this information every day to improve services and target advertisements. There appears to be an opportunity for law enforcement to better leverage this information in criminal investigations."

Bout time they figured it out. Now that they know it WONT work, they will be even more inclined to undermine Encryption.

[jmdrake]

https://it.slashdot.org/story/16/12/...oors-wont-work



Bout time they figured it out. Now that they know it WONT work, they will be even more inclined to undermine Encryption.

The biggest obstacle to encryption isn't the government but naysayers who insist "don't encrypt because the all powerful government can read it all anyway." Ridiculous argument but I hear it here all the time. Here's something to consider. If the NSA can easily decrypt everything, they aren't willing to come out and say it. So instead if your device is strongly encrypted the PTB try to bully someone into handing over the keys. Simply saying "We can decrypt it already anyway" would let the cat out of the bag and people would seek stronger encryption which would make it even harder for the government and/or hackers to decrypt your secrets.

[DamianTV]

The biggest obstacle to encryption isn't the government but naysayers who insist "don't encrypt because the all powerful government can read it all anyway." Ridiculous argument but I hear it here all the time. Here's something to consider. If the NSA can easily decrypt everything, they aren't willing to come out and say it. So instead if your device is strongly encrypted the PTB try to bully someone into handing over the keys. Simply saying "We can decrypt it already anyway" would let the cat out of the bag and people would seek stronger encryption which would make it even harder for the government and/or hackers to decrypt your secrets.

There is another side to this. Encryption doesnt need to be broken when the Gov can just come in and tell some company to "give us all the data youve collected on <insert person or group of people here>" or just buy it. At that point, the end to end encrypted communication between the user and whatever servers they are connecting to is absolutely pointless.

[jmdrake]

There is another side to this. Encryption doesnt need to be broken when the Gov can just come in and tell some company to "give us all the data youve collected on <insert person or group of people here>" or just buy it. At that point, the end to end encrypted communication between the user and whatever servers they are connecting to is absolutely pointless.

Right. Which is why Mega.co.us works by encryption on the browser/app and all that gets stored on their servers are encrypted files. And then there's the option of anonymous distributed encryption. Freenet works like that. If the government grabs a Freenet node the owner can honestly say he doesn't know what's on it.