Blessed are the cryptographers, labelling them criminal enablers is just foolish
- Reference: 1620804668
- News link: https://www.theregister.co.uk/2021/05/12/blessed_are_the_cryptographers/
- Source link:
Writing the code turned out to be surprising easy; as I wrote it all in Python, I had libraries to handle the Twitter integration, and the cryptography. I read up a bit on the theory, put the pieces together, and with a bit of debugging “CrypTweet” was up and running.
Next step: sharing my brand-new code with the world, spruiking it as the privacy solution every Twitterer needed.
[1]
[2]
[3]
Big mistake. My claims attracted the attention of exactly those folks who make their careers poking holes in the false promises of digital security: cryptographers. They assessed my work, found it wanting, and [4]presented a detailed list of all the things I’d done wrong , plus the associated exploits that meant my claims of privacy were hard to sustain.
CrypTweet quickly and quietly died - and I’d learned my lesson: never idly play with weapons.
Although I felt resentful at the time, I’ve grown increasingly appreciative of that uninvited and unwelcome intervention. What if someone had used my software, thinking it gave them the assurance of privacy, only to learn - to their peril - that my understanding fell short of providing any security?
I’d learned my lesson: never idly play with weapons.
Cryptography belongs to the serious end of maths, a science upon which lives depend. You get it wrong, and people die.
Privacy creates agency. When you can communicate privately, your potential actions grow. Someone who cannot communicate privately cannot reach out for the assistance of others. Left to their own devices, they will be easy pickings for the predations of enemies. If you want to disempower someone, make it impossible for them to maintain any privacy.
[5]
This brings us to a recent brainwave from the [6]Australian Criminal Intelligence Commission (ACIC). In a [7]recent report to the Parliamentary Joint Committee on Intelligence and Security, it asserted that encrypted messaging services - like Telegram, WhatsApp, and Signal - are used ‘almost exclusively’ for illegal activity, an assertion that would merit an eyebrow raise from many of my friends and business colleagues who use both Signal and WhatsApp as their preferred messaging apps.
The ACIC went on to state, “These platforms are used almost exclusively by SOC [serious and organised crime] groups and are developed specifically to obscure the identities of the involved criminal entities and enable avoidance of detection by law enforcement… They enable the user to communicate within closed networks to facilitate highly sophisticated criminal activity.”
Where to begin with this? Perhaps we could start with former Australian Prime Minister Malcolm Turnbull, who famously used and broadly [8]recommended the Wickr secure messaging app while he was in office. Obviously he was up to no good.
[9]
And the countless reporters who use Signal to ensure their private conversations about their investigations stay private? That’s definitely a bit suss. And what about those … political activists? Using these tools … to … get active? We can’t have that.
ACIC makes arguments we’ve heard before - about trafficking of children for sexual exploitation, money laundering and the like - worthy examples and undoubtedly secure messaging tools have sometimes furthered these and other illegal activities. Yet authorities have been able to disrupt these criminal activities, even without ‘wiretap’ access into any secure messaging apps, precisely because criminal activities leave traces for investigators within the real world.
[10]Harassers and bullies succeed in tech because silence is encouraged
[11]How do we combat mass global misinformation? How about making the internet a little harder to use
[12]The revolution will not be televised because my television has been radicalised
[13]To stop web giants abusing privacy, they must be prevented from respawning. Ever
It has never been easy to find a balance between the needs of the public to be safe and the needs of a private individual to preserve their own privacy. But today, in a world where [14]surveillance capitalism has made each of us ever-more-precisely identifiable and trackable, the need for privacy also provides a necessary penumbra of invisibility, the sort of invisibility a woman needs when she’s reaching out to a friend so she can flee her abusive partner. Or the connection to peers a gay teenager needs when they’re feeling very alone and threatened. Or a whistle-blower, gathering their courage to go public.
Privacy isn’t just important: it’s fundamental. Without privacy, we cannot be truly ourselves. All of the fearmongering of all of the policing agencies in the world won’t change that basic truth. ®
Get our [15]Tech Resources
[1] https://pubads.g.doubleclick.net/gampad/jump?co=1&iu=/6978/reg_security/front&sz=300x50%7C300x100%7C300x250%7C300x251%7C300x252%7C300x600%7C300x601&tile=2&c=2YJunOtfdOseGuoj2V6gS1AAAAA0&t=ct%3Dns%26unitnum%3D2%26raptor%3Dcondor%26pos%3Dtop%26test%3D0
[2] https://pubads.g.doubleclick.net/gampad/jump?co=1&iu=/6978/reg_security/front&sz=300x50%7C300x100%7C300x250%7C300x251%7C300x252%7C300x600%7C300x601&tile=4&c=44YJunOtfdOseGuoj2V6gS1AAAAA0&t=ct%3Dns%26unitnum%3D4%26raptor%3Dfalcon%26pos%3Dmid%26test%3D0
[3] https://pubads.g.doubleclick.net/gampad/jump?co=1&iu=/6978/reg_security/front&sz=300x50%7C300x100%7C300x250%7C300x251%7C300x252%7C300x600%7C300x601&tile=3&c=33YJunOtfdOseGuoj2V6gS1AAAAA0&t=ct%3Dns%26unitnum%3D3%26raptor%3Deagle%26pos%3Dmid%26test%3D0
[4] https://www.pcworld.com/article/250332/despite_best_intentions_cryptweet_criticized_for_poor_security.html
[5] https://pubads.g.doubleclick.net/gampad/jump?co=1&iu=/6978/reg_security/front&sz=300x50%7C300x100%7C300x250%7C300x251%7C300x252%7C300x600%7C300x601&tile=4&c=44YJunOtfdOseGuoj2V6gS1AAAAA0&t=ct%3Dns%26unitnum%3D4%26raptor%3Dfalcon%26pos%3Dmid%26test%3D0
[6] https://www.theregister.com/2018/06/18/australian_criminal_intelligence_commission_bins_necbuilt_biometrics_project/%20target=
[7] https://www.gizmodo.com.au/2021/05/acic-encypted-messaging-surveillance-australia/
[8] https://www.theregister.com/2015/10/09/australian_prime_minister_runs_private_email_server/
[9] https://pubads.g.doubleclick.net/gampad/jump?co=1&iu=/6978/reg_security/front&sz=300x50%7C300x100%7C300x250%7C300x251%7C300x252%7C300x600%7C300x601&tile=3&c=33YJunOtfdOseGuoj2V6gS1AAAAA0&t=ct%3Dns%26unitnum%3D3%26raptor%3Deagle%26pos%3Dmid%26test%3D0
[10] http://www.theregister.com/2021/04/20/harassers_and_bullies_succeed_in/
[11] http://www.theregister.com/2021/02/08/make_the_internet_harder_to_use/
[12] http://www.theregister.com/2020/11/16/radicalised_television/
[13] http://www.theregister.com/2020/10/16/web_giants_breakup/
[14] https://www.theregister.com/2018/06/04/fipr_privacy_debate/
[15] https://whitepapers.theregister.com/
Security is a journey, not a destination. ;)
The best security with always lost to the best hacker. ;)
Lastly, your mother's tactic is called "security by obscurity" and it's more effective than a lot of people would think. Hiding things in plain sight, or using dummies can be very useful.
It's a combination of security by obscurity (the hidden price pieces) with a honeypot (the cheap stuff).
Good thinking on Granny's part.
The uninformed burglar is bound to assume that Granny is a cheapo when it comes to the bling.
Only prior social engineering, i.e. knowing about the good stuff, will render Granny's defense moot.
"Only prior social engineering, i.e. knowing about the good stuff, will render Granny's defense moot."
Like seeing her wear it at Church on Sunday. Or to a family wedding, where one of the wedding party is a ne'er do well. Or overhearing the married-into-the-family Auntie jealously describing it down the pub. Etc.
Those bits of mineral are never worn in a vacuum.
or splashed around in that Den of Iniquity and Sin known as El Reg by a careless grandson...
ohhhhhh
I thought I was about to hear a song of praise about crypto-currency! I had not expected to read something about one of my favourite subjects, cryptography in the public space!
Relaly just commenting for the sake of commenting, I have very little to add and agree with the article completely.
A good article and one of the points it highlights, is that those who are supposed to protect us and our privacy are one of the most immediate threats to it.
Not only are they a threat but either lie outright or are extremely economical with the truth, why would we trust anyone who shows such dishonesty with much of our most intimate data?
"why would we trust anyone who shows such dishonesty with much of our most intimate data?"
We do not. However, the GreatUnwashed who keep voting them in either do, or don't care ... or more than likely are just to stupid to realize what they are doing.
Really ????
" In a recent report to the Parliamentary Joint Committee on Intelligence and Security, it asserted that encrypted messaging services - like Telegram, WhatsApp, and Signal - are used ‘almost exclusively’ for illegal activity, an assertion that would merit an eyebrow raise from many of my friends and business colleagues who use both Signal and WhatsApp as their preferred messaging apps."
Really ??? Are those people ****that*** retarded ?
For their, probably useless, education, I'm using signal for local council communication, like votes, various discussions,
also, some road security topics, all for the public interest.
We've resigned from whatsapp, due to the FB issue. Didn't want everyone in the town to know our discussions.
But, no, no terrorism nor illegal activity, here. This is crazy thoughts !
Re: Really ????
That'd be the Facebook issue that doesn't affect the UK or EU?
Not that I want to defend Facebook, but more to squash unwarranted tech hysteria. Rather like this article is trying to do...
Re: Really ????
Doesn't affect Facebook until May 15th when they finally roll it out, as the big splash screen in WhatsApp keeps telling me.
Malcolm Turnbull
Considering how the LNP has been disowning Turnbull, I could see Herr Peter Dutton going "Aha! See? Case in point!"
Order is important
“These platforms are used almost exclusively by SOC [serious and organised crime] groups"
Rather reminds me of the classic logic failure: "I see a black swan; therefore all swans are black"
I might have believed “SOC [serious and organised crime] groups almost exclusively use these platforms"
Though to be honest, I doubt that. There's a lot to be said for being a tree in a forrest.
Re: Order is important
If they really believe it to be used exclusively by criminals, then they should be taking steps to block it at the network level and get Apple and Google to remove the app from their app stores.
The fact that they're not raises interesting questions. Questions such as "do they really think they can get away with such a bold faced lie"?
Re: Order is important
"do they really think they can get away with such a bold faced lie"?
Silly question. Of course they do. They are politicians. How do you think they got to where they are in the first place? Born liars, the lot of 'em ... and apparently their constituents like it that way, so why change it now?
Applies to all politicians, everywhere, not just dissing the Aussies here!
[serious and organised crime]?
What's the difference between serious crime and organized crime?
Or is that one single set of criminals that is both serious and organized?
Is there any serious disorganized crime? Or perhaps facetious organized crime?
What about facetious disorganized crime? ::shudder::
Re: [serious and organised crime]?
Serious crime - guy bashes in another guys head for ... reasons.
Organised crime - group of local thieves robbing houses as a team.
Serious and organised crime - group of thieves break into houses, beat the living snot out of everyone there, steal everything and then demand regular payments to prevent them from coming by and doing it all over again next week...
I think i see a difference... maybe... ;)
Re: [serious and organised crime]?
So as long as there is no physical assault involved, the crime is not serious?
Re: [serious and organised crime]?
Not my definition Jake. But basically anything involving violence gets treated much more seriously than without.
Thats why a white collar criminal who fleeces thousands of people of their savings destroying their lives in the process will almost always get a much lighter sentence than a mugger who knocks down an old woman and breaks her hip in order to steal her handbag.
No one said its right, but it is the way the world works at the moment...
Re: [serious and organised crime]?
I don't know about serious or organized crime, but serious AND organized crime sounds like government business.
Are banks criminal?
When i use my online bank services, I believe (and seriously hope) that all traffic is strongly encrypted. Does that make the banks criminal? (O.k., they may be, but for other reasons). What about the VPN I need to use to access my work server when not on the local network? What about using https instead of http? And so on.
If governments do not want us to use crypto, they should show an example and stop using it themselves, making all documents and communication public. Like that's ever gonna happen.
Will government idiots never learn? They might have to be taught by example
Soon Pi will no longer be 3.14, but just plain 3 as the .14 is clearly messy and the sign of a creator who had no idea what they were doing :P (/sarc in case it wasnt obvious)
I still stand by my view that if the tech companies wanted to, they could demonstrate to countries and the idiots running them what will happen when crypto and privacy is removed by simply turning off the service for 7 days (1 calendar week) in that geographical location.
In this instance but turning off Fb / WhatsApp / Instagram / Signal / Telegram / Twitter etc etc ad infinitum (I dont know, nor care to know them all) as well the banks turning off all secure pay options for online services too (after all thats encrption too right? :P ) for all Aussie users, the government and the idiots running it could them observe what is the outcome of what they desire but I suspect they wont like the result (I'm guessing total riots and breakdown of society within 72hours).
Cryptography is a weapon
Phil Zimmerman felt the heat of the US government when it conducted a criminal investigation into his (alleged) 'munitions export without a license', i.e. PGP being made available globally. Thankfully this was dropped.
(All) governments have this lovely double standard - they want to keep their own communications secure and private, but be able to read everyone else's.
Re: Cryptography is a weapon
That was nothing but security theater, and everybody knew it.
A far better example is Bruce Schneier's "Applied Cryptography" book, my copy of which includs source code examples both in the text (which did not fall under the export restrictions) and in the CD, which was bound into the cover (and very definitely did fall under those restrictions). From daft people come daft laws. Do you vote? For daft people? Are you sure?
I'm pessimistic about surveillance, mostly because technology makes it much easier to beach the privacy of people than to protect it.
We've never managed to build a house that is impervious to burglary (at least, not for average people), and people know that and accept the risk. I believe this will be the final situation for privacy breaches.
I'm suddenly reminded that my mother deliberately keeps cheap jewelry in her bedstand, to satisfy burglars, and the real stuff is hidden somewhere else. At the moment, such a deceptive tactic would be called sophisticated in the digital world, but it might well become a common trick used by grandmothers.