<html xmlns:v="urn:schemas-microsoft-com:vml" xmlns:o="urn:schemas-microsoft-com:office:office" xmlns:w="urn:schemas-microsoft-com:office:word" xmlns:m="http://schemas.microsoft.com/office/2004/12/omml" xmlns="http://www.w3.org/TR/REC-html40">
<head>
<meta http-equiv="Content-Type" content="text/html; charset=utf-8">
<meta name="Generator" content="Microsoft Word 15 (filtered medium)">
<style><!--
/* Font Definitions */
@font-face
{font-family:"Cambria Math";
panose-1:2 4 5 3 5 4 6 3 2 4;}
@font-face
{font-family:Calibri;
panose-1:2 15 5 2 2 2 4 3 2 4;}
/* Style Definitions */
p.MsoNormal, li.MsoNormal, div.MsoNormal
{margin:0in;
margin-bottom:.0001pt;
font-size:11.0pt;
font-family:"Calibri",sans-serif;}
a:link, span.MsoHyperlink
{mso-style-priority:99;
color:#0563C1;
text-decoration:underline;}
a:visited, span.MsoHyperlinkFollowed
{mso-style-priority:99;
color:#954F72;
text-decoration:underline;}
p.MsoPlainText, li.MsoPlainText, div.MsoPlainText
{mso-style-priority:99;
mso-style-link:"Plain Text Char";
margin:0in;
margin-bottom:.0001pt;
font-size:11.0pt;
font-family:"Calibri",sans-serif;}
span.PlainTextChar
{mso-style-name:"Plain Text Char";
mso-style-priority:99;
mso-style-link:"Plain Text";
font-family:"Calibri",sans-serif;}
.MsoChpDefault
{mso-style-type:export-only;
font-family:"Calibri",sans-serif;}
@page WordSection1
{size:8.5in 11.0in;
margin:1.0in 1.0in 1.0in 1.0in;}
div.WordSection1
{page:WordSection1;}
--></style><!--[if gte mso 9]><xml>
<o:shapedefaults v:ext="edit" spidmax="1026" />
</xml><![endif]--><!--[if gte mso 9]><xml>
<o:shapelayout v:ext="edit">
<o:idmap v:ext="edit" data="1" />
</o:shapelayout></xml><![endif]-->
</head>
<body lang="EN-US" link="#0563C1" vlink="#954F72">
<div class="WordSection1">
<p class="MsoPlainText">The claim, "[US, China, etc.] can crack any encryption" needs to be unpacked.<o:p></o:p></p>
<p class="MsoPlainText"><o:p> </o:p></p>
<p class="MsoPlainText">The ability to do something *in fact* differs from the ability to do something *in practice*.
<o:p></o:p></p>
<p class="MsoPlainText"><o:p> </o:p></p>
<p class="MsoPlainText">If you can crack any encryption, but it is costly to do so, then in practice you may not be able to crack the encryption. Even though you can do it, you may not have the budget to do so. Thus if all users are using encryption, then
the cost of cracking everyone's encryption may be prohibitive. <o:p></o:p></p>
<p class="MsoPlainText"><o:p> </o:p></p>
<p class="MsoPlainText">Of course, the surveilling party will presumably optimize their efforts based on budgetary constraints. If it is too costly to crack e2e, they might invest in cracking the device, they might invest in physical interrogation of the communicating
person, they might invest in less-costly cracking technology, they might use heuristics to focus on just a subset of e2e, etc., etc.<o:p></o:p></p>
<p class="MsoPlainText"><o:p> </o:p></p>
<p class="MsoPlainText">They go where the costs are lowest. <o:p></o:p></p>
<p class="MsoPlainText"><o:p> </o:p></p>
<p class="MsoPlainText">By thinking in terms of costs, it is easier to recognize <a href="https://xkcd.com/538/">
the equivalence of encryption technology and blunt objects</a>.<o:p></o:p></p>
<p class="MsoPlainText"><o:p> </o:p></p>
<p class="MsoPlainText">- Hans<o:p></o:p></p>
<p class="MsoPlainText"><o:p> </o:p></p>
<p class="MsoPlainText"><o:p> </o:p></p>
<p class="MsoPlainText"><o:p> </o:p></p>
<p class="MsoPlainText"><o:p> </o:p></p>
<p class="MsoPlainText">-----Original Message-----<br>
From: LT [mailto:lt-bounces@lists.liberationtech.org] On Behalf Of Bill Woodcock<br>
Sent: Sunday, June 14, 2020 5:29 PM<br>
To: Ali-Reza Anghaie <ali@packetknife.com>; Yosem Companys <yosem@techlantis.com>; lt@lists.liberationtech.org<br>
Subject: Re: [liberationtech] What would you reply to this?</p>
<p class="MsoPlainText"><o:p> </o:p></p>
<p class="MsoPlainText">>> On Sun, Jun 14, 2020 at 2:38 PM Yosem Companys <<a href="mailto:yosem@techlantis.com"><span style="color:windowtext;text-decoration:none">yosem@techlantis.com</span></a>> wrote:<o:p></o:p></p>
<p class="MsoPlainText">>> Alex Nicholson 10:43 AM<o:p></o:p></p>
<p class="MsoPlainText">>> Curious what others think about this... this past week @Jason Calacanis (launch.co) talked about the need for all-user end-to-end encryption on services like Zoom in China, and basically anyone operating in or through China, because
of the Chinese govt’s likelihood of intercepting and/or interfering with communications as it likes. However, I would argue that the conversation is severely under-estimating the sophistication of the Chinese govt. The US’s NSA can crack any encryption in
the world and listen to any communications it wants. Why would we think China’s version of the NSA is any less sophisticated? Commercial encryption prevents interception by hackers and criminals, low-level operations without the budgets or resources of state
actors. The intelligence services of major world powers have the skills and tools to crack any company’s best attempt at encryption. So what does it matter if a service like Zoom or anything touching China is encrypted or not? If it touches Chinese soil, fibers,
or airspace, it can be read by their govt. If it’s encrypted, it prob won’t be read by criminals and civilian hackers only. Thoughts?<o:p></o:p></p>
<p class="MsoPlainText"><o:p> </o:p></p>
<p class="MsoPlainText">> On Jun 14, 2020, at 8:46 PM, Ali-Reza Anghaie <<a href="mailto:ali@packetknife.com"><span style="color:windowtext;text-decoration:none">ali@packetknife.com</span></a>> wrote:<o:p></o:p></p>
<p class="MsoPlainText">> I think people still don't understand what risk surfaces are actually worth attacking - and they latch onto encryption without any of the other OPSEC considerations, side-channel attacks on the information and groups being protected,
etc.<o:p></o:p></p>
<p class="MsoPlainText">> This XKCD still applies: <a href="https://xkcd.com/538/">
<span style="color:windowtext;text-decoration:none">https://xkcd.com/538/</span></a> The problem is the
<o:p></o:p></p>
<p class="MsoPlainText">> companies and politics still should _strive_ for the best in each applicable area but people are deluding themselves when they consider a Nation State threat model as their baseline.<o:p></o:p></p>
<p class="MsoPlainText"><o:p> </o:p></p>
<p class="MsoPlainText">Yeah, I mostly agree with that.<o:p></o:p></p>
<p class="MsoPlainText"><o:p> </o:p></p>
<p class="MsoPlainText">On the one hand, there is no uncrackable encryption… the passage of time, Moore’s law, quantum computing, it’ll all get decrypted, it’s just a question of when. Symmetric encryption works as long as the keys are used 1:1, get destroyed
after use, and are communicated securely in the first place. Quantum communication of symmetric keys seems promising.<o:p></o:p></p>
<p class="MsoPlainText"><o:p> </o:p></p>
<p class="MsoPlainText">But there are so many other, easier attacks, in the short run, that getting idiots to focus on key-length and ignore all the real attacks just makes governments’ work easier.<o:p></o:p></p>
<p class="MsoPlainText"><o:p> </o:p></p>
<p class="MsoPlainText"> -Bill<o:p></o:p></p>
<p class="MsoPlainText"><o:p> </o:p></p>
</div>
</body>
</html>