Comsec as Public Utility Beyond Illusory Privacy
Snowden may have raised the prospect of comsec as a public utility like power, water, gas, sewage, air quality, environmental protection and telecommunications. Privacy protection has been shown to be illusory at best, deceptive at worst, due to the uncontrollable technology applied erroneously for national security. Each of the other public utilities began as private offerings before becoming commercialized and then institutionalized as necessities, many eventually near or wholly monopolies. Each also evolved into military targets for control, contamination, destruction, and in some cases excluded as too essential for civilian livelihood to target. Comsec as a right for human discourse rather than a commercial service could enforce privacy beyond easy violation for official and commercial purposes. Freedom of comsec, say, as a new entry in the US Bill of Rights could lead the way for it to be a fundamental element of Human Rights. The problem will be as ever the commercial and governmental exploiters aiming to protect their interests against that of the public. FCC and NIST, indeed, the three branches, are hardly reliable to pursue this, so beholden to the spy agencies they cannot be trusted. NSA's ubiquitous spying on everybody at home and elsewhere with technology beyond accountability does raise the chances of getting agreement of all targets -- gov, com, edu, org -- to say enough is enough, national security has become a catchall for inexcusable invasion of the public realm.
Hi there, Dnia czwartek, 13 marca 2014 09:59:24 John Young pisze:
(...) Freedom of comsec, say, as a new entry in the US Bill of Rights could lead the way for it to be a fundamental element of Human Rights.
You had me up until this part. We don't need it. We have the secrecy of correspondence in most democratic countries: http://en.wikipedia.org/wiki/Secrecy_of_correspondence Well, the US kind of needs to get it into the Bill of Rights, maybe, but not as "comsec", but as plain old "secrecy of correspondence". Why? Because instead of creating a new "cyber"/"comsec" right, it's high time we uphold the rights we already have. Otherwise, once a new technology comes, we will have to fight this fight all over again -- as this will no longer be "comsec", but (say) "quantumsec". Again, where we have secrecy of correspondence already -- let's enforce it; where it is not there, it needs to be implemented and enshrined in law. But only as a general rule of "secrecy of correspondence", not as "comsec", not as "postal secrecy", not as "telephone privacy", as otherwise we will have the same discussion in 5-10 years all over again. -- Pozdr rysiek
Message du 13/03/14 15:33 De : "John Young" A : cypherpunks@cpunks.org, cryptography@randombit.net, cryptome@freelists.org Copie à : Objet : Comsec as Public Utility Beyond Illusory Privacy
Snowden may have raised the prospect of comsec as a public utility like power, water, gas, sewage, air quality, environmental protection and telecommunications. Privacy protection has been shown to be illusory at best, deceptive at worst, due to the uncontrollable technology applied erroneously for national security.
Each of the other public utilities began as private offerings before becoming commercialized and then institutionalized as necessities, many eventually near or wholly monopolies.
Each also evolved into military targets for control, contamination, destruction, and in some cases excluded as too essential for civilian livelihood to target.
Comsec as a right for human discourse rather than a commercial service could enforce privacy beyond easy violation for official and commercial purposes.
Freedom of comsec, say, as a new entry in the US Bill of Rights could lead the way for it to be a fundamental element of Human Rights.
The problem will be as ever the commercial and governmental exploiters aiming to protect their interests against that of the public.
FCC and NIST, indeed, the three branches, are hardly reliable to pursue this, so beholden to the spy agencies they cannot be trusted.
NSA's ubiquitous spying on everybody at home and elsewhere with technology beyond accountability does raise the chances of getting agreement of all targets -- gov, com, edu, org -- to say enough is enough, national security has become a catchall for inexcusable invasion of the public realm.
It remembers me when someone proposed that IPv6 encryption should become optional and the proposal was accepted. If we had IPv6 encrypted by now, things would be a little bit different ...
getting agreement of all targets -- gov, com, edu, org -- to say enough is enough, national security has become a catchall for inexcusable invasion of the public realm.
It remembers me when someone proposed that IPv6 encryption should become optional and the proposal was accepted. If we had IPv6 encrypted by now, things would be a little bit different ...
And networks would be harder to debug, unless you happened to work for the comsec utility or the NSA and already had all the decryption keys. Let me suggestion using IPv7 where encryption is also optional, but at least happens to use the same ecdsa keys you use for your money to encrypt packets if you so desire. -- ---------------------------------------------------------------------------- Troy Benjegerdes 'da hozer' hozer@hozed.org 7 elements earth::water::air::fire::mind::spirit::soul grid.coop Never pick a fight with someone who buys ink by the barrel, nor try buy a hacker who makes money by the megahash
At 11:52 PM 3/13/2014, Troy Benjegerdes sigged: "earth::water::air::fire::mind::spirit::soul" Your sig: "earth::water::air::fire::mind::spirit::soul" (EWAFMSS) pretty well covers the area of operations needing ubiquitous comsec against ubuiquitous spying of EWAFMSS. Certainly there will be violations and spying by those who design, run and abuse the systems of EWAFMSS. Especially those who are excused from accountability to "maintain the systems, or debug" EWAFMSS. More narrowly, system operators, network operators, maintenance staff, repariers, holders of keys to and lockpicks of the systems, ie, the Snowdens, the spies, the governors, will usurp control and unilaterally or collectively decide they know what is best for the systems' users, and that inevitably coincides with self-interest of the system operators of EWAFMSS. Given that inevitability of self-interest, cloaked in high-minded rationales of public service, or national security, what inevitably must be done to reign in the inevitable abusers of privilege, public service, national security, ie EWAFMSS. A range of options: assassination, revolution, counterspying, treason, war, founding of new faiths, schemes and con jobs in EWAFMSS. For comsec that could entail implantation of electroshock devices in every system operator which punishes, or in extremity, kills, for misbehavior programmed into the widgets. Hack a key, pick a lock, mosh RNG, open a backdoor, break a vow of public service, get singed as a warning, keep it up, get fried. This is basicly what NSA is implanting around the globe in systems if not witting and unwitting operators. Starting with implantation of their own Snowdens of devices of disinformation which leads the poor goofs to think they know the system vulns. Then the goofs spread the disinfo to, say, the Greenwalds, Poitras's and Gellmans who then goofily spread it to the public goofiness consumers. Blessing this operation is the FISC judges who mightily try to understand WTF DoJ is blowing at them to cloud what NSA is actually doing with its systems of EWAFMSS. Read the FISC orders to see the solons gyrate and spasm a pretense of understanding what is intended ot be non-understandable. NSA proceeds totally unhindered to do what it wants with abusing EWAFMSS, condoned by FISC glossing of the abuse -- what is done in the US is done worldwide for managing and exploiting for self-interest EWAFMSS. Yes, these very lists foster the appeal of exploiting the expoitation of EWAFMSS by pretending to oppose it, to found a new scheme of assassination, revolution, etc, etc. This will inevitably lead to compromisable proponents to be bribed and recruited for service in the established exploiters: billionaires, journalists, lawyers, courts, tech corporations, telcos, LEs, TLAs, Vaticans, Israelis, Muslims, Tea Parties, nations, black marketers, financial crime syndicates, freedom of information hustlers, leakers, and, most beautifully remunerative, crypto-comsec mofos. There's the pitch for comsec public utility, crypto-comsec mofos signing up to be implanted with EM devices for a Tor-Greenwald-grade lifetime of comfort bribe to loyally and patriotically run the sysems of EWAFMSS. Then immediately break the vow, hack the devices, cheat, lie, steal, bolthole an embassy, refuge in a rogue state, for a while enjoy the warm feeling of triumph, then be Zapped remotely for belief in knowing more than the Devil in the Details.
And networks would be harder to debug, unless you happened to work for the comsec utility or the NSA and already had all the decryption keys.
Let me suggestion using IPv7 where encryption is also optional, but at least happens to use the same ecdsa keys you use for your money to encrypt packets if you so desire.
-- ---------------------------------------------------------------------------- Troy Benjegerdes 'da hozer' hozer@hozed.org 7 elements
grid.coop
Never pick a fight with someone who buys ink by the barrel, nor try buy a hacker who makes money by the megahash
Message du 14/03/14 04:52 De : "Troy Benjegerdes" A : tpb-crypto@laposte.net Copie à : "John Young" , cypherpunks@cpunks.org, cryptography@randombit.net, cryptome@freelists.org Objet : Re: Comsec as Public Utility Beyond Illusory Privacy
getting agreement of all targets -- gov, com, edu, org -- to say enough is enough, national security has become a catchall for inexcusable invasion of the public realm.
It remembers me when someone proposed that IPv6 encryption should become optional and the proposal was accepted. If we had IPv6 encrypted by now, things would be a little bit different ...
And networks would be harder to debug, unless you happened to work for the comsec utility or the NSA and already had all the decryption keys.
Let me suggestion using IPv7 where encryption is also optional, but at least happens to use the same ecdsa keys you use for your money to encrypt packets if you so desire.
-- ---------------------------------------------------------------------------- Troy Benjegerdes 'da hozer' hozer@hozed.org 7 elements earth::water::air::fire::mind::spirit::soul grid.coop
Never pick a fight with someone who buys ink by the barrel, nor try buy a hacker who makes money by the megahash
I absolutely don't see the point that justifies debugging network problems to be a bigger concern than the privacy of everyone in the world. Debugging be damned. We should move to quantum-proof crypto, ECDSA is merely a stopgap.
It remembers me when someone proposed that IPv6 encryption should become optional and the proposal was accepted. If we had IPv6 encrypted by now, things would be a little bit different ...
And networks would be harder to debug, unless you happened to work for the comsec utility or the NSA and already had all the decryption keys.
Let me suggestion using IPv7 where encryption is also optional, but at least happens to use the same ecdsa keys you use for your money to encrypt packets if you so desire.
-- ---------------------------------------------------------------------------- Troy Benjegerdes 'da hozer' hozer@hozed.org 7 elements earth::water::air::fire::mind::spirit::soul grid.coop
Never pick a fight with someone who buys ink by the barrel, nor try buy a hacker who makes money by the megahash
I absolutely don't see the point that justifies debugging network problems to be a bigger concern than the privacy of everyone in the world. Debugging be damned.
We should move to quantum-proof crypto, ECDSA is merely a stopgap.
Most people will happily trade privacy for some 'free stuff'. Encrypting things nobody cares about hiding seems like a losing battle not worth fighting. 'De-bugging' is also de-bugging and removal of surveilance devices. If everything (including the network path my data takes) is encrypted, then I have no real ability to know if it's being tapped, redirected, or misdirected.
At 12:09 AM 3/17/2014, Troy Benjegerdes wrote:
If everything (including the network path my data takes) is encrypted, then I have no real ability to know if it's being tapped, redirected, or misdirected.
A point not well emphasized by cryptographers, in public at least, and advocates of encryption as the essential requirement for comsec. "Unbeakable crypto" may not be used as much as it once was but there are a host of newly-minted versions of snake oilish assurances dominating the booming comsec market, thanks to Snowden's magnificent gift, estimated to eventually reach the trillion dollar level in two decades, to the gov-com-edu-org comsec panic industry. Operators of systems, and the necessarily breachable security they offer, remain the achilles heels of comsec. Lavabit is only one of the instances in which sysadmins are compromised. Ubiquitous deployment of crypto throughout telecom and cyber systems is vulnerable to sysadmins who insist on full access to everything to "de-bug" and run their systems, especially those SAs easily manipulated by front offices and their ever so cooperative legal and financial advisors. Not many SAs wil do what Snowden did in the "public interest" which just happens to be a great fortune maker for media and comsec hustlers. End to end encryption is currently a hot recommendation of choice for comsec but skips over what happens behind, below, around and inside "end to end" code, hardware, implementation, and most of all the traffic flow of the precious capsules emitting transceiver vapor trails, EM clutter, arfully cloaked gaps, doors, handshakes, implants, bugs (and "de-bugs"), ways in and out, checks, double checks, safety plugs, sigs, nyms, language hints, and manifold uniquenesses witting and unwitting of fallible hunks of meat. It is, or should be, primary for cryptographers to publicly admit cryptosystems inevitably fail, as some do despite being overridden by sales and CEOs and investors, being bribed and NDA'd into complicity, or in worst cases threatened with prosecution for revealing in natsec systems built-in faults or more deviously, pretending there are none while glossing deep deception with shallow claims that there are always a few which can be repaired, nothing is perfect, you get what you pay for, etc, etc, the formulaic exculpation inherent in the word "security." No question this is expecting cryptographers to be more honest than the rest of the greedy "professional" class so avid to profess public interest while gobbling the public's hard earned with gleeful transgression slathered in "industry standards" and global treaties to assure governments and corporations remain piggish and dispensaries of rewards for the professional classes which find oligarchal enticements "irresistable" as Greenwald slobbered in agreeing to work closely with gov-com to withhold secrets under guise of ventriloquizing Snowden's "causing no harm to national security." "Causing no harm to national security" is verily medieval in its creed-promotional organized religion fervor. Cryptographers have long been missionaries for this duplicitous "trust us" faith, so it figures they will evangelize among journalists to adopt encryption to upgrade the low value of the fear and trembling scripture, and, as always, the compensation for scribes of arcane holy writ of bare panic and crypto balm.
participants (4)
-
John Young -
rysiek -
tpb-crypto＠laposte.net -
Troy Benjegerdes