What President Obama is getting wrong about encryption

[bigtree]

from WaPo:

____"I lean probably further in the direction of strong encryption than some do inside of law enforcement," Obama said during an interview with tech news site re/code. "But I am sympathetic to law enforcement because I know the kind of pressure they’re under to keep us safe. And it’s not as black and white as it’s sometimes portrayed."

But the technical aspects of encryption actually are quite black and white, experts say, adding that the example Obama used to illustrate the risks of encryption doesn't match up with how tech companies are deploying the security measure for customers. Obama suggested that the FBI might be blocked from discovering who a terrorist was communicating with by tech companies' recent efforts to beef up encryption. But that type of data would still remain available, technical experts say.

Obama tried to explain a scenario where this might harm national security during his re/code interview:

Let’s say you knew a particular person was involved in a terrorist plot. And the FBI is trying to figure out who else were they communicating with, in order to prevent the plot. Traditionally, what has been able to happen is that the FBI gets a court order. They go to the company, they request those records the same way that they’d go get a court order to request a wiretap. The company technically can comply.

With the expansion of encryption, Obama said, a tech company may have secured that data so well that it would be inaccessible. But that's not actually how the iOS or Android default encryption works, technical experts say.

"The example he gives in his interview is one where encryption deployed by a company prevents them from being able to tell the government who someone is in contact with," said Christopher Soghoian, the principal technologist at the American Civil Liberties Union's Speech, Privacy and Technology Project. "That's not taking place right now."


read more: http://www.washingtonpost.com/blogs/the-switch/wp/2015/02/19/what-president-obama-is-getting-wrong-about-encryption/?tid=sm_tw

related:

Google sounds alarm; strongly opposing increasing FBI powers to search and seize digital data
http://www.democraticunderground.com/10026244374

US & UK spies hacked/stole encryption keys used to protect the privacy of cellphone communications
http://www.democraticunderground.com/10026249099

[alc]

1. it's not a technical issue

The issue is that we have a right to privacy and a right to association including private communication with our associates. Too bad if that makes it hard for those who don't want us to have privacy.

To those who say "So what, I don't have anything to hide": Does your representative (or the candidate you want to win), or anyone in his family, or his campaign manager, or anyone else who can influence the him/her have anything to hide? When invading privacy is possible, you can bet that someone in the government will use it at some point in the future. And that someone may not be someone you like (think Cheney having the encryption keys to all D congress communication and tell me he wouldn't misuse it if he thought he could get away with it).

[lapfog_1]

2. To defeat TIA

or blanket snooping...

buy a digital camera and shoot some footage... it can be anything.

now write some software that uses PGP or other encryption, chunks the resulting message into at most 2 bits at a time, change the end of the pixels in frames of the video ( before compression) to the bits from the encrypted message. ( steganography ) This will adjust the colors slightly but no one will notice because the video never existed before so there will be nothing to compare to.

email the video or post it someplace.

If you really want to hide... make it an amateur porn video and post it to one of the big porn download sites (hides the recipient),

If you really really want to hide, hijack a well known porn posting company site to post the porn. probably no one will notice.

and... for good measure, before encrypting the message, use a one time pad code substitution (trickier as the one time pad has to be known by the recipient).

done.

[bigtree]

3. k