Subject: [perpass] https.CIO.gov

From: Tim Bray <[email-masked]>
Date: Wed, 25 Mar 2015 17:06:18 +1300

Check out https://https.cio.gov/ - some good clear thinking there in the
write-up.

---

From: Mike Liebhold <[email-masked]>
Date: Wed, 25 Mar 2015 10:08:33 -0700

HTTPs everywhere is a critically important goal, but as Peter Eckersley 
at EFF points out, without best practices for keeping certificates 
current, with reliable cert authorities -- the  -assumption-  of a 
secure HTTPs connection  can be undermined..

e.g. When encountering an "unrecognized certificate" warning - most 
people click through....  potentially  connecting to a spoofed site.... 
even though it says HTTPs in the url bar.

On 3/24/15 9:06 PM, Tim Bray wrote:
>
> Check out https://https.cio.gov/ - some good clear thinking there in 
> the write-up.
>
>
>
> _______________________________________________
> perpass mailing list
> [email-masked]
> https://www.ietf.org/mailman/listinfo/perpass

---

From: Mike Liebhold <[email-masked]>
Date: Wed, 25 Mar 2015 10:11:14 -0700

I neglected  to include the link to the new  EFF/Mozilla Certificate 
authority initiative.

Launching in 2015: A Certificate Authority to Encrypt the Entire Web
https://www.eff.org/deeplinks/2014/11/certificate-authority-encrypt-entire-web

On 3/25/15 10:08 AM, Mike Liebhold wrote:
> HTTPs everywhere is a critically important goal, but as Peter 
> Eckersley at EFF points out, without best practices for keeping 
> certificates current, with reliable cert authorities -- the  
> -assumption-  of a secure HTTPs connection  can be undermined..
>
> people click through....  potentially  connecting to a spoofed 
> site.... even though it says HTTPs in the url bar.
>
>
>
>

---

From: Ted Lemon <[email-masked]>
Date: Wed, 25 Mar 2015 12:47:16 -0500

On Mar 25, 2015, at 12:08 PM, Mike Liebhold <[email-masked]> wrote:
> e.g. When encountering an "unrecognized certificate" warning - most people click through....  potentially  connecting to a spoofed site.... even though it says HTTPs in the url bar.

This is a UI fail.   The browser should never display that alert, any more than it should display an alert to click through proposing that you might want to try a different web site if the one you were trying to reach were simply unreachable.

Of course, I realize that this makes captive portals more difficult, but enabling this particular UI fail simply in order to allow captive portals to work is a very expensive solution to an easily solved problem (see http://datatracker.ietf.org/doc/draft-wkumari-dhc-capport/).

---

From: [email-masked]
Date: Thu, 26 Mar 2015 22:11:40 -0400

Encryption everywhere all the time?  No, thank you.

Better said, and at effective length, by David Golumbia

   Opt-Out Citizenship: End-to-End Encryption and
   Constitutional Governance
   http://www.uncomputing.org/?p=272

--dan

---

From: Stephen Farrell <[email-masked]>
Date: Fri, 27 Mar 2015 02:42:43 +0000

> Encryption everywhere all the time?  No, thank you.

Much more encryption, done well, almost all the time - yes please:-)

>    http://www.uncomputing.org/?p=272

Had a quick flick. Arguments based on a presumption of "perfect
end-to-end encryption" are utterly useless as they are counterfactual.
Anything one likes can follow from a false assumption like that.

S.

---

From: Ted Lemon <[email-masked]>
Date: Thu, 26 Mar 2015 23:02:19 -0500

> Anything one likes can follow from a false assumption like that.

The article also makes the mistake of thinking that the NSA eavesdropping on us is really the big failure mode.   Whether or not you think the NSA should eavesdrop on us, there are plenty of actors who should not, but who can, if we don't have more encryption.   The NSA is just the bellwether.

And the argument that we don't _really_ need privacy makes a lot of sense until you start asking yourself who you want to have copies of your credit card, who you want to know that you are away from your home this week, who you want to have photos of you in indiscreet poses, which gamergate trolls you want to have access to your private information, etc.

Come on, Dan, don't troll us!

---

From: Dave Crocker <[email-masked]>
Date: Fri, 27 Mar 2015 06:26:13 -0500

> Come on, Dan, don't troll us!

Ted,

As far as I'm aware, this is a forum for discussing technical aspects of
privacy, rather than policy aspects.  As such, debating the policy
implications of true 'perfect' e2e encryption seems out of scope, though
I'd assume that being notified of useful articles about it is worthy.

Still, a casual ad hominem like yours constitutes a far greater trolling
action in the IETF than a serious posting to a an article about a
difficult topic.  Attempting to marginalize a serious person's serious
posting by attacking their motives is supposed to be unacceptable in the
IETF.

In fact since it prompted Stephen's response, I'd say that the comment
on downsides to 'perfect e2e encryption' was useful:  I class Stephen's
clarification of the difference between the goal of perfect e2e
encryption, vs. the currently-attainable far-less-than-perfect, an
essential clarification to discussions about efforts like https-everywhere.

This is not an intimate conversation amongst well-acquainted colleagues
subject to their own private social contract of behavior.  It's a public
forum.

d/

-- 
Dave Crocker
Brandenburg InternetWorking
bbiw.net

---

From: Joseph Lorenzo Hall <[email-masked]>
Date: Fri, 27 Mar 2015 06:42:27 -0500

>    http://www.uncomputing.org/?p=272

In addition to what others have said -- this does feel like a trolling
of perpass -- I think Mike Masnick summed up a useful perspective on
this from an article on FBI Director Comey's rather bizarre testimony
yesterday where he asked for US legislation mandating backdoors. In
short, just because we are mediating more of our lives through
networked devices does not mean the government should be able to to
access those flows, and it doesn't take away the responsibility to do
good old police work.

----

https://www.techdirt.com/articles/20150325/17430330432/fbi-quietly-removes-recommendation-to-encrypt-your-phone-as-fbi-director-warns-how-encryption-will-lead-to-tears.shtml

....

Not surprisingly, Comey pulls out the trifecta of FUD in trying to
explain why it needs to spy on everyone: pedophiles, kidnappers and
drug dealers:

“Tech execs say privacy should be the paramount virtue,” Comey
continued, “When I hear that I close my eyes and say try to image what
the world looks like where pedophiles can’t be seen, kidnapper can’t
be seen, drug dealers can’t be seen.”

Except we know exactly what that looks like -- because that's the
world we've basically always lived with. And yet, law enforcement
folks like the FBI and various police departments were able to use
basic detective work to track down criminals.

----

The thinking from articles like the one Dan sent can naturally be
extended to demanding government access to what are effectively our
thoughts (the last bastion of freedom in a Democracy, I'd think) once
we have computational cognitive support systems (which is not nearly
as sci-fi as you might think.

best, Joe

-- 
Joseph Lorenzo Hall
Chief Technologist
Center for Democracy & Technology
1634 I ST NW STE 1100
Washington DC 20006-4011
(p) 202-407-8825
(f) 202-637-0968
[email-masked]
PGP: https://josephhall.org/gpg-key
fingerprint: 3CA2 8D7B 9F6D DBD3 4B10  1607 5F86 6987 40A9 A871

---

From: Nicholas Weaver <[email-masked]>
Date: Fri, 27 Mar 2015 09:29:39 -0700

> On Mar 26, 2015, at 7:11 PM, [email-masked] wrote:
> 

This assumes three things:

a)  That you are protected by US law

b)  That the systems are NOBUS ("Nobody But Us")

c)  That cleartext isn't a direct exploitable vulnerability.

Unfortunately none is the case

Lets take case A and assume you aren't a 5EYES citizen.  The US is quite explicit that if you aren't a 5EYES citizen, anything goes:  There are no legal limits, there are no protections against US activities.

In particular, "economic espionage" in the classic sense [1] is on the table: So if anything you do affects international commerce, you are an in-scope target.

Lets take case B: There is an implicit assumption that the only one watching is the "good guys".  Its quite true that the NSA has been remarkably constrained in its monitoring outside its mandates (unfortunately its mandates include "SIGINT development" and economic issues.)

But who says the NSA is the only one listening?

The NSA's gross overreach in acting against others brings into play the golden rule corollary: "Feel free to do unto others as they hath already done unto you". [2]  All it takes to monitor a 10 Gbps link is a load balancer and a couple of 1u PCs: the software itself is pretty much routine NIDS-type stuff [3].

We have near zero security on internal communications crossing the US.  You think a foreign country can't have a couple of "diplomats" hire a bobcat?  Place monitors at Foggy Bottom starbucks or every hotel in DC?

And that isn't even beginning to consider all the things said countries can do on their borders:  If one endpoint of your communication is outside the US, and the countries it cross (*cough* France *cough*) can gain benefit from monitoring it, they will.  And since the NSA did it to them, they are welcome to do it back to us.

Lets take case C, which is the kicker:  Cleartext is not just an avenue for monitoring, but a vector for attack.  If your adversary can see your cleartext communication, and can identify you as a target, they can modify that communication to exploit you.

This is the biggest problem.  The NSA said "its OK for nation states to directly 'shoot' exploits from the backbone".

This also interacts very strongly with B: For <$200/each, I can deploy an open WiFi monitor thats fully deniable (everything is COTS), disguised (think 'plug in air freshener'), and tamper resistant, which enables not just "monitor all on the wifi" but explicit "pwn by name": injecting malicious responses into traffic of identified targets.

And the allowed target set is effectively everybody: the GCHQ used this to penetrate Belgacom.  Yes, telecom is critical infrastructure, and GCHQ used this to exploit a NATO ally's critical infrastructure.  So if you can penetrate an ally's critical infrastructure by injecting exploits into cleartext communication, and the NSA and GCHQ said its OK by doing it, why can't the DGSE do it to us?

If you are lucky, your adversary can be any country where your traffic passes through except your own.

Taken together:

If you aren't 5EYES, US law won't protect you.

If you are, foreign law won't protect you.

And in either case, cleartext, by being modified, is an exploitable vulnerability, not just an observation hole.

This is why we MUST encrypt all the things.

There are no legal norms and niceties that can protect our interests, no matter who "our" is:  The US government, US companies, US individuals,  foreign governments, foreign companies, foreign individuals, they all now face a practical UN full of adversaries who can and will exploit anything they want.

Its all on the table.

By spying on every communication for words like "WTO." and $CANDIDATE_NAME, by hacking Belgacom, Petrobras, Gemalto, Huawei, and individuals like Quisquater, the NSA and company have told the rest of the world that there are no limits on who you can spy on and who you can hack, and the rest of the world will listen.

[1] The typical NSA dodge is to redefine "economic espionage" to being 'provide the information to US companies'.  Thats true, they do not appear to do that form of economic espionage.  But they are quite willing to hand the information over to other portions of the US government, e.g. it is acceptable behavior to search every email seen on the planet for voting information on the WTO, and we've seen the NZ rules for this.

[2] The biggest offender is not the NSA but the GCHQ (British).  But they did it with our toys and then "Putin's law" comes into effect:  If you give someone a missile, you are partially responsible for who they shoot down.

[3] The biggest limit is often asymmetric traffic.  Bro in particular doesn't handle seeing one-side of a link, and its been a low priority for developers to change that.  But you can always download Vortex and start from there.

--
Nicholas Weaver                  it is a tale, told by an idiot,
[email-masked]                full of sound and fury,
510-666-2903                                 .signifying nothing
PGP: http://www1.icsi.berkeley.edu/~nweaver/data/nweaver_pub.asc

---

From: Ted Lemon <[email-masked]>
Date: Fri, 27 Mar 2015 21:48:14 -0400

> subject to their own private social contract of behavior.  It's a public

My reaction was based on genuine surprise to see Dan repeating this argument, since he lived through the last set of crypto wars just like the rest of us.   It was said with affection, but meant seriously.   If there is a new argument to be had here, it was not usefully presented in that article.

---

From: [email-masked]
Date: Fri, 27 Mar 2015 22:36:14 -0400

I don't have the {skill,time,drive} to debate all this,
for which I apologize.  I will ask you a question that
may produce the same response from you as I just gave,
namely: In a world where the deployment curve of the IoT
has a 17-month doubling time, who or what is going to do
the key management that you would actually believe in?

--dan

---

From: Eliot Lear <[email-masked]>
Date: Fri, 27 Mar 2015 23:08:45 -0400

Hi,

It seems to me that having an honest discussion about our biases, goals,
and assumptions might help.

My goal: I want the Internet to continue to grow in a safe way.  It
can't do that if people don't trust the infrastructure.  There are EU
studies that discuss what happens when people experience some form of
harm on the Internet.[1]  Encryption has played a role in reducing that
harm.  But it can also increase harm for the very reasons stated in that
article.  Not acknowledging this would be absurd.

Please now see below.

> Anything one likes can follow from a false assumption like that.

Let me see if I understand this statement correctly: this group is
working toward a world in which we encrypt our communications, and when
someone discusses what that world might look like, you claim it's
"counterfactual"?  That's not a reasonable argument.

Ted claims that the author argues that there is no need for a right to
privacy.  I didn't read that in the article at all, but rather that the
Constitution must be taken as a whole: the same document that protects
our rights also provides various balancing tests to protect the rights
of others.

On the other hand, the piece missing from that article is the need for
confidence in the infrastructure, and Ted goes in this direction: if you
give the good guys means to gain access to communications, in all
likelihood you're giving the bad guys those very same capabilities. 
That has been the cornerstone of the IETF position for a very long time,
and it holds for whatever definition of "good guys" and "bad guys" you
might have.  Weakening end-to-end encryption weakens confidence in the
infrastructure.  This guy doesn't care because his focus is about the
balance of needs from a legal sense.  But these issues cannot be viewed
in isolation from one another.

Eliot
[1] Riek, et. al, /Understanding the Influence of Cybercrime Risk on the
E-Service Adoption of European Internet Users/, WEIS 2014. 
http://weis2014.econinfosec.org/papers/RiekBoehmeMoore-WEIS2014.pdf

---

From: "Christian Huitema" <[email-masked]>
Date: Fri, 27 Mar 2015 23:22:54 -0500

On Friday, March 27, 2015 at 10:09 PM, Eliot Lear wrote:

> Let me see if I understand this statement correctly: this group is working toward a world in which we encrypt our communications, and when someone discusses what that world might look like, you claim it's "counterfactual"?  That's not a reasonable argument.
> Ted claims that the author argues that there is no need for a right to privacy.  I didn't read that in the article at all, but rather that the Constitution must be taken as a whole: the same document that protects our rights also provides various balancing tests to protect the rights of others. 

The author's point is that the state, with proper warrants, should be able to conduct searches for evidence of crimes. While this is a reasonable argument, it does not follow that people should not have the right to protect their communications. For example, there is no mandate anywhere that people should keep a copy of their private letters in some kind of archive, so that they could later be found when the police asks for it. And there is definitely no expectation that all our private communications should be copied and archived by the state. And I am pretty sure that there was no such expectation among the authors of the US constitution and Bill of Rights.

- -- Christian Huitema

---

From: Eliot Lear <[email-masked]>
Date: Sat, 28 Mar 2015 08:50:19 -0400

Hi Christian,

On 3/28/15 12:22 AM, Christian Huitema wrote:
>
> The author's point is that the state, with proper warrants, should be
> able to conduct searches for evidence of crimes.

Yes.

> While this is a reasonable argument, it does not follow that people
> should not have the right to protect their communications.

Yes.

> For example, there is no mandate anywhere that people should keep a
> copy of their private letters in some kind of archive, so that they
> could later be found when the police asks for it.

But if they *did* keep a copy they could be compelled to reveal it if
the state had probable cause or a warrant.  The technology to actually
retain copies was beyond the horizon of the framers.

> And there is definitely no expectation that all our private
> communications should be copied and archived by the state. 

Unless the state has a warrant or probable cause.

> And I am pretty sure that there was no such expectation among the
> authors of the US constitution and Bill of Rights.

We'll never know, but they left a very strong hint in the 4th amendment
that they would indeed seek an appropriate balance of rights, as the
Massachusetts Compromise shows the Bill of Rights was hotly debated
between federalists and anti-federalists.

When we get beyond the United States, of course, different societies
have different views about All Of This.

Eliot

---

From: [email-masked]
Date: Sat, 28 Mar 2015 13:39:02 +0000

Eliot 

> "counterfactual"?  That's not a reasonable argument.

We disagree. All arguments of the form "the *perfect* thing I dislike has this downside" are bogus. And we simply do not (yet) know how how do do even imperfect but usable e2e security for interpersonal messaging at scale. The article is fatally flawed.

S.

---

From: Hugo Maxwell Connery <[email-masked]>
Date: Sat, 28 Mar 2015 06:38:13 +0000

Hi,

Standard Fallacy: if communications are encrypted they cannot be read/obtained.

There are two places where 'encrypted' communications are viewable, at
the sender and receiver.  Thus, the government (or anyone) can obtain the
communications by invading the sending or receiving system if either a plain-text
of the message(s) or the key and cipher text are still obtainable on the device.
Metadata of the communication is often available in logs.

The question is, under what circumstances should the government (or others)
be able to do this?

Recall that when people say 'encryption' what they usually mean is 'secure
communication' and that means 3 things (CIA model): Confidentiality, 
Integrity and Authenticity.  

Sometimes only two of these properties are desired, and I suggest that we should 
be thinking about this.  For example, a public forum wishes for integrity
and authenticity but does not necessarily require confidentiality.

No amount of digital 'secure communications' will prevent surveillance when
an end-point device is compromised (e.g key logger).

Additionally, current transport protocols include the addresses of the end-points
and thus expose the metadata of these connections to all locations in the 
communications path, irrespective of 'secure communications'.  

Thus, anonymity is another consideration that is entailed in these discussions.
--
Hugo Connery, Head of IT, DTU Environment, http://www.env.dtu.dk
________________________________________
From: perpass [[email-masked]] on behalf of [email-masked] [[email-masked]]
Sent: Friday, 27 March 2015 03:11
To: [email-masked]
Subject: Re: [perpass] https.CIO.gov

--dan

---

From: Stephen Farrell <[email-masked]>
Date: Sat, 28 Mar 2015 14:09:53 +0000

On 28/03/15 02:36, [email-masked] wrote:
> In a world where the deployment curve of the IoT

I'm sorry but the article *you* quoted made just the opposite
assumption (that doing "perfect" e2e crypto is possible) and
now you want to argue the opposite side? (That it is not.)
That's not IMO constructive.

As to what we should be doing - we (participating in the IETF)
should be (and I think are) doing the engineering to figure out
if and how we can make the Internet more secure and privacy
friendly without breaking it. Yes, there are unsolved problems
there related to key management at scale and there are perhaps
even more fundamental issues with privacy generally (in that
we don't understand it nearly as well as other security things)
but we ought not be trying to use both sides of arguments for
what look to me like purely rhetorical purposes.

Higher quality input is of course welcome.

S.

---

From: Paul Kyzivat <[email-masked]>
Date: Sat, 28 Mar 2015 10:57:58 -0400

On 3/28/15 12:22 AM, Christian Huitema wrote:
> -----BEGIN PGP SIGNED MESSAGE-----
> Hash: SHA1
>

I also generally agree with this.

The problem is that many non-technical proposals around this take it to 
mean that all communications should be blocked from being encrypted in a 
way that prevents presumed good actors from deciphering them. They fail 
to recognize that this will also allow bad actors to decipher them.

Perhaps this can be addressed by focusing on the right of individuals to 
protect their communications from access by bad actors. (Even if this 
makes it more difficult for the "good" actors with warrants.)

	Thanks,
	Paul

---

From: Dave Crocker <[email-masked]>
Date: Sun, 29 Mar 2015 14:13:58 -0700

> retain copies was beyond the horizon of the framers.

And it should be noted that compelling disclosure in this way is
fundamentally different from prohibiting/defeating protection against
lesser efforts.  That is, being required to produce encryption keys is
not the same as being required to use encryption that does not provide
serious protection.  (A backdoor is an example of not being serious.)

This is probably obvious, but I think it worth noting, since I see it at
the core of the encrypt-everything/don't-allow-it debate.

d/