Hacker News new | past | comments | ask | show | jobs | submit login
Doomed to repeat history? Lessons from the crypto wars of the 1990s (2015) [pdf] (newamerica.org)
86 points by martialg on Aug 8, 2022 | hide | past | favorite | 46 comments



I remember the crypto wars of the 1990s. I played my own small part in 1992:

http://www.shub-internet.org/brad/cacm92nov.html

I was a member of DC CypherPunks, with Declan McCullagh. I got to meet Whitfield Diffie. I saw EFF and EPIC and other such organizations get created.

I was just a tiny fly on that wall, but it was clear what we were up against at the time, and how things have just gotten worse since then.

Back then, the crazies were worried about these things called RFID strips that were supposedly embedded in all the money, so that the government could track you wherever they wanted.

Today, we all carry around phones broadcasting Bluetooth or wifi MAC addresses or RFID tags to tell us where we lost our keys, and we give them so much more information than could ever have been gathered by the claimed RFID strips.


> Declan McCullagh

I remember his Politech mailing list back in the day:

https://www.mail-archive.com/politech@politechbot.com/mail9....

- he was alert to the risks of today’s technology decades before they began to be realised.


I hesitated to clock on the URL because "newamerica" is an alt-right keyword now. The article itself was full of alt-right dogwhistles. That is, in 2022 parlance. In 2015 it was just the opposite.

I find the 180 degree shift in meaning of many words, phrases, and even political positions over the last 7 years to be fascinating.


Maybe you’re just stuck in The Matrix. Not implying you should be alt right, but maybe stop thinking about everything in relationship to what you perceive as “alt-right,” which is a spurious term to begin with.


and what were those dogwhistles?


Reminds me of TrueCrypt and VeraCrypt, now replaced by corporate solutions (BitLocker etc), and the discussions about backdoors.


I wish pdf had a mobile view


You know PDF makes that AI-complete because it's all about pixels/glyphs and throws away any sort of semantics guarantees... But Adobe's trying AI anyway to give you a mobile view as 'liquid mode': https://www.creativersk.com/liquid-mode-a-better-reading-exp... Might be worth a shot.


It's refreshing to see the word "crypto" applied to cryptography instead of cryptocurrency, like the good old days.


Remember when CSS meant Content Scramble System? Everyone was printing DeCSS onto everything: t-shirts, sigs, hats, mugs.


Content Scramble System is a more recent creation than the Cascading Style Sheets. It got the news for a while, but it's not like the web CSS stole the name.


I mean tbf, they were released around the same time (so i agree one did not plagiarize the other) but DVD CSS was likely more widely known first - albeit due to DeCSS


And this generations DeCSS is called Reader Mode :)


From an old comment of mine on the topic:

https://youtu.be/sKOk4Y4inVY?t=518 [1]

1. "In 1995, there was a debate at Harvard Law School – four of us discussing the future of public key encryption and its control. I was on the side, I suppose, of freedom. It’s where I try to be. With me at that debate was a man called Daniel Weitzner who now works in the White House making Internet policy for the Obama administration.

On the other side was the then Deputy Attorney General of the United States and a lawyer in private practice named Stewart Baker who had been chief council to the National Security Agency, our listeners, and who was then in private life helping businesses to deal with the listeners. He then became, later on, the deputy for policy planning in the Department of Homeland Security in the United States and has much to do with what happened in our network after 2001.

At any rate, the four of us spent two pleasant hours debating the right to encrypt and at the end there was a little dinner party at the Harvard faculty club, and at the end, after all the food had been taken away and just the port and the walnuts were left on the table, Stuart said, “All right, among us now that we are all in private, just us girls, I’ll let our hair down.”

He didn’t have much hair even then, but he let it down.

“We are not going to prosecute your client, Mr. Zimmermann," he said. “Public key encryption will become available. We fought a long, losing battle against it, but it was just a delaying tactic.” And then he looked around the room and he said, ”But nobody cares about anonymity, do they?"

And a cold chill went up my spine and I thought, all right, Stuart, and now I know you’re going to spend the next twenty years trying to eliminate anonymity in human society and I am going to try to stop you and we’ll see how it goes.

And it’s going badly. We didn’t build the net with anonymity built in. That was a mistake. Now we are paying for it." -Eben Moglen

Given how prevalent quiet aquisence is in the tech community about mass surveillance, I think the mistake is going to be anonymity, and other user rights and freedoms foundations, including crypto. We already see it happening with crypto, but please remember the real war is on computing freedom. These other things are a subset.


Can you please not copy-paste old posts like this? You've copied this one more than once!

https://news.ycombinator.com/item?id=28105138 (Aug 2021)

https://news.ycombinator.com/item?id=25098136 (Nov 2020)

If you want to refer to something you posted before, that's great, but please use the tool for the job: a link.

https://hn.algolia.com/?dateRange=all&page=0&prefix=false&qu...


Sorry Dang. This is a bad habit of mine when I've done the digging to find particularly salient points on a topic, I tend to re-use them in this way. I'll keep it more conversational and less copy-pasta.

I do think the importance of what Eben said stands on its own though. It cuts to the very heart of the crypto-wars.

One new tool that didn't exist in the original crypto-war: national security letters.


I totally get it - especially because recurring topics come up.

The principle we're going for is good conversation. If you sense into what would make sense in a good in-person conversation, that's probably about right. Even when it's natural for the same material to come up in a series of conversations over time, people don't repeat identical boilerplate to each other; that would be weird.

Quotes are a special case because by definition one is repeating them rather than generating them.


What is a problem with (modest and appreciated/upvoted) copy-pasting old, relevant posts? A strict policy against that could turn into a conversation consisting solely of links...



The linked moderator comments explain it in detail and it's not really conversation if you're just recycling a stash of prepared commentary, linked or pasted. If you don't have much new to say, link it or let it be.


HN is specialized in current discussions as compared to forums. This is why we don't have notifications here. Very often people ask the same questions or make the same wrong assumptions. (Not exceeding) copy-pasting helps to keep the local discussion going without forcing people to click a lot. It also allows to improve your answer with time.

Disclaimer: It seems I am breaking the rules here, too: https://hn.algolia.com/?dateRange=all&page=0&prefix=true&que.... And I disagree with such rules of course.


Pasting the same comment at people over and over is pretty lame on its own, yes, you should stop doing it on HN whether you like the rule or not. You don't have to stamp 'incorrect' on every comment you think is wrong - it's boring for everyone involved. The goal is interesting conversation not 'keeping the discussion going', especially when the thing stops meaningfully being a discussion.


> it's boring for everyone involved

Speak for yourself: I get upvotes every time (up to 22).

> You don't have to stamp 'incorrect' on every comment you think is wrong

New people often make the same mistake about privacy and I choose to correct them, because I think it's very important. It never was about "keeping the discussion going" for me. Quite the opposite, actually.

It's mostly a classical "nothing to hide argument" (https://en.wikipedia.org/wiki/Nothing_to_hide_argument), which is unbelievably popular, sadly. There are hundreds of threads trying to explain it to someone every month, with all the same arguments, reworded. My posts stop this repeated discussions, because nobody found a counterpoint (yet?). From this reasoning, I believe it's worth to copy-paste instead of ignoring (and letting the discussion go the same way again), or linking (and loosing the attention of most observers who, quite reasonably, don't want to click a lot).


Speak for yourself: I get upvotes every time (up to 22).

People upvote things that are bad for the forum all the time, hence the rules and the moderation.

https://hn.algolia.com/?dateRange=all&page=0&prefix=false&so...

It's mostly a classical "nothing to hide argument"

It's still a thing you classically shouldn't do here.


There are usually some reasons for the moderation policies, hopefully such that they improve the discussion. I explained how my actions improve the discussion (by cutting repeated arguments about the nothing-to-hide). You are just dismissing my arguments without any explanation. Aren't you breaking the HN rules in this way?


Aren't you breaking the HN rules in this way?

I don't believe so. I'm not dismissing your arguments, it's just that here, this argument has been argued and settled. Your particular approach has been found not to improve discussion (as explained in exhaustive detail) so to participate meaningfully, you gotta avoid it for reasons that go well beyond just the act of pasting:

https://hn.algolia.com/?dateRange=all&page=0&prefix=true&que...

You can mail the mods and ask if you want to be quintuple sure, they're plenty responsive.


I'm too lazy to mail the mods. Also, this thread is a reply to the mod's message, so I hope he is reading this.

Meanwhile, I will assume that I'm doing a good thing. I don't see how your link provides an explanation "in exhaustive detail". What are "canned response" even are? When someone says "I have nothing to hide", any response might be considered as canned - so is it better to let people be unaware?


If an entire conversation consists solely of callbacks to the past, you're not having a conversation. You're writing a history book.


it does not make it as easy/simple to remove or otherwise modify the links.


> We didn’t build the net with anonymity built in

I'd say the Internet is pretty dang anonymous compared to, say, X.25 or PSTN.

I'm curious what kind of anonymity Eben Moglen had in mind.

> but please remember the real war is on computing freedom.

Excepting the MPAA and their fixation on encrypted HDMI, what computing freedoms are at risk of being lost, and to whom, exactly? (well, within the OECD - yes, things are bad in the PRC and in other autocratic regimes - but those are hardly new threats).


Well, for one, it's getting increasingly hard to run arbitrary code on any kind of manufactured computing device.

Riding the current of valid security concerns, all platforms are moving towards all code being signed and attributable and most code operating only within abstract/virtual environments that only provide mediated access to the hardware or the host system.


how do GUIX configuration definitions, including the signed-boot parts, fit into the future here?


they probably don't.


The number of people on iOS and iPadOS with no other computing devices is high. Walled gardens. Lack of ability to easily install any apps you want. Pushes for remote attestation. Hypervisors beneath OSes. The darker parts of “trusted computing”. I could go on with many more examples.


TPMs and remote attestation on all platforms. For example, there's no reasonable way to run an adblocker on Android without rooting, and if you do root, many apps e.g. banking apps will refuse to run. The feature is called SafetyNet.


> remote attestation

* Rule number 1 in Distributed systems fight-club is never trust the client.

* Rule number 2 in Distributed systems fight-club is never trust the client.

...so why do they trust their client in a little-snitch OEMs soldered to the motherboard?


I find the firewall app Netguard "quite reasonable" as an adblocker on unrooted Android. The default for all apps I use is 'block access' and right now most apps continue to work. Those that won't work get deleted unless I really have a need for them on mobile.


TPMs themselves are fine, if you control them. See: Librem Key. (Agree with you on other points.)


you aren't paying attention to the trends. and the overall trend in modern world - especially within the OECD - is curtailing freedom in the name of some greater good.

we're one "cyber pandemic" away from all new consumer hardware being turned into locked down plastic toys for our own safety. and the seeds are already being planted in the minds of the public https://duckduckgo.com/?q=cyber+pandemic


And what of the backdoor present in all consumer CPUs which intelligence agencies are exclusively allowed to purchase disabled? If you are making that argument, it seems like we’re already in quite dim a spot.


that's a different can of worms, but yes, we are. it's just going to get way worse, and there's nothing we can do about that.


we've had people being forbidden from taking trains or entering restaurants or going to the movies based on their vaccination status in western europe for very dubious sanitary reasons ( one could still be contamined with the black plague a enter those movies as long as they had covid vaccine, which was clearly not changing anything to the epidemic dynamics)... and nobody but a super small fringe minority cared

I was building an e2e app at the time, and let me tell you i had a real existential crisis as to why i cared so much about people's privacy against their own will


the choice taken, because it's both easier and worse, is to put a marketplace of apps as an interface to the very large amount of things that a computer can do.

I'm saying that in the future (given this trend), in order to get "the computer" to do anything at all, the interface won't be a CLI or a programming language, but a giant searchable marketplace where you can buy (pay for) each specific action that you want your computer to do.

this sounds a bit ridiculous now, but it's not. it's a super appstore. it's the API economy taken to an extreme level. its all the functionality of your computer as a service with a small transactional fee for every meaningful action.

instead of teaching more people to program (and making an effort to keep computing simple), we have been collectively making computers easier to use and harder to understand.

It's only a matter of time before opening browser developer tools requires a cyrptographically signed government issued authorization (to give a crude example of my worry); of course this could be promised to keep children safe (or whatever convenient political excuse).

More realistically, I don't think it would work to straight up enforce this; instead I suppose making it unfeasible or otherwise really annoying to open browser dev tools is the way to do it. I have reasonable suspicions that this is the main driving impulse behind WASM.


> It's only a matter of time before opening browser developer tools requires a cyrptographically signed government issued authorization

“debugger vendors in 2047 distributed numbered copies only, and only to officially licensed and bonded programmers. The debugger Dan used in software class was kept behind a special firewall so that it could be used only for class exercises.”

https://www.gnu.org/philosophy/right-to-read.en.html


Needs a (2015) in the title.


Added. Thanks!




Guidelines | FAQ | Lists | API | Security | Legal | Apply to YC | Contact

Search: