Schneier on Security

Clive Robinson • July 18, 2022 1:05 PM

Is this “really true” though,

Facebook has responded by encrypting the entire URL into a single ciphertext blob.

Facebook has a history of doing things on the less than technically sound, as have many other Web Sites.

Whilst it is almost certain it is a reversable transform for obfuscating data,

1, Is it what we would call “encryption”?
2, Is it really a “single blob”?

I have a feeling that for various financial and resource reasons it’s more “show” than cryptographic “strength”. Also that what might be called the “key” may either be included in the blob or used as more of a “salt” with a weak system key.

I guess we are going to have to wait a little while, but Facebook may have just set what is currently,

“The Worlds Greatest Bragging Rights Challenge”

And a lot of keen minds will as with games consoles and similar, want to have their name associated with cracking this puppy wide open.

Clive Robinson • July 18, 2022 5:32 PM

@ RapidGeek, ALL,

It is a slippery slope to ask politicians to “help” with anything encryption related.

Encryption is just one of very many surface symptoms, of an underlying problem.

The real problem is those with a mental deficiency, who believe themselves to be better in some way thus more entitled than others.

That “entitlement” comes through as a series of steps of

1, Harming (sadism)
2, Status (narcissism)
3, Money (sociopathy)
4, Power (psychopathy)
5, Control (Machiavellism)

You see these in all “heirarchics” the first two are often clearly visable in “Guard Labour” that protect those at the higher levels.

The thing is to have “control” you need not just “information” but “knowledge” to put it the correct context.

For instance if you have the information I have bought 100kg of sugar, am I making preserves such as jam/jelly, or unauthorised whisky/moonshine, or am I going to do something “revolutionary” such as add it to peopples vehicle fuel tanks, or use it with some kind of oxadizing agent as a proplent or more rapid energy release and gas expansion.

To know this you need not just the information but also the “knowledge” of what sugar can be used for. Then further information and knowledge to home in on my intentions.

Idealy you need to sit in my personal interaction or private space. To see what I see, hear what I hear, hear what I say and see what I do. To do this needs considerable resources which makes it prohibitive in the traditional sense of things. Which acted as a limit on how much power and control etc were possible.

However forcing people to use technology channels where the ability to monitor is easy, automated, and effectively low cost, gives both information and knowledge. Realistically this use of technology to surveille started with the earliest of publicly available communications back two or three centuries ago, but came to the fore in the Victorian era, which caused the rapid rise of cryptography in non millitary or diplomatic uses.

Because these “official” channels were not just limited, but controled at the “end points”, surveillance on everyone who uses the channels in either an open way (plaintext), or even a closed way (ciphertext monitored by traffic analysis) was possible. Thus “official public” channels have always been subject to surveillance by those who in effect control them.

For your “ciphertext” to be private / secure you need to be able to deny anyone but the intended recipients of your communications.

What this boils down to is for privacy in communications, you need as a minimum,

1, A “root of trust”/”shared secret”.
2, An already existing private/secure channel (to communicate 1).

If a third party gets access or control of either then you have no privacy / security.

Thus nearly all attacks on individuals privacy by the self entitled and thair agents has involved maintaining access in some way to the “Root of Trust” / “Shardd secret”.

Which is why the attacks on the use of “End to End Encryption”(E2EE) has been so intense.

Politicians, Corporates and civil servants will grudgingly let citizens have privacy from other citizens because that helps limit criminality. But they will fight tooth and nail to stop you having privacy from them as they need access to maintain status, money, power and control.

The obvious answer to the problem is to stop the “entitled” having any kind of access to heirarchical structures. But the only way to do that is unacceptable to most, for obvious reasons (not moral or ethical). So failing that the ordinary citizen needs communications free from “official control” and all the surveillance that comes with it. At the moment high quality and robust E2EE is a necessary minimum for citizens to have privacy.