Obama: We can't have encryption.

[RocketMan]

Anti-encryption laws remind one of the laws against body armor. Why don't they just have us wear transparent smocks, and a ball and chain?

I am sure that's part of their plan.  They just haven't reached it yet.

[HeroHog]

They can have my encryption when they pry it from my cold dead hands.

Well I guess that is probably true. I use the fingerprint thingie(technical term) on my iPhone.

I do NOT. The courts have held that you may be compelled to use the fingerprint reader to unlock your phone WITHOUT a search warrant but if you use a PIN or Key code, they can't. You have been advised.

[BlueStarLizzard]

Anti-encryption laws remind one of laws against body armor. "Citizen, you will not even attempt to protect yourself!" Why don't they just have us wear transparent smocks, and a ball and chain?

Well, forcing everyone into transparent smocks would defiantly give the "healthy" food lobby a boost, since dieting would be on everyone's minds... Well, except the proud fatties, I guess. 

[birdman]

I do NOT. The courts have held that you may be compelled to use the fingerprint reader to unlock your phone WITHOUT a search warrant but if you use a PIN or Key code, they can't. You have been advised.

Just power it off.  PIN rather than finger is required on startup.

[Hutch]

Just power it off.  PIN rather than finger is required on startup.

Thanks, BM.  I was worried.

"Hutch, you are commanded to unlock your phone!"
"Okay, hand it here... Oops, did I do that?"

[Ben]

Thanks, BM.  I was worried.

"Hutch, you are commanded to unlock your phone!"
"Okay, hand it here... Oops, did I do that?"

My Samsung goes straight to fingerprint on startup. I only have to use the unlock password if it misreads my fingerprint 10 times.

Though the information regarding search legality is making me thing about switching back to a swipe pattern.

[birdman]

My Samsung goes straight to fingerprint on startup. I only have to use the unlock password if it misreads my fingerprint 10 times.

Though the information regarding search legality is making me thing about switching back to a swipe pattern.

Sorry.  I meant to clarify for iPhone.

[KD5NRH]

I do NOT. The courts have held that you may be compelled to use the fingerprint reader to unlock your phone WITHOUT a search warrant but if you use a PIN or Key code, they can't. You have been advised.

You just need a more secure phone.

http://www.ebay.com/itm/Vintage-Phone-Motorola-SCN2500A-Leather-Bag-Cellular-Great-Condition-Working-/121879659738?hash=item1c609804da

No way they're getting your midget porn out of that one.

[HeroHog]

Just power it off.  PIN rather than finger is required on startup.

The question is, will you have time or be given the chance to power it down and what if you are using it to record the cop? Now yer screwed.

[HeroHog]

http://bayourenaissanceman.blogspot.com/2016/03/so-much-for-fingerprint-security-devices.html

[rcnixon]

Need to start sending large enormous amounts petabytes of encrypted data every-*expletive deleted*ing-where.
Said encrypted data should include such dangerous documents like the Declaration of Independence, the Constitution, and tens of thousands of nursery rhymes and naughty limericks.

Get a freeware package called "truly random" and generate petabytes of random text.  It will look just like one-time pad traffic and ages and eons of computer time will be spent trying to decrypt it. It will be faster too, just one step. Along the way, generate yourself some one-time pads for actual use. It's slow but it is unbreakable if you follow the three rules*. The transmitted traffic will also look just like your random traffic too.

Russ

* 1. The key must be the same length as the message.
   2. The key must be kept secure.
   3. The key must never be re-used.
And, just like the other three rules, there is a fourth corollary:
   4. Use message padding and spell out numbers and punctuation.

[zahc]

I have a Perl program to generate pages of OTP, and others exist. Mine makes old-school paper pages with line-numbers for paper-and-pencil use, because I feel there is no practical way to achieve true security of computer systems, so encrypting by hand is the only way, then computer security can be ignored (go ahead, just post your message on twitter). It is relatively easy, in these calm times, to drop pages off with people you may wish to have secure communication with in the normal course of visiting them.

In Vinges "A Fire Upon the Deep", FTL physics has enabled hypercomputation, rendering asymmetric-key crypto obsolete. There is a guild of aliens that make their livelihood transporting OTP data blobs around the universe.

github.com/Fasrad/otpgen

[230RN]

Anti-encryption laws remind one of laws against body armor. "Citizen Subject, you will not even attempt to protect yourself!" Why don't they just have us wear transparent smocks, and a ball and chain?

Moah bettah now.

[HankB]

I do NOT. The courts have held that you may be compelled to use the fingerprint reader to unlock your phone WITHOUT a search warrant but if you use a PIN or Key code, they can't. You have been advised.

If the phone can read one finger print, it can read more than one. Wouldn't it be possible to use, say, the index finger on your right hand to unlock the phone properly, and the index finger on your left hand to either wipe the phone or bring up some bogus data? 

[HeroHog]

If the phone can read one finger print, it can read more than one. Wouldn't it be possible to use, say, the index finger on your right hand to unlock the phone properly, and the index finger on your left hand to either wipe the phone or bring up some bogus data? 

Not unless you or someone figures out a way to program that. Fingerprint readers are notoriously easy to crack/defeat so I simply don't trust them.

[Blakenzy]

I see a large market for a company that puts out a phone with serious encryption as it's main selling point.

[cordex]

I see a large market for a company that puts out a phone with serious encryption as it's main selling point.

https://www.silentcircle.com/products-and-solutions/devices/

[Ben]

I see a large market for a company that puts out a phone with serious encryption as it's main selling point.

Ironically, I remember when one of Blackberry's largest markets was the US govt, with security being one of the main reasons.

[brimic]

Ironically, I remember when one of Blackberry's largest markets was the US govt, with security being one of the main reasons.

Funny how things change, even considering the idea that hillary had a lot of classified things moved illegally so she could access them with her iPad. 

[RevDisk]

Get a freeware package called "truly random" and generate petabytes of random text.  It will look just like one-time pad traffic and ages and eons of computer time will be spent trying to decrypt it. It will be faster too, just one step. Along the way, generate yourself some one-time pads for actual use. It's slow but it is unbreakable if you follow the three rules*. The transmitted traffic will also look just like your random traffic too.

Russ

* 1. The key must be the same length as the message.
   2. The key must be kept secure.
   3. The key must never be re-used.
And, just like the other three rules, there is a fourth corollary:
   4. Use message padding and spell out numbers and punctuation.

Chaff (spurious random or pseudo random generated information) generally hasn't been embraced by the crypto community. Too much overhead, too easy to spot as fake. Also it leads to IT folks getting really annoyed and banning blocking said IPs generating high levels of noise. Sometimes NICs go bad and start spewing out random traffic, which is a pain as well.


Btw, this is not directed at you or in anger. Just a generalized thing that I'd like to let folks know. NEVER EVER EVER USE SOFTWARE RANDOM NUMBER GENERATORS. If it remotely feasible to not use a software RNG, obviously. On the scale of 1 to 10 in terms of bad ideas, it's a "invading during winter while publicly expressing the desire to destroy every vodka distillery in Russia".

Just as another interesting aside, the best source of random numbers is a laser and a single photon counter, that is a silicon PIN detector. The silicon avalanche photodiode (APD) is the cheaper cousin. Photomultiplier tubes (PMT, aka night vision) can work as well. Basically, it can give you a time stamp of when a photon hits the sensor. Toss out the leading bits, and you literally have quantum noise. Probably the absolute platinum standard for randomness. Previous was atmospheric noise. You can get continuous 100Mbps of quantum noise for under $5k. APD would probably be a gold.

And using a webcam's CCD noise as an entropy seed over it would be silver. Maybe 1 Mbps with consumer hardware. Good enough for routine purposes, but not nuclear weapon related security.

https://github.com/epitron/webcam-rng
http://journals.aps.org/prx/pdf/10.1103/PhysRevX.4.031056

[Scout26]

On the scale of 1 to 10 in terms of bad ideas, it's a "invading during winter while publicly expressing the desire to destroy every vodka distillery in Russia".

Challenge Accepted !!!!

 

[KD5NRH]

Btw, this is not directed at you or in anger. Just a generalized thing that I'd like to let folks know. NEVER EVER EVER USE SOFTWARE RANDOM NUMBER GENERATORS. If it remotely feasible to not use a software RNG, obviously. On the scale of 1 to 10 in terms of bad ideas, it's a "invading during winter while publicly expressing the desire to destroy every vodka distillery in Russia".

Oh picky picky picky.  Next you're going to tell me that the digits of pi aren't random enough.   

[RevDisk]

Oh picky picky picky.  Next you're going to tell me that the digits of pi aren't random enough.   

Technically, every short (maybe even long) random numeric sequence you could generate might be found somewhere in pi. 

[KD5NRH]

Technically, every short (maybe even long) random numeric sequence you could generate might be found somewhere in pi.

So pi mod(e) should be plenty random for my new encryption system.  I'll tell the DoD to get ready for the transition.