[api]

Literally hosed. There's a funny jargon term "rubber hose cryptography" that's used to refer to the cryptanalysis method where you beat someone with a rubber hose until they give you the key. It's 100% effective against all forms of cryptography including even post-quantum algorithms.

[ipaddr]

You would be surprised that for a percent this would not work. Some even like it. Some have a deathwish and want to be a martyr. Some people blow themselves up to further a cause. Also put under heavy stress memories of keys cannot be recalled at times.

It's probably slightly less effective than threatening to kill family members but probably more than threat of jail time.

Either way you require someone alive and with mental awareness. The mind reading tools found in science fiction hasn't been developed yet.

[rangerelf]

It doesn't matter, something will be found that will coerce them into talking. Nobody is an island. Everyone has a breaking point, if it's not rubber hoses, it's socks full of rocks, or it's bottles of mineral water, or any number of methods. Don't think for a second that someone hasn't thought of a better way to get information out of somebody else.

[0xDEAFBEAD]

Yep... read up on interrogation resistance.

[jacquesm]

We're talking about normal people, not psychopaths.

[l33t7332273]

Terrorists are generally highly altruistic, not psychopaths.

It’s a lot easier to blow yourself up(or to spread ideology which encourages it)for a cause that you believe is helping people, in particular _your_ people.

[jacquesm]

The terrorists that blow themselves up and that blow other people up are usually misguided brainwashed angry young men. It's nothing to do with ideology, everything to do with power. Or did you think blowing up schools full of girls is something people genuinely believe helps their people, to give just one example?

Ordinary people just want to be left alone. Old guys wishing for more power will use anything to get it, including sacrificing the younger generations.

[l33t7332273]

> did you think blowing up schools full of girls is something people genuinely believe helps their people

It absolutely is something that they think helps their people, yes.

[jacquesm]

No, it's something that a bunch of old guys with issues told them helps their people.

Beliefs stop when they are no longer about yourself but about how other people should live. Especially when those other people loudly protest that this is how you think they should be living. Killing them is just murder, not the spreading of ideas.

But hey, those human rights are just for decoration anyway.

[dmayle]

That's actually not true. It can do nothing about M of N cryptography. (That's when a key is broken up such that there are N parts, and at least M (less than N) are required to decrypt. It doesn't matter how many rubber hoses you have, one person can fully divulge or give access to their key and it's still safe.

[hn_version_0023]

I always giggle a little when really smart people forget thugs exist and do what they’re told. If that includes breaking the knees of M people to get what they’re after, then M pairs of knees are gonna get destroyed.

This isn’t hard to understand, but it’s easy to forget our civilization hangs by a thread more often than any of us care to admit.

[ibejoeb]

I don't remember the provenance of the quip, but somewhere at a def con or a hope, I heard, "The point of cryptography is to force the government to torture you."

[jacquesm]

They're perfectly ok with that, and depending on where you live this may happen in more or less overt ways. If the government wants your information, they will get your information. Your very best outcome is to simply rot in detention until you cough up your keys.

[ibejoeb]

Now that I think about it, I'm pretty sure it was a session about root zone security, and Adam Langley was in the room. I was thinking, damn, kinda sucks to be the guy that holds Google's private keys. They want someone's information, so they let you rot...

[jazzyjackson]

power in numbers

can't torture us all!

[actionfromafar]

Are we deep enough in the thread for the customary reminder that each measure makes it incrementally harder to attack a system?

(Including a system of people.)

Even nation state adversaries don’t have infinite resources to allocate for all opponents.

[__alexs]

I think you can probably get away with only breaking one pair of knees and sending a video of it to the other people.

[solardev]

Youtube would delist that before they could all see it though.

[sofixa]

You know there are other ways to have a video and send it to people than YouTube, right? You can just email a link from dropbox or gdrive, or an attachment, or send a WhatsApp/Telegram/etc. message, send a letter with a USB drive, etc.

[solardev]

Yes. It was just a dumb joke :/

[lmm]

> You can just email a link from dropbox or gdrive, or an attachment, or send a WhatsApp/Telegram/etc. message

Why do you think governments are demanding those services give them access to quickly remove "misinformation"?

[MichaelZuo]

Any organization that is really really serious about security will obviously keep at least N-M +1 folks, along with their family, in other countries.

Which is a much much higher bar to clear for any would be rubber hose attackers.

[solardev]

Your secrets aren't really safe unless Xi and Putin each have part of your key personally memorized.

[Randomizer42]

That’s hyperbole

[pixl97]

Lets say for example

Bob, Jon, and Tom have pieces of the key. Bob and Jon are in the US and arrested over and commanded by a court to give up the key. Tom is the holdout. The US will issue an international arrest warrant, and now Tom can never safely fly again or the plane will be diverted to the nearest US friendly airport where they will be extradited. So, yea, "safe" is very situational here.

[BurningFrog]

Doesn't Tom's key fragment have to be on a disk somewhere for things to work?

That's the actual weak link to attack.

[kyleplum]

That situation just requires a longer hose

[snoman]

Or M hoses.

[gabereiser]

and more beatings.

[jacquesm]

Sure, so you hit all of the people that have all of the pieces. Problem solved.

[saalweachter]

Or you publicly announce you're hitting 1 of the N people with the rubber hose until M-1 of the other people send you their key fragments.

It's not like these keys are shared among disinterested strangers who have no attachment to each other.

[worthless-trash]

Somehow, somewhere you've just influenced a megacorp's internal crypto process.

[LinuxBender]

This probably works if each person has a cyanide+happy drug pill or a grenade and is willing to sacrifice themselves and the rubber-hoser(s). I think that requires a rare level of devotion. This process must also disable a simple and fragile signalling device to let the others know what's coming.

[aborsy]

This would not work well, because you can’t do it in a secret manner. Overuse of the rubber hose cryptography will become known, and there will be public backlash.

[eastbound]

Seems like the NSA is threatening everyone of arrest (=state-organized violence) if they don’t secretly give them keys, and Snowden revealed it, and there is no public backlash.

[amluto]

Hose-resistant cryptography is possible. Secret sharing comes to mind, or a system by which even the principals can only compromise a key slowly.