Comment on How would "banning encryption" even work in practise?
cecilkorik@lemmy.ca 2 weeks ago
You can download a torrent client and start pirating because it’s encrypted. If they wanted to crack down on it, the first thing they need to do is crack down on encryption. If they can see exactly what you’re doing, it’s now possible to easily catch you, with encryption it isn’t.
Note that this also applies to encryption itself. Once it’s banned, it gets much more difficult to hide the fact that you’re encrypting something. Encrypted data itself has to go into hiding. You have to resort to something like some pretty hardcore steganography which means you need to hide secret encrypted messages in normal-seeming non-encrypted traffic. The problem is that to do this you need to have a sufficient quantity of non-encrypted traffic to hide your secret encryption in without it starting to look suspicious, either due to the unusually massive volume of meaningless “normal” traffic needed to subtly encode the hidden data, or the fact that large amounts of hidden data in small amounts of “normal” data become increasingly obvious as the large number of supposedly “normal” mistakes and errors and artifacts that form the encoded data will suggest some of those variations are not in fact “normal” at all and will indicate that encrypted data is being concealed.
Governments banning encryption will of course never stop everybody. But it makes it much harder for the people still using encryption anyway and much easier for the people who want to see what they’re doing or at least see who they are. It’s classic “black or white” thinking to assume that because it hasn’t simply stopped encryption it hasn’t worked. This would be a big step that makes things much harder, and even taking small steps to make things slightly harder is an extremely effective tool and it’s become extremely common to try to convince people that these small regressions and erosions are inconsequential and normal even when they are in fact targeted, repeated, relentless and consistently add up to dramatic change over time. The only saving grace we have is that at least some people are simultaneously making the same kind of targeted, repeated, relentless changes for the common good and those can have just as drastic an effect.
Opinionhaver@feddit.uk 2 weeks ago
Would detecting that encrypted traffic be obvious or can you only see it after you start looking? So in other words, could the ISP just rat out on everyone who they detect using encryption or is that something that could only be proven by looking at the logs after you’re already under investigation?
cecilkorik@lemmy.ca 2 weeks ago
It’s not only obvious, it’s already done worldwide. [Deep packet inspection] evolved into HTTPS inspection and corporate/enterprise firewalls can detect and hijack attempts to establish encrypted connections already, as a “feature”. So do government firewalls in totalitarian countries. Of course they (probably) can’t do this secretly and transparently, because of the man-in-the-middle protections built into SSL, so they simply make the actual encrypted connection themselves on the client’s behalf, and give the client a different encrypted connection signed by their own certificate authority, which they force you to accept.
In this situation, you have two choices: You accept the certificate, and you accept that the owner of the intermediate certificate will be inspecting your “encrypted” connection. If you don’t accept the certificate, then your connection is blocked and you have to find some other way to encrypt and hide your traffic without it being intercepted, because it won’t let you go direct end-to-end. Usually, at the moment, this is not that hard for the tech-savvy to avoid, it doesn’t even require something as secretive as steganography, it’s usually simply a matter of tunneling through a different protocol or port. Although those approaches are still obvious, and can easily be detected and either blocked in real-time or flagged for investigation after-the-fact if they have any interest in doing something about it. Corporations or countries that want to lock down their networks further can simply block any ports or protocols that would allow such tunneling or inspection-evasion in the first place.
Deep packet inspection already allows any non-encrypted traffic to be clearly identified. If you don’t want any encrypted traffic to sneak through, you can safely assume anything that can’t be clearly identified is encrypted and block it. Depending on how strict you want to be about it, you start essentially whitelisting the internet to known, plaintext protocols. If it’s not known and plaintext, just block it. Problem solved. Encryption gone, until people start building (possibly hidden) encryption on top of those plaintext protocols, which is inevitable, and then you update your deep packet inspection to detect the encrypted fields inside the plaintext protocol and block them, and the back-and-forth battle continues.
Encryption is probably a false panacea against a major state-level adversary anyway, especially if they have plausible access to network infrastructure, but that’s a whole different can of worms and unless you’re a serious revolutionary/terrorist probably beyond the useful scope of most people’s realistic concerns.
sanpo@sopuli.xyz 2 weeks ago
Man, deep packet inspection is some crazy stuff.
Good implementation can identify the type of traffic within seconds with scarily good accuracy.
Quite a few countries actually implement this in their national ISP’s infrastructure to block VPNs, so the citizens can’t access non-approved websites.