Adam Fields (weblog)

The EFF has backed Tor:

“Tor is a toolset for a wide range of organizations and people that want to improve their safety and security on the Internet. Using Tor can help you anonymize web browsing and publishing, instant messaging, IRC, SSH, and more. Tor also provides a platform on which software developers can build new applications with built-in anonymity, safety, and privacy features.”

http://tor.eff.org/

We get more benefits out of having our legitimate communications encrypted (and protected from criminals) than criminals do by being able to hide. Strong crypto is always available if you want it. Covert channels are possible. Again, here’s an object lesson in Turing-Completeness.

The overall premise is this – Turing described a certain kind of basic computer that’s the baseline for computability. If another computer is “equivalent” to this (or instead, two computers are equivalent to each other), it can perform the same calculations – i.e.: take the same input and give the same output. There’s a principle in there (I’m not sure if it has a name) that says that it doesn’t matter if the alphabets are the same – the computation is still equivalent if the two machines are both Turing-complete, so some alphabets are interchangeable with others. This is how we get from computers processing zeroes and ones to human-readable text, images, and eventually moving images on the screen or other output device – alphabets can be encoded, and they’re still equivalent.

I’ve simplified things a bit.

This is a fundamental difference between digital computers and everything else. Computers are modeling devices capable of emulating a wide range of other things. Because of the interchangeability principles, the underlying restrictions and capabilities remain, regardless of what kind of representation you’re talking about. This has implications for encryption, digital media, and basically everything else we do with computers. More to the point, it has implications for trying to restrict what any given user wants to do by encoding some information as a digital signal, and the fact that pretty much, you can’t – they can always change the alphabet on you.

Examples of this are all over the place –

A lot of my friends work at banks or other large corporations that try to restrict what traffic can flow in and out of their network. They block ports, or they don’t allow certain protocols. Every one of my friends has successfully bypassed these restrictions by tunelling whatever they wanted to do over a different protocol. If you allow ssh, you allow everything to someone who can use ssh and is clever enough to realize that. Bits are fungible – it doesn’t matter to the computer what comes in or goes out, as long as there’s another translation program that can change one alphabet to another.

It’s currently possible to equip your car with a device that will let you open the door by knocking a certain pattern on the window. This is a perfect example of a covert channel – the alphabets are interchangeable, so your car can translate an unadvertised and hidden series of knocks into “open the door”, and it doesn’t fundamentally matter what the series of knocks was, or even that there was a series of knocks at all. It still means “open the door”. Bits are fungible.

The same principle is at work with digital media. When you play a movie, bits are read in, and transformed to a moving image of pixels. Here’s the important part. Unless you’re going to restrict access to the hardware (which is where the dreaded DRM “black box” comes in), even if the source file was encrypted and restricted, the machine on which you’re going to play it back still has to unencrypt it and display it. At that point, it can be captured and transformed into whatever form you want. Bits are fungible.

Bits are fungible. This is why “copy protection” is incompatible with general computing. If you allow general computing, bits can always be exchanged for other bits.

It’s also why encryption is not the same thing as security, why the bad guys will always have encryption, and why the EFF backing strong encryption is important for digital freedom.

Any questions?