Storing information in the future; was it safer in the past? [closed]

Question

I work in IT and I'm grateful for the many conveniences computers have brought into my home and workplace. While doing some research on encryption and the pros and cons of encrypting your hard drives and flash drives, I was made somewhat skeptical when I read that the NSA (oh look, that's my username) could potentially have or gain access to encrypted files through "backdoors" in the encryption software. Also from my research I noticed that encrypted information is extremely difficult to piece together, or de-crypt into a recognizable form.

I wish not to focus on encryption alone and the backdoor that may or may not be associated with that method, but the storage of documents and other file types that would be of value to an individual or large association. I fear that someday encryption will be as easy to bypass as your friends 4-digit phone password.

Down to the question; Is it safer to store information, in any form, through means of lock and key (or various, "ancient" methods) or does the future hold the key to truly secure and private information? How could this be accomplished using the old ways, or futuristic ways?

Answer 1

Security of info is a broad topic. Consider: the German army's location in Africa was given away by the shippments of champagne for officers. Just a few weeks ago, the US Marine commandant was complaining that every training mission in the last year with new cadets had been failed because at least one soldier gave away the group position with a cell phone. But you jump back to Elizabethan times, stories of whole fleets of enemy ships passing each other on the ocean just a horizon apart and never knowing it.

InfoSec is two parts: collecting data and then storing data. As we move into the future, our sensing capacities are vast, especially the coordinated sensing capacities of corporations and governments. But our encryption abilities have gained steadily every year. Mathematics says we should get ever stronger encryption as computing power increases. Why? Pretty simple: we know there are equations that take effort N to set up but take N+f(N) to solve, where f(N) is positive and worse than linear. So if you can spend 1 second encrypting, it takes 1.1 seconds to crack, but if you spend 100 seconds encrypting, it takes 10000 seconds to crack. But then our CPUs get faster, so what really happens is last year we spent 1 second and it took 1.1 to crack, but this year we spent 1 second (what would have been 100) and it took 100 seconds to crack (what would have been 10000).

The efficiency gains of encryption vs cracking should mean that barring an outright hijacked backdoor'd algorithm, the secrets of the future should be nigh impenetrable. We just need to keep pushing the bounds of how much time we can afford to spend on strong encryption.

In short, in the future, it will be hard to keep others from knowing your present, but they won't likely be able to read your past. Pretty much the opposite of human history so far.

Answer 2

Since the discovery of dynamite and lock-picks, physical security methods really only keep out the amatuers. With adequate access, a few semi-illegal supplies and a little determination, almost any physical defence can be compromised.

The same is mostly true of their virtual equivalents. Massive-scale brute force attacks can defeat almost any encryption technique and as computing horsepower decreases in cost, the availability of such massive-scale hardware is increasing. If the cost and availability of dynamite had grown on a similar scale to computing power, an average school child would be able to level several city blocks.

So my dear NSA, it is, as you already know... Security, like privacy is just an illusion which we teach to our children to help them sleep at night. In the real world and in all of its virtual counterparts, every wall is transparent. No secrets are safe.

Answer 3

Almost to simple to state:

• Electronic storage of secrets can be attacked by electronic means if the system is connected to the net, and also by physical means (opening the computer to install a physical keylogger, moving in next door to collect emissions).
• Physical storage of secrets can be attacked by physical means.

If electronic attacks are organized properly, the cost for each attack becomes very low. Attackers infect computers to build a botnet to attack an user who may not even be susceptible to the attack. But they make millions of these attacks, and if only 0.001% work out, that's a win for the attacker.

Just imagine, a burglar who cracks the lock of my door (but only if I use a specific brand of lock), goes to the kitchen (never mind if my wallet is on the sideboard in the hall), and looks if there are silver spoons in the lowermost drawer. This fails because my cutlery is in the topmost drawer, and anyway there are no silver spoons. He goes again, but on the way out he makes a duplicate of my key to sell it to another burglar, who looks for golden earrings on the dresser. Never mind that I have no earrings and no dresser. That scenario is completely insane.

I use a physical notebook for some secrets, e.g. for my Stackexchange password. (I have it memorized, too, but I might forget.) That means the secret is vulnerable to a targeted attack against me, but it will be immune against a random attack.

I'm betting that there won't be targeted attacks on the secrets in that notebook. I wouldn't write a bank pin into that notebook, too risky.

Answer 4

Trying to answer in the very wide arc as the question was stated:

Storing anything (not only information) begins with securing and question of breaching that. Mostly due to efficiency, but many pages can be filled with reasons, motives and interests. Storing something may not only come up in the aspect of security, but maybe degradation prevention, areal separation, still the base of them works the same: You do something in order to counter an action, event, process, which would affect the subject in the original environment without any effort spent on safeguarding the specific feature.

As it already begins with "countering", it is already a "sword-shield" situation, where the bigger sword requires bigger shield to counter, bigger shield will require bigger sword to breach. It will always depend on the effort. For information technology it is true multiple times.

There is no such container, that will prove to be secure for infinite time. Only that much secure it can be, that the effort does not worth to "crack" it. Technology level will eventually just overwhelm it at a certain point.

Answer 5

Even with the various advances in safe cracking and decryption techniques, there are still means of keeping information safe.

Firstly, you don't call attention to yourself or your information. Hillary Clinton's email server stood out like a beacon because its ID on the internet unambiguously called attention to itself and who owned it. If you skulked down the street with a large aluminum briefcase chained to your wrist, most observers would note something interesting is in there. If you walk down the street from a grocery store with a paper bag, who would suspect that you actually have $1,000,000 in hundred dollar bills inside?

Secondly, information needs to have controlled distribution. You might have a Top Secret clearance, but that does not mean you are entitled to every piece of Top Secret intelligence. Information is compartmentalized and distributed on a "need to know" basis. Information also needs to have a clear paper trail. To use the Clinton email server example again, information was obviously lifted from secure servers and transferred to the unsecured server. There should be a record of every individual who had access to this information on the secure server, and logs of when they accessed the information. Potentially, quite a lot of people could be charged with various violations of securities laws for making and distributing unauthorized copies of information (although realistically this does not appear to be in the cards)

In the internet age, information also needs to be isolated from the "public" Internet. The so called "Dark Web" simply means this part of the web is only accessible by special permissions, passwords etc. and/or physically separate from the internet by "air gaps".

Information which is stored or transmitted should be encrypted with the highest possible level of encryption, and techniques which should be extremely difficult to break, such as "one time pads" or book codes.

In the future, the best form of security might well be straight pen and paper; which isn't accessible by remote means. Teams of agents might still be able to break into a room and go through a filing cabinet, but this is far more difficult and time consuming than the Chinese hack which took the information and security clearance forms of an estimated 4 million US government employees. Imagine how long it would take to go through vaults full of filing cabinets to do the same thing.

Answer 6

It's almost guaranteed that any cryptography algorithm will be broken. If you look at the history of attacks against previously unbreakable algorithms. Look how MD5 went from "almost invulnerable" to "breakable in 3 seconds on a desktop PC." It's simply a fact of life.

Every form of static physical protection (locks, vaults, etc.) will be broken. Remember, bank vaults are rated in minutes: the number of minutes it takes a trained locksmith to break into them. They always say "locks keep honest people honest." It's simply a fact of life.

If you deal with any content that really needs to be protected, you know the locks and encryption are all part of the game, to slow an adversary down. However, they are always backed up by security personnel -- individuals actively protecting the information. Consider "the football," America's briefcase of nuclear codes. It's not secure because it's in some massive vault somewhere. It's secure because it's handcuffed to a Secret Service agent's hand at all times, and that agent will protect the briefcase with his life if need be. And we've all see the movie plots that overcome that protection. It's simply a fact of life.

The only true way to be free from the risk of private information getting out into the public eye is to break free of that information in the first place. The existence of the F-117 was closely guarded as part of an ultra-secret project codenamed Senior Trend. The US government did not want any information about the plane to get it (apparently it's designation as a "fighter" was to throw off enemy intelligence efforts). The US is now free of this secret, because they are no longer concerned with needing to hide it. The F-117 showed up in airshows around the country, and its project was acknowledged. Now it doesn't matter if any enemies get their hands on that information -- we gave it away.