Like many, I've been soaking up the new information as it comes in about this NSA debacle. What happens next? What's the solution? We could just accept that privacy is a thing of the past. Or could a better standard make the server not even be capable of handing over your data if it wanted to? On the surface, the idea seems patently absurd. And maybe it is.
I'm no encryption expert. I'm sure there are AT LEAST a few dozen people here whose knowledge on this subject dwarfs mine. So, let's get those mental juices flowing. Maybe something already exists but isn't being used. If not, I'm hoping the mere suggestion of the idea sparks an idea that leads to greatness.
After thinking about what such an implementation might look like, the best I've come up with is a key that changes each time to be used for the next message. You send an message to a server. It's encrypted with a key that your client generated the last time it sent a message. The server can use that key (which it received with the previous message and stored) to decrypt that message. Included with your new message is a new key that will be used next time. This allows the server to store a bunch of messages for you, but it's only capable of decrypting one of them. To be able to view history, the keys would all be stored on your own computer.
Unfortunately, this brings us a step backwards in terms of usability. Suddenly you're back to the days of only having one client capable of reading your stuff. The other thought that crossed my mind was client-to-client communication.
Maybe there's a better way to accomplish the same end goal - give companies an excuse to tell the FBI/NSA "Sorry, but I couldn't give you that information, no matter how badly I want to".
What do you all think? Am I crazy or is there any validity to any of this?
