A Case That Has Microsoft, Apple and Amazon Agreeing • Hacker News Board

Re: A Case That Has Microsoft, Apple and Amazon Agreeing

#51

Post by MichaelGG » Wed, Sep 02, 2015, 4:05 PM UTC

kgilpin wrote: post #4

If companies stored customer data encrypted by keys that are held by the customer, they wouldn't have this problem. Furthermore, they wouldn't have to worry about deleting customer data either. The customer would have the power to simply deny access to the keys.

Right, and how would that be implemented, in, say, a web browser? Do you really think that the government that's forcing all this secret spying would just give up? Or more likely, would they require modifications to the software to leak the key or plaintext?

How would users verify that the software was working securely? A webmail provider would need to publish a full client-server API and protocol spec, so that you could run some independent software to audit what was being sent to be sure no leakage was happening. This is simply untenable.

Oh and what would really happen is that everyone would lose access to their data since, in general, nobody is able to maintain keys. It's pretty understandable that companies have little desire to redesign their whole systems to provide a crappy experience to a nearly non-existent market segment.

Re: A Case That Has Microsoft, Apple and Amazon Agreeing

#52

Post by ddlatham » Wed, Sep 02, 2015, 4:07 PM UTC

rayiner wrote: post #35

ddlatham wrote: post #23

Earlier quoted context omitted.

If the data is opaque to the provider, then there are many services they won't be able to provide on it (without some major advances in homomorphic encryption). For example, spam detection or search. Sharing is also made much more difficult.

There is no reason that stuff can't be done on the client side. Outlook works just peachy searching my GB's of emails and attachments from its local replica, using the internet only to sync.

Not true - there are reasons not to do it on the client instead. Consider a web email client instead. It's not feasible to login to the site, download a full archive of your email, decrypt it, and index it before being able to do a search.

Re: A Case That Has Microsoft, Apple and Amazon Agreeing

#53

Post by Spivak » Wed, Sep 02, 2015, 4:09 PM UTC

saraha wrote: post #9

amgine wrote: post #3

It's great this article about Microsoft fighting for our privacy came put in the midst of the upset over Windows 10 phoning home.

Microsoft aren't fighting for your rights here. They are fighting for market share. Not turning your data over to the FBI is now a product feature.

And god damn would I be willing to pay top dollar for such a feature. Do you hear me $every_tech_company? I'll be more than willing to put my market demand where my mouth is, give me client side encryption and/or self-hosted versions of your products and I'll happily write the check.

Re: A Case That Has Microsoft, Apple and Amazon Agreeing

#54

Post by dogma1138 » Wed, Sep 02, 2015, 4:10 PM UTC

zeveb wrote: post #12

I am not a lawyer, but it seems to me that an American court has the power to demand that an American citizen produce an item or information under his control, even if it happens to be in another country (e.g., a man getting divorced can't drive his car and all his gold and jewelry into Canada to shield them from his ex-wife). I imagine that most other countries would behave similarly: being within their borders and…

You are not a lawyer, if some one does it they aren't forced to drive the car or jewelry back they might be sued for hiding assets in a civil court, this isn't the government suing people, divorce isn't a criminal procedure. In any case Corporations aren't people, and MSFT servers in Ireland probably belong to MSFT IE/EU which is a separate legal entity (which is why MSFT can say we don't have it). There is also a difference between a warrant an, order and a subpoena in this case and 1000's other issues that I also as some one who's not a lawyer can't even begin to imagine.

But you know who is a lawyer, MSFT's head legal council and i hear he also got a bunch others with him so i would think they would figure out how to handle this. But in general various agreements and treaties govern how law enforcement agencies and legal systems of different countries interact, some countries might accept a signed US court order (Canada for example), for others you will have to go through the extradition process codified in a treaty, and the list goes on and on and on.

*P.S. With several exception a court can't compel you to do anything if you violate a Subpoena you will be found in contempt and maybe charged for that, and while you can call that compelling It's not since the court will not actually force you to do anything.

Re: A Case That Has Microsoft, Apple and Amazon Agreeing

#55

Post by harryh » Wed, Sep 02, 2015, 4:12 PM UTC

ddlatham wrote: post #23

kgilpin wrote: post #4

If companies stored customer data encrypted by keys that are held by the customer, they wouldn't have this problem. Furthermore, they wouldn't have to worry about deleting customer data either. The customer would have the power to simply deny access to the keys.

If the data is opaque to the provider, then there are many services they won't be able to provide on it (without some major advances in homomorphic encryption). For example, spam detection or search. Sharing is also made much more difficult.

Also displaying advertising based on keywords in your email.

Re: A Case That Has Microsoft, Apple and Amazon Agreeing

#56

Post by jo909 » Wed, Sep 02, 2015, 4:14 PM UTC

Tactic wrote: post #42

soylentcola wrote: post #31

"There’s irony in any tech company confronting the government on privacy matters, considering how much heat many take for mining their own customer information and using it for advertising and other profitable purposes." See, I don't find this very ironic. In fact, my only real issue with data mining and analysis by these sorts of companies is the way governments can demand this info without my approval. If Microsoft…

The government has this ability with near all other relationships you have. So much so that they have codified the few that it doesn't apply to. We put lawyers, doctors, clergy and spouses in a special category but others can be required to divulge any information they have on you with the appropriate order. (What's appropriate is another discussion) Ultimately, realize that any dealing you have is open to the govern…

Exactly. The police can read all my letters if a judge allows it. They can tap my phone, bug my bedroom, track my movement, perform a cavity search, take my blood and DNA, detain me, and if I make really bad decisions even kill me.

And I am totally fine with that in principle, only not with a few somewhat minor details and missing checks and balances.

I want _my_ government to be able to do all that, according to the laws of _my_ country, which I am able to change and influence.

Re: A Case That Has Microsoft, Apple and Amazon Agreeing

#57

Post by nivla » Wed, Sep 02, 2015, 4:14 PM UTC

saraha wrote: post #9

amgine wrote: post #3

It's great this article about Microsoft fighting for our privacy came put in the midst of the upset over Windows 10 phoning home.

Microsoft aren't fighting for your rights here. They are fighting for market share. Not turning your data over to the FBI is now a product feature.

Which in turn is protecting our privacy. The same can also be said about all other corporations: Google, Mozilla etc.

Re: A Case That Has Microsoft, Apple and Amazon Agreeing

#58

Post by [deleted] » Wed, Sep 02, 2015, 4:14 PM UTC

saraha wrote: post #9

amgine wrote: post #3

It's great this article about Microsoft fighting for our privacy came put in the midst of the upset over Windows 10 phoning home.

Microsoft aren't fighting for your rights here. They are fighting for market share. Not turning your data over to the FBI is now a product feature.

[deleted]

Re: A Case That Has Microsoft, Apple and Amazon Agreeing

#59

Post by Spivak » Wed, Sep 02, 2015, 4:15 PM UTC

Dirlewanger wrote: post #15

amgine wrote: post #3

It's great this article about Microsoft fighting for our privacy came put in the midst of the upset over Windows 10 phoning home.

It's kind of a red herring to connect these two. The case here involves the government seizing data from a foreign data center. Were Microsoft to lose, this says to foreign customers that any time the US government wants some information stored overseas, they will get it. Obviously not good for business. Here in the states, Microsoft is going to collect everything it can about its customers and store it (and from the…

So your argument is that people and organizations worried about having their data seized in the US is not bad for business?

Most individuals didn't really care too much when the NSA documents were released but businesses sure did. Our security and privacy pitch to the management was bumped from, "would be nice someday" to "make it happen."

Re: A Case That Has Microsoft, Apple and Amazon Agreeing

#60

Post by colechristensen » Wed, Sep 02, 2015, 4:19 PM UTC

Tactic wrote: post #42

soylentcola wrote: post #31

"There’s irony in any tech company confronting the government on privacy matters, considering how much heat many take for mining their own customer information and using it for advertising and other profitable purposes." See, I don't find this very ironic. In fact, my only real issue with data mining and analysis by these sorts of companies is the way governments can demand this info without my approval. If Microsoft…

The government has this ability with near all other relationships you have. So much so that they have codified the few that it doesn't apply to. We put lawyers, doctors, clergy and spouses in a special category but others can be required to divulge any information they have on you with the appropriate order. (What's appropriate is another discussion) Ultimately, realize that any dealing you have is open to the govern…

"The right of the people to be secure in their persons, houses, papers, and effects, against unreasonable searches and seizures, shall not be violated, and no Warrants shall issue, but upon probable cause, supported by Oath or affirmation, and particularly describing the place to be searched, and the persons or things to be seized."

The US Government does _not_ have the legal authority to arbitrarily collect or seize data without a warrant specifying exactly where and what they're looking for.

>So much so that they have codified the few that it doesn't apply to.

There are a few exceptions on whom you can get warrants for, but we're not complaining about warrants with probable cause.

The complaint is that our "persons, houses, papers, and effects" are being violated without probable cause and without "particularly describing the place to be searched, and the persons or things to be seized".