41–50 of 184 posts
So... the FBI is essentially arguing we should all keep our doors unlocked because they have had to do some investigations in the past where they came to a home that was locked and it was hard for them to enter the home.
The FBI want to have a giant warehouse that houses a copy of every house key but we don't need to worry because no one will ever manage to break in to the warehouse.
Earlier quoted context omitted.
How many people can be bothered if it's not a turnkey solution?
Like I said it's not about the average person, it's about someone with something to hide. Those with something to hide will always go the extra distance. The issue I take with the FBI approach is it will have no effect on those that have stuff to hide but destroy any semblance privacy for those that don't. Terrorists will use GPG, citizens will use their backdoored iPhone full disk encryption and everyone but the ter…
Keep in mind that the FBI would love it if everyone held that to be true. We all have something to hide, average person or not. No matter if you are a criminal, political activist, pervert, lawyer, priest, or just the baker down the street. Paraphrasing John Oliver: your banking statements, medical data, dick pics, private messages, dick pics, dick pics, and your secret diary are all things you most likely want to hide.
( https://www.youtube.com/watch?v=zsjZ2r9Ygzw )
The FBI would not mind a situation where only people with technological know-how use GnuPG, LUKS with dm-crypt, etc., and the rest whatever came with their smartphone. Most criminals are not particularly tech-savvy, so if that group loses access to strong encryption by default, they largely gain what they want.
Of course there is no practical way to make the use of strong encryption by individual citizens around the globe illegal, and they know this. They may however succeed in outlawing strong disk encryption available by default on store-bought devices. So when a suspect uses an Android or IPhone, and the FBI has his or her device, they want to be able to access its contents without the suspect's consent. Ideally, they also want the most popular messaging platforms (like Facebook's WhatsApp) to have a backdoor available, in order for the vendor to be able to comply with warrants for such data.
Sort of a bummer that lawmakers don't have a better understanding of encryption in general and what it protects. They'd condemn hackers breaking into phones/accounts and stealing important notes/pictures, but turn around and condemn the very technology preventing that from happening to _everybody_ Anybody here want to run for office and be a voice for tech rights?
It's only a dichotomy if you see it from the angle where data is sacrosanct and its beset on all sides by evil trying to do it in. The better way to approach this issue, long term, is from a legal point of view with an interim state where encryption holds us over. That is the law decides who may or may not own or access a certain type of data with penalties upon tort or criminality. And we develop civil protocols for…
Once someone has your data, you don't know what they're doing with it and neither does the government. Which means they have to be prevented from getting it in the first place, which means encryption and laws that encourage and facilitate encryption.
It is utterly and completely unsurprising that all the government agencies involved in law enforcement on all levels will fight a never-ending fight against anything that impedes their ability to do what they think their job is.
They don't care about privacy or any of that, and see restrictions to getting full access to all data as we see bugs in our systems that keep them from running correctly.
Earlier quoted context omitted.
It's only a dichotomy if you see it from the angle where data is sacrosanct and its beset on all sides by evil trying to do it in. The better way to approach this issue, long term, is from a legal point of view with an interim state where encryption holds us over. That is the law decides who may or may not own or access a certain type of data with penalties upon tort or criminality. And we develop civil protocols for…
Thieves can't traditionally steal your stuff on a mass scale without you ever knowing about it and then cost effectively use it to economically and psychologically manipulate entire populations. Once someone has your data, you don't know what they're doing with it and neither does the government. Which means they have to be prevented from getting it in the first place, which means encryption and laws that encourage a…
Sort of a bummer that lawmakers don't have a better understanding of encryption in general and what it protects. They'd condemn hackers breaking into phones/accounts and stealing important notes/pictures, but turn around and condemn the very technology preventing that from happening to _everybody_ Anybody here want to run for office and be a voice for tech rights?
It might help if one of them gets their personal information leaked because they used unencrypted technology in their private lives. I do suspect this won't have any significant influence since they think the government will prevent the escrow from being hacked. Part of me hopes that there will be a significant data leak from whatever the NSA has stored. Maybe they'd realize that single point of failure sucks.
We should be careful when the FBI is advocating a capability to help investigate events which occur vanishingly rarely (and for which they have many other tools and avenues) vs the integrity of infrastructure which affects a wide swath of public security. When one looks at the entire balance, requiring a backdoor has a high chance that it would lock us into much less secure state of affairs than if everyone is free to pursue and apply the best privacy/encryption measures possible.
The problem is that we now know that the government has the goal of unlawful surveillance without oversight from courts, the legislature, or the public. There is essentially an ongoing "by any means necessary" attack on civil liberties.
Why should we think that the government is not planning to infiltrate the escrow services and preemptively capture all keys?
There has been a profound breach of trust (revealed by Snowden) and we must insist upon the rule of law and basic democratic transparency before we consent to any further risks.
I try not to be cynical but I am thinking that the trend we are on is leading to strong crypto being largely criminalized. I am hoping that our decentralized systems adapt to this threat and offer solutions that cannot be shut down (like Bitcoin and Ethereum).
Incidentally, if Apple seems likely to lose the battle over a back door, it ought to offer an Ethereum smart contract that will unlock one phone every day, require a key provided by each member of congress (with 100% consent required to unlock a device), and publish all unlock key requests on the Ethereum blockchain after a 30 day delay in case an investigation is in progress.
This protects against mass surveillance, but offers a very small back door with full transparency and no potential for large scale use (or abuse).
So... the FBI is essentially arguing we should all keep our doors unlocked because they have had to do some investigations in the past where they came to a home that was locked and it was hard for them to enter the home.
Remember how New York’s (physical) master keys became easily accessible[1] despite the fact that they were supposedly so carefully managed? All that effort, all that trouble, and now not only is there essentially no security at all but the master keys created a security hole that did not need to exist. The security of encryption is similarly proportional to the security of keys. The fewer things you have to secure, t…
Interesting article. I find amusing this (quite popular) type of argumentation: > "This is a serious security breach," said Councilman Peter Vallone (D-Queens), who heads the Council's Public Safety Committee. "We know terrorists are planning to attack our subways, and the MTA and NYPD better find these magical morons quickly, and then make them disappear for a year in jail." Like the only thing between terrorists an…
* We can have strong encryption just for the good guys
* We can have master keys that only approved staff will use
* We can block all the bad things on the internet and it'll be like they don't exist
* If we have a back door into an encrypted device, only the good guys will use it
The list is so damn long, yet people who really should know better get it wrong with depressing regularity. Are most politicians really that stupid? What are their advisers advising FFS?
Remember how New York’s (physical) master keys became easily accessible[1] despite the fact that they were supposedly so carefully managed? All that effort, all that trouble, and now not only is there essentially no security at all but the master keys created a security hole that did not need to exist. The security of encryption is similarly proportional to the security of keys. The fewer things you have to secure, t…
Except when this approaches towards zero security. The line is so thin, and actual expertise is needed to discern this sweetspot. I've seen entire corporations use apparently bulletproof security (Think Google's data centres), but fail to use DNSSEC or background check their security guards.
Avoid weak links like this, they are bad for business.