Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

FBI Wants It to Be Impractical to Deploy Strong Encryption Without Key Escrow

rietta.com

Post reply on HN
Print view View original

131–140 of 184 posts

Re: FBI Wants It to Be Impractical to Deploy Strong Encryption Without Key Escrow

#131

Post by squidbidness »

andrewla wrote: post #125

It's not clear to me where this article gets the idea of what the FBI wants. I haven't seen anything from the FBI or from Comey that indicates that they want to place limits on future cryptographics systems. It even seems like Comey is aware that the particular technique he is asking Apple to use will not apply to future phones made by Apple, and that the reality is that cryptography will soon reach the point where t…

The slippery slope fear is a bigger than which particular phone models will be made technically insecure by what the FBI is asking here and now in this case. The larger fear is the precedent that will be set by allowing such a ruling to stand--the strict legal precedent for cases much like this one, but also the momentum it will give to large agencies in the cultural fronts of the war against encryption.

Re: FBI Wants It to Be Impractical to Deploy Strong Encryption Without Key Escrow

#132

Post by Azkar »

chillacy wrote: post #129
andrewla wrote: post #125

It's not clear to me where this article gets the idea of what the FBI wants. I haven't seen anything from the FBI or from Comey that indicates that they want to place limits on future cryptographics systems. It even seems like Comey is aware that the particular technique he is asking Apple to use will not apply to future phones made by Apple, and that the reality is that cryptography will soon reach the point where t…

The issue isn't a technical one as much as a legal one. If the FBI can get the government to interpret the All Writs Act the way they want (any private entities must do what the govt says to aid a criminal investigation unless explicitly forbidden by law) to force Apple to write a custom version of iOS for them this time, the fear is that they can use the same law to install backdoors in ongoing versions. Legally the…

Exactly. The slope begins with a phone released in 2013, but it doesn't end, ever - unless we can set the precedent now that Apple doesn't have to do this kind of thing.

Re: FBI Wants It to Be Impractical to Deploy Strong Encryption Without Key Escrow

#133

Post by stegosaurus »

Here is the source code for the Linux Kernel including dm-crypt: https://git.kernel.org/cgit/linux/kernel/git/torvalds/linux....

Here is the source code for cryptsetup: https://gitlab.com/cryptsetup/cryptsetup

Here is the source code for GnuPG: http://git.gnupg.org/cgi-bin/gitweb.cgi

I have these files on my hard drive.

There are probably cryptographers that can recite the RSA/AES algorithms from memory.

We have the Internet and general purpose computers.

The only way you're getting rid of encryption is destroying all of that. I don't know why people feel the need to resort to arguments about economic damage, civil rights, whatever.

This is the fucking _Internet_ we're talking about. This isn't some biscuit tin with a particular pattern that Uncle George really, really likes. It's the god damn Internet.

You want to destroy one of the most beautiful creations humanity has ever seen, in the name of what? Stopping a few marathons being bombed?

Is the entire government clinically insane? Would they turn the sky green if it gave them more power? Am I still living in reality?

Re: FBI Wants It to Be Impractical to Deploy Strong Encryption Without Key Escrow

#135

Post by skybrian »

The problem with these slippery slope arguments is that they start treating unlocking a phone as the equivalent to breaking network encryption when technically they're not at all the same. Apparently the FBI wants you to think they're the same too? If so, don't let them away with it.

Signing a software update with a private key you already have is using crypto as it was intended. We presume private keys can be kept secure with enough effort, or public key encryption doesn't work, https doesn't work, software updates don't work, game over. Any attempts to get private parties to turn over their private keys should be strongly resisted, but requiring them to sign something given a search warrant adds a procedural step that acts as a check on government power (they can verify that the search warrant is valid, minimize scope of the change, and fight it in court if necessary).

Key escrow is a whole different thing, where they require a whole new system to be designed to preserve keys that would normally be destroyed. It's hard to preserve information when the user wants to destroy it (they can block network traffic and destroy the phone), resulting in all sorts of bad effects on system design and new vulnerabilities.

Re: FBI Wants It to Be Impractical to Deploy Strong Encryption Without Key Escrow

#136

Post by tzs »

makecheck wrote: post #21

Remember how New York’s (physical) master keys became easily accessible[1] despite the fact that they were supposedly so carefully managed? All that effort, all that trouble, and now not only is there essentially no security at all but the master keys created a security hole that did not need to exist. The security of encryption is similarly proportional to the security of keys. The fewer things you have to secure, t…

Although not in favor of key escrow systems, I'm not convinced that they cannot be implemented in a secure fashion. There are fundamental differences between physical keys and digital key that make analogies between the two unconvincing to me.

With a physical master key, all it takes is one possessor of a copy of the key to agree in order to get access to what the key is protecting, or compromising one possessor.

With digital data, such as an encryption key, an escrow system could be combined with a secret sharing system so that you need to gain access to multiple shares before you can get the underlying encryption key. With a sufficient number of shares required, distributed among a large enough number of independent escrow agents in different legal jurisdictions, the probability of someone getting your key illegitimately via the escrow system can be made arbitrarily small.

Re: FBI Wants It to Be Impractical to Deploy Strong Encryption Without Key Escrow

#137

Post by Zigurd »

mikekij wrote: post #92
Zigurd wrote: post #58

Keep an eye on the would-be profiteers. Why would VCs like Fred Wilson land on the side of the FBI and parrot their position despite certainly knowing better? Because there are billions of dollars of government investment money being lined up to implement the wishful thinking key escrow and other back-door schemes. Even if back-doored encryption is doomed in the market, co-investors will be rewarded.

As naive as it may be, I had never considered this. I think Fred is a trustworthy enough guy that he may not consciously be thinking about profiteering, but I can't figure out any other reason a tech investor would support back doors.

Shrewd plays or profiteering from idiocy... call it what you like. Look at the people on this forum who know a great deal about security. Some like to portray themselves as thoughtfully open minded - that they are seeking a solution. They make respectful noises about legal traditions. They know it boils down to exhuming the corpse of key escrow and rebranding it. But they are in a position to profit.

Re: FBI Wants It to Be Impractical to Deploy Strong Encryption Without Key Escrow

#138

Post by andrewla »

chillacy wrote: post #129
andrewla wrote: post #125

It's not clear to me where this article gets the idea of what the FBI wants. I haven't seen anything from the FBI or from Comey that indicates that they want to place limits on future cryptographics systems. It even seems like Comey is aware that the particular technique he is asking Apple to use will not apply to future phones made by Apple, and that the reality is that cryptography will soon reach the point where t…

The issue isn't a technical one as much as a legal one. If the FBI can get the government to interpret the All Writs Act the way they want (any private entities must do what the govt says to aid a criminal investigation unless explicitly forbidden by law) to force Apple to write a custom version of iOS for them this time, the fear is that they can use the same law to install backdoors in ongoing versions. Legally the…

> the fear is that they can use the same law to install backdoors in ongoing versions

There is no reasonable interpretation of the All Writs Act (which regards subpeonas) that could be interpreted to force Apple to preemptively make their OS insecure. If they include a backdoor in future versions of the iPhone, or if the FBI discovers a vulnerability, then it is entirely possible that they could use the same precedent to force them to open the backdoor for them, or even give them a metaphorical prybar for the backdoor.

But the point is that Apple is rapidly moving towards (and in their opinion, has already achieved) a hard stop -- they no longer possess the technical capability to break a locked iPhone after the 5s. For a specific case, and a specific subpoena, there is no work that Apple can do to comply with the subpoena.

And, like I said, it seems clear that Comey understands this, and is not asking Apple to weaken security in the future, and I see no indications that he is asking for that.

Re: FBI Wants It to Be Impractical to Deploy Strong Encryption Without Key Escrow

#139

Post by logfromblammo »

merpnderp wrote: post #93
qb45 wrote: post #79

Earlier quoted context omitted.

If only good guys used guns, nobody would need them. It actually is "we know bad guys already have guns, so better if good guys have them too". Same with crypto, btw.

That's not completely true. If bad guys didn't have guns, we'd still want good guys to have them. I don't want police having to take on a guy with knives and a baseball bat, themselves only armed with knives and a baseball bat.

Don't make the mistake of assuming that the police are always the good guys.

You actually can't assume that anyone is always going to be the "good guy", or that anyone else will always be a "bad guy".

And if you could program a smart gun to have a sense of morality, capable of judging between appropriate and inappropriate uses of lethal force, you no longer need a human to carry it around, do you?

If the bad guys can't have guns, good guys can't have them either, because sometimes they are exactly the same people in different circumstances. That's the big hole in good guy vs. bad guy reasoning.

Re: FBI Wants It to Be Impractical to Deploy Strong Encryption Without Key Escrow

#140

Post by duaneb »

sslayer wrote: post #100
duaneb wrote: post #82

Earlier quoted context omitted.

> If we enact rent controls and mandate the construction of below-market rate housing units, it'll help people afford housing. To be fair, this does in fact help many people afford housing. It just doesn't fix the endemic issue.

You support his point. It is a systemic issue, political patches do not work.

I don't really see many people claiming that rent control is going to solve rent for everyone. Seems like a blatant straw-man fallacy.
Post reply on HN