11–20 of 113 posts
The article asks: > How is the public interest served by a policy that only thwarts lawful search warrants? Perhaps the answer is that judges act as rubber stamps now, authorizing way too many search warrants. The author assumes that the judges are fairly applying the 4th amendment.
This article is very disturbing.
There are certainly other reasons to appreciate secure encryption though. But "not even a disgruntled apple employee, or one paid by your business competitor" brings up questions that are not good marketting to put in people's heads. Even "not even a hacker, cause we used actual secure crypto" is not what they want people to think about.
Now, personally, I include "not even law enforcement" in my list of attackers I'd like to defend from, and there's nothing wrong with that (and there's not supposed to be in America, the 4th ammendment and all). But the fact that it's actually good marketting generally (or at least they're betting on it) -- well, we have Snowden to thank for that. And I doubt it will last.
Also, of course, there are a variety of reasons the iphone crypto as a system isn't all that secure -- including but not limiting to the fact that we still have trust apple (we can't see the code, or the code in the updates pushed out regularly).
Not that I disagree that it's a benefit to make it harder for law enforcement
"The first question is whether the government can lawfully compel the telephone’s owner to divulge the passcode. I believe the answer is that yes, a person can in fact face punishment for refusal to enter in the password to decrypt his own phone. If the government obtains a subpoena ordering the person to enter in the passcode, and the person refuses or falsely claims not to know the passcode, a person can be held in…
I agree with what Apple is doing and I want them to do more. There are still some remaining holes that need to be closed up and all users should be encouraged to enable 2FA with the mandated switch in a few years.
What Apple does have is the directory of recipient public keys that your device should use to encrypt its messages. (Background: iMessage encrypts each message separately for every recipient device, which shows just how far Apple went to protect key security. Not only does Apple not have the keys, private keys never have to be exchanged among devices ever.)
But technically speaking -- I have no idea if they actually do this -- that gives them a way to insert a "wiretap" of sorts in the form of an additional, silent recipient that you don't know about. Think of it as adding another device to your iCloud account, only it's not yours. Still, this could at least be discovered by monitoring the size of the outgoing data to see if it matches the expected number of recipients.