Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

What It's Like When the FBI Asks You to Backdoor Your Software

securitywatch.pcmag.com

Post reply on HN
Print view View original

31–37 of 37 posts

Re: What It's Like When the FBI Asks You to Backdoor Your Software

#31

Post by ds9 »

Patient0 wrote: post #21
GigabyteCoin wrote: post #13

Sounds more like a marketing sham than a real FBI encounter to me. Really? The FBI agent approached her and started talking to her before she had even removed her mic? And everybody (including the agent) heard? Let me guess, she vehemently denied the offer? (I'll admit I didn't even bother to read past the second paragraph of this "article".) I don't think so...

Yeah it reads like a PR puff piece. I am sure that is what it is. It follows the template described in http://www.paulgraham.com/submarine.html .

I agree. A real FBI agent would have handed her a letter imposing a legal obligation to keep silent about the conversation, and she would be in jail now. In the alternative, it was a social engineering attack, and we're supposed to admire how they didn't fall for it.

More to the point, if it's possible for her company to compromise customers' communications unilaterally, then the service is insecure, regardless of what promises they make or what type of encryption they (claim to) use.

Re: What It's Like When the FBI Asks You to Backdoor Your Software

#33

Post by arca_vorago »

FrankBooth wrote: post #15
lawnchair_larry wrote: post #10

Earlier quoted context omitted.

It doesn't sound like that to anyone who has worked in security. This is their routine MO.

Right, that explains why we hear about this exact scenario playing out all the time... oh wait.

Ok, while you are right that this exact scenario (of an entity approaching a dev in a public place while at a conference and asking them to weaken something) does not happen very often, you need to understand that the person you are replying to is saying that in general, it is well known and well documented that various three letters have been active in weakening implementations in all kinds of projects over the years. Remember the clipper chip, Promis, OpenBSD's IPsec stack, NSA_key, or any of the more recent ones we have heard of, and for every one of those there are probably 10 that adhere to their NSL's or other forms of gag orders.

Your snarky and snide tone makes it seem like you think they never try to get people to implement backdoors or weaken implimentations (for side-channels), and I'm sure that's not what you meant, right?

Re: What It's Like When the FBI Asks You to Backdoor Your Software

#34

Post by [deleted] »

fiatmoney wrote: post #16
diydsp wrote: post #14

Earlier quoted context omitted.

> Her lecture concluded, she proceeded to grill the agent. "I asked if he had official paperwork for me, if this was an official request, who his boss was," said Sell. "He backed down very quickly."

"Backed down" in this context seems to mean "went away politely without answering any questions". Leading with verification and diatribing afterwards leaves you with some documentation, or a strong implication that they're a troll. She just went in the wrong order, which is honestly understandable but leaves us with an unverifiable story.

[deleted]

Re: What It's Like When the FBI Asks You to Backdoor Your Software

#35

Post by mandelbulb »

fiatmoney wrote: post #16
diydsp wrote: post #14

Earlier quoted context omitted.

> Her lecture concluded, she proceeded to grill the agent. "I asked if he had official paperwork for me, if this was an official request, who his boss was," said Sell. "He backed down very quickly."

"Backed down" in this context seems to mean "went away politely without answering any questions". Leading with verification and diatribing afterwards leaves you with some documentation, or a strong implication that they're a troll. She just went in the wrong order, which is honestly understandable but leaves us with an unverifiable story.

>she lectured him on topics ranging from the First and Fourth Amendments to the Constitution, to George Washington's creation of a Post Office in the US. "My ancestor was a drummer boy under Washington," Sell explained. "Washington thought it was very important to have freedom of information and private correspondence without government surveillance."

Don't forget that lecturing the FBI comes after verification and documentation as well. If that was an FBI agent he probably concluded she was not a desired partner.

Re: What It's Like When the FBI Asks You to Backdoor Your Software

#36

Post by DannyBee »

dalke wrote: post #24
DannyBee wrote: post #22

Earlier quoted context omitted.

Note that the "something of value" does not have to be tangible. Information has been held sufficient. See United States v. Sheker, 618 F.2d 607, where all that was done was ask about someone's location. If this was done to ascertain information about the company, and their willingness to participate in government surveillance, it is likely to be held "a thing of value" under such precedent (which explicitly holds th…

Thank you for pointing that out. "I am not a lawyer" and all that, but I do enjoy, oddly enough, reading judicial decisions. That one says: > We do not embrace the government's sweeping position that 18 U.S.C. 912 extends to anything that has value to the defendant. Such a broad reading of "value" negates any limitation the word could imply. By the same token, we cannot accept Sheker's suggestion that 18 U.S.C. 912 c…

The line is essentially going to be drawn pragmatically in most cases, because the precedent is so vague. Judges generally don't take kindly to people impersonating agents, so i would expect a bit of stretch to find an issue.

For example, if you look, the judge says "We do not embrace the government's sweeping position", but then in practice, did exactly this. They went to great pains to find some way to ascribe "value" to the location of another human being.

Re: What It's Like When the FBI Asks You to Backdoor Your Software

#37

Post by dalke »

DannyBee wrote: post #36
dalke wrote: post #24

Earlier quoted context omitted.

Thank you for pointing that out. "I am not a lawyer" and all that, but I do enjoy, oddly enough, reading judicial decisions. That one says: > We do not embrace the government's sweeping position that 18 U.S.C. 912 extends to anything that has value to the defendant. Such a broad reading of "value" negates any limitation the word could imply. By the same token, we cannot accept Sheker's suggestion that 18 U.S.C. 912 c…

The line is essentially going to be drawn pragmatically in most cases, because the precedent is so vague. Judges generally don't take kindly to people impersonating agents, so i would expect a bit of stretch to find an issue. For example, if you look, the judge says "We do not embrace the government's sweeping position", but then in practice, did exactly this. They went to great pains to find some way to ascribe "val…

Yes, which is why I can't figure out how to interpret that case. It seems the judge says you can't ask any questions, since any information has some value.

A police officer can ask questions of anyone, including "can I search this bag?" The legal theory is that an officer is also a citizen, and any citizen can ask that question, even of strangers.

Apparently the uniform and knowledge that it's a police officer isn't supposed to make people feel any extra obligation towards the officer, compared to a stranger.

But there has to be a limit to that, yes? Can the officer for money? Strangers do that.

Anyway, were I to judge this matter, I would say that if a person would reasonably give the same answer to a stranger as to an imposter, then there's nothing of value.

Yeah, and I'm sure as Sunday that most judges won't agree with me.

Post reply on HN