[deleted]
Encryption, Privacy Are Larger Issues Than Fighting Terrorism
51–60 of 183 posts
Re: Encryption, Privacy Are Larger Issues Than Fighting Terrorism
#52> No, David. If I were in the job now, I would have simply told the FBI to call Fort Meade, the headquarters of the National Security Agency, and NSA would have solved this problem for them. They're not as interested in solving the problem as they are in getting a legal precedent. That's quite the quote, especially given his history of employment. The weirdest thing about this whole cell-phone saga to me is that the…
> the perps are dead, did not appear to be part of some organized group A reasonable reason for inquiry here is to actually try to make sure if they were part of some organized group. "Appear not to be" is not quite enough. This is a valid reason to investigate even if they are dead. How did they get radicalized, etc. Not that it is a good enough reason to enforce breaking of encryption in the way proposed, but in a…
A reasonable reason for inquiry here is to actually try to make sure if they were part of some organized group. "Appear not to be" is not quite enough.
For a country that kills based on metadata[1], it seems quite far-fetched that they couldn't map out potentially interesting connections using just metadata.
Also, it would be pretty dumb to put any revealing data on a work phone with iCloud backups enabled (which is just not accessible due to the FBI's mistakes).
At any rate, this discussion is quite besides the point. Permitting this phone to be unlocked (or the hundred or so other phones mentioned) will open the floodgates for questionable regimes and a hunt for Apple's private key (more automation to handle requests will reduce security).
[1] http://www.nybooks.com/daily/2014/05/10/we-kill-people-based...
Re: Encryption, Privacy Are Larger Issues Than Fighting Terrorism
#53Earlier quoted context omitted.
> The next logical step is to outlaw phones and devices that are incapable of breaking into. Then they'll make it so you need a license to employ cryptography. Welcome to the 90s: https://en.wikipedia.org/wiki/Export_of_cryptography_from_th... [0] > It sounds crazy, but where we are right now would have sounded just as crazy 15 years ago. Hardly. 15 years ago, the US were just barely past their encryption export ban,…
I read the "we're back to the 90s again" articles. I think I would be careful not to overstate the case. I coded in the 90s. I did light crypto in the 90s. This isn't the 90s. The world was so different then that the analogy wears thin. It was mostly client-server, the web was just taking off, and vast cloud server farms weren't even on the horizon. As you noted, the laws back then weren't for creating crypto -- it w…
The only thing I think that directly ties back to the Zimmermann case would be the public nature of this fight.
..but since we're referencing the 90's: If the feds succeed in gaining the IOS source and signing keys I would say it's more like Phiple Troenix 2.0.
Re: Encryption, Privacy Are Larger Issues Than Fighting Terrorism
#54Earlier quoted context omitted.
> The next logical step is to outlaw phones and devices that are incapable of breaking into. Then they'll make it so you need a license to employ cryptography. Welcome to the 90s: https://en.wikipedia.org/wiki/Export_of_cryptography_from_th... [0] > It sounds crazy, but where we are right now would have sounded just as crazy 15 years ago. Hardly. 15 years ago, the US were just barely past their encryption export ban,…
I read the "we're back to the 90s again" articles. I think I would be careful not to overstate the case. I coded in the 90s. I did light crypto in the 90s. This isn't the 90s. The world was so different then that the analogy wears thin. It was mostly client-server, the web was just taking off, and vast cloud server farms weren't even on the horizon. As you noted, the laws back then weren't for creating crypto -- it w…
> Note that I'm talking from the viewpoint of the average developer making applications. The business side, the international side, and the exporting mess? Yes, it's very similar. My comment was about changes Joe Dev is seeing now. The 90s was "write it, but only sell it locally", the 2020s are likely to be "don't write it unless you have permission", which is a completely different can of worms.
I'm not from the US, so there may be a difference if you're a solely a domestic US developer, but from outside the US the distinction is pretty much entirely academic.
Re: Encryption, Privacy Are Larger Issues Than Fighting Terrorism
#55The Apple situation annoys me because it's no longer about the web. It's about breaking crypto on a device which is vendor-locked. The same thing as breaking homegrown crypto, or DVD crypto; easy and trivial. The fact that Apple doesn't use ephemeral keys and can't simply throw away the key in the event of an incident is worrisome enough.
Real crypto needs to be more compartmented than that. A bank is not secure because of the massive door - it's safe because it would take a thief weeks to empty every safety deposit box.
It's also made even safer when the key is (more or less) thrown away for periods of time and nobody can get it. Even with manual over-ride. Literally somebody could be dying inside the safe and nobody could save them.
In properly implemented crypto nobody should hear you scream.
Re: Encryption, Privacy Are Larger Issues Than Fighting Terrorism
#56> No, David. If I were in the job now, I would have simply told the FBI to call Fort Meade, the headquarters of the National Security Agency, and NSA would have solved this problem for them. They're not as interested in solving the problem as they are in getting a legal precedent. That's quite the quote, especially given his history of employment. The weirdest thing about this whole cell-phone saga to me is that the…
No the weirdest thing is that Apple is standing up to the government. Isn't that just wrong? You, the people choose the government, so in effect Apple is standing up to the people of America and saying 'no'. If you the people didn't want the FBI to be bullish then choose a different government. It feels to me (an outsider) that it's the government that is out of control and is not accountable to the people.
No. That's what a republic is: the government is not above law, and it is possible to push back against it.
Let me quote this piece of an anarchist pamphlet: "Governments are instituted among Men, deriving their just powers from the consent of the governed" - this means, amongst other things, that the governed do have the option to say "this is not okay anymore, stop."
What you seem to be saying is "you have a right to choose, once, and then just shut up and deal with it, the govt can do anything it wishes in the meantime." You're describing a dictatorship - "the State is always Right, by definition".
Re: Encryption, Privacy Are Larger Issues Than Fighting Terrorism
#57Earlier quoted context omitted.
> the perps are dead, did not appear to be part of some organized group A reasonable reason for inquiry here is to actually try to make sure if they were part of some organized group. "Appear not to be" is not quite enough. This is a valid reason to investigate even if they are dead. How did they get radicalized, etc. Not that it is a good enough reason to enforce breaking of encryption in the way proposed, but in a…
If this was really about the privacy of the perps; an NSL would've been enough and we'd never know about it. This is about setting precedent, and as publicly as possible. If the feds get their way the entire idea of encryption is weakened, and not just for the lawful citizens. I suspect the reason for having this battle so publicly is propaganda based, just as it was with Zimmermann in the 90's.
Since you brought up NSL....
The legality of the NSL (which does not require oversight- the FBI can self-sign them) hinges on the idea that the persons on whom the information is being gathered have/had "no reasonable expectation" of privacy of the information.
That said, if these back doors were to be instituted, could the argument then be made that we now have "no reasonable expectation" of privacy of anything on our cell phones? Could this set a precedent of unholy proportions?
Re: Encryption, Privacy Are Larger Issues Than Fighting Terrorism
#58Other governments are definitely going to force manufacturers to make their phones unlockable or not for sale in their country. China, Russia, Saudia Arabia, all forced Blackberry to turn over their encryption keys long ago. US politicians should set an example and say we are NOT going to be like China and Russia and other repressive regimes and that when people's lives are literally on their phones, they have a reas…
Well the winds have changed on that stance, at least in Europe. I've seen a couple of leading politicians say something in the line of: "If china can do it so can we" concerning the Chinese firewall and blocking "unwanted" content on the web, which is scary.
And the result has been, so far..."no we won't." Politicians tend to say stupid shit - for some of them, that's practically the job description.
Re: Encryption, Privacy Are Larger Issues Than Fighting Terrorism
#59Earlier quoted context omitted.
Apple is in many countries, with governments who'd all like this kind of access. If you give FBI the tools, you also have to accept Russia, China and the whole gang having access to your phone.
Well that is up to Apple, they don't have to make one phone. They could make a US version and a rest of the world version.
And then build that fence all along the border so that no world-version phones get in (see how well it worked for other illegal imports). Plus, you haven't solved the problem at all: you just say "okay, let's make only US phones vulnerable to foreign hacking." Should I enumerate why that's a bad thing?
Re: Encryption, Privacy Are Larger Issues Than Fighting Terrorism
#60Earlier quoted context omitted.
Its fine though, because if you make something illegal then criminals won't use it.
The thing is: if encryption is illegal and you encrypt your illegal material so law enforcement can't convict you for it, they can still convict you for using encryption.
Which is such a great idea, because proper encryption is undistinguishable from random data: so, if you have a drive, any drive, good luck convincing anyone that it does not contain any encrypted content, and that whatever is in the empty sectors is just garbage. Guilty until proven innocent.