71–74 of 74 posts
Earlier quoted context omitted.
I don't know what country you think that is true in, but citation needed. In the US at least, criminal convictions must be proven "beyond a reasonable doubt", they can't just say that they think there's information there, it must be proven that they already know it's there.
The hypothetical country the article writer wants to live in. The one where if you can't decrypt purported evidence of a crime you get the maximum sentence by default.
Earlier quoted context omitted.
I mean, didn't the NSA also get caught by Snowden? They intended it to be a secret. But the Juniper hackers are the NOBUS failure because changing the locks on a backdoor that somebody else had installed is easier than getting one installed yourself.
I don't think you're following. "NOBUS" doesn't mean "nobody but us can ever find out about the backdoor"; it means "nobody but us can actually use the backdoor". Ironically, the Juniper PKRNG backdoor --- I assume it was Chinese --- is also a NOBUS backdoor!
Except that it was intended to be "nobody but the us (i.e. the NSA)" and now you've got China using it.
Earlier quoted context omitted.
I don't think you're following. "NOBUS" doesn't mean "nobody but us can ever find out about the backdoor"; it means "nobody but us can actually use the backdoor". Ironically, the Juniper PKRNG backdoor --- I assume it was Chinese --- is also a NOBUS backdoor!
> it means "nobody but us can actually use the backdoor". Ironically, the Juniper PKRNG backdoor --- I assume it was Chinese --- is also a NOBUS backdoor! Except that it was intended to be "nobody but the us (i.e. the NSA)" and now you've got China using it.
NOBUS or not, if your adversary controls your source tree, you're boned. Here, the adversary replaced "our" NOBUS backdoor with theirs. Two different backdoors, different keys, same structure.
This is, far and away, the most authoritarian proposal for the regulation of encryption that I have EVER seen. As far as I know, no nation on Earth has legal provisions so explicitly authoritarian as to require every civilian to maintain copies of all their communication in a form that cops can access after the fact. If I send you a letter and you promptly burn it, that does not entitle the police to imprison either…
> If I send you a letter and you promptly burn it, that does not entitle the police to imprison either of us Aside: The fact that someone (legally) deleted data or (legally) switched to an encrypted channel may still be used against them, when establishing mens rea regarding some other actual crime. That said, I don't want to dissuade anyone from taking steps to be safe.