A Few Thoughts on Ray Ozzie’s “Clear” Proposal

#1

Post by Hagelin » Sat, Apr 28, 2018, 7:35 AM UTC

A Few Thoughts on Ray Ozzie’s “Clear” Proposal
blog.cryptographyengineering.com

Re: A Few Thoughts on Ray Ozzie’s “Clear” Proposal

#2

Post by throwaway84742 » Sat, Apr 28, 2018, 8:32 AM UTC

But why? Why give the government such a ripe target for abuse? Why tilt the balance of power even further in its favor?

Re: A Few Thoughts on Ray Ozzie’s “Clear” Proposal

#3

Post by shakna » Sat, Apr 28, 2018, 8:53 AM UTC

> It literally refers to a giant, ultra-secure vault that will have to be maintained individually by different phone manufacturers

We can't even trust manufacturers to provide updates in most cases. Placing that much trust in them is nothing short of lunacy.

Re: A Few Thoughts on Ray Ozzie’s “Clear” Proposal

#4

Post by SolarNet » Sat, Apr 28, 2018, 8:58 AM UTC

throwaway84742 wrote: post #2

But why? Why give the government such a ripe target for abuse? Why tilt the balance of power even further in its favor?

Also a good question, but this post focused only on why it's a stupid idea technically on purpose.

Re: A Few Thoughts on Ray Ozzie’s “Clear” Proposal

#5

Post by IAmEveryone » Sat, Apr 28, 2018, 9:47 AM UTC

CAs seem to be able to keep their private keys safe. Why should phone companies be less competent? They certainly have far more money to devote to it.

In any case, Ozzie’s proposal shows that the technological argument has always been more of an attempt to circumvent the political discussion.

The tech community loves the idea of subverting the law with technology when it doesn’t suit them. The Federal,Reserve is just a private bank run by Jews to enslave America? Bitcoin! I wanna trade drugs and child porn? Tor! (And bitcoin).

That dynamic is undemocratic. Whatever you may think about the US government, it is still far more legitimate to make these decisions than some guy in a basement and the CXOs of Google and Facebook. Moving the center of power from the public sphere to mighty techno-wizards may seem appealing as long as you can culturally identify with them. But if it comes to pass, it will be Comcast and Lockheed Martin that control the networks, not you and me.

Re: A Few Thoughts on Ray Ozzie’s “Clear” Proposal

#6

Post by [deleted] » Sat, Apr 28, 2018, 9:48 AM UTC

[deleted]

Re: A Few Thoughts on Ray Ozzie’s “Clear” Proposal

#7

Post by throwaway84742 » Sat, Apr 28, 2018, 9:49 AM UTC

SolarNet wrote: post #4

throwaway84742 wrote: post #2

But why? Why give the government such a ripe target for abuse? Why tilt the balance of power even further in its favor?

Also a good question, but this post focused only on why it's a stupid idea technically on purpose.

Point taken. He briefly talks about “policy” in the beginning. Policy is the instrument through which the ruling class gradually strips away individual freedoms. We need to prominently feature freedom in these conversations, because ultimately that’s what at stake here.

Re: A Few Thoughts on Ray Ozzie’s “Clear” Proposal

#8

Post by mtgx » Sat, Apr 28, 2018, 9:51 AM UTC

IAmEveryone wrote: post #5

CAs seem to be able to keep their private keys safe. Why should phone companies be less competent? They certainly have far more money to devote to it. In any case, Ozzie’s proposal shows that the technological argument has always been more of an attempt to circumvent the political discussion. The tech community loves the idea of subverting the law with technology when it doesn’t suit them. The Federal,Reserve is just…

Robert Graham had a rebuttal, too, and he mentions how Let's Encrypt for instance is quite vulnerable to sophisticated attackers employing DNS spoofing attacks against it:

https://blog.erratasec.com/2018/04/no-ray-ozzie-hasnt-solved...

Also, I think most would agree that CAs are quite terrible at security. It's part of the reason why everyone thinks the CA system sucks and is not trustworthy and it's also why Google has been pushing for Certificate Transparency to be able to verify if the CAs (or people hacking the CAs) are misbehaving. But it's still a patch on a broken system.

And look what's been happening with Symantec, too, the largest CA. They were terrible at managing the infrastructure in a secure manner. There are thousands of different CAs. Most are probably insecure or hacked, we just haven't learned about it yet.

Also, if you read Green's post, he mentions how this wouldn't be like the CA/software signing system at all. In those systems, you can revoke the certificate. If someone gets the master key for 500 million iPhones, those phones will either need to be bricked or they will remain vulnerable forever.

If the NSA/FBI would learn that the system was compromised, they'd never tell us about it either, because they'd know people would then be pushing for the removal of the system, and they wouldn't want that after fighting for so long for something like it.

I think Ozzie is being very irresponsible pushing for this. And the reason he is being this irresponsible is because he has a patent on it (Green links to it in the post), so he'd get royalty for billions and billions of phones for the next 20 years if implemented. That's really his main goal here. Ozzie wants all the credit and money for it, but I bet he's not going to take any liability for when the system is inevitably broken.

Re: A Few Thoughts on Ray Ozzie’s “Clear” Proposal

#9

Post by amelius » Sat, Apr 28, 2018, 9:55 AM UTC

throwaway84742 wrote: post #2

But why? Why give the government such a ripe target for abuse? Why tilt the balance of power even further in its favor?

Because now there is a patent, the government can start forcing companies to implement it. And the patent owner will profit. Quite smart, actually.

Re: A Few Thoughts on Ray Ozzie’s “Clear” Proposal

#10

Post by FascinatedBox » Sat, Apr 28, 2018, 9:59 AM UTC

> Also, when a phone is unlocked with Clear, a special chip inside the phone blows itself up.

no thanks