4 ms·

"It turns out that somehow, Comey believes that the question of whether to ban encryption without backdoors is “not a technical issue.” He told the senators tha

by api 11y ago

"It turns out that somehow, Comey believes that the question of whether to ban encryption without backdoors is “not a technical issue.” He told the senators that “plenty of companies” provide services online while still maintaining the ability to read their users' data, and that “plenty” of smartphone manufacturers can unlock encrypted phones. Thus, he concluded, “it’s a business model question.”" If you read between the lines a bit, it's clear that what they want is encryption to/from cloud hubs where data is stored using escrowed keys (a.k.a. server-side "encryption"). Many services already more or less do this, so the goal would be to push the entire market in this direction and then eventually to outlaw or otherwise restrict systems that do not work in this way. This fits in with the dumb terminal / mainframe model of the Internet being pushed to varying degrees by most of the tech giants these days and with Amazon's vision for IoT. It's stupid and naive to claim that there is some technical barrier to what the FBI wants. It's actually quite easy if we apply a bit of government pressure to push the Internet even further toward the "put everything in the cloud" direction it's already going. Anything in the cloud is almost by definition backdoored.

lmitchell 11y ago
The article does label key escrow as 'technical means that badly compromise their users’ security'. Now I'll be the first to admit that I'm not an expert, but saying 'well, you can use key escrow' ignores the fact that the authors label key escrow as one of the ways not to do it.
Zigurd 11y ago
> Many services already more or less do this... Those services can't be trusted now where part of the threat model is corrupt, hostile, and/or authoritarian state actors. Unless you think America is the only place you'll conduct business that needs secure communication, that's not a viable "solution."
- mindslight 11y ago
  Honestly the EFF should pivot their marketing directly to this, rather than staying abstract and getting lost in the noise - "FBI Director James Comey wants to help authoritarian regimes spy on Americans simply to make his agency's job easier"
- lazaroclapp 11y ago
  "Unless you think America is the only place you'll conduct business that needs secure communication", and you trust the US government in the general, and you trust each individual government agent or employee with that kind of access not be corrupt, and you trust each such agent or employee to be super-competent as to not be hacked by an hostile third party, and you trust the cloud company in the general, and you trust each employee of that company with access to not be corrupt and to be super-competent... and so on and so forth. The fact that we currently mostly use systems where we need to trust a large number of people with our data only to communicate with one another doesn't mean that those systems are the right ones to build, even at a relatively apolitical technical level. The early internet, before HTTPS was common, added a large number of interconnected ISPs to that list of 'fully trusted by design' parties. That was, as we have recognized for decades, a design bug. One which we are only now starting to fix adequately. Trusting the cloud providers with full access to all data stored or even processed by them is a similar design mistake. (Not saying that there isn't ever a use case to send data to a company so that they offer a service by processing it, but simply storing and transmitting private messages between two users shouldn't count as giving that data to the cloud provider anymore than it counts as giving that data to the ISP)
mindslight 11y ago
> Anything in the butt is almost by definition backdoored Pretty much. The TLAs are whining because they got used to wholesale vacuuming of butt data, and now the pendulum is poised to swing the other way. IMHO Apple is merely poking a hornet's nest, because it will be quite easy for USG to force them to modify their centrally-distributed software. The only truly defensible position we have is Free software. Whether there's enough interest/money to support its wide scale adoption is one of the major questions of our time.
- hueving 11y ago
  Greatest instance of the 'cloud-to-butt' translator I've seen.
- yuhong 11y ago
  Not so easy when there is no law requiring them to do so. In iMessage, Apple still has the keys but the forward secrecy is enough to exclude it from CALEA because of the way the "encryption" exception was designed. This of course caused FBI to complain, which among other example of encryption made encryption backdoors a political issue again in the first place.
  - mindslight 11y ago
    It's USG. Creating new authoritarian laws, especially indirectly applied through companies, is basically what it does.
    - yuhong 11y ago
      Which reminds me that CALEA, DMCA and the like was passed in the 1990s, when not as many people was using the Internet as today. SOPA/PIPA was passed in a time when everyone for example is using Google, which is why the protests was so effective. In this case, such a law requiring backdoors would be likely unconstitutional (it was tried in the 1990s too), which is why FBI is resorting to other methods.
      - 11y ago
Ar-Curunir 11y ago
Outsourcing your computation to the cloud doesn't have to be insecure, if you trust the code you're running (perhaps it's your own code). Cryptographers call this delegated computation, and while modern techniques are still VERY slow, there has been a lot of progress in the past few years, and I think the landscape of these techniques will look much better. Of course, we still have to contend with the case where the software you use is NOT owned or trusted completely by you. That's a different problem that IMO can only be solved by open source software.
topspin 11y ago
"Comey believes..." Comey is the emptiest suit I've ever seen testify before Congress. Comey is told by his handlers what he should claim to believe and otherwise he carefully avoids believing anything. At one point today he really showed his ass. After tacitly agreeing with Leahy about "an Internet sale" of a gun which implied anyone could order a gun online without a background check, Graham asked Comey if such a purchase would be "delivered to my home." When asked this question, the Director of the FBI, an organization that, along with the ATF, orchestrated the Fast and Furious gun-walking scheme and therefore should have absolutely zero confusion about the exclusive role of FFL holders in the transfer of firearms in the United States and the harsh federal penalties for anyone that fails to obey the relevant laws, answered in public, complete with a genuinely quizzical look; "... I assumed it's shipped to you, but I don't know for sure actually ..." Full stop. Not one shred of a clue. Un. Freaking. Believable. There is nothing there. Comey is literally propping up a suit for the cameras.

by api 11y ago

lmitchell 11y ago

The article does label key escrow as 'technical means that badly compromise their users’ security'. Now I'll be the first to admit that I'm not an expert, but saying 'well, you can use key escrow' ignores the fact that the authors label key escrow as one of the ways not to do it.

Zigurd 11y ago

> Many services already more or less do this... Those services can't be trusted now where part of the threat model is corrupt, hostile, and/or authoritarian state actors. Unless you think America is the only place you'll conduct business that needs secure communication, that's not a viable "solution."

mindslight 11y ago
Honestly the EFF should pivot their marketing directly to this, rather than staying abstract and getting lost in the noise - "FBI Director James Comey wants to help authoritarian regimes spy on Americans simply to make his agency's job easier"
lazaroclapp 11y ago
"Unless you think America is the only place you'll conduct business that needs secure communication", and you trust the US government in the general, and you trust each individual government agent or employee with that kind of access not be corrupt, and you trust each such agent or employee to be super-competent as to not be hacked by an hostile third party, and you trust the cloud company in the general, and you trust each employee of that company with access to not be corrupt and to be super-competent... and so on and so forth. The fact that we currently mostly use systems where we need to trust a large number of people with our data only to communicate with one another doesn't mean that those systems are the right ones to build, even at a relatively apolitical technical level. The early internet, before HTTPS was common, added a large number of interconnected ISPs to that list of 'fully trusted by design' parties. That was, as we have recognized for decades, a design bug. One which we are only now starting to fix adequately. Trusting the cloud providers with full access to all data stored or even processed by them is a similar design mistake. (Not saying that there isn't ever a use case to send data to a company so that they offer a service by processing it, but simply storing and transmitting private messages between two users shouldn't count as giving that data to the cloud provider anymore than it counts as giving that data to the ISP)

mindslight 11y ago

> Anything in the butt is almost by definition backdoored Pretty much. The TLAs are whining because they got used to wholesale vacuuming of butt data, and now the pendulum is poised to swing the other way. IMHO Apple is merely poking a hornet's nest, because it will be quite easy for USG to force them to modify their centrally-distributed software. The only truly defensible position we have is Free software. Whether there's enough interest/money to support its wide scale adoption is one of the major questions of our time.

hueving 11y ago
Greatest instance of the 'cloud-to-butt' translator I've seen.
yuhong 11y ago
Not so easy when there is no law requiring them to do so. In iMessage, Apple still has the keys but the forward secrecy is enough to exclude it from CALEA because of the way the "encryption" exception was designed. This of course caused FBI to complain, which among other example of encryption made encryption backdoors a political issue again in the first place.
- mindslight 11y ago
  It's USG. Creating new authoritarian laws, especially indirectly applied through companies, is basically what it does.
  - yuhong 11y ago
    Which reminds me that CALEA, DMCA and the like was passed in the 1990s, when not as many people was using the Internet as today. SOPA/PIPA was passed in a time when everyone for example is using Google, which is why the protests was so effective. In this case, such a law requiring backdoors would be likely unconstitutional (it was tried in the 1990s too), which is why FBI is resorting to other methods.
    - 11y ago

Ar-Curunir 11y ago

Outsourcing your computation to the cloud doesn't have to be insecure, if you trust the code you're running (perhaps it's your own code). Cryptographers call this delegated computation, and while modern techniques are still VERY slow, there has been a lot of progress in the past few years, and I think the landscape of these techniques will look much better. Of course, we still have to contend with the case where the software you use is NOT owned or trusted completely by you. That's a different problem that IMO can only be solved by open source software.

topspin 11y ago

"Comey believes..." Comey is the emptiest suit I've ever seen testify before Congress. Comey is told by his handlers what he should claim to believe and otherwise he carefully avoids believing anything. At one point today he really showed his ass. After tacitly agreeing with Leahy about "an Internet sale" of a gun which implied anyone could order a gun online without a background check, Graham asked Comey if such a purchase would be "delivered to my home." When asked this question, the Director of the FBI, an organization that, along with the ATF, orchestrated the Fast and Furious gun-walking scheme and therefore should have absolutely zero confusion about the exclusive role of FFL holders in the transfer of firearms in the United States and the harsh federal penalties for anyone that fails to obey the relevant laws, answered in public, complete with a genuinely quizzical look; "... I assumed it's shipped to you, but I don't know for sure actually ..." Full stop. Not one shred of a clue. Un. Freaking. Believable. There is nothing there. Comey is literally propping up a suit for the cameras.