4 ms·
Same problem pretty much with the NY bill. Buy a phone that is unlocked / decrypted at the time of sale. The next step is for the user to login and encrypt. I d
by joshka 11y ago
Same problem pretty much with the NY bill.
Buy a phone that is unlocked / decrypted at the time of sale.
The next step is for the user to login and encrypt. I don't see how this bill actually fixes that.
I guess this hinges on the definition of authorized when it comes to encrypting something I own. I hope I don't require authorization to do this.
A few questions I posed to the NY senator earlier this week:
1. Would you use such a phone knowing that the government / apple / seller of the phone could easily get into it.
2. Would it be legal for someone in the legal profession to use such a phone without being disbarred for negligence of the right to private communication?
3. If sold unlocked, and then later locked (i.e. every phone right now), where's the change?
4. Where's the 4th amendment fit in with this?
5. What should we do with old phones that don't support this? Dump them in the bay I guess?
6. Where are the technical experts that are telling you that this is actually feasible to do securely and safely? I'm looking hard, but only seeing negative responses from those that know what their talking about.
7. Who's responsible for fixing the broken device once the master key gets leaked? The manufacturer? The state of {CA/NY}?
8. the list goes on.
- rietta 11y agoI'm not so sure about that as the language of the bill states: "(d) (1) ...that is not capable of being decrypted and unlocked by its manufacturer or its operating system provider shall not result in liability to the seller or lessor if the inability of the manufacturer and operating system provider to decrypt and unlock the smartphone is the result of actions taken by a person or entity other than the manufacturer, the operating system provider, the seller, or the lessor and those actions were unauthorized by the manufacturer, the operating system provider, the seller, or the lessor." Presumably the "those actions were unauthorized" could be construed as prohibiting a FDE option from being built into the OS and provided by the manufacturer and this in conjunction with signed kernels in phones, would present a very high barrier on the user to be able to obtain device encryption without key escrow as we understand it today.
- cmurf 11y agoThis has been my understanding of what they really want, in particular when using the word "front door". That's key escrow. Not weakening encryption so that they can break it, but they want manufacturer or OS provider to have a copy of the keys used and in particular the law seems worded to burden the company to actually perform the decryption, not merely hand over the keys.
- cmurf 11y agoAddition: While I don't think either funded or unfunded mandate to do this decryption is OK; I think it's untenable for the company to hand over keys to just any government. With those keys, the government can not only decrypt, they can decrypt-modify-encrypt and thus frame dissidents or political enemies.
- rietta 11y agoThe argument has been around for a long time. The first crypto wars had their policy papers and summary pros/cons such as https://www.cs.cornell.edu/html/cs513-sp98/hw.policy.keyEscrow.html https://www.cs.cornell.edu/html/cs513-sp98/hw.policy.keyEscr....
- joshka 11y agoThis is where the bill breaks down logically. A seller of an unlocked/decryptable device can say "you're not authorized to encrypt this" all they like. As a user though, I don't require their authorization to do what I like to a device I own. A gun seller does not 'authorize' someone to use the gun to commit murder. Best buy, AT&T, etc. likewise do not authorize a user to encrypt their device. Nor should they. What I do with my device is none of their concern so long as I pay my bill.
- duskwuff 11y agoNot just the same problems as the New York bill; the wording of the two bills appears to be nearly identical! Here's the CA bill: http://www.leginfo.ca.gov/pub/15-16/bill/asm/ab_1651-1700/ab_1681_bill_20160120_introduced.html http://www.leginfo.ca.gov/pub/15-16/bill/asm/ab_1651-1700/ab... Here's the NY bill: http://legislation.nysenate.gov/pdf/bills/2015/A8093 http://legislation.nysenate.gov/pdf/bills/2015/A8093
- 5ilv3r 11y agoDude the last paragraph is almost word for word. Who wrote these??
- throwaway5752 11y agoCould be anyone. ALEC pushed "model legislation" to "great" effect (see castle doctrine, others) but other groups do it, too. See http://www.azcentral.com/story/news/politics/2014/04/05/lawmakers-pushing-identical-bills-written-national-groups/7339883/ http://www.azcentral.com/story/news/politics/2014/04/05/lawm..., among others.
- kabdib 11y agoNSA? FBI? I'm sure they're pretty happy with them. I'm going to make it clear to Jim that I'm going to give money to his political opponents in his next election.
- 5ilv3r 11y agoNah this will only benefit local cops. Those big guys have network sniffing.
- Bud 11y agoCould easily be explained by these bills originating with ALEC. https://en.wikipedia.org/wiki/American_Legislative_Exchange_Council https://en.wikipedia.org/wiki/American_Legislative_Exchange_...
- edj 11y ago