11 ms·
Sundar Pichai Responds to Apple and the FBI Hacking Request
- cryptoz 11y agoThere is full 'tweetstorm' that follows (this is 1/5), but I don't know how to link to that. Is it possible to link to a series of tweets? 2: https://twitter.com/sundarpichai/status/700104342720761856 https://twitter.com/sundarpichai/status/700104342720761856 3: https://twitter.com/sundarpichai/status/700104383762026496 https://twitter.com/sundarpichai/status/700104383762026496 4: https://twitter.com/sundarpichai/status/700104433183502336 https://twitter.com/sundarpichai/status/700104433183502336 5: https://twitter.com/sundarpichai/status/700104478360342528 https://twitter.com/sundarpichai/status/700104478360342528 Or we can read an article by The Verge: http://www.theverge.com/2016/2/17/11040266/google-ceo-sundar-pichai-sides-with-apple-encryption http://www.theverge.com/2016/2/17/11040266/google-ceo-sundar... Another Edit, OT: Twitter is really, really, really hard to use. Stop worrying about onboarding new users, please make twitter usable for existing users.
- justinv 11y agoNot quite as hard hitting as I would've hoped. Gruber's take: http://daringfireball.net/linked/2016/02/17/pichai-apple-fbi http://daringfireball.net/linked/2016/02/17/pichai-apple-fbi
- draw_down 11y agoI'm not sure I understand the distinction he's making. G will comply with "valid legal orders"; what is not "valid" about the order Apple got? Why is granting law enforcement different from hacking devices, the point of which is to gain access to data?
- sandworm101 11y agoThe order has been issued properly, so it is valid, but Apple et al will claim that it violates their constitutional rights. So the order can be issued but not enforced. That;s the "illegal" aspect.
- joycey 11y agoI believe the difference is that Apple/Google are okay with turning over user data on a case-by-case basis provided there's a proper subpoena from a judge, but not okay with building a tool for the FBI that will allow them to look at any user's data. The former is equivalent to allowing the government to open your mail and wander around your house provided that they've obtained a search warrant. The latter is equivalent to building a tool that would allow the government to open anyone's mail and wander around anyone's house without a search warrant.
- prutschman 11y agoThe FBI claims they're willing to accept a device-locked hack, that it's fine if it is only RAM-resident, and that Apple may keep the device on their own premises so long as FBI can attempt multiple pin entries electronically without risking a wipe. http://www.zdnet.com/article/this-is-how-the-fbi-wants-apple-to-backdoor-the-iphone/ http://www.zdnet.com/article/this-is-how-the-fbi-wants-apple...
- icebraining 11y agoI don't think Apple has been asked to build a tool, just to help unlock a single device. I think Pichai is making a distinction between handing over data they already own (eg. a Gmail account) and data stored on user-controlled devices, which must be hacked to access. Which is interesting, since he's essentially admitting that their push to send everything to "the cloud" makes their users less safe from governmental snooping (justified or not). Of course, we already knew that, but it's curious to see Google's own CEO say it.
- yuhong 11y agoI really wish the restrictions can be reduced or removed so @pmarca etc can tweet more on the companies of which they are the directors of. Same for the CEOs itself, and CEOs and other executives should be allowed to tweet at board of directors and vice versa.
- tobylane 11y agoGoogle owns blogpost. Google has several blogs there. Surely it'd be a vote of confidence for him to use it?
- melted 11y agoTranslation into English: our algorithms like your data very much, and we can't do anything with it if we can't read it. Shove your privacy needs where sun doesn't shine. We'll continue to give your data to the NSA without any judicial review.
- Oletros 11y agoTranslation: I'm trying hard but I don't have the level to even start a flamebait
- tbrock 11y agoTwitter doesn't seem like an appropriate medium for a response to this issue from a CEO of a major tech company. Hello! This isn't a picture of the burger you had for lunch or a pithy remark fest, it's the most important thing affecting your users today. Take some time and write a god damn letter with your company's stance.
- CaptSpify 11y agoEspecially when it has to be broken into 5 posts
- skybrian 11y agoWeird that it wasn't on Google+.
- rms_returns 11y agoTwitter is for corporates to make announcements. Facebook is for people to socialize and get in touch. Linkedin is for professionals to collaborate. Google Plus is just a general purpose communication platform. HN and Reddit are for hackers and power users to discuss things. Personally, I think Reddit/HN when combined with imgur.com serves all purposes in the world, there is no need for the other bloated stuff. But unfortunately, non-techies are going to be non-techies, they will never understand what is minimalism and elegance, may God help them see the light of truth, amen.
- eunice 11y agoI don't think it's some kind of technical barrier that prevents 'non-techies' from using reddit & imgur, it's the incredibly toxic culture
- gypsy_boots 11y agoMost non-Reddit users I know say they've tried looking at it, but just could not figure out the layout. Anecdotally, it took me a while to understand the layout/navigation. Now that's not to say that once people do figure out how to navigate, they're turned off by the culture. However, I do think the UI has something to do with more people not joining.
- citizensixteen 11y agoThis is the most concise summary I have found on the legal issues/possible ramifications concerning this case. The worry in this case is the troubling precedent it would set. https://lawfareblog.com/not-slippery-slope-jump-cliff https://lawfareblog.com/not-slippery-slope-jump-cliff Quotation from, Not a Slippery Slope, but a Jump off the Cliff By Nicholas Weaver. The request to Apple is accurately paraphrased as "Create malcode designed to subvert security protections, with additional forensic protections, customized for a particular target's phone, cryptographically sign that malcode so the target's phone accepts it as legitimate, and run that customized version through the update mechanism". (I speak of malcode in the technical sense of "code designed to subvert a security protection or compromise the device", not in intent.) The same logic behind what the FBI seeks could just as easily apply to a mandate forcing Microsoft, Google, Apple, and others to push malicious code to a device through automatic updates when the device isn't yet in law enforcement's hand. So the precedent the FBI seeks doesn't represent just "create and install malcode for this device in Law Enforcement possession" but rather "create and install malcode for this device". Let us assume that the FBI wins in court and gains this precedent. This does indeed solve the "going dark" problem as now the FBI can go to Apple, Cisco, Microsoft, or Google with a warrant and say "push out an update to this target". Once the target's device starts running the FBI's update then encryption no longer matters, even the much stronger security present in the latest Apple devices. So as long as the FBI identifies the target's devices before arrest there is no problem with any encryption. But at what cost?
- bitJericho 11y agoStallman sounds less and less crazy every year.
- nickik 11y agoNobody ever said the danger that he was talking about are not real. However his is still a very edge position.
- fnordfnordfnord 11y ago
- lemming 11y agoThis is a pretty lame response. Could be a troubling precedent? Really? Tweeting it also seems to massively trivialise it.
- tomp 11y ago> We know that law enforcement and intelligence agencies face significant challenges in protecting the public against crime and terrorism. Do we? Crime rate has been falling. Terrorism is a statistical bleep. The majority of "crime" is government's own invention (non-violent drug-related offenses, prostitution, civil forfeiture, arresting people because they don't pay their student loans [1] [edit: not actually true, as tzs pointed out below], cop murders). Personally, I believe that even without any ability to access any digital communication/stored data, law enforcement wouldn't be in a worse position compared to 30 years ago. [1] http://finance.yahoo.com/news/paul-aker-us-marshal-student-loan-debt-arrest-212047386.html http://finance.yahoo.com/news/paul-aker-us-marshal-student-l...
- tzs 11y agoYour list of government-invented crime includes not paying student loans [1], but the article you cite for that is an article about how someone's arrest was not for not paying student loans and how many other articles misreported it as being for not paying student loans (it was for failure to appear in court). [1] Well, actually, what you said was that arresting people because they don't pay their student loans is a crime, not that not paying student loans is a crime, but I'm assuming that was just an error of phrasing.
- tomp 11y agoYeah, I was wrong, he was arrested for not appearing in court (although it's not clear that he actually received the summons to appear in court). This was blatant spreading of FUD on my part. Props to you for actually reading the sources others post, and I am ashamed of myself and will try be more like you and read articles fully, not only skim them, in the future.
- rayiner 11y agoThe majority of crime is not government invented. The majority of prisoners in prison are not there for any of the crimes you list: http://felonvoting.procon.org/view.resource.php?resourceID=004339 http://felonvoting.procon.org/view.resource.php?resourceID=0... Besides that, the crime rate has been falling during a period coincident with aggressive policing, more incarceration, and more legal measures (RICO) to fight organized crime. While people have alternative theories for that decrease (e.g. banning leaded gasoline), aggressive policing cannot be ruled out as a reason for the decrease in crime. Finally, tape recordings and wire taps are the backbone of investigations of sophisticated crime. It's disingenuous to pretend that pervasive encrypted communications doesn't dramatically change the landscape law enforcement is dealing with. I happen to think the privacy benefits of encryption outweigh the cost to law enforcement, but I think it's ridiculous to pretend like there isn't real crime out there or that encryption doesn't make it harder to fight it.
- shiftoutbox 11y agoWas this a complete thought ? Also if the user posts something like this on facebook does it carry less gravitas then Twitter . Can we stop giving Twitter comments some mystical value .
- yoz-y 11y agoComments from Google CEO on an extremely pressing issue have value regardless of the medium where they are posted. Twitter just happens to be the place where such discussions often happen.
- csrm123 11y agoIs there literally no other way that the FBI could get the data off the phone? I'm sure they could download the memory, stick it all in some kind of iOS VM and try every 4-digit PIN in no time, all without worrying that the phone would self-destruct. Couldn't they?
- weinzierl 11y agoNo. Flash memory is encrypted with a key that is derived not only from the PIN but also an ID that is fused into the device when it is manufactured. If we exclude the possibility of a backdoor there is no way to retrieve this ID expect from the silicon itself. Encryption keys are stored unencrypted in RAM, but only as long as the device is active. RAM loses it's content quickly when it is not refreshed every few micro seconds. Moreover the RAM in the iPhone is a package on package design which makes it hard to connect to it.
- uptown 11y agoHow long would it take, given the immense computing capabilities of the government, to try every possible permutation of Apple's signing keys in order for them to be able to sign their own home-grown version of iOS? With over a billion devices at stake, isn't that what intelligence agencies would actively be targeting?
- jeff_marshall 11y agoUsing brute force (i.e. "immense computing capabilities") for properly sized keys is unlikely to ever be practical with classical computers. With quantum computers, many currently deployed key lengths that would be impractical to brute force with classical computers would become vulnerable to attack, but nobody is currently known to have quantum computers of sufficient power. See Wikipedia for basic details[1]. IMO, an intelligence agency would be more likely to invest in other methods (algorithm implementation weaknesses, software bugs, insider access, etc), due to the higher liklihood of sucess. That said, it's interesting to note that the NSA is moving towards "post-quantum" cryptography[2], under the assumption that suitably powerful quantum computers will be, or have been, built. Whether the NSA already has such suitably powerful quantum computers is anybodys guess. [1] https://en.wikipedia.org/wiki/Key_size#Brute_force_attack https://en.wikipedia.org/wiki/Key_size#Brute_force_attack [2] https://www.nsa.gov/ia/programs/suiteb_cryptography/ https://www.nsa.gov/ia/programs/suiteb_cryptography/
- alanwatts 11y agoVery interesting. I wonder how one feasibly could test "quantum resistant algorithms" without having a quantum computer to test it against.
- periodontal 11y agoThe same way we create and vet conventional cryptography: withstanding public scrutiny of experts until we are reasonably confident that there are no major issues. Most attacks are theoretical and require only novel analysis and a new bound on computational difficulty, not a proof of concept (i.e., algorithms are abandoned by cryptographers long before attacks become feasible). Post quantum algorithms are simply algorithms designed and analyzed against a stronger threat model. Some of the attacks and techniques are still being developed, so no one knows if new quantum algorithms will be invented tomorrow that trivialize certain problems but the same danger is present to some extent for conventional cryptography today.
- known 11y agoApple complies with Chinese authorities and not US?
- xyzzy4 11y agoMaybe the Chinese authorities have broader power in China than the FBI has in the US.
- shiftoutbox 11y agoIs China , you remember a communist country wrought with corruption . That most Americans businessmen feel is the cause of and solution to off of their problems .
- aioprisan 11y agoApple never complied to this type of request to Chinese authorities. Source?
- musha68k 11y agoLame but not unexpected comments from a company living off their users' data - it's quasi by definition that privacy isn't something GOOG is particularly interested in at all as the lack of it is at the very core of their own creepy business model. Each of us info-tech "professionals" downplaying this reality by falling for GOOG marketing are not merely cattle but sheep. Cool open-source projects count as successful opinion manipulation ("marketing") as well btw (Angular, Kubernetes, etc). I admit it, I'm a sheep meeeeeehmeeeeeehmeehmeh but it might be about time to finally change that meehmeehmeh.
- zaphar 11y agoSo Google undoubtedly know a lot about you. This knowledge also powers a large number of highly useful features. e.g. * Remind me that it's time to leave for my meeting. Taking traffic and preferred method of travel into account. * Alert me about that breaking news story that I'm really interested in following. * Tell me what the weather is going to be like when my plane lands. All of these are things I value and they are only possible if Google knows enough things about me to answer those questions. A phone can't power it you need software running in a datacenter somewhere. People want these features which is why Google is able to make money. Everytime this topic comes up people rant about how Google is creepy but it's disingenuous because the tradeoff is Incredibly useful features vs user privacy. It's a perfectly valid position to want governmental protections for one's data to provide some recourse for violations of your privacy while still enabling those same useful features.
- JustSomeNobody 11y agoI would much rather he wrote something more formal and stopped with the weak sounding 'could'.
- j1vms 11y agoTo be fair, the way Cook went to media with this is not at all an order of magnitude better than the way Pichai did. Consider that if Cook had wanted to make the statement more official and tie his company to this stance, he could have very easily ordered investor-level press release and then linked it from the homepage for general public awareness. That would cause a much bigger shockwave.
- awinter-py 11y agoThis would have more force if G didn't have a history of siding with tech giants on moral issues. 2 CEOs ago, apple asked G to collude in a hiring scam and G replied with an emoticon. If the device were truly secure we wouldn't be having this conversation. Alternatively, if law enforcement wanted to get into a dead guy's filing cabinet on suspicion of conspiracy murder, with a valid court order, there wouldn't be any outrage. We're being bamboozled by a PR campaign in favor of closed-source software. If the guy was still alive apple could just push him an IOS update containing backdoors galore. This is not a secure device!