4 ms·

I wonder if anyone has explained to them there is this thing called open-source software. Sure you may be able to convince/force Apple to give you some sort of

by jpgvm 11y ago

I wonder if anyone has explained to them there is this thing called open-source software. Sure you may be able to convince/force Apple to give you some sort of key escrow system but do you think you can convince the GPG developers? If you implement key escrow and it's public knowledge that encryption systems that implement it are useless then people that actually want to hide stuff will simply use GPG and other uncompromised systems. The only thing this sort of system is good for is enhancing the reach of the surveillance apparatus. That is, spying on innocent people. As for why they want to do this.. no-one knows but it's awfully concerning.

emodendroket 11y ago
How many people can be bothered if it's not a turnkey solution?
- jpgvm 11y ago
  Like I said it's not about the average person, it's about someone with something to hide. Those with something to hide will always go the extra distance. The issue I take with the FBI approach is it will have no effect on those that have stuff to hide but destroy any semblance privacy for those that don't. Terrorists will use GPG, citizens will use their backdoored iPhone full disk encryption and everyone but the terrorists lose.
  - emodendroket 11y ago
    Oh. I misinterpreted what you were saying to mean "it doesn't matter because we have GPG."
  - Aelinsaar 11y ago
    That's a problem too. Right now people with something to hide don't stand out amidst a background of similar encryption. If they suddenly have to switch to something relatively more exotic, that alone would be a coup for people in signals intelligence, don't you think?
    - jpgvm 11y ago
      Yeah definitely. This is currently the problem with ToR. The people that need the protection that ToR provides paint a target on their backs because there isn't enough ToR usage for them to be inconspicuous. Which is sad.. because for all of the bad usage of ToR there are people that depend on it to preserve free speech and any weakening of it could easily get them imprisoned or in many cases executed.
    - graycat 11y ago
      It doesn't have to look "exotic" at all: Sam just sends Joe a file in base 64. But that is how all the multimedia content is sent in e-mail now. Until dig into what Sam sent, it looks like just another JPG file sent in e-mail. But translate it from base 64 and give it to an image program and will discover that the file is not a JPG file. Or a PNG, BMP, MP3, WAV, EXE etc. file either. But about have to translate from base 64 to conclude this.
  - Freak_NL 11y ago
    > it's not about the average person, it's about someone with something to hide Keep in mind that the FBI would love it if everyone held that to be true. We all have something to hide, average person or not. No matter if you are a criminal, political activist, pervert, lawyer, priest, or just the baker down the street. Paraphrasing John Oliver: your banking statements, medical data, dick pics, private messages, dick pics, dick pics, and your secret diary are all things you most likely want to hide. ( https://www.youtube.com/watch?v=zsjZ2r9Ygzw https://www.youtube.com/watch?v=zsjZ2r9Ygzw ) The FBI would not mind a situation where only people with technological know-how use GnuPG, LUKS with dm-crypt, etc., and the rest whatever came with their smartphone. Most criminals are not particularly tech-savvy, so if that group loses access to strong encryption by default, they largely gain what they want. Of course there is no practical way to make the use of strong encryption by individual citizens around the globe illegal, and they know this. They may however succeed in outlawing strong disk encryption available by default on store-bought devices. So when a suspect uses an Android or IPhone, and the FBI has his or her device, they want to be able to access its contents without the suspect's consent. Ideally, they also want the most popular messaging platforms (like Facebook's WhatsApp) to have a backdoor available, in order for the vendor to be able to comply with warrants for such data.
  - ikeboy 11y ago
    >Always I gave some sources in https://news.ycombinator.com/item?id=10582206 https://news.ycombinator.com/item?id=10582206 that might change your mind. Changing the default makes a difference.
  - stonemetal 11y ago
    I'll just leave this here: http://www.dailydot.com/crime/tor-harvard-bomb-suspect/ http://www.dailydot.com/crime/tor-harvard-bomb-suspect/
- tonyedgecombe 11y ago
  Only terrorists.
- rubbingalcohol 11y ago
  Would it be possible to provide crypto as an open source "interface library" to commercial applications? So instead of the application doing the crypto (eg. Apple iOS) it would be farmed out to an optional library of the user's choosing. Apple could make it easy for a user to install such a library and then say (truthfully) that the cryptographic functions of their OS is not in their hands, since that feature is handled by a third party open source maintainer. At that point it would be an infinite game of whack-a-mole for the FBI to try to get backdoors in open source crypto interface libraries which could be maintained outside of the US.
  - graycat 11y ago
    A whack-a-mole game the FBI has no chance of winning. How? Keep the de/encryption software simple, dirt simple, just open source C code, run as a command line program on, say, an old PC/DOS system with no hard disk. For encryption, just put the file on, say, a smartphone, to be encrypted on a diskette, give the diskette to the PC, erase the orignal file from the smartphone, have the command line C code on the PC do the encryption and write the results as a base 64 file to a diskette, and, with no effort at all at encryption or security, let the smartphone read the diskette and send the file. Simple. Just keep it simple, just dirt simple, really small, open source code. The de/encryption has to be, what, just a few loops in C, in a few hundred lines of code? The rest is just dirt simple C file I/O just one byte at a time? So, very much do not want some 100,000 line app with the de/encryption buried deep inside somewhere. And want the de/encryption run on some other device, maybe an old PC/DOS machine with no hard disk and no network connection. Or get a Raspberry Pi running some simple operating system and where can be sure that no important data will be left on the computer.
- cstejerean 11y ago
  Just those that have a lot to hide, such as the terrorists the FBI wanted to catch in the first place.
mike_hearn 11y ago
I see this objection raised so frequently, and I feel it really misses the point badly. The tech community tells itself that it won the first "crypto wars". You cannot win "wars" against governments in that sort of sense and the first crypto war was never actually won at all. I think in light of events in recent years we need to reinterpret the events of the 90's in a new light - the tech industry didn't win, rather, after realising how awful and worthless the software the cypherpunks produced really was, the government simply got bored of playing. Nobody, and I mean nobody, gives one tiny shit about GPG. GPG is so bad, such truly unusable software, that terrorists would literally rather die or risk lifetime imprisonment than use it: http://privacy-pc.com/articles/how-terrorists-encrypt-threatscape-overview.html Governments don't care about GPG now, they don't care about some theoretical open source program that you could install from abroad, they only care about the encryption their adversaries actually use which - given that 99.9% of the FBI's adversaries are not crypto experts - turns out to be whatever ordinary people are using automatically thanks to tech companies switching it on. This is especially true because often people don't meticulously plan crimes out ahead of time: they either commit crimes of passion, or they make basic mistakes. So if you have to plan ahead and convince not only yourself, but all your accomplices, all to install some exotic and awkward to use piece of technology ... well, a lot of bad guys won't do it. So. If the FBI succeeds in breaking the encryption used by Apple, Google, Microsoft, Twitter, Facebook and a few other big names, then they've got 99% of the guys they want.
- kbart 11y ago
  If the worst case scenario fulfill and people will get jailed for petty crimes based on evidence snooped from their personal electronic devices and social media accounts, they will realize that they actually have something to hide and will look for alternatives to puppet companies. That's where open source and/or non-USA&Co originated software comes to play. See Twitter and Whatsapp role in recent mass protests.
- TillE 11y ago
  Usage patterns can easily change for a variety of reasons. WhatsApp is hugely popular now, but tomorrow it might be something else not based in the US. If they manage to write a law such that it bans strong encryption from the App Store, that will achieve their goal. But any other scenario is at best a temporary gain.
rietta 11y ago
It has been explained to them multiple times in congressional hearings. If you have a long time, the recent House Judiciary Committee Hearing is worth the watch: The Encryption Tightrope: Balancing Americans’ Security and Privacy https://www.youtube.com/watch?v=g1GgnbN9oNw https://www.youtube.com/watch?v=g1GgnbN9oNw There was another one that I watched back in June, but I cannot find the video at the moment. Should have bookmarked it! In the rietta.com article, I linked the this hearing, starting with Susan Landau's testimony starting at https://www.youtube.com/watch?v=g1GgnbN9oNw&t=3h35m50s https://www.youtube.com/watch?v=g1GgnbN9oNw&t=3h35m50s. But there is more must watch portions of the hearing. I like GnuPG and I use it regularly with work as does my team. And some of our clients do too, but not nearly enough. But my mom and dad are never going to use it. They do both use iPhones though. So being able to protect them is important.

by jpgvm 11y ago

emodendroket 11y ago

How many people can be bothered if it's not a turnkey solution?

jpgvm 11y ago
Like I said it's not about the average person, it's about someone with something to hide. Those with something to hide will always go the extra distance. The issue I take with the FBI approach is it will have no effect on those that have stuff to hide but destroy any semblance privacy for those that don't. Terrorists will use GPG, citizens will use their backdoored iPhone full disk encryption and everyone but the terrorists lose.
- emodendroket 11y ago
  Oh. I misinterpreted what you were saying to mean "it doesn't matter because we have GPG."
- Aelinsaar 11y ago
  That's a problem too. Right now people with something to hide don't stand out amidst a background of similar encryption. If they suddenly have to switch to something relatively more exotic, that alone would be a coup for people in signals intelligence, don't you think?
  - jpgvm 11y ago
    Yeah definitely. This is currently the problem with ToR. The people that need the protection that ToR provides paint a target on their backs because there isn't enough ToR usage for them to be inconspicuous. Which is sad.. because for all of the bad usage of ToR there are people that depend on it to preserve free speech and any weakening of it could easily get them imprisoned or in many cases executed.
  - graycat 11y ago
    It doesn't have to look "exotic" at all: Sam just sends Joe a file in base 64. But that is how all the multimedia content is sent in e-mail now. Until dig into what Sam sent, it looks like just another JPG file sent in e-mail. But translate it from base 64 and give it to an image program and will discover that the file is not a JPG file. Or a PNG, BMP, MP3, WAV, EXE etc. file either. But about have to translate from base 64 to conclude this.
- Freak_NL 11y ago
  > it's not about the average person, it's about someone with something to hide Keep in mind that the FBI would love it if everyone held that to be true. We all have something to hide, average person or not. No matter if you are a criminal, political activist, pervert, lawyer, priest, or just the baker down the street. Paraphrasing John Oliver: your banking statements, medical data, dick pics, private messages, dick pics, dick pics, and your secret diary are all things you most likely want to hide. ( https://www.youtube.com/watch?v=zsjZ2r9Ygzw https://www.youtube.com/watch?v=zsjZ2r9Ygzw ) The FBI would not mind a situation where only people with technological know-how use GnuPG, LUKS with dm-crypt, etc., and the rest whatever came with their smartphone. Most criminals are not particularly tech-savvy, so if that group loses access to strong encryption by default, they largely gain what they want. Of course there is no practical way to make the use of strong encryption by individual citizens around the globe illegal, and they know this. They may however succeed in outlawing strong disk encryption available by default on store-bought devices. So when a suspect uses an Android or IPhone, and the FBI has his or her device, they want to be able to access its contents without the suspect's consent. Ideally, they also want the most popular messaging platforms (like Facebook's WhatsApp) to have a backdoor available, in order for the vendor to be able to comply with warrants for such data.
- ikeboy 11y ago
  >Always I gave some sources in https://news.ycombinator.com/item?id=10582206 https://news.ycombinator.com/item?id=10582206 that might change your mind. Changing the default makes a difference.
- stonemetal 11y ago
  I'll just leave this here: http://www.dailydot.com/crime/tor-harvard-bomb-suspect/ http://www.dailydot.com/crime/tor-harvard-bomb-suspect/
tonyedgecombe 11y ago
Only terrorists.
rubbingalcohol 11y ago
Would it be possible to provide crypto as an open source "interface library" to commercial applications? So instead of the application doing the crypto (eg. Apple iOS) it would be farmed out to an optional library of the user's choosing. Apple could make it easy for a user to install such a library and then say (truthfully) that the cryptographic functions of their OS is not in their hands, since that feature is handled by a third party open source maintainer. At that point it would be an infinite game of whack-a-mole for the FBI to try to get backdoors in open source crypto interface libraries which could be maintained outside of the US.
- graycat 11y ago
  A whack-a-mole game the FBI has no chance of winning. How? Keep the de/encryption software simple, dirt simple, just open source C code, run as a command line program on, say, an old PC/DOS system with no hard disk. For encryption, just put the file on, say, a smartphone, to be encrypted on a diskette, give the diskette to the PC, erase the orignal file from the smartphone, have the command line C code on the PC do the encryption and write the results as a base 64 file to a diskette, and, with no effort at all at encryption or security, let the smartphone read the diskette and send the file. Simple. Just keep it simple, just dirt simple, really small, open source code. The de/encryption has to be, what, just a few loops in C, in a few hundred lines of code? The rest is just dirt simple C file I/O just one byte at a time? So, very much do not want some 100,000 line app with the de/encryption buried deep inside somewhere. And want the de/encryption run on some other device, maybe an old PC/DOS machine with no hard disk and no network connection. Or get a Raspberry Pi running some simple operating system and where can be sure that no important data will be left on the computer.
cstejerean 11y ago
Just those that have a lot to hide, such as the terrorists the FBI wanted to catch in the first place.

mike_hearn 11y ago

I see this objection raised so frequently, and I feel it really misses the point badly. The tech community tells itself that it won the first "crypto wars". You cannot win "wars" against governments in that sort of sense and the first crypto war was never actually won at all. I think in light of events in recent years we need to reinterpret the events of the 90's in a new light - the tech industry didn't win, rather, after realising how awful and worthless the software the cypherpunks produced really was, the government simply got bored of playing. Nobody, and I mean nobody, gives one tiny shit about GPG. GPG is so bad, such truly unusable software, that terrorists would literally rather die or risk lifetime imprisonment than use it: http://privacy-pc.com/articles/how-terrorists-encrypt-threatscape-overview.html Governments don't care about GPG now, they don't care about some theoretical open source program that you could install from abroad, they only care about the encryption their adversaries actually use which - given that 99.9% of the FBI's adversaries are not crypto experts - turns out to be whatever ordinary people are using automatically thanks to tech companies switching it on. This is especially true because often people don't meticulously plan crimes out ahead of time: they either commit crimes of passion, or they make basic mistakes. So if you have to plan ahead and convince not only yourself, but all your accomplices, all to install some exotic and awkward to use piece of technology ... well, a lot of bad guys won't do it. So. If the FBI succeeds in breaking the encryption used by Apple, Google, Microsoft, Twitter, Facebook and a few other big names, then they've got 99% of the guys they want.

kbart 11y ago
If the worst case scenario fulfill and people will get jailed for petty crimes based on evidence snooped from their personal electronic devices and social media accounts, they will realize that they actually have something to hide and will look for alternatives to puppet companies. That's where open source and/or non-USA&Co originated software comes to play. See Twitter and Whatsapp role in recent mass protests.
TillE 11y ago
Usage patterns can easily change for a variety of reasons. WhatsApp is hugely popular now, but tomorrow it might be something else not based in the US. If they manage to write a law such that it bans strong encryption from the App Store, that will achieve their goal. But any other scenario is at best a temporary gain.

rietta 11y ago

It has been explained to them multiple times in congressional hearings. If you have a long time, the recent House Judiciary Committee Hearing is worth the watch: The Encryption Tightrope: Balancing Americans’ Security and Privacy https://www.youtube.com/watch?v=g1GgnbN9oNw https://www.youtube.com/watch?v=g1GgnbN9oNw There was another one that I watched back in June, but I cannot find the video at the moment. Should have bookmarked it! In the rietta.com article, I linked the this hearing, starting with Susan Landau's testimony starting at https://www.youtube.com/watch?v=g1GgnbN9oNw&t=3h35m50s https://www.youtube.com/watch?v=g1GgnbN9oNw&t=3h35m50s. But there is more must watch portions of the hearing. I like GnuPG and I use it regularly with work as does my team. And some of our clients do too, but not nearly enough. But my mom and dad are never going to use it. They do both use iPhones though. So being able to protect them is important.