5 ms·

I wrote letters to my Congress critters arguing essentially the same point It is disqualifying that a "leader" like James Comey would argue that the government

I wrote letters to my Congress critters arguing essentially the same point It is disqualifying that a "leader" like James Comey would argue that the government can reasonably demand that private companies can protect customer secrets and give the government a secret path to access those secrets, in spite of everyone's failure to properly protect secrets (ala home depot, target, opm, et. Al.). This is not the argument of a serious, honest man. It advertises his ignorance of reality and utter incompetence of judgement.

ars 11y ago
So if Apple really did make an unbreakable phone then would (should) they have the right to make Apple break it? Let's legislate this issue now, and ignore the fact that they might be able to break it some other way. That's a side point and not very relevant.
- TheSpiceIsLife 11y ago
  Legislation does not make me feel safe.
- studentrob 11y ago
  Not that it matters much, since encryption can be under your own control regardless of whether the government permits a phone manufacturer to sell you a product designed as such or not, but it seems to be already legislated by CALEA [1]. Obama talks like that hasn't been already decided, and outside tech forums I feel like anyone who suggests new legislation for this is gunning for certain parts of CALEA to be changed to restrict freedoms, not grant them. [1] https://www.techdirt.com/articles/20160315/15505433916/apples-response-to-doj-your-filing-is-full-blatantly-misleading-claims-outright-falsehoods.shtml https://www.techdirt.com/articles/20160315/15505433916/apple...
- mindslight 11y ago
  On the contrary, let's hope off any legislation is pushed off as long as possible. The concept of an unbreakable container simply does not exist in the public's nor the government's realm of possibilities. Historically if some device was created by a person, it could be undone by a more-powerful a group of persons. Might makes right, in the prescriptive sense. So until unbreakable encryption becomes widely distributed and appreciated by the majority, the only thing that can come out of any legislation is the same top-down power structure most everybody has been primed to accept. We can only hope that the group drafting any legislation remains unconcerned about preventing truly secure encryption, to avoid the result of preemptively criminalizing various types of code for everybody! This is the threat to worry about - government forcibly restricting the advancement of society, simply so that it may retain better control over us. What makes this situation so worrying is that Apple has sold the story of unbreakable encryption for a system with a designed-in backdoor! This merely provokes the government's immune response over a capability that the people don't yet widely have.
- droopybuns 11y ago
  I have a mental tool that I rely on to help avoiding indulgence in silly thoughts. I want to share it, but it sounds kind of harsh, so I want to make sure that I am forcefully communicating the spirit of it's intention. It's a tool that helps me- not a judgement of your comment. "If" is for children. The scenario you are describing is a hypothetical which is not based on the state of software development today. We are not likely to be dealing with the ability to build an unbreakable phone any time soon. We are certainly dealing with the condition of failure- companies can't seem to keep data secret, even when they want to. Your question is built on a flawed premise. Show me a way to reliably constrain a developer so that when they compile, the data you want to keep secret reliably stays secret, and then I'll be happy to indulge in this scenario. For now, we are just too shitty at developing bug free, let alone secure software.
  - cortesoft 11y ago
    That is a silly notion... 'if' is not for children, 'if' is for conditional statements. As software developers, we use 'if' every single day of our lives. Stating things in the form of conditionals is very important when talking about the future (since the future is full of conditionals). Also, as far as 'showing you a way' that 'the data you want to keep secret reliably stays secret'... well, that is the definition of encryption, and we are pretty good at encryption. In fact, if we weren't, then this entire case would be a moot point.
    - droopybuns 11y ago
      If you think we are pretty good at encryption, I'm worried that you're not paying attention. Matt Green captures the spirit of what a lot of us feel who are on the front lines of infosec defense: https://twitter.com/matthew_d_green/status/709919895002042368 https://twitter.com/matthew_d_green/status/70991989500204236... "We can barely encrypt." This problem is not new. Put some time in and read Matt Blaze's paper "Why (Special Agent) Johnny (still) can't encrypt." http://www.crypto.com/papers/p25sec.pdf http://www.crypto.com/papers/p25sec.pdf >>Also, as far as 'showing you a way' ... My point is apparently poorly made, so let me try improving. Encryption is a feature- but our ability to properly implement it is woefully inadequate. Many developers think very much like you seem to be- I have a secret, so I need to encrypt. But they forget about (or have no awareness of ) offensive methods for intercepting a secret with a debugger. They think in terms of network transport or file system objects. So many a developer says "I'll just take out my copy of applied cryptography and go to work." And then security experts get more fuel for yelling about the danger of rolling your own crypto (even if you're just implementing what you see in Applied Crypto). Finally- I was obviously not talking about conditional statements. Read it again and pay attention. Hypothetical "if only" scenarios are great and amusing way to burn brain cycles with no real application. It is also a tactical error, because it indulges people in considering things that don't exist as potentially real.
TheCondor 11y ago
In general, there is already a solution to this. It's a search warrant or subpoena and a judge; judges have ordered encryption opened in the past and defendants comply or can get contempt. All this is about the Feds snooping without anyone knowing.. Perhaps another approach to this would be to lobby that all government encryption, including military, be key escrowed so that the populus could review the communication in the future. They won't like that but at least there is a legitimate use case for it.
- studentrob 11y ago
  > Perhaps another approach to this would be to lobby that all government encryption, including military, be key escrowed so that the populus could review the communication in the future It's not practical. Terrorists would just use the free encryption software that doesn't use escrowed keys. They're the fish we want to fry the most and they will be the first to not use whatever the US government tries to manipulate.
  - x0054 11y ago
    The solution is simple, we simply need to pass a law which makes it illegal for terrorists to use non escrowed key encryption software :)

ars 11y ago

So if Apple really did make an unbreakable phone then would (should) they have the right to make Apple break it? Let's legislate this issue now, and ignore the fact that they might be able to break it some other way. That's a side point and not very relevant.

TheSpiceIsLife 11y ago
Legislation does not make me feel safe.
studentrob 11y ago
Not that it matters much, since encryption can be under your own control regardless of whether the government permits a phone manufacturer to sell you a product designed as such or not, but it seems to be already legislated by CALEA [1]. Obama talks like that hasn't been already decided, and outside tech forums I feel like anyone who suggests new legislation for this is gunning for certain parts of CALEA to be changed to restrict freedoms, not grant them. [1] https://www.techdirt.com/articles/20160315/15505433916/apples-response-to-doj-your-filing-is-full-blatantly-misleading-claims-outright-falsehoods.shtml https://www.techdirt.com/articles/20160315/15505433916/apple...
mindslight 11y ago
On the contrary, let's hope off any legislation is pushed off as long as possible. The concept of an unbreakable container simply does not exist in the public's nor the government's realm of possibilities. Historically if some device was created by a person, it could be undone by a more-powerful a group of persons. Might makes right, in the prescriptive sense. So until unbreakable encryption becomes widely distributed and appreciated by the majority, the only thing that can come out of any legislation is the same top-down power structure most everybody has been primed to accept. We can only hope that the group drafting any legislation remains unconcerned about preventing truly secure encryption, to avoid the result of preemptively criminalizing various types of code for everybody! This is the threat to worry about - government forcibly restricting the advancement of society, simply so that it may retain better control over us. What makes this situation so worrying is that Apple has sold the story of unbreakable encryption for a system with a designed-in backdoor! This merely provokes the government's immune response over a capability that the people don't yet widely have.
droopybuns 11y ago
I have a mental tool that I rely on to help avoiding indulgence in silly thoughts. I want to share it, but it sounds kind of harsh, so I want to make sure that I am forcefully communicating the spirit of it's intention. It's a tool that helps me- not a judgement of your comment. "If" is for children. The scenario you are describing is a hypothetical which is not based on the state of software development today. We are not likely to be dealing with the ability to build an unbreakable phone any time soon. We are certainly dealing with the condition of failure- companies can't seem to keep data secret, even when they want to. Your question is built on a flawed premise. Show me a way to reliably constrain a developer so that when they compile, the data you want to keep secret reliably stays secret, and then I'll be happy to indulge in this scenario. For now, we are just too shitty at developing bug free, let alone secure software.
- cortesoft 11y ago
  That is a silly notion... 'if' is not for children, 'if' is for conditional statements. As software developers, we use 'if' every single day of our lives. Stating things in the form of conditionals is very important when talking about the future (since the future is full of conditionals). Also, as far as 'showing you a way' that 'the data you want to keep secret reliably stays secret'... well, that is the definition of encryption, and we are pretty good at encryption. In fact, if we weren't, then this entire case would be a moot point.
  - droopybuns 11y ago
    If you think we are pretty good at encryption, I'm worried that you're not paying attention. Matt Green captures the spirit of what a lot of us feel who are on the front lines of infosec defense: https://twitter.com/matthew_d_green/status/709919895002042368 https://twitter.com/matthew_d_green/status/70991989500204236... "We can barely encrypt." This problem is not new. Put some time in and read Matt Blaze's paper "Why (Special Agent) Johnny (still) can't encrypt." http://www.crypto.com/papers/p25sec.pdf http://www.crypto.com/papers/p25sec.pdf >>Also, as far as 'showing you a way' ... My point is apparently poorly made, so let me try improving. Encryption is a feature- but our ability to properly implement it is woefully inadequate. Many developers think very much like you seem to be- I have a secret, so I need to encrypt. But they forget about (or have no awareness of ) offensive methods for intercepting a secret with a debugger. They think in terms of network transport or file system objects. So many a developer says "I'll just take out my copy of applied cryptography and go to work." And then security experts get more fuel for yelling about the danger of rolling your own crypto (even if you're just implementing what you see in Applied Crypto). Finally- I was obviously not talking about conditional statements. Read it again and pay attention. Hypothetical "if only" scenarios are great and amusing way to burn brain cycles with no real application. It is also a tactical error, because it indulges people in considering things that don't exist as potentially real.

TheCondor 11y ago

In general, there is already a solution to this. It's a search warrant or subpoena and a judge; judges have ordered encryption opened in the past and defendants comply or can get contempt. All this is about the Feds snooping without anyone knowing.. Perhaps another approach to this would be to lobby that all government encryption, including military, be key escrowed so that the populus could review the communication in the future. They won't like that but at least there is a legitimate use case for it.

studentrob 11y ago
> Perhaps another approach to this would be to lobby that all government encryption, including military, be key escrowed so that the populus could review the communication in the future It's not practical. Terrorists would just use the free encryption software that doesn't use escrowed keys. They're the fish we want to fry the most and they will be the first to not use whatever the US government tries to manipulate.
- x0054 11y ago
  The solution is simple, we simply need to pass a law which makes it illegal for terrorists to use non escrowed key encryption software :)