10 ms·

This is not just govt access. For a judge to be able to order your computer unlocked, means people at Microsoft, at Lenovo (or whoever you use), and at your ISP

by rietta 11y ago

This is not just govt access. For a judge to be able to order your computer unlocked, means people at Microsoft, at Lenovo (or whoever you use), and at your ISP all have the keys to unlock your data even if you used an “encryption” feature. You have to trust every company, everywhere to never have a security incident involving the keys. I posted my full thoughts after the first reading through this at https://rietta.com/blog/2016/04/08/feinstein-burr-encryption-bill/ https://rietta.com/blog/2016/04/08/feinstein-burr-encryption.... Specifically, any U.S company would be required to maintain the ability, through unspecified means, to retrieve the plain-text from any data “made unintelligible by a feature, product, or service owned, controlled, created, or provided by the [company].” And the company would then be required to turn over such data in real-time “concurrently with its transmission” or “expeditiously, if stored by the [company] or on a device.” It's chilling.

vox_mollis 11y ago
any U.S company Your response begs the solution. Presumably, FOSS is not considered a "covered entity" under this bill. Arch or Gentoo linux, private mailserver, XMPP server with OTR, etc, is a simple circumvention.
- etjossem 11y ago
  A covered entity includes "any person who provides ... a method to facilitate a communication or the processing or storage of data." FOSS encryption libraries could be considered a method of processing data. If signed into law, this could compel maintainers to design libraries with gov't decryption in mind.
  - retbull 11y ago
    Just decryption. It isn't government only just mandated by them ANYONE can use it.
    - etjossem 11y ago
      Agreed. Those familiar with encryption understand that a single security incident resulting in the theft of such a backdoor key is all it would take. The attack would cascade to any company that implemented the library.
  - vox_mollis 11y ago
    How could this be enforced, assuming the library developers are scattered throughout the world? Worst case scenario, all US developers drop off the project, or contribute anonymously.
  - DennisP 11y ago
    Given that courts have ruled open-source crypto code to be constitutionally protected speech, it might be difficult to make that stick. https://en.wikipedia.org/wiki/Source_code#Legal_issues_in_the_United_States https://en.wikipedia.org/wiki/Source_code#Legal_issues_in_th...
    - etjossem 11y ago
      The case in question (Bernstein v. United States) is fascinating: https://epic.org/crypto/export_controls/bernstein_decision_9_cir.html https://epic.org/crypto/export_controls/bernstein_decision_9...
    - maxerickson 11y ago
      Would protected speech mean you could use some non compliant code to provide services or just that you could publish it?
      - DennisP 11y ago
        I don't know, but the bill doesn't appear to cover end users. Cloud-based services would probably have to deal with it, but not people running software on their own computers.
- rietta 11y ago
  It would seem that no US person could package or distribute such open source crypto without becoming a covered entity.
- anonbanker 11y ago
  Red Hat would be. Consider the amount of funding RH and Sun Microsystems have put into the linux desktop. Imagine if they were now required to provide technical assistance to people attempting to surveil through the tools they've invented.
stcredzero 11y ago
Something is broken here. Feinstein is so off base and so unaware of the implications of her proposal, she's forwarded a proposal that basically breaks the entire internet. (Over time, all data security would degrade.) Especially considering that she has a history of doing this with legislation involving technical stuff. Dunning-Kruger with literally global downside. (Knee-jerk emotionally motivated legislation that's horribly broken.)
- abtinf 11y ago
  >and so unaware of the implications of her proposal I suggest you check your premises.
  - stcredzero 11y ago
    It fits the pattern of her misguided anti-gun laws. I think the implications don't matter to her, so long as the legislation resonates emotionally with uninformed voters. (EDIT: To clarify: from a rational perspective, some of her sponsored anti-gun laws primarily have the effect of alienating and galvanizing the opposition with nonsensical and ineffective laws. From a rational anti-gun perspective, they have done more harm than good.)
    - munificent 11y ago
      You can look at the legislature like a biological ecosystem subject to evolution. The natural selection force that acts on it is election ("natural election"?). Legislators who do not get elected do not survive in the ecosystem. That means the direct evolutionary pressure is for legislators who focus on re-election above all else. Any actors who have different priorities are quickly outcompeted and kicked out of the gene pool.
      - Retra 11y ago
        You could look at insulation like it's made of whipped cream, but that doesn't make it a good pie topping. In other words, government officials are not in fact bound by the rules of natural selection whatsoever, and they can live perfectly comfortable, happy lives without getting reelected.
cb18 11y ago
It's not just chilling, it's insane. A crypto-secured digital communication should be analogous to sending an untampered with letter, or having a private conversation in a secure location. Just because the medium being communicated over changes, doesn't mean we should adopt wildly regressive policies. By proposing that all this 'cryptographically secured'[0] communication can be accessed at a later date, they're basically saying that the contents of all snail mail letters should be photo copied, and all private conversations should be recorded. [0] If there is a possibility of 'technical assistance,' then it is not cryptographically secure.
- rayiner 11y ago
  > A crypto-secured digital communication should be analogous to sending an untampered with letter, or having a private conversation in a secure location. I don't think anything in the bill requires a provider to keep around copies of information they don't already keep. They need to be able to provide access contemporaneously with transmission (i.e. basically a wiretap), or if they have stored it or can access it on the device. If you receive a sealed letter and the police get a warrant, they can search your drawer and open that letter. If you have a private conversation with someone, a prosecutor can subpoena that person and force them to testify about what you told them. I'm amenable to the argument that the law shouldn't stand in the way of progress; it's possible to communicate much more securely now than it ever was in the past and the law shouldn't stand in the way of people taking advantage of those advances. But the bill isn't "regressive"--it's attempting to maintain powers the police already have with traditional means of communication.
  - newjersey 11y ago
    > If you receive a sealed letter and the police get a warrant, they can search your drawer and open that letter. If you have a private conversation with someone, a prosecutor can subpoena that person and force them to testify about what you told them. If you are a bank with a lock box, are you required to have a key to a safe that a customer installs inside the lock box to store their valuables? Of course, a court can order you to give what you have but how can they order you to give them something you don't have?
tzs 11y ago
> For a judge to be able to order your computer unlocked, means people at Microsoft, at Lenovo (or whoever you use), and at your ISP all have the keys to unlock your data even if you used an “encryption” feature. You have to trust every company, everywhere to never have a security incident involving the keys. I've only read the thing once and so may have overlooked it, but I didn't see anything that implies that companies will have to keep keys. For encrypted data, they have to provide technical assistance in decrypting the data, but I didn't see anything that would make assisting with a brute force attack not qualify as technical assistance. There was something in there about having to respond expeditiously (or something like that), but I think one could make a good argument that brute force is responding expeditiously as long as there is not a known faster way for that particular device.
- jhayward 11y ago
  Did you miss the part where they have to be able to decrypt conversations in real-time?
- woodman 11y ago
  > I didn't see anything that implies that companies will have to keep keys. That is the intent and the logical consequence, obviously they can't say "backdoor". If plain text goes into your device, software or service, and is stored, than you'd be required to provide the plain text on demand. Your product isn't a sha-2 algorithm that just happens to have a massive cloud backup service behind it, your product is a secure remote backup service. The folks who think this is a good idea are going to be the same ones nailing your ass to the wall for breaking their law, they won't entertain the excuse - they'll say that your choice in implementing a non-reversible feature demonstrates predetermination, a cyber booby-trap.
narrator 11y ago
The militaries and security agencies of other countries are not going to like this. I could see this being a boon to the Russian or Chinese semiconductor industries. They could market some sort of secure USB device that would contain a password input keyboard and do all the encryption for the host computer. They don't have to have the latest fab technology, just something that's not crackable by western agencies. They have fabs for 90nm right now in Russia, which is about 12 years behind US production, so it's not unthinkable.

by rietta 11y ago

vox_mollis 11y ago

any U.S company Your response begs the solution. Presumably, FOSS is not considered a "covered entity" under this bill. Arch or Gentoo linux, private mailserver, XMPP server with OTR, etc, is a simple circumvention.

etjossem 11y ago
A covered entity includes "any person who provides ... a method to facilitate a communication or the processing or storage of data." FOSS encryption libraries could be considered a method of processing data. If signed into law, this could compel maintainers to design libraries with gov't decryption in mind.
- retbull 11y ago
  Just decryption. It isn't government only just mandated by them ANYONE can use it.
  - etjossem 11y ago
    Agreed. Those familiar with encryption understand that a single security incident resulting in the theft of such a backdoor key is all it would take. The attack would cascade to any company that implemented the library.
- vox_mollis 11y ago
  How could this be enforced, assuming the library developers are scattered throughout the world? Worst case scenario, all US developers drop off the project, or contribute anonymously.
- DennisP 11y ago
  Given that courts have ruled open-source crypto code to be constitutionally protected speech, it might be difficult to make that stick. https://en.wikipedia.org/wiki/Source_code#Legal_issues_in_the_United_States https://en.wikipedia.org/wiki/Source_code#Legal_issues_in_th...
  - etjossem 11y ago
    The case in question (Bernstein v. United States) is fascinating: https://epic.org/crypto/export_controls/bernstein_decision_9_cir.html https://epic.org/crypto/export_controls/bernstein_decision_9...
  - maxerickson 11y ago
    Would protected speech mean you could use some non compliant code to provide services or just that you could publish it?
    - DennisP 11y ago
      I don't know, but the bill doesn't appear to cover end users. Cloud-based services would probably have to deal with it, but not people running software on their own computers.
rietta 11y ago
It would seem that no US person could package or distribute such open source crypto without becoming a covered entity.
anonbanker 11y ago
Red Hat would be. Consider the amount of funding RH and Sun Microsystems have put into the linux desktop. Imagine if they were now required to provide technical assistance to people attempting to surveil through the tools they've invented.

stcredzero 11y ago

Something is broken here. Feinstein is so off base and so unaware of the implications of her proposal, she's forwarded a proposal that basically breaks the entire internet. (Over time, all data security would degrade.) Especially considering that she has a history of doing this with legislation involving technical stuff. Dunning-Kruger with literally global downside. (Knee-jerk emotionally motivated legislation that's horribly broken.)

abtinf 11y ago
>and so unaware of the implications of her proposal I suggest you check your premises.
- stcredzero 11y ago
  It fits the pattern of her misguided anti-gun laws. I think the implications don't matter to her, so long as the legislation resonates emotionally with uninformed voters. (EDIT: To clarify: from a rational perspective, some of her sponsored anti-gun laws primarily have the effect of alienating and galvanizing the opposition with nonsensical and ineffective laws. From a rational anti-gun perspective, they have done more harm than good.)
  - munificent 11y ago
    You can look at the legislature like a biological ecosystem subject to evolution. The natural selection force that acts on it is election ("natural election"?). Legislators who do not get elected do not survive in the ecosystem. That means the direct evolutionary pressure is for legislators who focus on re-election above all else. Any actors who have different priorities are quickly outcompeted and kicked out of the gene pool.
    - Retra 11y ago
      You could look at insulation like it's made of whipped cream, but that doesn't make it a good pie topping. In other words, government officials are not in fact bound by the rules of natural selection whatsoever, and they can live perfectly comfortable, happy lives without getting reelected.

cb18 11y ago

It's not just chilling, it's insane. A crypto-secured digital communication should be analogous to sending an untampered with letter, or having a private conversation in a secure location. Just because the medium being communicated over changes, doesn't mean we should adopt wildly regressive policies. By proposing that all this 'cryptographically secured'[0] communication can be accessed at a later date, they're basically saying that the contents of all snail mail letters should be photo copied, and all private conversations should be recorded. [0] If there is a possibility of 'technical assistance,' then it is not cryptographically secure.

rayiner 11y ago
> A crypto-secured digital communication should be analogous to sending an untampered with letter, or having a private conversation in a secure location. I don't think anything in the bill requires a provider to keep around copies of information they don't already keep. They need to be able to provide access contemporaneously with transmission (i.e. basically a wiretap), or if they have stored it or can access it on the device. If you receive a sealed letter and the police get a warrant, they can search your drawer and open that letter. If you have a private conversation with someone, a prosecutor can subpoena that person and force them to testify about what you told them. I'm amenable to the argument that the law shouldn't stand in the way of progress; it's possible to communicate much more securely now than it ever was in the past and the law shouldn't stand in the way of people taking advantage of those advances. But the bill isn't "regressive"--it's attempting to maintain powers the police already have with traditional means of communication.
- newjersey 11y ago
  > If you receive a sealed letter and the police get a warrant, they can search your drawer and open that letter. If you have a private conversation with someone, a prosecutor can subpoena that person and force them to testify about what you told them. If you are a bank with a lock box, are you required to have a key to a safe that a customer installs inside the lock box to store their valuables? Of course, a court can order you to give what you have but how can they order you to give them something you don't have?

tzs 11y ago

> For a judge to be able to order your computer unlocked, means people at Microsoft, at Lenovo (or whoever you use), and at your ISP all have the keys to unlock your data even if you used an “encryption” feature. You have to trust every company, everywhere to never have a security incident involving the keys. I've only read the thing once and so may have overlooked it, but I didn't see anything that implies that companies will have to keep keys. For encrypted data, they have to provide technical assistance in decrypting the data, but I didn't see anything that would make assisting with a brute force attack not qualify as technical assistance. There was something in there about having to respond expeditiously (or something like that), but I think one could make a good argument that brute force is responding expeditiously as long as there is not a known faster way for that particular device.

jhayward 11y ago
Did you miss the part where they have to be able to decrypt conversations in real-time?
woodman 11y ago
> I didn't see anything that implies that companies will have to keep keys. That is the intent and the logical consequence, obviously they can't say "backdoor". If plain text goes into your device, software or service, and is stored, than you'd be required to provide the plain text on demand. Your product isn't a sha-2 algorithm that just happens to have a massive cloud backup service behind it, your product is a secure remote backup service. The folks who think this is a good idea are going to be the same ones nailing your ass to the wall for breaking their law, they won't entertain the excuse - they'll say that your choice in implementing a non-reversible feature demonstrates predetermination, a cyber booby-trap.

narrator 11y ago

The militaries and security agencies of other countries are not going to like this. I could see this being a boon to the Russian or Chinese semiconductor industries. They could market some sort of secure USB device that would contain a password input keyboard and do all the encryption for the host computer. They don't have to have the latest fab technology, just something that's not crackable by western agencies. They have fabs for 90nm right now in Russia, which is about 12 years behind US production, so it's not unthinkable.