3 ms·

> I don't think anything in the bill requires a provider to keep around copies of information they don't already keep. Password hashes, if this were to become

by woodman 11y ago

> I don't think anything in the bill requires a provider to keep around copies of information they don't already keep. Password hashes, if this were to become law then you'd have to store them in clear text or encrypt them with a controlled key. You frequently see that sort of practice turn up in massive security breaches. Also, homomorphic databases are out - you can't provide a service without being able to deliver plaintext to the state. So no decentralized security, you'd be forced to choose, during the handshake, between clear text or a CA model that offers no protection from state level attackers - which is no coincidence. > But the bill isn't "regressive"--it's attempting to maintain... Device manufacturers are covered. So even if it is unrelated to an ongoing service, it is still required to render assistance in compromising the product. That is regressive. And I've only mentioned the primary impact, this thing would make the manufacture of end user serviced devices economically impossible. Unless we had a less horrible alternative... what if manufacturers where offered the alternative of installing a key escrow chip? I could swear that I've heard that idea proposed before. Edit: I forgot to include software developers, so let your imagination run over that. That bitlocker feature offered by Microsoft? That is covered.

rayiner 11y ago
I'm referring to the analogy to "photocopying snail-mail letters." I don't read anything in the bill to require companies to keep a history of the communications. It contemplates situations where the government has obtained the encrypted communications by some other means. > So even if it is unrelated to an ongoing service, it is still required to render assistance in compromising the product. That is regressive. "Regressive" means stepping backward from the status quo. The government can already compel your bank to drill your safe deposit box; it can subpoena your accountant to spill the beans on the complex financial transactions he arranged for you; etc. Compelling assistance from tech companies might be a bad idea, but it's an extension of the status quo.
- woodman 11y ago
  > I don't read anything in the bill to require companies to keep a history of the communications. That isn't what I said or what I addressed. You said "...keep around copies of information they don't already keep.", that isn't true - for the reasons I previously explained. It isn't restricted to "communications", it is for any stored data - if you get it in plain text then you are required to render on demand in plain text. You are not allowed to use forward security as a feature of your product. > "Regressive" means stepping backward from the status quo. I know what the word means, you've misused it. The USG making it illegal to render information unusable to them for some theoretical future investigation is not the status quo. That logic would make manufacture of paper shredders illegal.
- prutschman 11y ago
  Can the government presently compel a bank not to offer super-secure highly drill resistant safe deposit boxes? Signal by Whisper Systems is intended to work in such a way that a subpoena for someone's chat logs would be useless because there's nothing useful to subpoena. They cannot access the keys necessary to decrypt. Assume for the sake of argument that they've achieved their goal from a technical standpoint. As a result they are unable to comply with subsection (a); they cannot provide the unencrypted information, and no amount of technical assistance on their behalf would allow them to do so. Section 3. (c) "License Distributors" would appear to prohibit Apple from making the app available in its app store.
  - kijin 11y ago
    "Technical assistance" is very vague. If the FBI can legally compel Apple to produce a backdoored firmware for their phones, they can also compel Open Whisper Systems to produce a backdoored version of the Signal app to intercept all plaintext on the client side. Since almost everybody has automatic updates turned on, they won't even need to find a way to push the rogue version to the target's device. Every service that relies on a vendor-provided app is open to this kind of "technical assistance". Ditto for any webapp that relies on vendor-provided JavaScript crypto libraries. The vendor can "technically assist" themselves at any time to gain surveillance capabilities they previously did not have.
- cb18 11y ago
  >I'm referring to the analogy to "photocopying snail-mail letters." The analogy is that anybody who intercepts and stores encrypted communication data, has a kind of Schrodinger's Cat photo-copied letter. If at some later date they acquire the encryption key, then they have a photo-copied letter never intended for them. If they don't acquire the key, they don't have a letter. (Or perhaps they still do 'have a letter' they just can't read it, that's kind of a metaphysical question)
deleted 11y ago
[deleted]

by woodman 11y ago

rayiner 11y ago

I'm referring to the analogy to "photocopying snail-mail letters." I don't read anything in the bill to require companies to keep a history of the communications. It contemplates situations where the government has obtained the encrypted communications by some other means. > So even if it is unrelated to an ongoing service, it is still required to render assistance in compromising the product. That is regressive. "Regressive" means stepping backward from the status quo. The government can already compel your bank to drill your safe deposit box; it can subpoena your accountant to spill the beans on the complex financial transactions he arranged for you; etc. Compelling assistance from tech companies might be a bad idea, but it's an extension of the status quo.

woodman 11y ago
> I don't read anything in the bill to require companies to keep a history of the communications. That isn't what I said or what I addressed. You said "...keep around copies of information they don't already keep.", that isn't true - for the reasons I previously explained. It isn't restricted to "communications", it is for any stored data - if you get it in plain text then you are required to render on demand in plain text. You are not allowed to use forward security as a feature of your product. > "Regressive" means stepping backward from the status quo. I know what the word means, you've misused it. The USG making it illegal to render information unusable to them for some theoretical future investigation is not the status quo. That logic would make manufacture of paper shredders illegal.
prutschman 11y ago
Can the government presently compel a bank not to offer super-secure highly drill resistant safe deposit boxes? Signal by Whisper Systems is intended to work in such a way that a subpoena for someone's chat logs would be useless because there's nothing useful to subpoena. They cannot access the keys necessary to decrypt. Assume for the sake of argument that they've achieved their goal from a technical standpoint. As a result they are unable to comply with subsection (a); they cannot provide the unencrypted information, and no amount of technical assistance on their behalf would allow them to do so. Section 3. (c) "License Distributors" would appear to prohibit Apple from making the app available in its app store.
- kijin 11y ago
  "Technical assistance" is very vague. If the FBI can legally compel Apple to produce a backdoored firmware for their phones, they can also compel Open Whisper Systems to produce a backdoored version of the Signal app to intercept all plaintext on the client side. Since almost everybody has automatic updates turned on, they won't even need to find a way to push the rogue version to the target's device. Every service that relies on a vendor-provided app is open to this kind of "technical assistance". Ditto for any webapp that relies on vendor-provided JavaScript crypto libraries. The vendor can "technically assist" themselves at any time to gain surveillance capabilities they previously did not have.
cb18 11y ago
>I'm referring to the analogy to "photocopying snail-mail letters." The analogy is that anybody who intercepts and stores encrypted communication data, has a kind of Schrodinger's Cat photo-copied letter. If at some later date they acquire the encryption key, then they have a photo-copied letter never intended for them. If they don't acquire the key, they don't have a letter. (Or perhaps they still do 'have a letter' they just can't read it, that's kind of a metaphysical question)

deleted 11y ago

[deleted]