5 ms·

FBI Is Pushing Back Against Judge's Order to Reveal Tor Browser Exploit

77 points by ashitlerferad 11y ago

hvidgaard 11y ago
I actually agree with the FBI here. I would love to see the vulnerability fixed, but it is of little importance to the case. It's like asking what make and model of lockpicking tools they used to pick a lock. If it is to verify the legality of it, I'm sure that allowing only the judge and an expert to see the exploit is enough.
- woodman 11y ago
  > It's like asking what make and model of lockpicking tools they used to pick a lock. It is more like asking for the technical specs of the teleportation equipment they used. It needs to be established that they broke into the right house, because there are all sorts of potential "mistakes" that can be hidden behind secret magical investigative tools.
  - hvidgaard 11y ago
    Not at all. What they had was a lead, they got access and found the real evidence. They wouldn't know if it was the right house or not, that is the nature of a lead, and the person (hopefully a judge) that gave them green light decided if the lead was substansial enough to warrent hacking a citezen and break privacy. The process from start to finish can be public. If they followed protocol and found real evidence that is what matters. They can demand to see warrants and the timeline of the process to determine the legality of what happened, but the technical nature of the exploit adds no additional insight to this.
    - woodman 11y ago
      > If they followed protocol and found real evidence that is what matters. That is what is yet to be determined. Trying to shield the process from public scrutiny and justifying it with an appeal to authority is a pretty bad idea. Imagine the same logic applied in the non-digital world: traffic stops conducted with probable cause delivered by a black box and an authoritative "Just trust me, I'm an expert."
      - wldcordeiro 11y ago
        You mean a drug dog?
        woodman 11y ago
        I think that the unreliability has entered the public consciousness fairly recently, so we'll see how that goes. Polygraphs offer a more positive example, as well as breathalyzers. [0] [0] http://embeddedgurus.com/barr-code/2009/11/breathalyzer-source-code-analysis/ http://embeddedgurus.com/barr-code/2009/11/breathalyzer-sour...
      - hvidgaard 11y ago
        I agree, and if the defendant wants a judge and domain experts to go over it, fine, but the public does not need to know for this particular case.
        woodman 11y ago
        I'm not sure how that would work without more secrecy (FISA style courts) or compelled silence (NSLs). Before we do that, maybe we should take a moment to reevaluate the premise of state secrets, and the benefits they provide a free society.
deepnet 11y ago
FBI broke into your house to prove you were commmiting a crime. FBI broke into your firefox... FBI keeps all citizens at risk because it is convenient to them that there is a major flaw in the most common doorlocks. Specific circumstances, proper oversight ? Ripe for overreach these citizen unsafety programmes.
deleted 11y ago
[deleted]
pdkl95 11y ago
Such arrogant hubris: Here, [Special Agent] Alfin starts an analogy for software vulnerabilities: that of a flaw in a lock. “In layman's terms, an ‘exploit’ could be thought of as a defect in a lock that would allow someone with the proper tool to unlock it without possessing the key,” he writes. He admits that there is a flaw, but no mention at all that the flaw should be fixed? If one person found the exploit, someone else can as well. Apparently fantasies about having a "nobus" tool are a higher priority than protecting people.
- d33 11y ago
  That's why I believe that there should be more energy put into genetic fuzzing of Firefox. If we managed to attach AFL to its content sniffing engine for example, I'm pretty sure it wouldn't take long to find something fun... Google doesn't seem to say that anybody officially tried it so far: https://encrypted.google.com/search?hl=pl&q=afl-fuzz%20firefox https://encrypted.google.com/search?hl=pl&q=afl-fuzz%20firef...
DominoTree 11y ago
Pretty sure that just about everyone is hoarding Firefox 0days :P
- unlinker 11y ago
  That's my thought too. I'm sure most of the so-called "security experts" who like to talk about how important privacy and security are for the rest of us are sitting on lots of 0-days.
  - wldcordeiro 11y ago
    Right? There are too many valuable bug bounties and interested parties for people to divulge the best exploits. Those are all probably still in the wild and will remain that way until the right buyer appears.
vox_mollis 11y ago
May be? They almost certainly are stockpiling them.
anonnyj 11y ago
"hoarding" "a" Does not compute...
- wldcordeiro 11y ago
  Stowing away a better term for you? Yeah hoarding is usually a plural reference but you know what the article meant.
  - plorg 11y ago
    More like "reserving". Clearly they're actually using the exploit in question. I would associate "stowing away" or "hoarding" with hiding or putting a later circumstance. In any case, the original title ("FBI Is Pushing Back Against Judge's Order to Reveal Tor Browser Exploit") is more informative and less click-baity. There's a reason that's HN's preferred style.

77 points by ashitlerferad 11y ago

I actually agree with the FBI here. I would love to see the vulnerability fixed, but it is of little importance to the case. It's like asking what make and model of lockpicking tools they used to pick a lock. If it is to verify the legality of it, I'm sure that allowing only the judge and an expert to see the exploit is enough.

woodman 11y ago
> It's like asking what make and model of lockpicking tools they used to pick a lock. It is more like asking for the technical specs of the teleportation equipment they used. It needs to be established that they broke into the right house, because there are all sorts of potential "mistakes" that can be hidden behind secret magical investigative tools.
- hvidgaard 11y ago
  Not at all. What they had was a lead, they got access and found the real evidence. They wouldn't know if it was the right house or not, that is the nature of a lead, and the person (hopefully a judge) that gave them green light decided if the lead was substansial enough to warrent hacking a citezen and break privacy. The process from start to finish can be public. If they followed protocol and found real evidence that is what matters. They can demand to see warrants and the timeline of the process to determine the legality of what happened, but the technical nature of the exploit adds no additional insight to this.
  - woodman 11y ago
    > If they followed protocol and found real evidence that is what matters. That is what is yet to be determined. Trying to shield the process from public scrutiny and justifying it with an appeal to authority is a pretty bad idea. Imagine the same logic applied in the non-digital world: traffic stops conducted with probable cause delivered by a black box and an authoritative "Just trust me, I'm an expert."
    - wldcordeiro 11y ago
      You mean a drug dog?
      - woodman 11y ago
        I think that the unreliability has entered the public consciousness fairly recently, so we'll see how that goes. Polygraphs offer a more positive example, as well as breathalyzers. [0] [0] http://embeddedgurus.com/barr-code/2009/11/breathalyzer-source-code-analysis/ http://embeddedgurus.com/barr-code/2009/11/breathalyzer-sour...
    - hvidgaard 11y ago
      I agree, and if the defendant wants a judge and domain experts to go over it, fine, but the public does not need to know for this particular case.
      - woodman 11y ago
        I'm not sure how that would work without more secrecy (FISA style courts) or compelled silence (NSLs). Before we do that, maybe we should take a moment to reevaluate the premise of state secrets, and the benefits they provide a free society.

deepnet 11y ago

FBI broke into your house to prove you were commmiting a crime. FBI broke into your firefox... FBI keeps all citizens at risk because it is convenient to them that there is a major flaw in the most common doorlocks. Specific circumstances, proper oversight ? Ripe for overreach these citizen unsafety programmes.

deleted 11y ago

[deleted]

pdkl95 11y ago

Such arrogant hubris: Here, [Special Agent] Alfin starts an analogy for software vulnerabilities: that of a flaw in a lock. “In layman's terms, an ‘exploit’ could be thought of as a defect in a lock that would allow someone with the proper tool to unlock it without possessing the key,” he writes. He admits that there is a flaw, but no mention at all that the flaw should be fixed? If one person found the exploit, someone else can as well. Apparently fantasies about having a "nobus" tool are a higher priority than protecting people.

d33 11y ago
That's why I believe that there should be more energy put into genetic fuzzing of Firefox. If we managed to attach AFL to its content sniffing engine for example, I'm pretty sure it wouldn't take long to find something fun... Google doesn't seem to say that anybody officially tried it so far: https://encrypted.google.com/search?hl=pl&q=afl-fuzz%20firefox https://encrypted.google.com/search?hl=pl&q=afl-fuzz%20firef...

DominoTree 11y ago

Pretty sure that just about everyone is hoarding Firefox 0days :P

unlinker 11y ago
That's my thought too. I'm sure most of the so-called "security experts" who like to talk about how important privacy and security are for the rest of us are sitting on lots of 0-days.
- wldcordeiro 11y ago
  Right? There are too many valuable bug bounties and interested parties for people to divulge the best exploits. Those are all probably still in the wild and will remain that way until the right buyer appears.

vox_mollis 11y ago

May be? They almost certainly are stockpiling them.

anonnyj 11y ago

"hoarding" "a" Does not compute...

wldcordeiro 11y ago
Stowing away a better term for you? Yeah hoarding is usually a plural reference but you know what the article meant.
- plorg 11y ago
  More like "reserving". Clearly they're actually using the exploit in question. I would associate "stowing away" or "hoarding" with hiding or putting a later circumstance. In any case, the original title ("FBI Is Pushing Back Against Judge's Order to Reveal Tor Browser Exploit") is more informative and less click-baity. There's a reason that's HN's preferred style.