3 ms·

Or in other words, an article I wrote a while back explaining (to complete idiots) why a security backdoor is a bad idea in general. Why no, you can't 'have an

by CM30 10y ago

Or in other words, an article I wrote a while back explaining (to complete idiots) why a security backdoor is a bad idea in general. Why no, you can't 'have an encryption hole just for police/authorities to use'. Perhaps a few politicians may even reconsider their attitudes towards encryption and security in general. Eh, probably not.

panzer_wyrm 10y ago
Iphones have built in security backdoor called trust apple code signing. That is the foundation of their walled garden. So far Apple seem to protect it pretty well. They show that only the good guys can control the backdoor argument is not without merit.
- Retric 10y ago
  For one system, over a few years when few people are trying to break in sure. But, the history of those trusted systems is terrible overall. Look at video game consoles for example and it's not just one or two that but all the major companies that tried generally several times each. EX: https://nakedsecurity.sophos.com/2012/10/25/sony-ps3-hacked-for-good-master-keys-revealed/ https://nakedsecurity.sophos.com/2012/10/25/sony-ps3-hacked-... And no the US government has not done much better.
  - panzer_wyrm 10y ago
    I do not support the walled garden, mandatory code signing from anybody but the owner and so on. People should control their devices. I just point that apple show that keeping keys really works. I don't think that console jailbreaks are from leaked keys (except ps3) but from normal exploits.
    - Retric 10y ago
      There has been several different leaked keys for different systems. Remember, Blue Ray had the same issue five different times in 06, 08, 09, 11, and 12. https://en.wikipedia.org/wiki/AACS_encryption_key_controversy https://en.wikipedia.org/wiki/AACS_encryption_key_controvers... Also, maintaining back doors would be a significantly harder problem than just keeping keys on a server used to sign things. Apple can for example keep the keys on an offline private server, but that's not really viable if 10 or 100's of thousands of people across multiple agency's of state, local, and federal law enforcement need access to break into things. Worse you could quickly find nobody outside the US would be willing to use our software or services.
  - deleted 10y ago
    [deleted]
  - CM30 10y ago
    Another example along those lines is the NES Classic Mini. Doesn't connect to the internet, doesn't let you write anything to the console and doesn't come with anything like games to buy or extra storage mediums to use. Yet within weeks, people had hacked it wide open and stuck hundreds of ROMs on it.
- marcosdumay 10y ago
  > So far Apple seem to protect it pretty well. That we know of. It's also important to remember that the only public trial against that backdoor was only for show, and despite not officially breaking it, the attacker got everything on the phone anyway.
deleted 10y ago
[deleted]
corpMaverick 10y ago
Politians should be the first to worry about privacy. 1 - They are not guaranteed to always be in power. 2 - They will be the first to be targeted. 3 - They have the most to lose. I just don't understand why they don't care about it.
- 3131s 10y ago
  And we should worry about our politician's security too. What if they are blackmailed while in power? That creates a terrible national security situation. This line of argument would hopefully resonate with the constituencies of the politicians pushing hardest for these backdoors (although it's a fairly bipartisan effort).
  - pbhjpbhj 10y ago
    With backdoors, which I'm not advocating for incidentally, the TLAs know they're being blackmailed and can intervene. Without that access politicians can still be blackmailed but it's harder for the TLAs to know about it.
    - 3131s 10y ago
      Is that necessarily true? With a scheme like key escrow, is there a sure-fire way to detect a hacker as opposed to an authorized user accessing data? At the very least it seems that if the NSA itself or some other agency were hacked (again) then this problem would still exist. The NSA has notably lacked this type of audit trail in their systems before, hence their inability to track Snowden.
- white-flame 10y ago
  Congress was absolutely aghast when they found out they were being spied on by the three letter agencies, whenever they met with foreign representatives. But they don't care at all when it's applied to the general public, because they assume they'll have clout or connections to keep that at bay. I've never heard anything come out of that above kerfuffle, presumably because there was some backroom dealing done to ensure it's not a problem for them specifically.

by CM30 10y ago

panzer_wyrm 10y ago

Iphones have built in security backdoor called trust apple code signing. That is the foundation of their walled garden. So far Apple seem to protect it pretty well. They show that only the good guys can control the backdoor argument is not without merit.

Retric 10y ago
For one system, over a few years when few people are trying to break in sure. But, the history of those trusted systems is terrible overall. Look at video game consoles for example and it's not just one or two that but all the major companies that tried generally several times each. EX: https://nakedsecurity.sophos.com/2012/10/25/sony-ps3-hacked-for-good-master-keys-revealed/ https://nakedsecurity.sophos.com/2012/10/25/sony-ps3-hacked-... And no the US government has not done much better.
- panzer_wyrm 10y ago
  I do not support the walled garden, mandatory code signing from anybody but the owner and so on. People should control their devices. I just point that apple show that keeping keys really works. I don't think that console jailbreaks are from leaked keys (except ps3) but from normal exploits.
  - Retric 10y ago
    There has been several different leaked keys for different systems. Remember, Blue Ray had the same issue five different times in 06, 08, 09, 11, and 12. https://en.wikipedia.org/wiki/AACS_encryption_key_controversy https://en.wikipedia.org/wiki/AACS_encryption_key_controvers... Also, maintaining back doors would be a significantly harder problem than just keeping keys on a server used to sign things. Apple can for example keep the keys on an offline private server, but that's not really viable if 10 or 100's of thousands of people across multiple agency's of state, local, and federal law enforcement need access to break into things. Worse you could quickly find nobody outside the US would be willing to use our software or services.
- deleted 10y ago
  [deleted]
- CM30 10y ago
  Another example along those lines is the NES Classic Mini. Doesn't connect to the internet, doesn't let you write anything to the console and doesn't come with anything like games to buy or extra storage mediums to use. Yet within weeks, people had hacked it wide open and stuck hundreds of ROMs on it.
marcosdumay 10y ago
> So far Apple seem to protect it pretty well. That we know of. It's also important to remember that the only public trial against that backdoor was only for show, and despite not officially breaking it, the attacker got everything on the phone anyway.

deleted 10y ago

[deleted]

corpMaverick 10y ago

Politians should be the first to worry about privacy. 1 - They are not guaranteed to always be in power. 2 - They will be the first to be targeted. 3 - They have the most to lose. I just don't understand why they don't care about it.

3131s 10y ago
And we should worry about our politician's security too. What if they are blackmailed while in power? That creates a terrible national security situation. This line of argument would hopefully resonate with the constituencies of the politicians pushing hardest for these backdoors (although it's a fairly bipartisan effort).
- pbhjpbhj 10y ago
  With backdoors, which I'm not advocating for incidentally, the TLAs know they're being blackmailed and can intervene. Without that access politicians can still be blackmailed but it's harder for the TLAs to know about it.
  - 3131s 10y ago
    Is that necessarily true? With a scheme like key escrow, is there a sure-fire way to detect a hacker as opposed to an authorized user accessing data? At the very least it seems that if the NSA itself or some other agency were hacked (again) then this problem would still exist. The NSA has notably lacked this type of audit trail in their systems before, hence their inability to track Snowden.
white-flame 10y ago
Congress was absolutely aghast when they found out they were being spied on by the three letter agencies, whenever they met with foreign representatives. But they don't care at all when it's applied to the general public, because they assume they'll have clout or connections to keep that at bay. I've never heard anything come out of that above kerfuffle, presumably because there was some backroom dealing done to ensure it's not a problem for them specifically.