6 ms·
You can build yourself such a rifle, or maybe even ten of them, but you can't build and sell a billion. The points of control are pretty easy to find in a cont
by idlewords 9y ago
You can build yourself such a rifle, or maybe even ten of them, but you can't build and sell a billion.
The points of control are pretty easy to find in a context where the Internet is run by a dozen large companies all headquartered in the United States.
- pcwalton 9y agoBut we're talking about relatively simple algorithms here. Not even iOS prevents you from, say, running crypto written in Javascript (as ill-advised as that is). Gun control is far easier than controlling AES.
- tptacek 9y agoThey don't want to control AES. I think they want the defaults used by commercial devices to be subject to court order. They can deal with the idea that suspects can arrange to protect their communications; they've been dealing with that for centuries. What they have a hard time with is when all communications everywhere are irrevocably protected without trying.
- jessaustin 9y agoThis seems to admit what many suspect: the purpose of this exercise is not to catch criminals, who as you indicate will have good crypto even when good crypto is criminal. The purpose is to surveil normal citizens, all the time.
- bwaldrep 9y agoI don't think such an admission necessarily follows. It has always been possible for determined criminals to invest enough time and caution to make their communications prohibitively expensive to intercept. The vast majority do not do so. Everyone (criminals included!) have to make decisions about the tradeoffs in time, effort, and convenience they're willing to make for security. Changing the default level of security enabled out of the box on commercial devices changes that calculus. It's possible to simultaneously believe that the FBI should not surveil normal citizens all the time, criminals do have the ability to secure their communications to an arbitrary degree if they make the effort, and the default level of security your iPhone provides should be less than "requires nation-state level resources in order to comply with a lawful search warrant."
- jessaustin 9y agoLet us stipulate that dumb (unsophisticated, foolish, intemperate, whatever) criminals exist. Is it now your argument that LEOs especially need help catching these dumb ones, who would actually be coordinating their criminal activities via cheapest-commercially-available non-burner smartphones with original ROMs? Are they just forgetting entirely the smart criminals who have hired someone to root their equipment? Know your limits, I suppose. That's nonsense, of course. They'll continue to catch the dumb ones the way they always have: when the criminal screws up and a cop whose shift is still young just happens to be around. They'll continue to catch the smart criminals only very rarely, when someone with enough clout gets pissed off enough. They'll continue to "catch" innocents all day every day, only now they'll have more circumstantial "evidence" of the "this guy googled TVs last month; he was obviously trying to decide which TVs to steal" variety. This is why the Founders wrote the Fourth Amendment.
- tptacek 9y agoYes: I believe the overriding concern is that smartphone vendors have defaulted people who don't ever think about comsec to extremely strong comsec.
- jessaustin 9y agoSort of like automobile manufacturers, who with all their airbags and crumple zones have defaulted drivers who don't ever think about safety to extremely strong safety. It's really disheartening, to read security professionals hoping to deny security to regular people. I guess I'm somewhat mollified that you've stopped pretending this is about catching criminals.
- idlewords 9y agoSome of the people getting this unbreakable security by default are really, really bad people, and we want the police to be able to catch them.
- 9y ago
- littlestymaar 9y agoYou can buid a riffle by yourself but I can't copy-paste yours, with code that's a huge deal.