8 ms·
Justice Dept. Revives Push to Mandate a Way to Unlock Phones
- braderhart 9y agoHow do you have secure encryption with proprietary backdoors? Maybe this will wake people up to only using open source operating systems.
- ISL 9y agoAny encryption scheme with a backdoor is insecure, by definition.
- gizmo686 9y agoNot if you change the security definition. Which they will. All they are asking for is some form of key escrow; which can (and has) been given a reasonable security definition. The problem is that secure implementations of key escrow are much harder; and (given the amount of use the escrowed key will get), certainly going to be broken in practice.
- braderhart 9y agoDo you have examples?
- ajross 9y agoAndroid, at least the parts that would be required to be modified to implement this misfeature, is already open source. That won't help. The DoJ isn't asking for proprietary code secrecy, fundamentally they're asking for key escrow. Storing data in different places isn't something source visibility can address.
- forapurpose 9y ago> Maybe this will wake people up to only using open source operating systems. OS security has limited impact when other subsystems, not in control of the OS, run on the device.
- braderhart 9y agoDo you have examples and agreed that things like forcing Intel ME do not help, but please note that many of these partially rely on proprietary Windows drivers.
- PrivacyPro1 9y agoLinux has never been hacked. By gosh, you're right!
- rdl 9y agoTrump's election should really have been the last nail in the coffin on this kind of stuff, at least in the US. Either you hate him (and thus don't want him or anyone like him in the future to have this kind of access), or you love him and don't want anyone who hates him to ever gain this kind of access. A polarizing political figure should erode trust in unrestrained state power unless you believe he's the last President ever.
- akatechis 9y agoTrump did nothing wrong.
- jacquesm 9y ago> A polarizing political figure should erode trust in unrestrained state power unless you believe he's the last President ever. How big a percentage of the electorate would back canceling the next election cycle?
- enraged_camel 9y agoFrom my casual observations and conversations with people, I would guess 20% would at least support postponing the next election cycle purely on the basis of “voter fraud” conspiracy nonsense that Fox News et al peddle.
- rdl 9y agoThat to me seems like the biggest problem with parliamentary systems (which have many other advantages, especially for new parties, local constituencies, etc.). Unless there's a sovereign, or some other system, it's often left up to the sitting government to decide when elections will be called.
- IAmEveryone 9y agoThat's not true for most parliamentary systems. In fact it's only customary in the UK to arbitrarily call elections when poll numbers are up. But even in the UK, there is obviously a maximum term between elections. And calling elections without reason isn't actually possible anymore. Theresa May had to jump through some hoops to almost lose her majority last summer. In the US, a president who leaves office before the expiration of their term is replaced by the Vice President (or the next in the line of succession if there is no Vice President). In Germany, a chancellor can only recalled by electing a replacement. If they resign or die, the President gets to make a few decision, and they will usually task the leader of the largest party to find themselves a majority. Only after two or three failures of that process would a President turn to early elections.
- JumpCrisscross 9y agoApple, Amazon, Netflix and Google will need to work hard to distance themselves from Facebook in the public imagination. They’re presently all “big tech” FAANGs. Until that happens, Silicon Valley’s political priorities will suffer in D.C.
- apotheothesomai 9y agoWhile the political priorities of telecoms, oil companies, the pharmaceutical cartel, and banking continue to set the political agenda. Sure, that makes sense. Let's ignore one of the larger sections of our economy and opt to punish the bad actors at the expense of the whole industry in this one sector alone.
- JumpCrisscross 9y agoTech countered many political interests. With tech weakened, the interests they were defending have no defences. We must reform money’s role in our democracy, but basic political balances are intrinsic to the game. In retrospect, privacy advocates may have relied too heavily on the support of a single segment.
- stevemk14ebr 9y agoI like the idea of focusing on the device problem rather than the transport problem. I'm personally completely ok with the special devices specific unlock code suggested. It's not universal, and requires the government to go through the company first who at some level at least have a stake in me believing my device is secure. The insentives seem to work and I still have reasonable security.
- wyager 9y ago> I still have reasonable security. Backdoored “security” is in no way reasonable. It’s essentially not security at all.
- jacquesm 9y agoSecurity is pretty binary in this sense. It is either secure or it isn´t.
- deleted 9y ago[deleted]
- cellis 9y agoNice try, FBI
- mtgx 9y agoThis will undo all efforts so far that tried to deter thieves from stealing iPhones and expensive Android phones.
- naasking 9y ago> The insentives seem to work and I still have reasonable security. Sure, let's just have Equifax store this data. They're good at protecting confidential information right? or maybe Facebook? I think you have an unreasonably low threshold for what qualifies as "reasonable security".
- IBM 9y agoI think some type of "lawful access" was inevitable. Law enforcement all over the world weren't going to just let the status quo fly. If it's going to happen hopefully Apple can do some jujutsu and get GDPR in the US out of it as part of an omnibus bill [1]. [1] https://www.bloomberg.com/news/articles/2018-03-24/apple-s-tim-cook-calls-for-more-regulations-on-data-privacy https://www.bloomberg.com/news/articles/2018-03-24/apple-s-t...
- mtgx 9y agoNothing is "inevitable". Laws are constructs of society, ultimately. Cutting hands for stealing, death penalty for smoking marijuana, forcing people to not use end-to-end encryption - it can all be undone by a vigilant and activist society. If everyone has a self-defeatist "inevitable" attitude on the other hand...
- IBM 9y agoDon't get me wrong, I hope Apple (and the rest of the tech industry) try to kill the baby in the crib. But it'd be sticking your head in the sand and intellectually dishonest to say that law enforcement doesn't have a legitimate interest in pursuing this and are just going to give up because some tech people say it shouldn't happen. At least this way something of value is gained.
- 18pfsmt 9y agoWe already have the safest, most prosperous society in human history. We need to stop taking individual freedoms away just to move the needle a fraction of a percent.
- kabdib 9y agoLaw enforcement also has a legitimate interest in being able to walk into my house, examine and copy my stuff, and make sure I'm not doing anything against the law. They also have a legitimate interest in stopping me on the street at random and demanding my identity, proof of citizenship, a blood sample (to make sure I'm not doing any drugs that are against the law), and a list of the people that I've talked to today, and about what subjects. Oh, that's not "legitimate"? I've seen serious proposals for those in the past few years, and not a few actual instances. All invoking the L-word. What do people mean by "legitimate" then? Mostly, I see it as begging the question, an attempt to redefine and color the argument. Of course their interests are "legitimate" -- whose are not? Does passing a law make something legitimate? What about an unconstitutional law? History has proven that capabilities like the ones proposed are always abused by power, and that compromised security systems grow more compromised over time. My head is not in the sand.
- zrb05293 9y agoWow. One of the people working on this is a former security guy at Intel. Makes me wonder if meltdown and specter were engineered into chips on purpose.
- grzm 9y agoWithout other evidence pointing to deliberate design of the flaws, it's reasonable to think that an expert on security would be hired by Intel for that expertise on security, and that they would also be someone tapped to be in a high-level group that would be looking into security issues for the government. You can definitely disagree with the goals of the Justice Department and those involved in this matter without also attributing deliberately introducing flaws that resulting in Meltdown and Spectre.
- DerekL 9y agoMeltdown and Spectre aren't backdoors or simple mistakes. They are the unforeseen consequences of speculative execution. Also, other companies' processors are affected too.
- rdl 9y agoSpectre/Meltdown aren't the "tinfoil" (which might actually be legitimate) fears in Intel -- those are probably Intel Management Engine/AMT/etc. and general supply chain risk (maybe Intel processors in general are safe, but if you're a target, maybe the machines you order are "special" -- although making special CPUs in the latest process, especially if you're not Intel itself, is a lot harder than making "special" versions of other chips in older process in the system.)
- bootlooped 9y agoIf all the hacks, breaches and vulnerabilities from the past 5 years have taught us anything, it should be that security is hard enough to do without weaknesses intentionally baked in.
- rgbrenner 9y agoThe debate receded when the Trump administration took office Comey was the key advocate in this during the Obama years. He spoke for years advocating backdoors... even after Trump took office. Here's an article from March 2017 when he advocated an international backdoor[0]. Here's one in May 2017 when he backed Feinsteins decrypt bill[1]. It receded because Comey was pushed out. And it took a while for Wray to come in and make it an issue again. It's worth remembering that this is not some faceless government action. They're just people who are lobbying for the change. Remember to contact your representatives regularly to advocate your position on these issues. 0. https://www.techdirt.com/articles/20170327/10121437009/james-comeys-new-idea-international-encryption-backdoor-partnership.shtml https://www.techdirt.com/articles/20170327/10121437009/james... 1. https://techcrunch.com/2017/05/03/fbi-director-comey-backs-new-feinstein-push-for-decrypt-bill/ https://techcrunch.com/2017/05/03/fbi-director-comey-backs-n...
- IBM 9y agoThe reason this story even exists is because this issue of "lawful access" is not due to any individual personalities. It's clearly a priority at an institutional level, including the White House: >Against that backdrop, law enforcement officials have revived talks inside the executive branch over whether to ask Congress to enact legislation mandating the access mechanisms. The Trump White House circulated a memo last month among security and economic agencies outlining ways to think about solving the problem, officials said.
- rgbrenner 9y agoYes, I'm sure they have found allies and people that agree with them. That doesn't mean the debate is over or lost. If everyone in government agreed on this issue, they would have passed it years ago. Obama's whitehouse was the reason the FBI never got very far on this issue. Even up until he left, all he could agree to was that it was an issue and solutions should be looked into. Obviously Trump is much more open to passing something on this than Obama was. But note Congress never put a bill on Obama's desk... even the floated Compliance with Court Orders Act of 2016 got little congressional support, and ended up never being introduced.
- pishpash 9y agoAnd here I thought it was to mandate unlocking the bootloader and radio bands, alas, power only works one way: to take away rights.
- mindslight 9y agoHaha, I was right there with you. Ah, those fleeting moments of naive optimism.
- 18pfsmt 9y agoWell, various people want the government to do something to the "other," and these people just disagree about what they want the government to force people or groups of people (i.e. corporations) to do. Others just think we should stop letting the government force anything without substantial data that indicates an actual probable reduction of some negative behavior. I think Apple has the will to fight this and I think a strong 4th amendment case can be made. Freedom of the people must be protected.
- mtgx 9y agoI'm going to bet that this law will come with a provision that says researchers that try to break or report bugs in whatever system they come up with could get jail time.
- wmf 9y agoWhat do people think about "crypto crumple zones" (basically crypto that costs $1B to brute-force)? https://www.usenix.org/node/208172 https://www.usenix.org/node/208172
- quotemstr 9y agoOkay --- I'll iterate the algorithm a thousand times. Now I'm back to respectable strength. Besides, any selective "break glass" scheme is going to be vulnerable to arguments about the need for urgent access to prevent terror or something. Either the population has access to strong crypto or it doesn't --- and technological prohibition never actually works. You may be able to make it easy to crack phones used by the naive, but you can't stop determined people writing and running software.
- FLUX-YOU 9y ago$1B isn't law enforcement cost effective for the criminals that would unknowingly use this scheme thinking it was secure. There's basically no way you convince them to use this when more secure alternatives already exist, for free.
- wpdev_63 9y agoThere are already built in backdoors. What is going on here?[0] [0]:https://thehackernews.com/2017/03/wikileaks-cia-mac-iphone-hacking.html https://thehackernews.com/2017/03/wikileaks-cia-mac-iphone-h...
- JudasGoat 9y agoI think that Apple's concessions to the Chinese government undermined the "moral high ground" that Tim Cook once stood upon.
- nkkollaw 9y agoThis is somewhat unrelated, but I really think 4-5 years terms for government anywhere in the world is way too long. You elect them, they break promises and pass all kinds of crazy laws, and still get to stay and keep doing damage for 5 years, after which they might even get elected again because most people won't remember what happened 5 years back. It might not be feasible, but a way for citizens to send everyone home easily every 1-2 years if they screw up would be beneficial.
- ashildr 9y agoSo the Justice department wants Huawei to give a key to their American customer‘s phones to the Chinese government?
- wmf 9y agoNo? That doesn't follow.
- confounded 9y agoIt kind of does. I may have misinterpreted the article, but the proposal seems to be forcing hardware and software vendors into key-escrow schemes. So the decryption key on your phone (or perhaps a key to the key, same thing AFAICT) would have to be stored by the manufacturer so that it could be accessed by various US government agencies. If it’s a Chinese company, that means the Chinese government would have access, too. And if such a law and precedent was set by the US, the likely reaction from other countries would be to enact similar laws. So, lots of people all over the world will be able decrypt your data, for lots of reasons.
- wmf 9y agoOne would hope that for phones sold in the US the keys would be escrowed somewhere that only the US could get to them. Likewise for other countries.
- confounded 9y agoAh, so no legal tests all. All keys straight to the government, for always-on, total surveillance for the entire population? I personally wouldn’t hope for that.
- wmf 9y agoNo, I didn't say that either.
- ubernostrum 9y ago
- einarfd 9y agoI would really like to be a fly on the wall, when American diplomats are going to try to explain to its allies that them having a backdoor to all cellphones in the world is a good idea. Then capping it all of by coming up with a strategy of how to sell this idea to their electorate, which some places, have a very dim view of American privacy laws. In addition if Google and Apple builds some backdoor into their products, any regime of any country which Google and Apple operates in will demand to get the same backdoor. How are they going to not give them that, they won't be able to. I'm sure the Justice Department, and the FBI does not care about foreign implications of their wishes, but their are parts of the American government that has to. It is deeply naive to believe that something like this will fly on the international stage.
- Gys 9y ago> any regime of any country which Google and Apple operates in will demand to get the same backdoor Exactly. So we end up with 1000s of people (many services from many countries) that have authorized access to your phone. This cannot be contained in any way. Not something to look forward to....
- wmf 9y agoAny backdoor would probably be per-country so you have to pay attention to what country your phone is registered in.
- confounded 9y agoWhy do you think this? The manufacturer is obliged to maintain a backdoor, and give access on demand. The US is a big enough market that they could force this to be built. Other countries will just write similar laws to get the same access to the same backdoors.
- Gys 9y ago'Sorry Mr NSA, but the user choose German as UI language, so we only enabled the German backdoor'. Sure...
- 9y ago
- JoshMnem 9y agoI was hoping that it was going to be an article about how users should be able to unlock their own phones and get root access without any risk of bricking them.
- emh68 9y agoWhy would the government push an backdoor that would expose their own citizens to more hacking? Almost seems like they’re just trying to look tough on crime but won’t actually do it.
- jliptzin 9y agoWhy do we need this? If this has been such a huge problem for them over the last decade shouldn’t we have seen a rise in crime rates because criminals are having an easier time getting away? Seems like it’s been the opposite.
- PrivacyPro1 9y agoThe way to get support is to make it about catching child pornographers and "human traffickers". Nobody wants to be against that, and there's bipartisan support. The reason to fear this, of course, is if there's a backdoor, hackers will find it. Period.
- tracker1 9y agoThe question I have for anyone pushing for this, is do you want a foreign gov't to have the same access? Because as soon as you require this in the US, that's exactly what will happen.
- tracker1 9y agoJust to be clear, these guys are in favor of China, Russia, Iran and ISIS having back doors into devices used in the US for communication of potentially very privileged information. Once backdoors are introduced, that is the outcome that will come of this.
- IAmEveryone 9y agoThere's a lot of conspiracies and security absolutism in this thread. So while I agree that this policy is misguided, I think it's important for the community to address the actual issues raised, and not some strawmen about the government preparing to enslave all citizen etc. Imagine you're a high-minded, fair, and absolutely law-abiding FBI officer charged with solving some white collar crime, like corruption or fraud. You started some time in the 80s. The usual MO was to get a warrant and search someone's house and office. You'd find 60 to 100 binders full of letters, transaction records, and org charts for this criminal enterprise you're investigation. Today, you find an iPhone and a smug banker telling you take it. "The new model is coming out anyway." Then, he orders a Vodka Soda from his butler and you slink out, iPhone in hand. Just to be clear (again): I absolutely do not think that this scenario is reason enough to mandate backdoors. But I am similarly convinced that it happens, probably quite often. And that it would be rather frustrating to deal with. It will be far easier to convince people if we start acknowledging what they already think to be true, to avoid hyperbole, and not to obscure our real motivation behind some rather ridiculous claims of technical impossibility[0[. [0[: bitcoin already has 2-of-3 multisig, so 1-of-2 shouldn't really be impossible if anybody, you know, tried