6 ms·

FBI Drive for Encryption Backdoors is Déjà vu for Security Experts

33 points by araneae 16y ago

lhnz 16y ago
What kind of security is offered by a service with a backdoor?
- jerf 16y ago
  False.
- ergo98 16y ago
  It depends upon the implementation of the "backdoor": If the government had a heavily guarded server that held the only copy of a private key that was the pair of a public key that all asymmetric encryption added as a mandatory target (just like a PGP recovery key in the enterprise), and law enforcement could pass messages through it, with a coupled court order and with civilian oversight, and public text popped out, it could be secure. But that isn't how they would do it.
jambo 16y ago
>FBI’s general counsel Valerie Caproni told the New York Times that companies “can promise strong encryption. They just need to figure out how they can provide us plain text.” Replace the second sentence with: "They just need to be lying." Doublespeak at its finest.
fleitz 16y ago
As long as the public are provided the keys and access to encrypted FBI documents I think it's a great idea. It will vastly improve citizens ability to help the FBI ensure compliance with state, federal, and constitutional mandates. Also, stopping advocacy for such backdoors into citizens encryption will help the FBI uphold the people's rights as outlined in the 4th amendment, unfortunately no such protection exists for the Government in the constitution.
zaphar 16y ago
I don't get how this is even feasible? I mean maybe you can get some companies to implement the backdoors and fulfill the requirements of the law while simultaneously making themselves vulnerable to a whole new class of security holes. But that won't solve the FBI's problem. There is no way you will ever get GPG or openssh to do this. And therefore no way you would possibly harm that Mob Boss who will be using GPG not PGP or some other commercial encryption scheme. The internet has already broken this for the FBI they need to adapt or live with it.
- tseabrooks 16y ago
  What the law would do is make everyone using an encryption tool (Such as OpenSSH or GPG) a criminal... It's like the Eric Schmidt Quote: " If you have something that you don't want anyone to know, maybe you shouldn't be doing it in the first place. " The laws that would arise would make anyone with a desire for REAL privacy an immediate criminal. I don't use Twitter but if I did I'd tag this with #fail.
  - LiveTheDream 16y ago
    "There's no way to rule innocent men. The only power any government has is the power to crack down on criminals. Well, when there aren't enough criminals, one makes them. One declares so many things to be a crime that it becomes impossible to live without breaking laws." -- Ayn Rand, "Atlas Shrugged"
  - tptacek 16y ago
    It is flagrantly unlikely that this law would outlaw OpenSSH or GPG, or in any way change the way normal people use OpenSSH or GPG. I say "unlikely", a hedging word, which you did not use, because nobody knows what this proposal actually contains, because it hasn't been disclosed yet. The probability that the federal government could outlaw OpenSSH is epsilon. You can don the tinfoil hat and argue anything, but the reality is that the government cannot outlaw or even substantially influence the IT practices of all five hundred of the Fortune 500. So, at the risk of sounding like Vizzini, clearly, the objective here can't simply be to outlaw cryptography, because that is an untenable proposition. What is substantially more likely is that the DoJ wants RIM and Skype to build CALEA-style systems so that BBM's and Skype calls don't constitute an immediate exemption from all wiretaps. Call it the "criminals should not be secure from wiretaps by default" proposition. Before you geek out about how you could (say) use OpenSSH to build a non-wiretappable voice network, remember that the people writing and arguing for these proposals are not geeks, and they do not care.
pstuart 16y ago
They should first be able to handle their own data before asking for favors: http://www.infoworld.com/d/developer-world/anatomy-it-disaster-how-fbi-blew-it-243 http://www.infoworld.com/d/developer-world/anatomy-it-disast...

33 points by araneae 16y ago

lhnz 16y ago

What kind of security is offered by a service with a backdoor?

jerf 16y ago
False.
ergo98 16y ago
It depends upon the implementation of the "backdoor": If the government had a heavily guarded server that held the only copy of a private key that was the pair of a public key that all asymmetric encryption added as a mandatory target (just like a PGP recovery key in the enterprise), and law enforcement could pass messages through it, with a coupled court order and with civilian oversight, and public text popped out, it could be secure. But that isn't how they would do it.

jambo 16y ago

>FBI’s general counsel Valerie Caproni told the New York Times that companies “can promise strong encryption. They just need to figure out how they can provide us plain text.” Replace the second sentence with: "They just need to be lying." Doublespeak at its finest.

fleitz 16y ago

As long as the public are provided the keys and access to encrypted FBI documents I think it's a great idea. It will vastly improve citizens ability to help the FBI ensure compliance with state, federal, and constitutional mandates. Also, stopping advocacy for such backdoors into citizens encryption will help the FBI uphold the people's rights as outlined in the 4th amendment, unfortunately no such protection exists for the Government in the constitution.

zaphar 16y ago

I don't get how this is even feasible? I mean maybe you can get some companies to implement the backdoors and fulfill the requirements of the law while simultaneously making themselves vulnerable to a whole new class of security holes. But that won't solve the FBI's problem. There is no way you will ever get GPG or openssh to do this. And therefore no way you would possibly harm that Mob Boss who will be using GPG not PGP or some other commercial encryption scheme. The internet has already broken this for the FBI they need to adapt or live with it.

tseabrooks 16y ago
What the law would do is make everyone using an encryption tool (Such as OpenSSH or GPG) a criminal... It's like the Eric Schmidt Quote: " If you have something that you don't want anyone to know, maybe you shouldn't be doing it in the first place. " The laws that would arise would make anyone with a desire for REAL privacy an immediate criminal. I don't use Twitter but if I did I'd tag this with #fail.
- LiveTheDream 16y ago
  "There's no way to rule innocent men. The only power any government has is the power to crack down on criminals. Well, when there aren't enough criminals, one makes them. One declares so many things to be a crime that it becomes impossible to live without breaking laws." -- Ayn Rand, "Atlas Shrugged"
- tptacek 16y ago
  It is flagrantly unlikely that this law would outlaw OpenSSH or GPG, or in any way change the way normal people use OpenSSH or GPG. I say "unlikely", a hedging word, which you did not use, because nobody knows what this proposal actually contains, because it hasn't been disclosed yet. The probability that the federal government could outlaw OpenSSH is epsilon. You can don the tinfoil hat and argue anything, but the reality is that the government cannot outlaw or even substantially influence the IT practices of all five hundred of the Fortune 500. So, at the risk of sounding like Vizzini, clearly, the objective here can't simply be to outlaw cryptography, because that is an untenable proposition. What is substantially more likely is that the DoJ wants RIM and Skype to build CALEA-style systems so that BBM's and Skype calls don't constitute an immediate exemption from all wiretaps. Call it the "criminals should not be secure from wiretaps by default" proposition. Before you geek out about how you could (say) use OpenSSH to build a non-wiretappable voice network, remember that the people writing and arguing for these proposals are not geeks, and they do not care.

pstuart 16y ago

They should first be able to handle their own data before asking for favors: http://www.infoworld.com/d/developer-world/anatomy-it-disaster-how-fbi-blew-it-243 http://www.infoworld.com/d/developer-world/anatomy-it-disast...