5 ms·

> GrayKey, which counts an ex-Apple security engineer among its founders How is it possible for someone to start a business built on breaking the security syst

• eridius 8y ago
  Why would it be unethical to get a job trying to break the security you previously helped implement? Security is not accomplished via obscurity so it's not like there's a trade secret issue here. Really the only problem I can think of is if you put backdoors or weaknesses into the system with the expectation of being hired later to defeat the same system. But the problem there is the fact that you deliberately crippled the system you were building and not the fact that you were hired later to defeat it.
  • chongli 8y ago
    It becomes unethical as soon as you discover the vulnerability and refuse to disclose it. It's like if you have a key to an apartment and you move out without the landlord asking for it back. It's not unethical if you then discover that the key still works. It becomes unethical when you do not disclose this fact. Worse still if you start making copies of the key and selling it to people who intend to break into that apartment.
    • mywacaday 8y ago
      Agree its unethical to not disclose but if thats your business model I guess you don't care. In the landlord example my argument is that the landlord is being unethical, locks should be changed.
      • chongli 8y ago
        Maybe the landlord usually changes the locks but forgot this time? Heck, think about a quiet suburban neighbourhood. If someone forgets to lock their doors at night and they get robbed, it's still the burglar's fault for committing the crime. One of the guiding principles of ethics I follow is Kant's "ought implies can" [1]. If you make a mistake and forget to do something, that's not the same as deliberately choosing not to do it. All humans make mistakes of this kind. To imply otherwise is to imply that a person could rise above all of humanity. That is asking far too much. [1] https://en.wikipedia.org/wiki/Ought_implies_can https://en.wikipedia.org/wiki/Ought_implies_can
    • snowwrestler 8y ago
      I think the ethics depend heavily on when a flaw was discovered. If this person knew of a flaw when at Apple, and did not disclose it to Apple (his employer), but instead left to go exploit it--that would be clearly unethical and possibly even illegal. But if they left, and then, as an ex-employee of Apple, discovered a new flaw in Apple's security... how are they any different from a random person who never worked at Apple? Do security researchers have a general ethical obligation to disclose a product's security flaws to the company who created it? I think most security researchers would say no... the obligation is more rightly put on the company itself to produce secure products. Company managers don't generally have an ethical obligation to their ex-employees after the employment period ends. It doesn't seem fair to say that ex-employees should be obligated toward their former employer. The exception would be if they acted unethically while employed there and then reaped the benefits later. Or look at it this way--imagine an employee of GrayKey went to Apple, and then learned how Apple is defeating GrayKey. Does that employee have an ethical obligation to tell GrayKey about that? If ethics don't work the same in both directions, they're probably not strong ethics. That is, unless there is some higher moral at stake, like "breaking security is always wrong." But even that is problematic because if you never try to break security, it never gets better.
      • chongli 8y ago
        I think the ethics depend heavily on when a flaw was discovered. If this person knew of a flaw when at Apple, and did not disclose it to Apple (his employer), but instead left to go exploit it--that would be clearly unethical and possibly even illegal. But if they left, and then, as an ex-employee of Apple, discovered a new flaw in Apple's security... how are they any different from a random person who never worked at Apple? They are still different from the average person on the street. Security is more than just the binary flaw/no flaw distinction. Perhaps while working at Apple the researcher knew about some old libraries that were still in production release but had not been worked on, let alone updated in years? That sort of insider knowledge could help them find exploits the average person wouldn't think of. GrayKey is a completely unethical company. They are selling unauthorized access to people's devices. The fact that their main clients are law enforcement officers is irrelevant. I can't believe you'd suggest that Apple is in the wrong for hindering GrayKey's efforts. Am I in the wrong for changing the locks on my door to hinder burglars? Security flaws are ticking time bombs that threaten all of society. Discovering them and exploiting them rather than helping to fix them is ethically akin to discovering chemical or biological weapons and helping to put them into use.
• ghettoimp 8y ago
  Yeah, even aside from ethics, I really don't understand how building a GrayKey device is even legal. Can't Apple sue them under the DMCA or something?
  • ynniv 8y ago
    Better to let them build their boxes, then fix the loopholes they're using. You can't legislate real security.
• mikeash 8y ago
  The basic principle of modern security is that a secure system must be secure even if an attacker knows all aspects of the system’s design. This is what warnings against “security by obscurity” are referring to. The only ethical breach I see here would be if they deliberately weakened the system so that they could break it later, which seems unlikely.
  • londons_explore 8y ago
    Someone smart in this position would 'accidentally forget' to document and fix a bug he/she discovers while scouring the source code. Then leave Apple and join another company and proceed to 'rediscover' it.
    • dev_dull 8y ago
      Then they fix the bug and his leverage disappears.