4 ms·

Can't companies already be compelled to push updates to select devices adding a decrypted sidechannel to "e2e encrypted" apps, effectively providing a wiretap w

Can't companies already be compelled to push updates to select devices adding a decrypted sidechannel to "e2e encrypted" apps, effectively providing a wiretap when a warrant is in hand? There's no need to weaken the encryption at all when end-users don't actually control the software they run day-to-day. Just replace the software while they're asleep.

suizi 6y ago
Part of the point of end-to-end encryption is that you explicitly don't trust these companies. Would anyone be willing to trust them if they went around pushing malware on a whim?
jonny_eh 6y ago
> Can't companies already be compelled to push updates to select devices Nope. Can you link to an example?
- pengaru 6y ago
  Lavabit shut its doors to not comply with such requests.
- LinuxBender 6y ago
  I do not have a current link because the software was acquired bty AT&T and intentionally does not have a public name any more, but all phones used to have CarrierIQ. In debug mode, it could intercept any facet of code execution, network communication (pre-tls), log all finger movements, log phone movement and velocity. To put into debug mode, the phone just needs to receive a http header when it checks in for updates. It will log all the data, upload it and disable debug on a follow up header. The software can be installed over the air with no user interaction or notification. This was supposed to move to the firmware module to avoid users rooting the phone and removing it, but I honestly have no idea if or how that progressed.
- dane-pgp 6y ago
  That may be the case in Australia at least. From [0]: "if an agency were undertaking an investigation into an act of terrorism and a provider was capable of removing encryption from the device of a terrorism suspect without weakening other devices in the market then the provider could be compelled under a technical assistance notice to provide help to the agency by removing the electronic protection" As for the US, I wouldn't be surprised if the government has sought to achieve something like this using the All Writs Act[1]. However, in the recent case of Facebook helping the FBI with a targeted use of a vulnerability[2], it seems that they cooperated voluntarily, even paying a third party contractor to help. [0] https://www.computerworld.com/article/3460071/encryption-has-the-government-stuck-to-its-no-backdoors-pledge.html https://www.computerworld.com/article/3460071/encryption-has... [1] https://en.wikipedia.org/wiki/All_Writs_Act#Application_to_electronic_devices https://en.wikipedia.org/wiki/All_Writs_Act#Application_to_e... [2] https://gizmodo.com/report-facebook-helped-the-fbi-exploit-vulnerability-i-1843988377 https://gizmodo.com/report-facebook-helped-the-fbi-exploit-v...

suizi 6y ago

Part of the point of end-to-end encryption is that you explicitly don't trust these companies. Would anyone be willing to trust them if they went around pushing malware on a whim?

jonny_eh 6y ago

> Can't companies already be compelled to push updates to select devices Nope. Can you link to an example?

pengaru 6y ago
Lavabit shut its doors to not comply with such requests.
LinuxBender 6y ago
I do not have a current link because the software was acquired bty AT&T and intentionally does not have a public name any more, but all phones used to have CarrierIQ. In debug mode, it could intercept any facet of code execution, network communication (pre-tls), log all finger movements, log phone movement and velocity. To put into debug mode, the phone just needs to receive a http header when it checks in for updates. It will log all the data, upload it and disable debug on a follow up header. The software can be installed over the air with no user interaction or notification. This was supposed to move to the firmware module to avoid users rooting the phone and removing it, but I honestly have no idea if or how that progressed.
dane-pgp 6y ago
That may be the case in Australia at least. From [0]: "if an agency were undertaking an investigation into an act of terrorism and a provider was capable of removing encryption from the device of a terrorism suspect without weakening other devices in the market then the provider could be compelled under a technical assistance notice to provide help to the agency by removing the electronic protection" As for the US, I wouldn't be surprised if the government has sought to achieve something like this using the All Writs Act[1]. However, in the recent case of Facebook helping the FBI with a targeted use of a vulnerability[2], it seems that they cooperated voluntarily, even paying a third party contractor to help. [0] https://www.computerworld.com/article/3460071/encryption-has-the-government-stuck-to-its-no-backdoors-pledge.html https://www.computerworld.com/article/3460071/encryption-has... [1] https://en.wikipedia.org/wiki/All_Writs_Act#Application_to_electronic_devices https://en.wikipedia.org/wiki/All_Writs_Act#Application_to_e... [2] https://gizmodo.com/report-facebook-helped-the-fbi-exploit-vulnerability-i-1843988377 https://gizmodo.com/report-facebook-helped-the-fbi-exploit-v...