3 ms·
Ask HN: Government back doors, would you rather?
Ignoring, for the sake of specificity in discussion, the alternatives such as “no back doors ever”, using whatever reasoning you want for how the false dichotomy may hypothetically arise (mine being a what-if scenario: what if a domestic US warrant were acquired to bug a physical residence of an entity with video surveillance and the equivalent were needed for electronic residence), would you rather:
Have a government backdoor to encryption?
OR
Have a government backdoor to screen capture?
I know the question is heavily loaded, but I’m curious as to where warrant-based screen capturing would be placed relative to warrant-based encryption back doors.
- austincheney 6y agoSince almost nobody bothers to encrypt their personal data at rest I don’t see the need for a backdoor. If, via a warrant, you have physical access to the hardware you have all you need, in most cases.
- 9wzYQbTYsAIc 6y agoNoted I’m thinking of e2e encrypted mobile messaging, probably obviously in the context of federal investigations of conspiracy to commit sedition, insurrection, or treason. In that scenario, I don’t think physical access to the hardware would necessarily lead to the same result as physical access to a laptop, for example.
- nness 6y ago"Have a government backdoor to screen capture?" would probably be the least disruptive for two assumptions: 1. They can only see what you're currently doing, not see everything you have ever done, which I assume because: 2. They can't record everyone forever as storage would be insane, and right now, a backdoor to encryption avoids that issue by just using the company's storage. (Assuming a "NSA style wiretap" operation and not a court-ordered surveillance)
- LinuxBender 6y agoAnd the framework for this already exists. Each of the browsers has an addon built in and an API to do screen captures. All you would need is a file storage API like Firefox send, a remote trigger piggy backing on something like DoH and Bob's your uncle.
- 9wzYQbTYsAIc 6y agoProbably similar APIs within the mobile operating systems, too.
- 9wzYQbTYsAIc 6y agoI hadn’t thought of it from the perspective of historical data, thanks for that insight. The existence of a law enforcement tool to watch the screen of a specific device at a specific set of times does seem more palatable than the existence of such a tool to decrypt any data stream. 1. Arbitrarily constrains the surveillance to taps on the device itself 2. Tapping the infrastructure would be unnecessarily redundant 3. Given the contemporary security landscape of vulnerable chip architectures and remote access vulnerabilities, the existence of an unpatchable vulnerability (“backdoor”) enabling a sophisticated attacker (“government office with the keys”) to get read-only, remote screen capture just seems like less of a security risk than other, non-hypothetical vulnerabilities that already exist. Not sure how you’d secure those keys though, or what you’d do if they got stolen, but I imagine that it wouldn’t be dramatically different than secure boot key handling. Anyone have insight to that side of things?