3 ms·

"Have a government backdoor to screen capture?" would probably be the least disruptive for two assumptions: 1. They can only see what you're currently doing, n

by nness 6y ago

"Have a government backdoor to screen capture?" would probably be the least disruptive for two assumptions: 1. They can only see what you're currently doing, not see everything you have ever done, which I assume because: 2. They can't record everyone forever as storage would be insane, and right now, a backdoor to encryption avoids that issue by just using the company's storage. (Assuming a "NSA style wiretap" operation and not a court-ordered surveillance)

LinuxBender 6y ago
And the framework for this already exists. Each of the browsers has an addon built in and an API to do screen captures. All you would need is a file storage API like Firefox send, a remote trigger piggy backing on something like DoH and Bob's your uncle.
- 9wzYQbTYsAIc 6y ago
  Probably similar APIs within the mobile operating systems, too.
9wzYQbTYsAIc 6y ago
I hadn’t thought of it from the perspective of historical data, thanks for that insight. The existence of a law enforcement tool to watch the screen of a specific device at a specific set of times does seem more palatable than the existence of such a tool to decrypt any data stream. 1. Arbitrarily constrains the surveillance to taps on the device itself 2. Tapping the infrastructure would be unnecessarily redundant 3. Given the contemporary security landscape of vulnerable chip architectures and remote access vulnerabilities, the existence of an unpatchable vulnerability (“backdoor”) enabling a sophisticated attacker (“government office with the keys”) to get read-only, remote screen capture just seems like less of a security risk than other, non-hypothetical vulnerabilities that already exist. Not sure how you’d secure those keys though, or what you’d do if they got stolen, but I imagine that it wouldn’t be dramatically different than secure boot key handling. Anyone have insight to that side of things?

by nness 6y ago

LinuxBender 6y ago

And the framework for this already exists. Each of the browsers has an addon built in and an API to do screen captures. All you would need is a file storage API like Firefox send, a remote trigger piggy backing on something like DoH and Bob's your uncle.

9wzYQbTYsAIc 6y ago
Probably similar APIs within the mobile operating systems, too.

9wzYQbTYsAIc 6y ago

I hadn’t thought of it from the perspective of historical data, thanks for that insight. The existence of a law enforcement tool to watch the screen of a specific device at a specific set of times does seem more palatable than the existence of such a tool to decrypt any data stream. 1. Arbitrarily constrains the surveillance to taps on the device itself 2. Tapping the infrastructure would be unnecessarily redundant 3. Given the contemporary security landscape of vulnerable chip architectures and remote access vulnerabilities, the existence of an unpatchable vulnerability (“backdoor”) enabling a sophisticated attacker (“government office with the keys”) to get read-only, remote screen capture just seems like less of a security risk than other, non-hypothetical vulnerabilities that already exist. Not sure how you’d secure those keys though, or what you’d do if they got stolen, but I imagine that it wouldn’t be dramatically different than secure boot key handling. Anyone have insight to that side of things?