3 ms·
This is incorrect because you’re conflating access by request and access with a court order. Without a warrant, or even probable cause, police can get some meta
by angry_octet 3y ago
This is incorrect because you’re conflating access by request and access with a court order. Without a warrant, or even probable cause, police can get some meta data, but not everything in the cloud. In many places police can force you to use biometrics to unlock devices, but not compel a passphrase. (Passphrases are significantly harder for e.g. Greykey to glitch brute force than PINs.)
- lxgr 3y agoWhat's "access by request"? > Passphrases are significantly harder for e.g. Greykey to glitch brute force than PINs. PINs are their own thing, i.e. neither passwords nor passphrases. They form a hierarchy: Passphrases: High (enough) entropy; can be stretched into an encryption key using a PBKDF. Passwords: Medium entropy; long enough to be somewhat brute-force resistant in case of a database breach. Can't really be used to encrypt data by themselves. PINs: Very low entropy, must be part of a larger, trusted system that can reliably enforce limits on invalid PIN attempts. Practically, this means tamper-resistant hardware, e.g. a HSM, TPM, smartcard, Yubikey...
- angry_octet 3y agoThe police just ask the company for the data. https://en.wikipedia.org/wiki/Third-party_doctrine https://en.wikipedia.org/wiki/Third-party_doctrine --- You're introducing key stretching for unknown reasons. It's irrelevant for attacks on e.g. iPhones -- they're not cracking encryption, they're doing dictionary attacks.