4 ms·

Doesn't this problem exist throughout the tech industry though? Microsoft, Google, Apple etc are keeping the keys that allow you to push updates secret, aren't

Doesn't this problem exist throughout the tech industry though? Microsoft, Google, Apple etc are keeping the keys that allow you to push updates secret, aren't they?

sebzim4500 3y ago
Yeah, but if we're honest all three of those companies are more competent than the UK goverment. Source: sometimes interact with the UK government
- Spivak 3y ago
  So you just make the three companies keep the keys then. People are out here like "a secure backdoor to encryption is impossible" and then don't even blink for the keys for root CAs which is the basis for the world's online security. Or the AWS managed S3 encryption keys. There's a lot of of hopium in this thread for people who I think want it to be more impossible in practice than it really is.
  - ChrisKnott 3y ago
    It was never even suggested that the government would have encryption keys. The government do not have access to SSL traffic, but companies are responsible for CSAM uploaded over SSL.
aae42 3y ago
Also public key certificate authorities
skydhash 3y ago
> Microsoft, Google, Apple etc are keeping the keys that allow you to push updates secret Governments can provide immunity, which companies can't do. Companies try not to do these kinds of stealing, governments don't care.
owlbite 3y ago
If a software signing key is compromised it can be revoked and a few weeks later the risk is only to people who don't keep their OS up to date. Further, exploited compromises are detectable, especially if exploited at scale. If the backdoor crypto key is compromised, sure they can revoke it (assuming they manage to design a competent system), but all the sensitive information up that point is now available to whoever possesses the backdoor key. Unlike the software signing case, exploitation of the compromise is likely undetectable unless the attacker reveals their knowledge somehow.
- ChrisKnott 3y ago
  The same is true of SSL traffic to a bank though isn't it? If a crime group is intercepted encrypted traffic and saving it, then the keys are stolen, they can decrypt that data. But opponents of the OSB claim it will make communication with your bank less secure - how?
JimDabell 3y ago
> Microsoft, Google, Apple etc are keeping the keys that allow you to push updates secret, aren't they? From yesterday: > the China-Based threat actor, Storm-0558, used an acquired Microsoft account (MSA) consumer key to forge tokens to access OWA and Outlook.com. Upon identifying that the threat actor had acquired the consumer key, Microsoft performed a comprehensive technical investigation into the acquisition of the Microsoft account consumer signing key, including how it was used to access enterprise email. — https://news.ycombinator.com/item?id=37408776 https://news.ycombinator.com/item?id=37408776 I think Microsoft’s handling of keys is almost certainly far, far more secure than anything the British government would care to achieve.

Doesn't this problem exist throughout the tech industry though? Microsoft, Google, Apple etc are keeping the keys that allow you to push updates secret, aren't they?

sebzim4500 3y ago

Yeah, but if we're honest all three of those companies are more competent than the UK goverment. Source: sometimes interact with the UK government

Spivak 3y ago
So you just make the three companies keep the keys then. People are out here like "a secure backdoor to encryption is impossible" and then don't even blink for the keys for root CAs which is the basis for the world's online security. Or the AWS managed S3 encryption keys. There's a lot of of hopium in this thread for people who I think want it to be more impossible in practice than it really is.
- ChrisKnott 3y ago
  It was never even suggested that the government would have encryption keys. The government do not have access to SSL traffic, but companies are responsible for CSAM uploaded over SSL.

aae42 3y ago

Also public key certificate authorities

skydhash 3y ago

> Microsoft, Google, Apple etc are keeping the keys that allow you to push updates secret Governments can provide immunity, which companies can't do. Companies try not to do these kinds of stealing, governments don't care.

owlbite 3y ago

If a software signing key is compromised it can be revoked and a few weeks later the risk is only to people who don't keep their OS up to date. Further, exploited compromises are detectable, especially if exploited at scale. If the backdoor crypto key is compromised, sure they can revoke it (assuming they manage to design a competent system), but all the sensitive information up that point is now available to whoever possesses the backdoor key. Unlike the software signing case, exploitation of the compromise is likely undetectable unless the attacker reveals their knowledge somehow.

ChrisKnott 3y ago
The same is true of SSL traffic to a bank though isn't it? If a crime group is intercepted encrypted traffic and saving it, then the keys are stolen, they can decrypt that data. But opponents of the OSB claim it will make communication with your bank less secure - how?

JimDabell 3y ago

> Microsoft, Google, Apple etc are keeping the keys that allow you to push updates secret, aren't they? From yesterday: > the China-Based threat actor, Storm-0558, used an acquired Microsoft account (MSA) consumer key to forge tokens to access OWA and Outlook.com. Upon identifying that the threat actor had acquired the consumer key, Microsoft performed a comprehensive technical investigation into the acquisition of the Microsoft account consumer signing key, including how it was used to access enterprise email. — https://news.ycombinator.com/item?id=37408776 https://news.ycombinator.com/item?id=37408776 I think Microsoft’s handling of keys is almost certainly far, far more secure than anything the British government would care to achieve.