4 ms·

> I hope they can create some good You mean backdoors? Don't forget these are not optional in China

• _heimdall 3y ago
  This is such a common view, but are software backdoors really that much less common in the US or EU? Data is often the real value when it comes to governments, and at that point the only protection is either using services that collect very little (few exist) or end to end encryption. On the E2E front, it seems only a matter of time until one of the many attempts to require encryption backdoors passes in the west.
  • zb3 3y ago
    I've personally analysed various Chinese CCTV firmware vendors and backdoors planted there were obvious, here's an example: https://github.com/zb3/tiandy-research https://github.com/zb3/tiandy-research, but a better example was XiongMai which actively tried to disguise the backdoor ("Ret" was normally used for replies in that protocol, but the backdoor op requires it set in the request, you can't explain this by incompetence) Are vendors in the US or EU required to do crap like that while also being prohibited to admit it? Of course services that collect the data "in the cloud" share that data with the government, but this is official and predictable.
    • _heimdall 3y ago
      I expect it depends quite a bit on how specific of a definitions of "backdoors" we're talking about. Our main OSes, desktop and mobile, have quite a few backdoors though I couldn't speak to whether the government forced them to do it. Mobile phones, mobile networks, and most (if not all) of the internet trunk lines include backdoors for the government to use. Data collection isn't technically a backdoor, though functionally it is as it allows the government to do what they want to while dodging regulations for search warrants and similar. The Twitter files point to another backdoor, even if again not technically quite a software "backdoor". If we stick to the strict definition of a backdoor, the CCP very likely has more control over companies and does require software backdoors for the government to access. In a more general sense though, I at least wouldn't consider the US or the EU to be meaningfully better about the government having access to and control of tech in much the same way.
      • vizzier 3y ago
        https://en.wikipedia.org/wiki/PRISM https://en.wikipedia.org/wiki/PRISM https://en.wikipedia.org/wiki/Five_Eyes https://en.wikipedia.org/wiki/Five_Eyes https://en.wikipedia.org/wiki/XKeyscore https://en.wikipedia.org/wiki/XKeyscore https://en.wikipedia.org/wiki/2010s_global_surveillance_disclosures https://en.wikipedia.org/wiki/2010s_global_surveillance_disc... Its certainly not like we don't try.
    • axus 3y ago
      Maybe the shoddy backdoors are an example of malicious compliance with the law? Probably not, they'd lose less sales if the backdoors were well hidden.
      • zb3 3y ago
        These are white-label though, you don't buy a "XiongMai" product, you buy a product that you think is made by your local manufacturer, except it has Chinese firmware inside..
  • jszymborski 3y ago
    > This is such a common view, but are software backdoors really that much less common in the US or EU? Yes.
• deleted 3y ago
  [deleted]