4 ms·

"Other people... build systems that can provide meaningful security for their users." Do all of the implementations, particularly on mobile, actually provide s

"Other people... build systems that can provide meaningful security for their users." Do all of the implementations, particularly on mobile, actually provide such security? If a court is willing to order TLS keys to be turned over in order to enable the government to access information, why couldn't they order the developer to release a backdoored version through the relevant App Store or other update mechanism? If the author refuses to comply, then they will demand the codesigning keys so they can backdoor it themselves. To quote your critique of another's security proposal: "Then the only difference between hushmail and your model is exactly what the FBI will get a subpoena to have you type into your server to subvert your users. The models are equivalently insecure."

danielweber 12y ago
As 'rayiner points out repeatedly, there is plenty of precedent for people being forced to turn over information in their possession to comply with government investigations going back centuries. This is much different than requiring that arbitrary third-parties to be compelled to take arbitrary action to assist in a government investigation. Where they are required, it is a power granted by statute with limited scope. (Phone companies are required to assist in wiretaps via things like Communications Assistance for Law Enforcement Act; I forget that was in effect before that. And they get to bill the government for it.)
- absherwin 12y ago
  Lavabit didn't actually have the information in a format that was readable. In order to get it, they needed to change the way their system operated to decrypt the information the next time a particular user logged in. If one can force a person to modify the source code running on his servers, why can't one force a person to modify a binary distributed to clients? From reading the arguments in this case, it's not clear to me that the judges would have been impressed by that distinction. Their focus was on whether Lavabit had the technical capability to provide the information the government demanded. In both cases, the answer is yes. We won't know the actual answer until this has been litigated. If it has and I've missed it, I'd love to see the case in question.
  - danielweber 12y ago
    If Levison said "I don't know how to get that information and I don't even have it" then the DOJ might have bought it and it might have been over. But once he established that he owned the information, then it was either get it out himself, or let the DOJ go through and get the information themselves. IANAL.
    - pbhjpbhj 12y ago
      That works until the government analysts look at the system and see that you could get the information and then a court finds that you perjured yourself as "beyond reasonable doubt" you did know how to get the information. Then you're looking at the same position you had before just from the inside of a prison instead.
      - danielweber 12y ago
        To be sure, Levinson should have gotten competent legal counsel long before this all started. (He knew he was going to have this fight eventually, but he had to scramble for a lawyer when this specific request came in.) And that counsel would have advised him exactly what he could have and should have revealed, and how to comply with previous requests. His complying with prior orders surely weakened any attempt to say "but I can't get that information!"
      - rhizome 12y ago
        "Reasonable doubt" is not even close to the standard required for perjury.
        pbhjpbhj 12y ago
        Go on, educate me.

danielweber 12y ago

As 'rayiner points out repeatedly, there is plenty of precedent for people being forced to turn over information in their possession to comply with government investigations going back centuries. This is much different than requiring that arbitrary third-parties to be compelled to take arbitrary action to assist in a government investigation. Where they are required, it is a power granted by statute with limited scope. (Phone companies are required to assist in wiretaps via things like Communications Assistance for Law Enforcement Act; I forget that was in effect before that. And they get to bill the government for it.)

absherwin 12y ago
Lavabit didn't actually have the information in a format that was readable. In order to get it, they needed to change the way their system operated to decrypt the information the next time a particular user logged in. If one can force a person to modify the source code running on his servers, why can't one force a person to modify a binary distributed to clients? From reading the arguments in this case, it's not clear to me that the judges would have been impressed by that distinction. Their focus was on whether Lavabit had the technical capability to provide the information the government demanded. In both cases, the answer is yes. We won't know the actual answer until this has been litigated. If it has and I've missed it, I'd love to see the case in question.
- danielweber 12y ago
  If Levison said "I don't know how to get that information and I don't even have it" then the DOJ might have bought it and it might have been over. But once he established that he owned the information, then it was either get it out himself, or let the DOJ go through and get the information themselves. IANAL.
  - pbhjpbhj 12y ago
    That works until the government analysts look at the system and see that you could get the information and then a court finds that you perjured yourself as "beyond reasonable doubt" you did know how to get the information. Then you're looking at the same position you had before just from the inside of a prison instead.
    - danielweber 12y ago
      To be sure, Levinson should have gotten competent legal counsel long before this all started. (He knew he was going to have this fight eventually, but he had to scramble for a lawyer when this specific request came in.) And that counsel would have advised him exactly what he could have and should have revealed, and how to comply with previous requests. His complying with prior orders surely weakened any attempt to say "but I can't get that information!"
    - rhizome 12y ago
      "Reasonable doubt" is not even close to the standard required for perjury.
      - pbhjpbhj 12y ago
        Go on, educate me.