10 ms·

There are plenty of things you can do. Your passwords (or whatever authentication method you choose to use) are a "back door" to get access to your device/acco

There are plenty of things you can do. Your passwords (or whatever authentication method you choose to use) are a "back door" to get access to your device/accounts. What do you do to keep them secure? Your password can also be used be used by the bad guys - what do you do to reduce the chance of that happening and mitigate damage if it does happen? Now instead of thinking how you protect your own information, come up with ways concerning how you would protect your neighbor's, neighborhood's, city's, etc. and work your way up. Implementing the "back door" might be a difficult problem, but stating a priori that it's an intractable problem is just lazy thinking.

toyg 12y ago
Let's not try to doublespeak our way out of this: a "backdoor" that is only in your mind and heavily hashed everywhere else is not a backdoor -- it's a front door of which only one person (you) holds the key. A backdoor is a backdoor is a backdoor: an entrance on which you have no visibility nor control. And this is exactly what a "golden key" would be, regardless of how it's implemented.
- csandreasen 12y ago
  A backdoor is nothing more than a second means of accessing a system. We're already used to having secondary measures in place to access our accounts for our own use (i.e.: password recovery). There is no 100% solution - our own primary passwords are sometimes stolen, and password recovery measures are regularly abused as well. The issue really boils down to allowing authorized users to access the systems and reducing the risk of unauthorized users to get in. Like it or not, law enforcement officers with a valid warrant to search your device are authorized users. It's in the constitution. Once you get past that, the thing to look at is how do reduce the risk of 3rd parties or law enforcement officials without valid warrants gaining access.
  - toyg 12y ago
    > password recovery measures are regularly abused as well > how to reduce the risk of 3rd parties [...] gaining access. Don't you see the contradiction there? Our systems are already full of holes, so let's create some more...? You also assume I'm a US citizen, which I am not. The minute the US mandate backdoors to manufacturers, all governments will want in, including some very nasty customers. So what do you do next, have separate keys for each government and country-based firmware, i.e. even more holes? It's a slippery slope. "The thing to look at" is how to remove the capability for third parties to access your data, regardless of who they are. Say that tomorrow I'll wake up in Nazi Sweden (not terribly unlikely, seeing current Euro trends), I'd rather not have brownshirts with keys to all my data - would you?
    - csandreasen 12y ago
      I actually don't see the contradiction - our security systems are full of holes largely as a matter of convenience. We put in password recovery because we routinely forget passwords. We make stupid password recovery processes that involve mothers' maiden names because it would be too much of hassle to do something more secure like show up at Google HQ with three forms of ID. The police don't have the same usability requirements. They only need access to the data on your phone once; they're not opening it every 10 minutes of every day to check your SMS/e-mail/HN posts/etc. In addition, they also have the requirement that they can't be opening your device without a valid search warrant. Any system put in place to allow them access needs to be designed with conditions like these in mind. With regards to other countries, manufacturers are already required to comply with all laws in any country they operate in. I don't think Americans should have to make a decision as to whether or not their own law enforcement should have the ability to decrypt phones based on what Chinese police might do in their own country. If you're worried about brownshirts taking over your government, there's nothing preventing you from encrypting the data yourself - nothing prevented you from doing it before. There are legitimate reasons for law enforcement to search a device after being issued a valid warrant; same as your house, place of business, safe deposit boxes, etc. Strong encryption by default on hundreds of millions of devices on which people conduct much of their daily business is something new. Locks and safes will slow down an investigation, but never to the point of bringing it to a halt. Strong encryption will. Given how central these devices have become in our lives, I don't know that it makes much sense to prevent police from searching them when they are legitimately investigating an actual crime.
  - dsjoerg 12y ago
    >> Like it or not, law enforcement officers with a valid warrant to search your device are authorized users. It's in the constitution. It's not, of course, literally in the Constitution that you cannot encrypt things and then refuse to decrypt them for law enforcement. Nor is it in the Constitution that people selling encryption devices must include backdoors. What words in the Constitution do you see as pertaining here?
    - csandreasen 12y ago
      I'd say the entire part of the 4th Amendment that deals with warrants is what pertains to this issue. Of course you can encrypt things yourself, and I would imagine you could probably refuse to hand over the password under your 5th Amendment rights. Nothing's changed there. I think the issue here is that someone else (Apple) has gone and set up an encrypted environment for you in such a way that actively prevents law enforcement from carrying out legal investigations with a warrant on an incredibly popular series of devices that they were capable of searching before. Let's face it - the number of people who are buying iPhones because they are now encrypted is miniscule. If you really wanted to encrypt all of your data, optional full disk encryption already existed on other phones. The problem the police have with it is that it's now set up by default, they can no longer access it when they do have a valid warrant and this extends to everyone instead of just the handful of criminals that would take extra steps to encrypt their data. John Q. Criminal didn't choose to encrypt his phone, Apple made that decision for him.
      - mullingitover 12y ago
        > The problem the police have with it is that it's now set up by default, they can no longer access it when they do have a valid warrant and this extends to everyone instead of just the handful of criminals that would take extra steps to encrypt their data. Not at all true. The fifth amendment doesn't mean the court can't serve you with a subpoena for your device's unencrypted contents and imprison you until you provide it, for life if necessary.
        csandreasen 12y ago
csandreasen 12y ago
I'll take the downvotes as indication that I failed in my appeal to HN to discuss potentially workable solutions instead of just dismissing the problem as impossible. I'll go ahead post my own possible solution in hopes of actually furthering discussion. A couple minutes of thought on the subject brings me to: 1) Have the device manufacturer, FBI and Federal Court system all create their own public/private key pairs. FBI and the courts publish their public keys; the device manufacturer includes their public key, the FBI's and the court's on each device. 2) Each of these organizations stores their private key in a their own central secure facility. The key is only to exist in airgapped systems, further encrypted using a secure multi-party scheme so that multiple people are needed any time the private keys are accessed. Include personnel vetting, logging, video cameras, secure vaults, etc. to add further security. 3) When the user selects their password, the storage media is encrypted using that password, and the password is stored in a separate location on the device encrypted using the FBI's public key, the device manufacturer's public key and finally the courts' public key. 4) When law enforcement needs to decrypt the phone, they request a warrant from the court. When the warrant is approved, they send a copy of the encrypted password to the court's secure facility. The court decrypts it using their private key and hands it back. 5) The FBI (or the court, whichever) brings a copy of the warrant and the partially decrypted password to the device manufacturer. If the device manufacturer wishes to contest the warrant, they go through the normal appeals process. If not, they decrypt again using their private key and hands the resulting encrypting password over to the FBI. 6) The FBI takes the resulting encrypted password back to their own secure facility and decrypts it once more using their own private key, giving them the plaintext password. They now have access to the device, and could only have done so with a valid warrant and further given a third party trusted by the suspect (the device manufacturer) a further say in whether or not to appeal the warrant. There's my quick solution. Feel free to further the discussion by critiquing or improving it rather than downvoting to oblivion.
- delinka 12y ago
  And although this makes collusion more difficult, how does your plan prevent it? How can I, with my password and keys in my own controls, prevent rogue FBI agents colluding with corporate employees (through brides, blackmail, intimidation) and frightened judges ("can't let the terrorists win!" even though no one's convicted yet) from accessing my data that ultimately they have no business accessing? We've seen law enforcement abuse every form of power they've been handed (see National Security Letters for one example), so I don't trust them to Do What's Right. Ever.
deleted 12y ago
[deleted]
vidarh 12y ago
We mitigate through compartmentalisation: Instead of one password for everything, each user has different username/password combinations, and hopefully different passwords for most services they access. That is the key point here: The moment you introduce a backdoor you have painted a target on the parties that needs to hold those keys big enough to be seen from space. Meanwhile, with compartmentalised keys, some users accounts get compromised all the time, but no single leak is sufficient to get everyone.

toyg 12y ago

Let's not try to doublespeak our way out of this: a "backdoor" that is only in your mind and heavily hashed everywhere else is not a backdoor -- it's a front door of which only one person (you) holds the key. A backdoor is a backdoor is a backdoor: an entrance on which you have no visibility nor control. And this is exactly what a "golden key" would be, regardless of how it's implemented.

csandreasen 12y ago
A backdoor is nothing more than a second means of accessing a system. We're already used to having secondary measures in place to access our accounts for our own use (i.e.: password recovery). There is no 100% solution - our own primary passwords are sometimes stolen, and password recovery measures are regularly abused as well. The issue really boils down to allowing authorized users to access the systems and reducing the risk of unauthorized users to get in. Like it or not, law enforcement officers with a valid warrant to search your device are authorized users. It's in the constitution. Once you get past that, the thing to look at is how do reduce the risk of 3rd parties or law enforcement officials without valid warrants gaining access.
- toyg 12y ago
  > password recovery measures are regularly abused as well > how to reduce the risk of 3rd parties [...] gaining access. Don't you see the contradiction there? Our systems are already full of holes, so let's create some more...? You also assume I'm a US citizen, which I am not. The minute the US mandate backdoors to manufacturers, all governments will want in, including some very nasty customers. So what do you do next, have separate keys for each government and country-based firmware, i.e. even more holes? It's a slippery slope. "The thing to look at" is how to remove the capability for third parties to access your data, regardless of who they are. Say that tomorrow I'll wake up in Nazi Sweden (not terribly unlikely, seeing current Euro trends), I'd rather not have brownshirts with keys to all my data - would you?
  - csandreasen 12y ago
    I actually don't see the contradiction - our security systems are full of holes largely as a matter of convenience. We put in password recovery because we routinely forget passwords. We make stupid password recovery processes that involve mothers' maiden names because it would be too much of hassle to do something more secure like show up at Google HQ with three forms of ID. The police don't have the same usability requirements. They only need access to the data on your phone once; they're not opening it every 10 minutes of every day to check your SMS/e-mail/HN posts/etc. In addition, they also have the requirement that they can't be opening your device without a valid search warrant. Any system put in place to allow them access needs to be designed with conditions like these in mind. With regards to other countries, manufacturers are already required to comply with all laws in any country they operate in. I don't think Americans should have to make a decision as to whether or not their own law enforcement should have the ability to decrypt phones based on what Chinese police might do in their own country. If you're worried about brownshirts taking over your government, there's nothing preventing you from encrypting the data yourself - nothing prevented you from doing it before. There are legitimate reasons for law enforcement to search a device after being issued a valid warrant; same as your house, place of business, safe deposit boxes, etc. Strong encryption by default on hundreds of millions of devices on which people conduct much of their daily business is something new. Locks and safes will slow down an investigation, but never to the point of bringing it to a halt. Strong encryption will. Given how central these devices have become in our lives, I don't know that it makes much sense to prevent police from searching them when they are legitimately investigating an actual crime.
- dsjoerg 12y ago
  >> Like it or not, law enforcement officers with a valid warrant to search your device are authorized users. It's in the constitution. It's not, of course, literally in the Constitution that you cannot encrypt things and then refuse to decrypt them for law enforcement. Nor is it in the Constitution that people selling encryption devices must include backdoors. What words in the Constitution do you see as pertaining here?
  - csandreasen 12y ago
    I'd say the entire part of the 4th Amendment that deals with warrants is what pertains to this issue. Of course you can encrypt things yourself, and I would imagine you could probably refuse to hand over the password under your 5th Amendment rights. Nothing's changed there. I think the issue here is that someone else (Apple) has gone and set up an encrypted environment for you in such a way that actively prevents law enforcement from carrying out legal investigations with a warrant on an incredibly popular series of devices that they were capable of searching before. Let's face it - the number of people who are buying iPhones because they are now encrypted is miniscule. If you really wanted to encrypt all of your data, optional full disk encryption already existed on other phones. The problem the police have with it is that it's now set up by default, they can no longer access it when they do have a valid warrant and this extends to everyone instead of just the handful of criminals that would take extra steps to encrypt their data. John Q. Criminal didn't choose to encrypt his phone, Apple made that decision for him.
    - mullingitover 12y ago
      > The problem the police have with it is that it's now set up by default, they can no longer access it when they do have a valid warrant and this extends to everyone instead of just the handful of criminals that would take extra steps to encrypt their data. Not at all true. The fifth amendment doesn't mean the court can't serve you with a subpoena for your device's unencrypted contents and imprison you until you provide it, for life if necessary.
      - csandreasen 12y ago

csandreasen 12y ago

I'll take the downvotes as indication that I failed in my appeal to HN to discuss potentially workable solutions instead of just dismissing the problem as impossible. I'll go ahead post my own possible solution in hopes of actually furthering discussion. A couple minutes of thought on the subject brings me to: 1) Have the device manufacturer, FBI and Federal Court system all create their own public/private key pairs. FBI and the courts publish their public keys; the device manufacturer includes their public key, the FBI's and the court's on each device. 2) Each of these organizations stores their private key in a their own central secure facility. The key is only to exist in airgapped systems, further encrypted using a secure multi-party scheme so that multiple people are needed any time the private keys are accessed. Include personnel vetting, logging, video cameras, secure vaults, etc. to add further security. 3) When the user selects their password, the storage media is encrypted using that password, and the password is stored in a separate location on the device encrypted using the FBI's public key, the device manufacturer's public key and finally the courts' public key. 4) When law enforcement needs to decrypt the phone, they request a warrant from the court. When the warrant is approved, they send a copy of the encrypted password to the court's secure facility. The court decrypts it using their private key and hands it back. 5) The FBI (or the court, whichever) brings a copy of the warrant and the partially decrypted password to the device manufacturer. If the device manufacturer wishes to contest the warrant, they go through the normal appeals process. If not, they decrypt again using their private key and hands the resulting encrypting password over to the FBI. 6) The FBI takes the resulting encrypted password back to their own secure facility and decrypts it once more using their own private key, giving them the plaintext password. They now have access to the device, and could only have done so with a valid warrant and further given a third party trusted by the suspect (the device manufacturer) a further say in whether or not to appeal the warrant. There's my quick solution. Feel free to further the discussion by critiquing or improving it rather than downvoting to oblivion.

delinka 12y ago
And although this makes collusion more difficult, how does your plan prevent it? How can I, with my password and keys in my own controls, prevent rogue FBI agents colluding with corporate employees (through brides, blackmail, intimidation) and frightened judges ("can't let the terrorists win!" even though no one's convicted yet) from accessing my data that ultimately they have no business accessing? We've seen law enforcement abuse every form of power they've been handed (see National Security Letters for one example), so I don't trust them to Do What's Right. Ever.

deleted 12y ago

[deleted]

vidarh 12y ago

We mitigate through compartmentalisation: Instead of one password for everything, each user has different username/password combinations, and hopefully different passwords for most services they access. That is the key point here: The moment you introduce a backdoor you have painted a target on the parties that needs to hold those keys big enough to be seen from space. Meanwhile, with compartmentalised keys, some users accounts get compromised all the time, but no single leak is sufficient to get everyone.