5 ms·

I'll take the downvotes as indication that I failed in my appeal to HN to discuss potentially workable solutions instead of just dismissing the problem as impos

I'll take the downvotes as indication that I failed in my appeal to HN to discuss potentially workable solutions instead of just dismissing the problem as impossible. I'll go ahead post my own possible solution in hopes of actually furthering discussion. A couple minutes of thought on the subject brings me to: 1) Have the device manufacturer, FBI and Federal Court system all create their own public/private key pairs. FBI and the courts publish their public keys; the device manufacturer includes their public key, the FBI's and the court's on each device. 2) Each of these organizations stores their private key in a their own central secure facility. The key is only to exist in airgapped systems, further encrypted using a secure multi-party scheme so that multiple people are needed any time the private keys are accessed. Include personnel vetting, logging, video cameras, secure vaults, etc. to add further security. 3) When the user selects their password, the storage media is encrypted using that password, and the password is stored in a separate location on the device encrypted using the FBI's public key, the device manufacturer's public key and finally the courts' public key. 4) When law enforcement needs to decrypt the phone, they request a warrant from the court. When the warrant is approved, they send a copy of the encrypted password to the court's secure facility. The court decrypts it using their private key and hands it back. 5) The FBI (or the court, whichever) brings a copy of the warrant and the partially decrypted password to the device manufacturer. If the device manufacturer wishes to contest the warrant, they go through the normal appeals process. If not, they decrypt again using their private key and hands the resulting encrypting password over to the FBI. 6) The FBI takes the resulting encrypted password back to their own secure facility and decrypts it once more using their own private key, giving them the plaintext password. They now have access to the device, and could only have done so with a valid warrant and further given a third party trusted by the suspect (the device manufacturer) a further say in whether or not to appeal the warrant. There's my quick solution. Feel free to further the discussion by critiquing or improving it rather than downvoting to oblivion.

delinka 12y ago
And although this makes collusion more difficult, how does your plan prevent it? How can I, with my password and keys in my own controls, prevent rogue FBI agents colluding with corporate employees (through brides, blackmail, intimidation) and frightened judges ("can't let the terrorists win!" even though no one's convicted yet) from accessing my data that ultimately they have no business accessing? We've seen law enforcement abuse every form of power they've been handed (see National Security Letters for one example), so I don't trust them to Do What's Right. Ever.
- AceJohnny2 12y ago
  > through brides Russian brides I suppose, in the context of this discussion?
  - Omniusaspirer 12y ago
    I know you're probably just making a joke here but if not I believe he meant to say "bribes".
- jordanpg 12y ago
  Sometimes it seems like the entire Snowden debate is ultimately reducible to one's belief about this. In a phrase, one's belief that given N people with power P, q will eventually abuse it. I think that as N grows, the probability that q >= 1 approaches 1. It strikes me as a self-evident feature of human nature.
  - j42 12y ago
    Actually I think power is more a force than a proclivity... Given the infamous Stanford prison experiment and now this, I wouldn't classify it as 'definitive' but the correlation is well demonstrated. [source] http://www.sciencedirect.com/science/article/pii/S1048984314000800 http://www.sciencedirect.com/science/article/pii/S1048984314...
- csandreasen 12y ago
  You don't prevent it. That's the thing about security - there is never a such thing as 100% secure. The key is coming up with reasonable expectations and implementing policies to mitigate the risk down to an acceptable level, [EDIT]then putting measures in place to limit damage if those measures do fail[/EDIT]. If I were a third party with access to your device, I could brute force the encryption. There is nothing you can do about it - I will eventually get your password; the trick is whether it will take me a few minutes or a few decades. What's an acceptable time frame to protect the data on your personal cell phone? Do you care if I get the personal data on it 20 years from now or have to spend $2 million in computing power to get it? Unlike me stealing your data, there are very legitimate reasons for law enforcement to have access to devices to carry out investigations. The warrant requirement is a check on abuse. If there's an issue regarding abuse of power (e.g.: bribing employees, intimidating judges, overly broad laws), it would be better for everyone to work to address the real problems than taking away means for law enforcement to investigate actual criminals.
toyg 12y ago
In the wikileaks era, when large governments cannot keep safe even their most private documents, you rely on multiple entities keeping their key private, including manufacturers (which we know are routinely compromised by governments, as demonstrated in the DigiNotar case and elsewhere). Good luck with that. Also, what happens once a key is leaked? Are we supposed to throw away every phone and every computer?
- morpher 12y ago
  This scheme is only broken if all entities fail to keep their keys secure. In the event of a key compromise, updated keys could be pushed out and used to reencrypt. Of course that presents another weakness. (Who signs the update? What if their key is compromised).
  - toyg 12y ago
    "The courts" are basically a sieve (every newspaper hack learns this on his first day on the job), so you can count that one out very quickly. Manufacturers are only slightly better, and we've seen it with DigiNotar et al. That leaves the FBI/government, not exactly the strongest fort when it comes to public leaks. In that sense, Apple's marketing is right: the only person you should trust with the safety of your data is yourself. Also, if you allow firmware to reflash its keys, then you have a mechanism that again can be subverted (as well as what you point out). I think we've seen it with games that that sort of DRM doesn't work in the long run -- it's routinely cracked, but manufacturers don't care too much as long as it allows them time-windows long enough to make bank. Making it the basis of all data-handling in the land doesn't seem particularly smart.
    - timv 12y ago
      But that's a bit of a different argument that the hand-waving Keybase were using. Saying "it's not possible to build a secure backdoor" is a cop-out. The truth is, we can build systems so that your data can be decrypted with either your key, or a master key. And we can build systems where the master key requires multiple coordinated parties. Such systems can be used to implement secure backdoors, but only if we can trust those parties with the master keys to do their job properly. That requires: - Proper key security so their keys don't get exposed - Proper access controls so that the keys are only used for the purpose for which they're intended. The problem is that we know with complete confidence that all of the parties involved in that process will fail at one or both of those hurdles. This isn't a technical problem. "Secure golden keys" are technically feasible, and not even particularly hard. It's simply an issue that there is no one that you ought to trust with such a key.
deleted 12y ago
[deleted]
AnthonyMouse 12y ago
> There's my quick solution. Feel free to further the discussion by critiquing or improving it rather than downvoting to oblivion. Rather than critiquing your specific solution, allow me to explain why no solution is possible in general. 0. Because this is Apple, people are assuming Apple's model, but it is not acceptable to enshrine that model into legislation for all of the reasons I could go into if they don't seem sufficiently obvious to anyone. And if Cyanogen on a Nexus device or Debian on a PC doesn't support the backdoor (or does but the device owner has the power to remove it), it is clearly unreasonable to hold Apple to a different standard, and in any event would be ineffective because the "criminals" (or anyone desiring privacy) could just use non-Apple devices. 1. Even if you are willing to pass a law against general purpose computing, if you have a backdoor that can't be updated you have both a security vulnerability (because flaws can't be fixed) and an ineffective backdoor (because if someone e.g. loses their keys there is nothing you can do about it). 2. If you have a backdoor that can be updated, whatever process is used for updating the backdoor is now a security vulnerability. Having the updates signed by the Director of the FBI and the Pope provides no security because the Director of the FBI and the Pope have neither the expertise nor the time to understand what it is they're signing, and a rubber stamp enforced by digital signatures is still a rubber stamp.
mullingitover 12y ago
Here's why it wouldn't work: Non-US consumers, let alone companies, (which is to say, the majority of the smartphone market) have no interest in purchasing devices that can be rooted by the US government. Correction: it could work, in theory, if US companies were willing to sacrifice massive amounts of revenue for no reward.
- csandreasen 12y ago
  Then the device manufacturer can make an international version. The US Congress could pass a law requiring all of some certain class of devices implement something to allow law enforcement to decrypt, but that wouldn't prevent the device manufacturers from selling a different version to their international customers.
  - visarga 12y ago
    Yes, but how would we trust them if they are already selling spyware infected phones in other countries? The making of phones is going to get commoditized - everyone could make a phone in a few years, from parts and using open source software. Then we will have choices and never have to use spyware again.
  - russgray 12y ago
    Doesn't that just mean that as a wannabe criminal I buy my iPhone from some no-extradition-treaty country, safe in the knowledge that the FBI's keys aren't on it?
Natsu 12y ago
1) We have to trust the 3rd parties with the master key, not just now, but forever. You can't "un-give" them master key access, nor has anyone proposed such a system. The idea is already unworkable for that very reason. 2) If you have jurisdiction over someone, you can force them to decrypt something based on a warrant, so it isn't even desireable for a backdoor to exist. Rather than hoping they follow the rules in their ultra-secret room that normal people will never see, they can work through the court system, publicly. 3) There's a concept called "attack surface." A backdoor increases that, by increasing the number of secrets. 4) The article goes into detail over the real-world failures of systems like these. 5) The device manufacturer does not necessarily have our interests at heart and should not be the party contesting warrants in any reasonable system. 6) Even if the encryption scheme was sound, human error trumps all. We're introducing all sorts of elements, each of which is a point of failure, and none of which has interests aligned with those of the end user (us). OTP is provably secure, you know. It's the key management that gets you. So we haven't demonstrated the need for this vs. compelling someone via warrant to decrypt and other means. We have good reason to believe that illegal, dragnet surveillance is the real reason for opposition. Even if you believe that our own government is (and always will be) perfectly virtuous with that power, there are many foreign governments with similar capabilities. Not sending them any traffic? Think again (BGP hijacks). And we have lots of experience showing that such systems leave people vulnerable to bad guys. So this asks us to take on big risks for bad reasons and we know that. There just aren't any good reasons not to dismiss and oppose such systems outright and there are many good reasons to be suspicious of the motives of anyone telling us otherwise. I blacklisted WaPo some time ago as not being a credible news source. This editorial only gives me further reason to keep them blacklisted.
- pluma 12y ago
  > If you have jurisdiction over someone, you can force them to decrypt something based on a warrant A lot of people in IT seem to be blind to this. Encryption is no different from a very good hiding spot. If the authorities know it exists and you know how to access the information within it, there are ways to get you to disclose that information. It's not like they will just let you walk away if you simply say "no". And that's just for the normal "criminals" argument. For "terrorists" there are even more ways to get them to disclose information. Rubber-hose cryptanalysis is a thing.
natch 12y ago
You are blindly assuming the FBI and the courts are good guys, non-corrupt, and consistent. This is not borne out by evidence, to borrow a phrase from another commenter.
riquito 12y ago
Each and every government on the planet would ask that their public key is inserted on each device/server. Even if you naively trust your present and future government, do you trust all the others?
CWuestefeld 12y ago
Others have given very good overall arguments against this. But let me give one specific technical problem with your proposal. The gov't will be able to get the encrypted input for the device mfr, and the output decrypted from that. Given this data, they will have a huge headstart in backing out a solution to what the mfr's private key is. Even if this weren't so, it makes every major vendor a very cost-effective target for the government. They'll devote resources to either breaking their private key (as I described above), or just using straightforward human engineering techniques. This apparent extra layer of security will not last long in practice. EDIT - in my 2nd para above, it assumes that a mfr has a single private key, which is probably not the case. But generating a unique key pair for every discrete device is both an expense problem and introduces difficulties with managing the set of keys, which makes its security even more difficult.

delinka 12y ago

And although this makes collusion more difficult, how does your plan prevent it? How can I, with my password and keys in my own controls, prevent rogue FBI agents colluding with corporate employees (through brides, blackmail, intimidation) and frightened judges ("can't let the terrorists win!" even though no one's convicted yet) from accessing my data that ultimately they have no business accessing? We've seen law enforcement abuse every form of power they've been handed (see National Security Letters for one example), so I don't trust them to Do What's Right. Ever.

AceJohnny2 12y ago
> through brides Russian brides I suppose, in the context of this discussion?
- Omniusaspirer 12y ago
  I know you're probably just making a joke here but if not I believe he meant to say "bribes".
jordanpg 12y ago
Sometimes it seems like the entire Snowden debate is ultimately reducible to one's belief about this. In a phrase, one's belief that given N people with power P, q will eventually abuse it. I think that as N grows, the probability that q >= 1 approaches 1. It strikes me as a self-evident feature of human nature.
- j42 12y ago
  Actually I think power is more a force than a proclivity... Given the infamous Stanford prison experiment and now this, I wouldn't classify it as 'definitive' but the correlation is well demonstrated. [source] http://www.sciencedirect.com/science/article/pii/S1048984314000800 http://www.sciencedirect.com/science/article/pii/S1048984314...
csandreasen 12y ago
You don't prevent it. That's the thing about security - there is never a such thing as 100% secure. The key is coming up with reasonable expectations and implementing policies to mitigate the risk down to an acceptable level, [EDIT]then putting measures in place to limit damage if those measures do fail[/EDIT]. If I were a third party with access to your device, I could brute force the encryption. There is nothing you can do about it - I will eventually get your password; the trick is whether it will take me a few minutes or a few decades. What's an acceptable time frame to protect the data on your personal cell phone? Do you care if I get the personal data on it 20 years from now or have to spend $2 million in computing power to get it? Unlike me stealing your data, there are very legitimate reasons for law enforcement to have access to devices to carry out investigations. The warrant requirement is a check on abuse. If there's an issue regarding abuse of power (e.g.: bribing employees, intimidating judges, overly broad laws), it would be better for everyone to work to address the real problems than taking away means for law enforcement to investigate actual criminals.

toyg 12y ago

In the wikileaks era, when large governments cannot keep safe even their most private documents, you rely on multiple entities keeping their key private, including manufacturers (which we know are routinely compromised by governments, as demonstrated in the DigiNotar case and elsewhere). Good luck with that. Also, what happens once a key is leaked? Are we supposed to throw away every phone and every computer?

morpher 12y ago
This scheme is only broken if all entities fail to keep their keys secure. In the event of a key compromise, updated keys could be pushed out and used to reencrypt. Of course that presents another weakness. (Who signs the update? What if their key is compromised).
- toyg 12y ago
  "The courts" are basically a sieve (every newspaper hack learns this on his first day on the job), so you can count that one out very quickly. Manufacturers are only slightly better, and we've seen it with DigiNotar et al. That leaves the FBI/government, not exactly the strongest fort when it comes to public leaks. In that sense, Apple's marketing is right: the only person you should trust with the safety of your data is yourself. Also, if you allow firmware to reflash its keys, then you have a mechanism that again can be subverted (as well as what you point out). I think we've seen it with games that that sort of DRM doesn't work in the long run -- it's routinely cracked, but manufacturers don't care too much as long as it allows them time-windows long enough to make bank. Making it the basis of all data-handling in the land doesn't seem particularly smart.
  - timv 12y ago
    But that's a bit of a different argument that the hand-waving Keybase were using. Saying "it's not possible to build a secure backdoor" is a cop-out. The truth is, we can build systems so that your data can be decrypted with either your key, or a master key. And we can build systems where the master key requires multiple coordinated parties. Such systems can be used to implement secure backdoors, but only if we can trust those parties with the master keys to do their job properly. That requires: - Proper key security so their keys don't get exposed - Proper access controls so that the keys are only used for the purpose for which they're intended. The problem is that we know with complete confidence that all of the parties involved in that process will fail at one or both of those hurdles. This isn't a technical problem. "Secure golden keys" are technically feasible, and not even particularly hard. It's simply an issue that there is no one that you ought to trust with such a key.

deleted 12y ago

[deleted]

AnthonyMouse 12y ago

> There's my quick solution. Feel free to further the discussion by critiquing or improving it rather than downvoting to oblivion. Rather than critiquing your specific solution, allow me to explain why no solution is possible in general. 0. Because this is Apple, people are assuming Apple's model, but it is not acceptable to enshrine that model into legislation for all of the reasons I could go into if they don't seem sufficiently obvious to anyone. And if Cyanogen on a Nexus device or Debian on a PC doesn't support the backdoor (or does but the device owner has the power to remove it), it is clearly unreasonable to hold Apple to a different standard, and in any event would be ineffective because the "criminals" (or anyone desiring privacy) could just use non-Apple devices. 1. Even if you are willing to pass a law against general purpose computing, if you have a backdoor that can't be updated you have both a security vulnerability (because flaws can't be fixed) and an ineffective backdoor (because if someone e.g. loses their keys there is nothing you can do about it). 2. If you have a backdoor that can be updated, whatever process is used for updating the backdoor is now a security vulnerability. Having the updates signed by the Director of the FBI and the Pope provides no security because the Director of the FBI and the Pope have neither the expertise nor the time to understand what it is they're signing, and a rubber stamp enforced by digital signatures is still a rubber stamp.

mullingitover 12y ago

Here's why it wouldn't work: Non-US consumers, let alone companies, (which is to say, the majority of the smartphone market) have no interest in purchasing devices that can be rooted by the US government. Correction: it could work, in theory, if US companies were willing to sacrifice massive amounts of revenue for no reward.

csandreasen 12y ago
Then the device manufacturer can make an international version. The US Congress could pass a law requiring all of some certain class of devices implement something to allow law enforcement to decrypt, but that wouldn't prevent the device manufacturers from selling a different version to their international customers.
- visarga 12y ago
  Yes, but how would we trust them if they are already selling spyware infected phones in other countries? The making of phones is going to get commoditized - everyone could make a phone in a few years, from parts and using open source software. Then we will have choices and never have to use spyware again.
- russgray 12y ago
  Doesn't that just mean that as a wannabe criminal I buy my iPhone from some no-extradition-treaty country, safe in the knowledge that the FBI's keys aren't on it?

Natsu 12y ago

1) We have to trust the 3rd parties with the master key, not just now, but forever. You can't "un-give" them master key access, nor has anyone proposed such a system. The idea is already unworkable for that very reason. 2) If you have jurisdiction over someone, you can force them to decrypt something based on a warrant, so it isn't even desireable for a backdoor to exist. Rather than hoping they follow the rules in their ultra-secret room that normal people will never see, they can work through the court system, publicly. 3) There's a concept called "attack surface." A backdoor increases that, by increasing the number of secrets. 4) The article goes into detail over the real-world failures of systems like these. 5) The device manufacturer does not necessarily have our interests at heart and should not be the party contesting warrants in any reasonable system. 6) Even if the encryption scheme was sound, human error trumps all. We're introducing all sorts of elements, each of which is a point of failure, and none of which has interests aligned with those of the end user (us). OTP is provably secure, you know. It's the key management that gets you. So we haven't demonstrated the need for this vs. compelling someone via warrant to decrypt and other means. We have good reason to believe that illegal, dragnet surveillance is the real reason for opposition. Even if you believe that our own government is (and always will be) perfectly virtuous with that power, there are many foreign governments with similar capabilities. Not sending them any traffic? Think again (BGP hijacks). And we have lots of experience showing that such systems leave people vulnerable to bad guys. So this asks us to take on big risks for bad reasons and we know that. There just aren't any good reasons not to dismiss and oppose such systems outright and there are many good reasons to be suspicious of the motives of anyone telling us otherwise. I blacklisted WaPo some time ago as not being a credible news source. This editorial only gives me further reason to keep them blacklisted.

pluma 12y ago
> If you have jurisdiction over someone, you can force them to decrypt something based on a warrant A lot of people in IT seem to be blind to this. Encryption is no different from a very good hiding spot. If the authorities know it exists and you know how to access the information within it, there are ways to get you to disclose that information. It's not like they will just let you walk away if you simply say "no". And that's just for the normal "criminals" argument. For "terrorists" there are even more ways to get them to disclose information. Rubber-hose cryptanalysis is a thing.

natch 12y ago

You are blindly assuming the FBI and the courts are good guys, non-corrupt, and consistent. This is not borne out by evidence, to borrow a phrase from another commenter.

riquito 12y ago

Each and every government on the planet would ask that their public key is inserted on each device/server. Even if you naively trust your present and future government, do you trust all the others?

CWuestefeld 12y ago

Others have given very good overall arguments against this. But let me give one specific technical problem with your proposal. The gov't will be able to get the encrypted input for the device mfr, and the output decrypted from that. Given this data, they will have a huge headstart in backing out a solution to what the mfr's private key is. Even if this weren't so, it makes every major vendor a very cost-effective target for the government. They'll devote resources to either breaking their private key (as I described above), or just using straightforward human engineering techniques. This apparent extra layer of security will not last long in practice. EDIT - in my 2nd para above, it assumes that a mfr has a single private key, which is probably not the case. But generating a unique key pair for every discrete device is both an expense problem and introduces difficulties with managing the set of keys, which makes its security even more difficult.