5 ms·

The parent comment asked about "subvert encryption in any way, key escrow or otherwise". CALEA relies on voluntary key escrow which essentially all major infor

The parent comment asked about "subvert encryption in any way, key escrow or otherwise". CALEA relies on voluntary key escrow which essentially all major information providers have been willing to provide (see Snowden leaks). Voluntary only exists where incentives allow a full reasoned decision to be made by corporations. Look at the fines that Yahoo was forced to face on a daily basis for not providing the information requested by the government. Look at how QWest was unraveled. Soft power, financial leverage, standards manipulation, other laws and legal requirements (law praxis) - including those mentioned in the parent comments (ignored thus far by downvote brigade), executive orders and others effectively require key escrow. All major telecommunications carriers have been onboarded to 'voluntary escrow' in this regard. The presumed 'big news' being that Apple and Google providing escrow-less cryptography directly implies that there was key escrow before (there was encryption present before, but no law enforcement condemnation). I encourage readers of these comments to chase the provided links and information, as well as the fully body of knowledge leaked by Binney, Snowden and others, to bear on the 'truthiness' of this comment thread.

lern_too_spel 12y ago
The "big news" wasn't that they are "providing escrow-less cryptography" but that iOS 8 added full-disk encryption and that Android 5 turned full disk encryption on by default. They never had access to the encryption keys. On iOS 7 and earlier, Apple could extract data from native apps "for which the data is not encrypted using the passcode." http://images.apple.com/privacy/docs/legal-process-guidelines-us.pdf http://images.apple.com/privacy/docs/legal-process-guideline...
- xnull2guest 12y ago
  Nah that's not right at all. The big news was in fact that they would be providing end-to-end encryption with the claim that they 'do not have a key and so can not comply with key requests.' Find me some articles that don't center around the issue of law enforcement getting keys. Encryption, including by default and including FDE existed before this year. That's not the news. Any HN reader reading this can confirm this is the case with a few quick searches around the use of full disk encryption and encryption in general in Google and Apple.
  - tptacek 12y ago
    I've read this comment three times and I can't find anywhere inside of it any testable claim. You started this thread very authoritatively, but at this point instead of providing evidence or even authoritative cites, you're asking people to search the trade press to confirm your arguments. Your claim at the top of this thread was that companies like Microsoft (presumably also Google, Dropbox, Apple, Stripe, Mozilla, Facebook, LinkedIn, Samsung, &c) were legally compelled to implement --- your words --- key escrow. Even if we charitably defocus that argument to cover not just literally key escrow but any cryptographic or security UX property meant to reduce security or provide lawful intercept capabilities, I know that claim to be false. I'm eagerly awaiting actual evidence from you to back your claim up, because if you're right, I'm profoundly wrong about something. I doubt you're right, but the risk/reward on wasting my time versus a life-changing revelation work out for me to keep participating in this discussion.
    - xnull2guest 12y ago
      > I know that claim to be false. Bollocks. But let me ask you this: have other incentives - non-legal ones, even personal whim - enticed any of these companies to provide key escrow for the US government? What is the current policy climate with this regard? Is there a voluntary key escrow program? How many companies are on board it? Is there a single telecommunications provider that -isn't- providing key escrow? I can't find a testable claim anywhere in your comment. That's not a ding, it's merely the usual nature of HN comments. It is a sort of foul play to selectively apply criteria. Here's a testable claim. If a HN participant does independent research on the Apple and Google encryption news recently (not you or me or lern_too_spel), that participant will find that encryption is not new nor the thing that law enforcement are critical about. They will find that there is a long history of FDE on Android and on Apple and on other products. They will find that both Apple and Google declared that they would provide encryption mechanisms that they would not have access to decryption keys for. They will find that this causes a ruckus at the FBI and other law enforcement. This is a testable claim. Not testable by you or by me. But it is testable by other readers. They should do it for themselves. The quality of my posts are not in question. I highly encourage readers to wade through my comment history (and that of 'xnull' as well) to links interesting and relevant to the current state of cybercontrol.
- xnull2guest 12y ago
  From your own document. "For all devices running iOS 8.0 and later versions, Apple will no longer be performing iOS data extractions as the data sought will be encrypted and Apple will not possess the encryption key. For iOS devices running iOS versions earlier than iOS 8.0, upon receipt of a valid search warrant issued upon a showing of probable cause, Apple can extract certain categories of active data from passcode locked iOS devices. Specifically, the user generated active files on an iOS device that are contained in Apple’s native apps and for which the data is not encrypted using the passcode (“user generated active files”), can be extracted and provided to law enforcement on external media. Apple can perform this data extraction process on iOS devices running iOS 4 through iOS 7. Please note the only categories of user generated active files that can be provided to law enforcement, pursuant to a valid search warrant, are: SMS, iMessage, MMS, photos, videos, contacts, audio recording, and call history. Apple cannot provide: email, calendar entries, or any third-party app data." I can see how you read this. I read it another way. There was encryption on the device, but it was circumvented in iOS4 through iOS7 (so called "active data") so that law enforcement could access it (over snailmail). The implication is that 'active data' persists longer than the alivetime of the device. "It is further ordered that, to the extent that data on the Device is encrypted, Apple may provide a copy of the encrypted data to law enforcement but Apple is not required to attempt to decrypt, or otherwise enable law enforcement's attempts to access any encrypted data." I can see how you read this. I read it another way. Many of the CALEA programs allow businesses to 'volunteer' data or to volunteer to decrypt information. They've been bullied into doing this. Apple says that it will take a stand, but I don't have very much trust in them because them ultimately is a board of directors chasing profits. "iCloud only stores content for the services that the subscriber has elected to maintain in the account while the subscriber’s account remains active. Apple does not retain deleted content once it is cleared from Apple’s servers. iCloud content may include stored photos, documents, contacts, calendars, bookmarks and iOS device backups. iOS device backups may include photos and videos in the users’ camera roll, device settings, app data, iMessage, SMS, and MMS messages and voicemail. iCloud content may be provided in response to a search warrant issued upon a showing of probable cause." iCloud data syncs by default. That is, they've added data encryption to singular devices but placed the data by default into their cloud, where they offer decryption for law enforcement.
  - 12y ago

lern_too_spel 12y ago

The "big news" wasn't that they are "providing escrow-less cryptography" but that iOS 8 added full-disk encryption and that Android 5 turned full disk encryption on by default. They never had access to the encryption keys. On iOS 7 and earlier, Apple could extract data from native apps "for which the data is not encrypted using the passcode." http://images.apple.com/privacy/docs/legal-process-guidelines-us.pdf http://images.apple.com/privacy/docs/legal-process-guideline...

xnull2guest 12y ago
Nah that's not right at all. The big news was in fact that they would be providing end-to-end encryption with the claim that they 'do not have a key and so can not comply with key requests.' Find me some articles that don't center around the issue of law enforcement getting keys. Encryption, including by default and including FDE existed before this year. That's not the news. Any HN reader reading this can confirm this is the case with a few quick searches around the use of full disk encryption and encryption in general in Google and Apple.
- tptacek 12y ago
  I've read this comment three times and I can't find anywhere inside of it any testable claim. You started this thread very authoritatively, but at this point instead of providing evidence or even authoritative cites, you're asking people to search the trade press to confirm your arguments. Your claim at the top of this thread was that companies like Microsoft (presumably also Google, Dropbox, Apple, Stripe, Mozilla, Facebook, LinkedIn, Samsung, &c) were legally compelled to implement --- your words --- key escrow. Even if we charitably defocus that argument to cover not just literally key escrow but any cryptographic or security UX property meant to reduce security or provide lawful intercept capabilities, I know that claim to be false. I'm eagerly awaiting actual evidence from you to back your claim up, because if you're right, I'm profoundly wrong about something. I doubt you're right, but the risk/reward on wasting my time versus a life-changing revelation work out for me to keep participating in this discussion.
  - xnull2guest 12y ago
    > I know that claim to be false. Bollocks. But let me ask you this: have other incentives - non-legal ones, even personal whim - enticed any of these companies to provide key escrow for the US government? What is the current policy climate with this regard? Is there a voluntary key escrow program? How many companies are on board it? Is there a single telecommunications provider that -isn't- providing key escrow? I can't find a testable claim anywhere in your comment. That's not a ding, it's merely the usual nature of HN comments. It is a sort of foul play to selectively apply criteria. Here's a testable claim. If a HN participant does independent research on the Apple and Google encryption news recently (not you or me or lern_too_spel), that participant will find that encryption is not new nor the thing that law enforcement are critical about. They will find that there is a long history of FDE on Android and on Apple and on other products. They will find that both Apple and Google declared that they would provide encryption mechanisms that they would not have access to decryption keys for. They will find that this causes a ruckus at the FBI and other law enforcement. This is a testable claim. Not testable by you or by me. But it is testable by other readers. They should do it for themselves. The quality of my posts are not in question. I highly encourage readers to wade through my comment history (and that of 'xnull' as well) to links interesting and relevant to the current state of cybercontrol.
xnull2guest 12y ago
From your own document. "For all devices running iOS 8.0 and later versions, Apple will no longer be performing iOS data extractions as the data sought will be encrypted and Apple will not possess the encryption key. For iOS devices running iOS versions earlier than iOS 8.0, upon receipt of a valid search warrant issued upon a showing of probable cause, Apple can extract certain categories of active data from passcode locked iOS devices. Specifically, the user generated active files on an iOS device that are contained in Apple’s native apps and for which the data is not encrypted using the passcode (“user generated active files”), can be extracted and provided to law enforcement on external media. Apple can perform this data extraction process on iOS devices running iOS 4 through iOS 7. Please note the only categories of user generated active files that can be provided to law enforcement, pursuant to a valid search warrant, are: SMS, iMessage, MMS, photos, videos, contacts, audio recording, and call history. Apple cannot provide: email, calendar entries, or any third-party app data." I can see how you read this. I read it another way. There was encryption on the device, but it was circumvented in iOS4 through iOS7 (so called "active data") so that law enforcement could access it (over snailmail). The implication is that 'active data' persists longer than the alivetime of the device. "It is further ordered that, to the extent that data on the Device is encrypted, Apple may provide a copy of the encrypted data to law enforcement but Apple is not required to attempt to decrypt, or otherwise enable law enforcement's attempts to access any encrypted data." I can see how you read this. I read it another way. Many of the CALEA programs allow businesses to 'volunteer' data or to volunteer to decrypt information. They've been bullied into doing this. Apple says that it will take a stand, but I don't have very much trust in them because them ultimately is a board of directors chasing profits. "iCloud only stores content for the services that the subscriber has elected to maintain in the account while the subscriber’s account remains active. Apple does not retain deleted content once it is cleared from Apple’s servers. iCloud content may include stored photos, documents, contacts, calendars, bookmarks and iOS device backups. iOS device backups may include photos and videos in the users’ camera roll, device settings, app data, iMessage, SMS, and MMS messages and voicemail. iCloud content may be provided in response to a search warrant issued upon a showing of probable cause." iCloud data syncs by default. That is, they've added data encryption to singular devices but placed the data by default into their cloud, where they offer decryption for law enforcement.
- 12y ago