6 ms·

Nah that's not right at all. The big news was in fact that they would be providing end-to-end encryption with the claim that they 'do not have a key and so can

Nah that's not right at all. The big news was in fact that they would be providing end-to-end encryption with the claim that they 'do not have a key and so can not comply with key requests.' Find me some articles that don't center around the issue of law enforcement getting keys. Encryption, including by default and including FDE existed before this year. That's not the news. Any HN reader reading this can confirm this is the case with a few quick searches around the use of full disk encryption and encryption in general in Google and Apple.

tptacek 12y ago
I've read this comment three times and I can't find anywhere inside of it any testable claim. You started this thread very authoritatively, but at this point instead of providing evidence or even authoritative cites, you're asking people to search the trade press to confirm your arguments. Your claim at the top of this thread was that companies like Microsoft (presumably also Google, Dropbox, Apple, Stripe, Mozilla, Facebook, LinkedIn, Samsung, &c) were legally compelled to implement --- your words --- key escrow. Even if we charitably defocus that argument to cover not just literally key escrow but any cryptographic or security UX property meant to reduce security or provide lawful intercept capabilities, I know that claim to be false. I'm eagerly awaiting actual evidence from you to back your claim up, because if you're right, I'm profoundly wrong about something. I doubt you're right, but the risk/reward on wasting my time versus a life-changing revelation work out for me to keep participating in this discussion.
- xnull2guest 12y ago
  > I know that claim to be false. Bollocks. But let me ask you this: have other incentives - non-legal ones, even personal whim - enticed any of these companies to provide key escrow for the US government? What is the current policy climate with this regard? Is there a voluntary key escrow program? How many companies are on board it? Is there a single telecommunications provider that -isn't- providing key escrow? I can't find a testable claim anywhere in your comment. That's not a ding, it's merely the usual nature of HN comments. It is a sort of foul play to selectively apply criteria. Here's a testable claim. If a HN participant does independent research on the Apple and Google encryption news recently (not you or me or lern_too_spel), that participant will find that encryption is not new nor the thing that law enforcement are critical about. They will find that there is a long history of FDE on Android and on Apple and on other products. They will find that both Apple and Google declared that they would provide encryption mechanisms that they would not have access to decryption keys for. They will find that this causes a ruckus at the FBI and other law enforcement. This is a testable claim. Not testable by you or by me. But it is testable by other readers. They should do it for themselves. The quality of my posts are not in question. I highly encourage readers to wade through my comment history (and that of 'xnull' as well) to links interesting and relevant to the current state of cybercontrol.
  - tptacek 12y ago
    Yeah, OK. I think I understand the dynamics of this thread now.
    - xnull2guest 12y ago
      I don't think that's fair as I could say (and refrained from) saying the same thing earlier. The facts stand on their own. I encourage anyone who makes it to this comment-leaf to investigate the facts for yourselves. Neither I nor Tptacek are pseudonyms you can trust.
      - tptacek 12y ago
        I think you can trust that my name is actually Thomas Ptacek.
        xnull2guest 12y ago
        And that mine is not actually Xavier Null.
lern_too_spel 12y ago
I pointed you to a primary source for Apple. Here's a secondary source for Android: http://www.washingtonpost.com/blogs/the-switch/wp/2014/09/18/newest-androids-will-join-iphones-in-offering-default-encryption-blocking-police/ http://www.washingtonpost.com/blogs/the-switch/wp/2014/09/18.... Once they push the new release to the public git repository, I can give you a zeroary source by pointing you to the actual commit. You don't even have a secondary source to back up your fantastic claim. I see I've interacted with you before with the same result. I'll give you the same ultimatum I gave you then. Provide a source now, or stop repeating this nonsense.
- xnull2guest 12y ago
  I'll reply the same way as before (likely to end with the same result). Here is a much, much better source. Apple's announcement itself: "Unlike our competitors, Apple cannot bypass your passcode and therefore cannot access this data. So it's not technically feasible for us to respond to government warrants for the extraction of this data from devices in their possession running iOS 8." https://www.apple.com/privacy/government-information-requests/ https://www.apple.com/privacy/government-information-request... "Specifically, Apple has radically improved the way that data on those devices is encrypted. Once users set a passcode, Apple will no longer be able to unlock your device—even if ordered to do so by a court." http://www.slate.com/articles/technology/future_tense/2014/09/ios_8_encryption_why_apple_won_t_unlock_your_iphone_for_the_police.html http://www.slate.com/articles/technology/future_tense/2014/0... "To get started, it's worth pointing out that disk encryption is hardly new with iOS 8. In fact, Apple's operating system has enabled some form of encryption since before iOS 7. What's happened in the latest update is that Apple has decided to protect much more of the interesting data on the device under the user's passcode. ... So to a large extent the 'new' feature Apple is touting in iOS 8 is simply that they're encrypting more data. But it's also worth pointing out that newer iOS devices ... also add substantial hardware protections to thwart device cracking. In the rest of this post I'm going to talk about how these protections may work and how Apple can realistically claim not to possess a back door." http://blog.cryptographyengineering.com/2014/10/why-cant-apple-decrypt-your-iphone.html http://blog.cryptographyengineering.com/2014/10/why-cant-app...

tptacek 12y ago

I've read this comment three times and I can't find anywhere inside of it any testable claim. You started this thread very authoritatively, but at this point instead of providing evidence or even authoritative cites, you're asking people to search the trade press to confirm your arguments. Your claim at the top of this thread was that companies like Microsoft (presumably also Google, Dropbox, Apple, Stripe, Mozilla, Facebook, LinkedIn, Samsung, &c) were legally compelled to implement --- your words --- key escrow. Even if we charitably defocus that argument to cover not just literally key escrow but any cryptographic or security UX property meant to reduce security or provide lawful intercept capabilities, I know that claim to be false. I'm eagerly awaiting actual evidence from you to back your claim up, because if you're right, I'm profoundly wrong about something. I doubt you're right, but the risk/reward on wasting my time versus a life-changing revelation work out for me to keep participating in this discussion.

xnull2guest 12y ago
> I know that claim to be false. Bollocks. But let me ask you this: have other incentives - non-legal ones, even personal whim - enticed any of these companies to provide key escrow for the US government? What is the current policy climate with this regard? Is there a voluntary key escrow program? How many companies are on board it? Is there a single telecommunications provider that -isn't- providing key escrow? I can't find a testable claim anywhere in your comment. That's not a ding, it's merely the usual nature of HN comments. It is a sort of foul play to selectively apply criteria. Here's a testable claim. If a HN participant does independent research on the Apple and Google encryption news recently (not you or me or lern_too_spel), that participant will find that encryption is not new nor the thing that law enforcement are critical about. They will find that there is a long history of FDE on Android and on Apple and on other products. They will find that both Apple and Google declared that they would provide encryption mechanisms that they would not have access to decryption keys for. They will find that this causes a ruckus at the FBI and other law enforcement. This is a testable claim. Not testable by you or by me. But it is testable by other readers. They should do it for themselves. The quality of my posts are not in question. I highly encourage readers to wade through my comment history (and that of 'xnull' as well) to links interesting and relevant to the current state of cybercontrol.
- tptacek 12y ago
  Yeah, OK. I think I understand the dynamics of this thread now.
  - xnull2guest 12y ago
    I don't think that's fair as I could say (and refrained from) saying the same thing earlier. The facts stand on their own. I encourage anyone who makes it to this comment-leaf to investigate the facts for yourselves. Neither I nor Tptacek are pseudonyms you can trust.
    - tptacek 12y ago
      I think you can trust that my name is actually Thomas Ptacek.
      - xnull2guest 12y ago
        And that mine is not actually Xavier Null.

lern_too_spel 12y ago

I pointed you to a primary source for Apple. Here's a secondary source for Android: http://www.washingtonpost.com/blogs/the-switch/wp/2014/09/18/newest-androids-will-join-iphones-in-offering-default-encryption-blocking-police/ http://www.washingtonpost.com/blogs/the-switch/wp/2014/09/18.... Once they push the new release to the public git repository, I can give you a zeroary source by pointing you to the actual commit. You don't even have a secondary source to back up your fantastic claim. I see I've interacted with you before with the same result. I'll give you the same ultimatum I gave you then. Provide a source now, or stop repeating this nonsense.

xnull2guest 12y ago
I'll reply the same way as before (likely to end with the same result). Here is a much, much better source. Apple's announcement itself: "Unlike our competitors, Apple cannot bypass your passcode and therefore cannot access this data. So it's not technically feasible for us to respond to government warrants for the extraction of this data from devices in their possession running iOS 8." https://www.apple.com/privacy/government-information-requests/ https://www.apple.com/privacy/government-information-request... "Specifically, Apple has radically improved the way that data on those devices is encrypted. Once users set a passcode, Apple will no longer be able to unlock your device—even if ordered to do so by a court." http://www.slate.com/articles/technology/future_tense/2014/09/ios_8_encryption_why_apple_won_t_unlock_your_iphone_for_the_police.html http://www.slate.com/articles/technology/future_tense/2014/0... "To get started, it's worth pointing out that disk encryption is hardly new with iOS 8. In fact, Apple's operating system has enabled some form of encryption since before iOS 7. What's happened in the latest update is that Apple has decided to protect much more of the interesting data on the device under the user's passcode. ... So to a large extent the 'new' feature Apple is touting in iOS 8 is simply that they're encrypting more data. But it's also worth pointing out that newer iOS devices ... also add substantial hardware protections to thwart device cracking. In the rest of this post I'm going to talk about how these protections may work and how Apple can realistically claim not to possess a back door." http://blog.cryptographyengineering.com/2014/10/why-cant-apple-decrypt-your-iphone.html http://blog.cryptographyengineering.com/2014/10/why-cant-app...