3 ms·

> If these companies, whether it's Microsoft, Google, or others, encrypted as much of their services as possible, end-to-end, without them having the ability to

> If these companies, whether it's Microsoft, Google, or others, encrypted as much of their services as possible, end-to-end, without them having the ability to decrypt that data, this wouldn't be such an issue, because the US gov can't legally force the companies to decrypt what they can't decrypt. That's possible for some, but not for all services. For example you can have a personal online storage that's encrypted, but you can't have an online store that's encrypted where you can easily share files with somebody else who can see the files in a web browser. Or collaborative document editing. You can't easily and without end-user involvement have an end-to-end encrypted mail service etc.

rayiner 12y ago
If the document is shared with select people, you can still use encryption to share keys. If it's shares with anyone with a link, you have very little to stand on to say it's protected by the 4th amendment in the first place.
- Xylakant 12y ago
  That's why I specifically mentioned web browsers. That implies the key is on the server or sent to the server and thus it's possible to intercept or recover it. You need a trusted client on the end users device and the key must never be passed to the server to be considered secure.
- tptacek 12y ago
  If that's true, it's also true that it's reasonable to access someone's bank account with a SQL injection, since those are just different kinds of links.
  - rayiner 12y ago
    I'm not sure I follow. I'm thinking of a Google Docs link where anyone can access the document if they know the URL. How is that like an SQL injection?
    - sillysaurus3 12y ago
      Often times, part of a URL is fed directly into a database. Tweaking this part is how you do SQL injection, which then gives you access to documents you weren't originally authorized for. It sounded like Thomas's point was that if you base legal claims off of the mere fact that URLs are used, then you must consider all types of URLs. One type of URL is a kind that performs SQL injection, which gives you access to unexpected documents, which is already quite illegal. Such URLs are fundamentally accessible by anyone. (Anyone can type any URL into any browser, so hypothetically one could inject SQL by accident and end up with an unauthorized document.) So if you consider URLs enough to determine whether a document is protected, it must be true that many private digital documents on the planet are in fact public, because many private documents are vulnerable to SQL injection.

rayiner 12y ago

If the document is shared with select people, you can still use encryption to share keys. If it's shares with anyone with a link, you have very little to stand on to say it's protected by the 4th amendment in the first place.

Xylakant 12y ago
That's why I specifically mentioned web browsers. That implies the key is on the server or sent to the server and thus it's possible to intercept or recover it. You need a trusted client on the end users device and the key must never be passed to the server to be considered secure.
tptacek 12y ago
If that's true, it's also true that it's reasonable to access someone's bank account with a SQL injection, since those are just different kinds of links.
- rayiner 12y ago
  I'm not sure I follow. I'm thinking of a Google Docs link where anyone can access the document if they know the URL. How is that like an SQL injection?
  - sillysaurus3 12y ago
    Often times, part of a URL is fed directly into a database. Tweaking this part is how you do SQL injection, which then gives you access to documents you weren't originally authorized for. It sounded like Thomas's point was that if you base legal claims off of the mere fact that URLs are used, then you must consider all types of URLs. One type of URL is a kind that performs SQL injection, which gives you access to unexpected documents, which is already quite illegal. Such URLs are fundamentally accessible by anyone. (Anyone can type any URL into any browser, so hypothetically one could inject SQL by accident and end up with an unauthorized document.) So if you consider URLs enough to determine whether a document is protected, it must be true that many private digital documents on the planet are in fact public, because many private documents are vulnerable to SQL injection.