4 ms·
> One possible way to backdoor it might be mandate that companies keep copies of the encrypted messages, tagged with a device ID. Then to decrypt you need to ge
by cesarb 11y ago
> One possible way to backdoor it might be mandate that companies keep copies of the encrypted messages, tagged with a device ID. Then to decrypt you need to get the person's phone, which is a clearer analogy to getting a warrant to search someone's house to look for things they have stashed.
That doesn't work if the message has been encrypted on transit with an one-time key, which is discarded after the message has been received. The Axolotl system (used by TextSecure/Signal and AFAIK the new encryption on WhatsApp) does that. Once the message has been received (and thus the corresponding key discarded), any copy of the encrypted message becomes useless.
The current tendency in protocol design is to use ephemeral keys (usually through some Diffie-Hellman variant) whenever possible, since it's more secure.
> With SSL they can just get a warrant (or you know, don't get a warrant) and look at the server, where everything is in plain text.
That doesn't work if the server is outside their jurisdiction.
- c0g 11y agoYour first point: Yep, totally right. I think there's two levels though, the first being that my messages are free from dragnet style surveillance, the second being that my messages are totally secure. Making them get a warrant and get my actual device to decrypt my messages is a damn sight better than having unfettered access to clear text. Second point: Not sure about that, can't I just serve a warrant on Facebook UK to give me the data? If they say "Sorry, we can't get it because America", I imagine the police will say "What? Give it up or go to prison". Similarly, if Google/Apple allow banned apps in their app store, just bring a suit against their UK tentacles.
- cesarb 11y ago> Similarly, if Google/Apple allow banned apps in their app store, just bring a suit against their UK tentacles. The app doesn't have to be in their app store: on Android, it's a simple checkbox to be able to install an app from outside the app store. One can also enable developer mode and install it as if it were a self-developed app.