[HN Gopher] The FBI Should Stop Attacking Encryption
___________________________________________________________________
The FBI Should Stop Attacking Encryption
Author : KubikPixel
Score : 389 points
Date : 2021-03-15 07:45 UTC (15 hours ago)
(HTM) web link (www.eff.org)
(TXT) w3m dump (www.eff.org)
| clipradiowallet wrote:
| FWIW, I've had a warrant executed against me by the FBI. They
| seized every electronic device I own, and forcibly took my
| biometric data(fingerprints, face scan, retinal scan) in the
| hopes they could unlock my devices with it. They were unable to
| access any LUKS-encrypted volumes, and were less than happy about
| that situation. Can't say much else unless I'm good with 99x
| anxiety for the next few days.
|
| ps: not charged, not convicted, very innocent. not a fan of the
| justice dept.
| amoshi wrote:
| Very depressing how in the UK you could've been forced to
| disclose your password under section 49 of the Regulation of
| Investigatory Powers Act, and gotten even 5 years jail time if
| you refused. I presume there isn't a US equivalent?
| mannerheim wrote:
| It's complicated. There's no specific law in the US regarding
| key disclosure, but you can be punished for e.g. contempt of
| court, maybe spoliation. In theory, the Fifth Amendment
| should protect individuals from self-incrimination, but
| courts have ruled that forcing people to disclose keys is not
| that.
|
| See In re Boucher for a case where Fifth Amendment
| protections were not upheld and US v. Doe for a case where
| they were.
| colinmhayes wrote:
| The Boucher case is special because the ruling held that
| Boucher had waived fifth amendment rights for the computer
| by showing some of it to law enforcement. If you exercise
| your fifth from the start I do not believe you can be
| compelled to provide the state with passwords, although
| they can use your biometric data.
| arminiusreturns wrote:
| Do you happen to know the case regarding the biometric
| data?
| lights0123 wrote:
| The highest-ruling decision so far doesn't allow
| biometric use: https://www.usnews.com/news/national-
| news/articles/2019-01-1...
| eingaeKaiy8ujie wrote:
| What if you "forgot" the password?
| mannerheim wrote:
| In the US, contempt of court is a possible outcome.
| kaliali wrote:
| I read this in a whiny voice. Seriously the FBI doesn't give two
| shits what you think, they take power by force.
| jrsj wrote:
| Just wait until they tell us that encryption back doors are
| necessary to stop racism and watch as half the population claps
| excitedly for the total elimination of privacy in the U.S.
| anm89 wrote:
| Did you know that 75% of Neo Nazi's use encryption! \s
| sodality2 wrote:
| I don't believe that is true (and pray it isn't). I don't think
| the populace is that stupid. Also, unnecessarily political. I
| could replace "racism" with "immigration" or "socialism" just
| as easily, that doesn't make it true.
| tremon wrote:
| Why not? "We need lie detectors to stop communism" worked
| fine before, didn't it?
| sodality2 wrote:
| I'd like to think that it wouldn't work now, given the
| interconnectedness of the world today. I also wouldn't be
| very surprised if it did work, though.
| jrsj wrote:
| I don't care if it seems political, it's reality. This is
| just the most effective tool the government has for
| manufacturing consent at the moment.
|
| This is the just the thing we're already clearly willing to
| give up civil liberties for in another areas, primarily in
| freedom of speech and basic property rights. Complaining
| about it this seen as unacceptable -- you can't criticize or
| question any mainstream view put out by the media on this
| issue.
|
| Identity politics is the clear and _only_ vehicle for this
| kind of suppression of basic rights at the moment.
|
| Support encryption backdoors, we need them to fight White
| Nationalist Terrorist Insurrectionists!
|
| If there is some sort of PATRIOT Act 2.0 under the current
| administration targeted at "domestic terrorism" I absolutely
| guarantee you someone will at least try to put an encryption
| backdoor in it.
| ausbah wrote:
| can anyone speak to companies like Cellbrite? how haven't they
| been sued into oblivion by phone manufacturers?
| lstodd wrote:
| Why should they be? Next step is pentesting, which massively
| benefits overall security.
| cm2187 wrote:
| Another argument against the "going dark" claim is that before
| smartphones and the internet, the only conversations the FBI
| could monitor was through phonelines and mail. These were known
| to be easily monitored and I doubt there was much more criminal
| activity happening through those then than now.
|
| I would argue that the conversations that have gone online are
| the interactions that were previously happening in-person (at
| least in term of criminal activity), to which the FBI didn't have
| access before.
|
| There is something Orwellian with the idea that there shouldn't
| be a word that can be pronounced in the country that the
| government cannot record and listen to after the fact. The limits
| of what is legal or not have always moved (see homosexuality,
| drug and alcohol consumption, etc). So a 100% enforcement of the
| law is counter-intuitively undesirable.
| hertzrat wrote:
| Anybody serious about this issue should contact their
| representatives to let them know it's a concern.
| lbblack wrote:
| I find it extremely alarming that law enforcement almost
| everywhere around the world is attempting to undermine almost a
| century-fold of legitimate mathematics and science with regards
| to encryption and cryptography.
|
| It's a tad embarrassing that lawmakers (who aren't even
| computer scientists like c'mon are we for real here?) somehow
| forgot how and who broke the Enigma Machine. Alan Turing did
| that.
|
| Same thing with the Tor browser developed by the US Navy.
| Either everyone has access to a tool which can guarantee that
| you can blend in with the rest of the crowd, or every civilian
| has a special color and we all pop out while the lawmakers and
| police are somehow wearing grey.
|
| How did cypherpunks and computer scientists get blasted from
| the government like this? Shouldn't there be some laws
| regarding digital privacy for US citizens?
|
| Somehow AD revenue is caked everywhere but I can't use a
| computer without the FBI wanting my social security card? What
| the duck. Shucks I thought this was America.
| at-fates-hands wrote:
| >> Either everyone has access to a tool which can guarantee
| that you can blend in with the rest of the crowd.
|
| This is already happening. When the NSA decided the best
| approach to combat terrorism was to scoop up all emails,
| text, voice and internet browsing of every citizen on a daily
| basis, they inadvertently created a way we can all "blend in"
| now.
|
| A perfect example is the Jan 6th capitol attack. It was being
| planned out on the open, on social media channels. They
| didn't use any obfuscation in their language and still, even
| with all the technology they have, the massive surveillance
| machine couldn't stop it from happening.
|
| I still firmly believe encryption is needed for privacy, but
| over the last 10-15 years, the insane amount of data being
| vacuumed up is allowing people to hide in plain site.
| laurent92 wrote:
| We need to make it strategic to hide our communications. The
| day the CIA decides that [place any enemy] has routers all
| over the place in US territory and that their spying is bad,
| they will mandate the use of Tor instead of discouraging it.
| We don't need to be at war, but we need a capable enemy.
| A4ET8a8uTh0 wrote:
| I heard the balance of power argument before and, well, you
| were already granted this wish ( and I would argue that you
| had it granted twice ). Both China and Russia are very
| capable adversaries at this time and US is slipping from
| its top dog position. It is genuinely sad to watch.
| throwaway53453 wrote:
| Russia isn't a threat to the US. Foreign policy maybe,
| but not existential like China.
| drummojg wrote:
| Russia is a terrible threat to the US. How much/many of
| their disinformation and memes (in the traditional sense)
| are correlated with disrupted political discourse,
| extremism, and disunity in the US? They don't sponsor
| squads of disinfo/misinfo actors just for giggles. It has
| a profound destabilizing bang for their buck.
| spacephysics wrote:
| Similar disinformation happens domestically, see
| russiagate
| voldacar wrote:
| Tor is not an end-all solution. Hidden services can be
| trivially unmasked (for an actor like the CIA/NSA) with
| traffic correlation attacks
| r3trohack3r wrote:
| Targeted surveillance is different than mass
| surveillance, different threat models call for different
| tools.
|
| https://everytwoyears.org/2020/07/13/tactical-
| privacy.html
| _wldu wrote:
| 15 years ago, if I had said that society would build a tracking
| system and that most people would happily carry a tracker in
| their pocket and pay monthly fees to support the tracking
| networks, I would have been laughed out of the room.
|
| But that is what happened, and most people are oblivious to
| this fact.
| christophilus wrote:
| I watched Citizen of the State recently, and the paranoid old
| man in that movie looks like a normie today.
| ISL wrote:
| I think you mean Enemy of the State?
|
| https://en.m.wikipedia.org/wiki/Enemy_of_the_State_(film)
| TeMPOraL wrote:
| >> _Citizen of the State_
|
| > _I think you mean Enemy of the State?_
|
| Given the topic of mass surveillance, this doesn't sound
| like much of a distinction...
| bzzzt wrote:
| I don't know if people are oblivious - it's just that there
| are a lot of perceived benefits for the user of the 'tracking
| device'. Tracking people is a byproduct of all the services a
| modern phone offers (due to technical or monetization
| reasons).
| mFixman wrote:
| 15 years ago was 2006. Almost every adult carried a cellphone
| everywhere back then.
| maerF0x0 wrote:
| I certainly didn't. But will concede I was definitely a
| late adopter.
| snarf21 wrote:
| "Hey wiretap, can bunnies eat pancakes?"
| api wrote:
| Those devices have addictive properties, especially casual
| mobile games and social media.
|
| In the past addictive properties were enough to get people to
| do absurd things like roll up leaves, light them on fire, and
| deliberately huff the smoke. That's arguably more harmful
| than what mobile devices do to us.
| poink wrote:
| I don't think, "Most people are oblivious," they just don't
| care and/or don't understand the implications.
|
| The idea that the government can use your mobile phone to spy
| on you is so widely understood that even the dumbest popcorn
| movies make sure to show fugitives ditching their phones and
| criminals collecting/discarding them before they discuss
| business without explaining why. Everybody understands the
| purpose of a "burner" phone.
| _wldu wrote:
| Yes, most everyone knows that they can be tracked.
|
| The point is that we voluntarily paid/pay to build and
| maintain the tracking infrastructure. That's what most
| people don't realize.
| tw04 wrote:
| >I don't think, "Most people are oblivious," they just
| don't care and/or don't understand the implications.
|
| But they do, that's what's baffling. The number of people I
| have heard parrot the "Bill Gates put a tracking chip in
| the vaccine" has me both baffled and worried. These are
| people who appear to be otherwise completely sane and
| mostly rational. When I've pointed out that's literally
| what their phone does, so why would Bill Gates waste any
| money putting something in a vaccine (ignoring that's not
| even physically possible) - I get a "well that's
| different".
|
| They are concerned, but as a non-technical person for some
| reason they just can't quite wrap their heads around what
| is happening.
| mbg721 wrote:
| They can, but they wish it weren't true. Cell phones have
| an obvious huge upside, and society has adjusted itself
| so that you pretty much have to have one. (Ever asked to
| use somebody's phone?). Meanwhile, one of these
| technocrats is pushing a vaccine that might as well be
| magic, developed in an unusually short time, to cure a
| disease that people think might occasionally kill
| somebody else, but probably not them. The response makes
| complete sense.
| clankyclanker wrote:
| Would it not lead to a horrifying dystopia, it wold be
| interesting to see how the response changed it the
| vaccine were marketed as a status symbol.
| marcosdumay wrote:
| 15 years ago people did carry a tracker on their pocket
| already.
| fsflover wrote:
| Most people simply have no choice unless you are willing to
| switch to GNU/Linux phones. Those are not 100% ready for
| everything yet.
| grishka wrote:
| It doesn't matter what your phone runs. As long as it's
| communicating with the network, the carrier knows its
| location.
| fsflover wrote:
| Cell towers is far from the only tracking possibility.
| grishka wrote:
| Yes but it's the only one that's a requirement if you
| want to actually use your phone.
| mannerheim wrote:
| Not a silver bullet unless you never let your phone talk to
| a cell tower - in which case it stops being a phone and
| starts being a miniature tablet.
| fsflover wrote:
| At least with Librem 5 you can use the hardware kill
| switch whenever you need privacy.
| loceng wrote:
| Indeed, the internet amplified and accelerate everything - but
| as we've seen, arguably the largest harm that can come is
| through mass manipulation via public propaganda that's promoted
| - and that's not encrypted.
|
| It's arguably different industrial complexes that have lead to
| mass surveillance, perhaps mostly the military-security
| industrial complex, that has lead to the current path; fear as
| a distraction from what's really needed is healing and
| strengthening the individual to not be brittle and prone to
| manipulation.
| scruffyherder wrote:
| I'll take 15kg of pastrami for the Miami delivery. I'm getting
| a pushback on the new price on Genoa but Eddie tells me he
| knows he can smooth it over.
|
| The dates however are spoiled,it's going to need a total clean.
|
| I am the walrus.
| fishmaster wrote:
| The chihuahua flies at noon.
| alkonaut wrote:
| > I would argue that the conversations that have gone online
| are the interactions that were previously happening in-person
| (at least in term of criminal activity), to which the FBI
| didn't have access before.
|
| Indeed. But those conversations/meetings were visible, risky
| etc. They were thus possible to monitor/attack and they weren't
| scalable.
|
| From the perspective of law enforcement, criminals being able
| to discuss crimes or make payments without there being a
| phyiscal exchange is a nightmare. In the past, they could
| monitor meetings between criminals. Now they basically need to
| look over the shoulder of criminals in order to prove that
| CriminalA spoke to CriminalB. It must be extremely difficult.
| sneak wrote:
| Nah, they just need to issue a wiretap order to the encrypted
| messenger app's centralized servers.
|
| Even end to end encrypted systems know who is talking to who,
| and how often, and where those two parties are (due to client
| IP geolocation).
| mannerheim wrote:
| With a decentralised protocol + Tor that sort of metadata
| could be either unavailable or extremely difficult to
| ascertain.
| tremon wrote:
| Not really, even at my work we have (well, had) regular
| swap-meets for supermarket discount trackers. So one week I
| would shop as badge #1, the next week I would be badge #2.
| Just knowing the identity of the person who was issued the
| account doesn't give you any information about who's using
| it now.
|
| In aggregate, you would still be able to identify which
| group of people used which endpoints, but aggregate
| information won't hold up in court.
|
| Yes, geolocation would solve that, but I would expect such
| people to absolutely disable the GPS, so you'd need to rely
| on cell tower pings, which are not found on the same
| servers.
| snarf21 wrote:
| Yeah, these things are scary. My test for people who ask for
| these backdoors is to ask for them to hand me their unlocked
| mobile. I promise to not share any information I read/see.
| There is an expression in this area that I love (but I can't
| remember the exact phrase): If you follow anyone around for
| some small period of time, you will find them guilty of
| breaking the law.
| Jabbermonkey wrote:
| "If you give me six lines written by the hand of the most
| honest of men, I will find something in them which will hang
| him." - Cardinal Richelieu (disputed)
| RcouF1uZ4gsC wrote:
| I don't think that is quite comparable to now.
|
| Back in France at the time of Richelieu, there wasn't a
| concept of free speech or religious freedom. Thus if you
| said that you thought the king was an idiot, you could be
| hanged. Or you doubted the Church, or doubted God existed.
|
| Remember, blasphemy could be punished by death at that
| time.
|
| Nowadays, in most free democracies you are free to say you
| don't believe in religion, or think the leaders are idiots
| and there are minimal consequences.
| rubyfan wrote:
| > _The limits of what is legal or not have always moved (see
| homosexuality, drug and alcohol consumption, etc). So a 100%
| enforcement of the law is counter-intuitively undesirable._
|
| This is perhaps one of the more simple and persuasive arguments
| against domestic surveillance and spying that I've heard.
| rtkwe wrote:
| > Another argument against the "going dark" claim is that
| before smartphones and the internet, the only conversations the
| FBI could monitor was through phonelines and mail. These were
| known to be easily monitored and I doubt there was much more
| criminal activity happening through those then than now.
|
| It doesn't really matter that they quantitatively have access
| to more to them, from the POV of law enforcement though they
| had access to everything that was available if they wanted it
| then and they don't now. Law enforcement chafes and pushes
| against any attempt to limit them because their self image is
| that of protectors and good guys so what they do has good
| reason even if people don't want them to, it's a whole self
| justifying greater good/ends justify the means self justifying
| loop a lot of place fall into, including tech companies. You
| see it constantly with unjustified searches, stops and
| seizures, given a limit, eg the requirement for probable cause
| for a search, police find any way around it they can to justify
| the action they already want to take, eg smell of drugs or
| 'acting suspicious'.
|
| There are definitely crimes that go unsolved because police
| can't monitor everything 24/7, that irritates a group tasked
| with 'protecting' society so they push back. We feel the same
| thing in software engineering to a certain extent, governance,
| architectural approval, etc all suck to work with but they
| exist for a reason in big orgs but just because they're useful
| agencies doesn't mean they suck less when you're held up
| because the architects take 3 months to approve something and
| want 20 Powerpoint decks to do it.
| jtbayly wrote:
| But mail and phone were essentially the only methods of long-
| distance communication. The new methods of long-distance
| instant communication are not just groundbreaking for
| organizing legal business.
|
| Something really has fundamentally changed with the
| introduction of instant encrypted messages. I'm for that
| change, and against the government attempting to ban it.
| leetcrew wrote:
| it's not like you can't implement encrypted comms over mail
| and phone in the first place. people with a strong enough
| incentive (and nerds) have been using symmetric encryption
| for a long time.
|
| what has changed is, like you say, how trivially easy it is
| to send instant encrypted messages. what was once the domain
| of spy agencies and organized crime is now practical for my
| mom to ask me what I would like for dinner. one wonders why
| the FBI finds that so concerning.
| anm89 wrote:
| I like how these policies illustrate clearly what the real agenda
| of these agencies is.
|
| It clearly isn't to protect the American People in general. The
| way to do that would be to give them the best security measures
| available ie: E2E encryption.
|
| It is to strengthen the government against it's citizens. By
| having an encryption asymmetry between the government and it's
| citizens, the victory is that actions can be made easier in the
| case where the government and it's citizens are opposing forces.
|
| It's pretty clear in my mind that the FBI views "it's team" as
| exclusively law enforcement, other three letter agencies and
| other governmental organizations and it views everyone else as a
| hostile. The FBI is not on your side.
| JasonFruit wrote:
| I've been reading the Constitution, and I noticed an interesting
| point: the only federal law enforcement authorized by the
| Constitution was the state militias, which at the time consisted
| of all the able-bodied men of each state, and was commanded by
| officers from that State. This provided a check on the government
| that we have given up: how comfortable could the federal
| government be asking a non-professional group drawn from the
| general public, with their primary allegiance not to the federal
| government, but to a single state, to enforce a law that is
| inimical to their interests? I wonder if abandoning the state
| militias has helped cause the out of control federal law
| enforcement we see now.
| api wrote:
| We've massively increased the role of the Federal government
| vs. what was outlined in the constitution. The most significant
| reason for this by far is war, particularly WWII and the Cold
| War.
|
| Other wars before these played a role but I feel like WWII was
| the turning point after which the US was a different place. We
| entered more or less a permanent state of war or war-readiness
| since then, and the Cold War provided a rationale to massively
| increase the size of our espionage apparatus. Originally the
| idea was that this spy apparatus would only be aimed outward,
| but that was always a fantasy. Anything we aim outward will
| eventually be aimed inward.
| Mediterraneo10 wrote:
| I'd say that an even larger reason for federal-level law
| enforcement is the mobility that modern means of
| transportation brought. When the US was founded with its
| vision of autonomous states, there was not much mobility
| between states. It is no accident that the boom in the use of
| US marshals, postal police, and the Secret Service came with
| the building of the railways, making for crimes that spanned
| across states, for instance, while the FBI appeared in the
| automobile age.
|
| Once you get national-level police that inherently see
| themselves are superior to and unaccountable to state-level
| bodies, then it is no surprise that they might want to wield
| that power, and that might have happened even without those
| foreign wars the US was involved in.
| cies wrote:
| I dont understand why the US people still trust these agencies.
| FBI, CIA, NSA have all shown to act against the democracy in many
| cases. If they could be trusted, they could be trusted with a
| backdoor. Since they cannot be trusted, the backdoor only makes
| them a more dangerous enemy of the people.
| peteretep wrote:
| What's the alternative?
| [deleted]
| KMag wrote:
| The alternative is to design systems, structures, and
| procedures more robust against infiltration by selfish actors
| or actors loyal to foreign governments. "Defense in depth"
| instead of assuming you can ring fence the good guys, etc.
|
| Law enforcement ends up having to rely more on undercover
| work and informants, as it used to in the past. The CIA and
| NSA end up getting less intelligence for the same budget, but
| conversely, spies who infiltrate the CIA, NSA, etc. get less
| bang for their buck, as well.
| judge2020 wrote:
| We don't trust them, but we do expect them to stop exceedingly
| violent crime, ie. terrorism and csam - and they do that well.
| A lot of americans don't care at all, though, and trust them
| regardless because they 'have nothing to hide'.
| DocTomoe wrote:
| This is a wrong premise. The US people don't _have_ to trust
| them, ultimately, their opinion is not important. What is
| important is that whoever currently is in power considers them
| useful - which is easy to achieve. And no political candidate
| who is likely to take office will take a stand against what in
| the end will be the tools they use once they are elected.
|
| For the citizenry, the only way to deal with this situation is
| to avoid storing data, and hardening their devices.
| boomboomsubban wrote:
| I disagree that the elected officials are the ones that
| ultimately hold the power here. Part of both the CIA and
| NSA's job is to control elections, any candidate truly
| opposing them would have to overcome that.
| cies wrote:
| Or fix the demoncracy back into a democracy.
| clipradiowallet wrote:
| > I dont understand why the US people still trust these
| agencies
|
| We DON'T trust them. We have about as much say in what those
| agencies do as a random shop keeper in 1980's USSR does with
| the KGB.
| scruffyherder wrote:
| I voted with my feet. Life outside the five eyes has been...
| interesting
| gibspaulding wrote:
| I would love to hear more about this. Have you written about
| the process anywhere? Would you be comfortable saying where
| you moved?
| alkonaut wrote:
| What's the alternative to having law enforcement agencies at
| any level (whether that is on a regional or national level
| doesn't really matter?) with democratic oversight?
|
| If the democratic oversight fails and transparency suffers,
| then the outcome will be less than ideal. But the answer is
| hardly "remove law enforcement authorities from level x",
| surely it must be improved transparency and oversight?
|
| Also, no agency can be trusted with a back door. Back doors are
| available for all actors or no actor. An NSA back door to
| encryption is also a back door used by an authoritarian regime.
| There are no "exclusive" back doors.
| boomboomsubban wrote:
| >But the answer is hardly "remove law enforcement authorities
| from level x", surely it must be improved transparency and
| oversight?
|
| You can use this to argue that the FBI and parts of the DHS
| should still exist in some form, but the CIA, NSA and
| military intelligence agencies are not law enforcement.
| Deestan wrote:
| Nobody can be "trusted" with a backdoor, because it isn't
| really a valid concept.
|
| A backdoor is a vulnerability that doesn't care who you are or
| what your purpose is or who pays you. If you found the backdoor
| it is open to you.
|
| However hard the backdoor's security is, an insider recruited
| by Swedish intelligence (or Russia whatever the bogeyman du
| jour is) will leak the key at some point. Now all your "secure"
| shit can be accessed invisibly by Swedish hackers. By its very
| nature, the backdoor cannot easily be changed and its use
| cannot be detected.
|
| A mundane example is the TSA keys. In addition to being leaked
| by greedy insiders making a quick buck, they've been leaked by
| accident several times. E.g.
| https://hackaday.com/2015/09/18/dear-tsa-this-is-why-you-sho...
| They are now public knowledge, and a backdoor into your luggage
| from anyone who cares enough to file up a key.
| poundofshrimp wrote:
| Just give the government a copy of the private key. What
| could go wrong? It's not like anyone is hacking into the
| government these days.
| 2OEH8eoCRo0 wrote:
| What about hardware backdoors where you would need physical
| access to the device?
| MaxBarraclough wrote:
| The TSA masterkey case is an interesting analogue example.
|
| I don't know much about locks, but I wonder how it could ever
| be secure, even if they never leaked photos of the
| masterkeys. In principle, it should be possible to reverse-
| engineer the shape of the masterkey from any masterkey-
| compatible lock. Would it be practical to do this?
| lallysingh wrote:
| This is the same TSA that's shown those keys in photo ops?
| formerly_proven wrote:
| - It is not secure
|
| - You can make/buy them
|
| - Luggage locks are all garbage anyway
|
| Most mechanical locks are garbage and neither resistant to
| practical physical attacks nor at all pick resistant. Many
| are vulnerable to super-generic low-skill attacks like bump
| keys and comb picks.
|
| Many electronic locks are garbage.
|
| Smart locks are complete garbage.
|
| See
| https://www.youtube.com/channel/UCm9K6rby98W8JigLoZOh6FQ
| for many practical examples.
| topkeks wrote:
| I don't understand why Americans always use those garbage
| locks even in their homes. You never see such shitty
| locks in Northern Europe. Literally everyone is using
| Abloys.
| leetcrew wrote:
| physical locks are meant only to deter
| casual/opportunistic attacks. LPL essentially makes this
| point in the video on his home security setup. it's
| pointless to spend a lot of money on a front door lock
| that takes more effort to pick than it takes to force
| open the door or smash a window.
| yownie wrote:
| All governments (potentially) being (the deadliest) enemies of
| the general public used to be generally understood in all
| democratic circles. Most people seem to have forgotten, and/or
| don't read their histories.
| garmaine wrote:
| Why do you think we have any control or say over the situation?
| cies wrote:
| Well, you shout really loud yr a democracy.
|
| Basically saying you have no control is saying that the US is
| no democracy.
| sneak wrote:
| The US does not have equal protection under the law, and
| the laws are enforced arbitrarily to carry out the will of
| the military and the ownership class.
|
| The thing you reference is just a cover story. It's plain
| as day to anyone paying attention who runs that country.
|
| There is no party you can vote for that will stop the
| perpetual war or perpetual ubiquitous surveillance, despite
| a vast majority of people in the country being against both
| war and surveillance.
| mannerheim wrote:
| Is there a vast majority against surveillance?
|
| > A majority of voters say they are satisfied with the
| authority given to U.S. intelligence agencies to monitor
| Americans suspected of committing a crime, according to a
| poll released Thursday.
|
| > Fifty-one percent of respondents in a recent Hill-
| HarrisX survey said the intelligence community has the
| "right amount of power" in determining who should be
| subject to government surveillance.
|
| https://thehill.com/hilltv/what-americas-
| thinking/433071-pol...
| cies wrote:
| Wholeheartedly agree. Hence it is about trust (my first
| point) and/or absence of democracy. And this is a bigger
| issue than encryption, IMHO.
| sneak wrote:
| Sure, but life continues in the absence of democracy, and
| encryption is useful in the short term in that life.
| Building a democracy where none exists is a
| multigenerational task.
| justaman wrote:
| When the FBI is hurting bad for talent to secure the interests of
| the US, why on earth would I sign up when this is their stance on
| encryption?
| ios14 wrote:
| Paradox. They need more talent to build more secure mousetraps.
| Large portions of the talent pool are sidelined on political
| and/or technology-first ideology.
|
| Requirements don't change, talent is lacking: backdoors that
| compromise encryption become the proposed bandaid. We are all
| worse off as a result.
| anm89 wrote:
| Yeah they've got billboard up all over my city recruiting for
| 'special agents'.
|
| Whatever they are paying i could not imagine it's even close to
| enough to deal with what you are signing up for.
| markhahn wrote:
| "Non-backdoored communication, being necessary to the security of
| a free State, the right of the people to strong encryption, shall
| not be infringed."
| sxqnicholas wrote:
| The article's title is a little misleading, but I agree with
| their overarching message.
|
| Law enforcement should never be given the easy way out in terms
| of breaking encryption. Asking for backdoors to be installed in
| every device is extremely lazy police work. I'm sure there are
| other ways of breaking encryption like the rubber-hose technique
| (of course with valid arrest warrant).
|
| Arguing that law enforcement should stop attacking encryption
| because it jeopardises privacy seems a little naive to me. What
| about criminals that profit from creating spyware? In fact,
| allowing law enforcement to actively research new ways to break
| encryption can be productive for improving security in the long
| run. Stop using weak passwords people.
| varispeed wrote:
| What I find most upsetting about this is that it seems the real
| goal is to defend the monopoly of big pharmaceutical companies
| and it has nothing to do with protecting the public. Cannabis
| is a great enemy of some corporations that are heavily pushing
| their opiate based drugs and they corrupt law makers and law
| enforcement to protect their markets at the expense of public
| who pays for it. This is obscene and erodes trust in any public
| services.
| iNate2000 wrote:
| 1. researching ways to break encryption is only productive if
| people are allowed to use the stronger encryption that comes
| from that research.
|
| 2. FBI isn't arguing for new ways to break encryption, they're
| arguing that old ways to cripple encryption should be used on
| purpose.
| JoshTriplett wrote:
| > I'm sure there are other ways of breaking encryption like the
| rubber-hose technique (of course with valid arrest warrant).
|
| "rubber-hose technique" refers to torture, not to something
| that a warrant would allow.
| KubikPixel wrote:
| The FBI Should Stop Attacking Encryption and Tell Congress About
| All the Encrypted Phones It's Already Hacking Into
| exikyut wrote:
| I didn't realise this was the listed title of the article. I
| like it than "the FBI should stop attacking encryption" a lot
| better.
| HenryBemis wrote:
| > When the FBI says it's "going dark" because it can't beat
| encryption, what it's really asking for is a method of breaking
| in that's cheaper, easier
|
| The way I see it, authorities all over have zero difficulty in
| breaking into devices (deus ex Cellebrite).
|
| I always believe that any password we use (computers, phones,
| etc.) is only to protect us against the _common criminal_.
| Someone who will take your phone, and a strong PIN /password will
| only stop them from using your Apple/Android-Pay, read your
| emails, read your messages, etc.
|
| If the gov _wants_ to get something from you, then the gov _will_
| take something from you.
|
| "Give up your password or go to jail: Police push legal
| boundaries to get into cellphones"
| (https://www.nbcnews.com/news/us-news/give-your-password-or-g...)
|
| Also the _Security_ by XKCD. (https://xkcd.com/538/) (in non-
| democratic countries, or really dark scenarios).
|
| Also.. let's be honest, when the "default" on all devices is to
| "sync _all_ with Google /Apple cloud", then there is minimal need
| to even alert someone to the fact that you need their data (e.g.
| by arresting them, confiscating their devices, etc.)
|
| Just warrant+gag to Apple/Google/Dropbox/etc. and you got their
| "latest" backup easy-peasy.
| XorNot wrote:
| App updates has always struck me as the big one.
|
| I can't turn them off, I can't easily validate them, and
| there's little preventing an update just for my device being
| shipped.
| scruffyherder wrote:
| Without fail I was always getting carrier "upgrades" before
| big protests and police sweeps. It became my warning signal.
|
| Once the virus hit the news in Wuhan, and the protests
| started to dial down the updates got fewer and fewer. And
| with the closing of the border I haven't gotten a carrier
| upgrade in months. As part of the 2 million + crowd I know
| I'm tracked like a rat. But that's how cellphones work
| biafra wrote:
| Whether you can turn them off depends on your operating
| system. Most of them allow you to turn them off. What are you
| using? And if it really bothers you, why don't you switch?
| HenryBemis wrote:
| The point XorNot made (and I agree) is that "it is switched
| on by default". And then you need to go to 5 different
| settings to switch them off (OS update, App update, iCloud
| login, iCloud sync of Backup-StockApps-Messages-etc).
|
| The "welcome" should not be "all your data are belong to
| us". It should be "Hi, iCloud-Y/N, AutoUpdateOS-Y/N, Backup
| Message-Y/N, Backup Notes-Y/N, etc.).
|
| I get it that for MANY reasons Apple wants everyone to run
| the latest OS/Apps versions, but.... did they ASK me?
|
| Exiting their ecosystem is painful. Apple/Google rely on
| this. There are plenty of discussions on 'how to exit' and
| alternatives, but this is HN. The average HN-er is not
| exactly the same as the average smartphone user.
| XorNot wrote:
| Honestly it's more that there's no reason to think any of
| those buttons do what they say they do. Why should they?
| I haven't inspected the source code which controls them,
| I didn't build the firmware images which go on my
| devices.
|
| Without reproducible builds from multiple sources, how
| can we be sure of anything?
|
| If there's a service we have a desperate need for, it's a
| change in ecosystem priorities that core functionality -
| OS's, chipsets, etc. - are open source, and updates go
| out as inspectable patches which get pulled into
| reproducible build farms and bittorrented out to users.
|
| Start with C compilers and work your way outward from
| there, but I should be able to cryptographically prove to
| myself that the firmware update going into my Android
| phone was independently reproducible from public source
| code from users in a few different nations.
| sneak wrote:
| You can indeed turn them off, at least on mobile devices.
|
| Desktop apps are much worse in this regard.
|
| https://github.com/signalapp/Signal-Desktop/issues/4578
|
| https://github.com/bitwarden/desktop/issues/552
| peteretep wrote:
| > Just warrant+gag
|
| And ... that's probably ok? The people are not meant to be
| protected against all searches, only warrantless search.
| HenryBemis wrote:
| >And ... that's probably ok
|
| 1000% ok. Caveat: the warrant is legit and they
| (judges/appropriate authorities per country) do their job
| right and don't have 100 pre-printed approvals (a la blank
| cheque) lying around and just hand them over to any policeman
| and/or torturer walks in asking for one.
|
| (Also) I am thinking the people in China, Iran, Turkey, etc.
| where people dissapear in the middle of the night (even
| public figures). Do we not care for those 1.5bn people
| because they are outside the EU, USA, CA, AUS, NZ, etc?
|
| My initial point is that one cannot hide from the State. One
| can only hide their data from the _common_ criminal.
___________________________________________________________________
(page generated 2021-03-15 23:02 UTC)