Comment by api | Hacker News Reader

Comment by api | Hacker News Reader

"It turns out that somehow, Comey believes that the question of whether to ban encryption without backdoors is “not a technical issue.” He told the senators that “plenty of companies” provide services online while still maintaining the ability to read their users' data, and that “plenty” of smartphone manufacturers can unlock encrypted phones. Thus, he concluded, “it’s a business model question.”"

If you read between the lines a bit, it's clear that what they want is encryption to/from cloud hubs where data is stored using escrowed keys (a.k.a. server-side "encryption"). Many services already more or less do this, so the goal would be to push the entire market in this direction and then eventually to outlaw or otherwise restrict systems that do not work in this way.

This fits in with the dumb terminal / mainframe model of the Internet being pushed to varying degrees by most of the tech giants these days and with Amazon's vision for IoT.

It's stupid and naive to claim that there is some technical barrier to what the FBI wants. It's actually quite easy if we apply a bit of government pressure to push the Internet even further toward the "put everything in the cloud" direction it's already going. Anything in the cloud is almost by definition backdoored.

> Anything in the butt is almost by definition backdoored

Pretty much. The TLAs are whining because they got used to wholesale vacuuming of butt data, and now the pendulum is poised to swing the other way.

IMHO Apple is merely poking a hornet's nest, because it will be quite easy for USG to force them to modify their centrally-distributed software. The only truly defensible position we have is Free software. Whether there's enough interest/money to support its wide scale adoption is one of the major questions of our time.

Greatest instance of the 'cloud-to-butt' translator I've seen.

Not so easy when there is no law requiring them to do so. In iMessage, Apple still has the keys but the forward secrecy is enough to exclude it from CALEA because of the way the "encryption" exception was designed. This of course caused FBI to complain, which among other example of encryption made encryption backdoors a political issue again in the first place.

It's USG. Creating new authoritarian laws, especially indirectly applied through companies, is basically what it does.

Which reminds me that CALEA, DMCA and the like was passed in the 1990s, when not as many people was using the Internet as today. SOPA/PIPA was passed in a time when everyone for example is using Google, which is why the protests was so effective. In this case, such a law requiring backdoors would be likely unconstitutional (it was tried in the 1990s too), which is why FBI is resorting to other methods.

I itnerpret the trend the opposite way - lots of people using the Internet, but having no clue how software works and being utterly disempowered with respect to what their devices do. In the 90s, it was the entire Internet community was solidly against surveillance backdoors. Now the majority figures the activities shown on primetime propaganda are what is required to keep them "safe".

> such a law requiring backdoors would be likely unconstitutional

Lol, as if that means anything when all ten test cases from the Bill of Rights are failing! I can see such a law being easily gavel-stamped since it's regulating interstate commercial activity.

But the number of people using the Internet was relatively small, so nothing has changed really. The only difference is that the majority began using the Internet in the first place.

Depends on how one perceives democratic force working.

I don't view the absolute number of calls to congress as important as unstated assumptions about what is "unamerican".

Back in the 90s if you asserted that the government was tapping everything, you were called a conspiracy nut. Because we had a shared societal belief that it was off the table in a free society. This has now been broken.

A politician endorsing a surveillance system that would make East Germany jealous would have been ridiculed by the media. Now they're ridiculed for not supporting such totalitarianism.

That was caused by 9/11 though not the increasing use of the Internet. Which also reminds me that the US-EU safe harbor dates back to 2000.

Sure, but the cause of it doesn't really matter. The net effect is I feel we're in a worse position for this battle than the 90s. Perhaps the 90s are just safely in the past, but this time I feel this issue will be with us until the tyrants finally get their way, or USG collapses.

And Snowden's disclosures, while great for exposing the conspiracy, serves to normalize the surveillance. Very few people are switching away from butt services as a result, a tacit endorsement of the status quo.

FWIW, if you watch things from before 11sep2001 there's still constant mentions of terrorism. "911" is more of a pretend watershed so we can tell ourselves "everything changed" when in reality the panopticon has been building for far longer.

I hope that Bernie wins, and that will help at least as a first step toward change.

"Comey believes..."

Comey is the emptiest suit I've ever seen testify before Congress. Comey is told by his handlers what he should claim to believe and otherwise he carefully avoids believing anything.

At one point today he really showed his ass. After tacitly agreeing with Leahy about "an Internet sale" of a gun which implied anyone could order a gun online without a background check, Graham asked Comey if such a purchase would be "delivered to my home."

When asked this question, the Director of the FBI, an organization that, along with the ATF, orchestrated the Fast and Furious gun-walking scheme and therefore should have absolutely zero confusion about the exclusive role of FFL holders in the transfer of firearms in the United States and the harsh federal penalties for anyone that fails to obey the relevant laws, answered in public, complete with a genuinely quizzical look;

"... I assumed it's shipped to you, but I don't know for sure actually ..."

Full stop. Not one shred of a clue. Un. Freaking. Believable.

There is nothing there. Comey is literally propping up a suit for the cameras.

> Many services already more or less do this...

Those services can't be trusted now where part of the threat model is corrupt, hostile, and/or authoritarian state actors. Unless you think America is the only place you'll conduct business that needs secure communication, that's not a viable "solution."

Honestly the EFF should pivot their marketing directly to this, rather than staying abstract and getting lost in the noise - "FBI Director James Comey wants to help authoritarian regimes spy on Americans simply to make his agency's job easier"

"Unless you think America is the only place you'll conduct business that needs secure communication", and you trust the US government in the general, and you trust each individual government agent or employee with that kind of access not be corrupt, and you trust each such agent or employee to be super-competent as to not be hacked by an hostile third party, and you trust the cloud company in the general, and you trust each employee of that company with access to not be corrupt and to be super-competent... and so on and so forth.

The fact that we currently mostly use systems where we need to trust a large number of people with our data only to communicate with one another doesn't mean that those systems are the right ones to build, even at a relatively apolitical technical level. The early internet, before HTTPS was common, added a large number of interconnected ISPs to that list of 'fully trusted by design' parties. That was, as we have recognized for decades, a design bug. One which we are only now starting to fix adequately. Trusting the cloud providers with full access to all data stored or even processed by them is a similar design mistake.

(Not saying that there isn't ever a use case to send data to a company so that they offer a service by processing it, but simply storing and transmitting private messages between two users shouldn't count as giving that data to the cloud provider anymore than it counts as giving that data to the ISP)

The article does label key escrow as 'technical means that badly compromise their users’ security'. Now I'll be the first to admit that I'm not an expert, but saying 'well, you can use key escrow' ignores the fact that the authors label key escrow as one of the ways not to do it.

Outsourcing your computation to the cloud doesn't have to be insecure, if you trust the code you're running (perhaps it's your own code). Cryptographers call this delegated computation, and while modern techniques are still VERY slow, there has been a lot of progress in the past few years, and I think the landscape of these techniques will look much better.

Of course, we still have to contend with the case where the software you use is NOT owned or trusted completely by you. That's a different problem that IMO can only be solved by open source software.

Reply on news.ycombinator.com