Comment by joshka | Hacker News Reader

Comment by joshka | Hacker News Reader

Parent Full thread

Same problem pretty much with the NY bill. Buy a phone that is unlocked / decrypted at the time of sale. The next step is for the user to login and encrypt. I don't see how this bill actually fixes that. I guess this hinges on the definition of authorized when it comes to encrypting something I own. I hope I don't require authorization to do this.

A few questions I posed to the NY senator earlier this week:

1. Would you use such a phone knowing that the government / apple / seller of the phone could easily get into it. 2. Would it be legal for someone in the legal profession to use such a phone without being disbarred for negligence of the right to private communication? 3. If sold unlocked, and then later locked (i.e. every phone right now), where's the change? 4. Where's the 4th amendment fit in with this? 5. What should we do with old phones that don't support this? Dump them in the bay I guess? 6. Where are the technical experts that are telling you that this is actually feasible to do securely and safely? I'm looking hard, but only seeing negative responses from those that know what their talking about. 7. Who's responsible for fixing the broken device once the master key gets leaked? The manufacturer? The state of {CA/NY}? 8. the list goes on.

Not just the same problems as the New York bill; the wording of the two bills appears to be nearly identical!

Here's the CA bill: http://www.leginfo.ca.gov/pub/15-16/bill/asm/ab_1651-1700/ab...

Here's the NY bill: http://legislation.nysenate.gov/pdf/bills/2015/A8093

Although there is definitely cause for concern, these are just state-level legislative bodies. They couldn't prevent Californians and New Yorkers from buying out of state or international phones that aren't crippled with back doors.

It's a worrying trend, though. It seems every few months another law like this is proposed. Requires constant vigilance on our part.

Could easily be explained by these bills originating with ALEC.

https://en.wikipedia.org/wiki/American_Legislative_Exchange_...

Dude the last paragraph is almost word for word. Who wrote these??

Could be anyone. ALEC pushed "model legislation" to "great" effect (see castle doctrine, others) but other groups do it, too. See http://www.azcentral.com/story/news/politics/2014/04/05/lawm..., among others.

NSA? FBI? I'm sure they're pretty happy with them.

I'm going to make it clear to Jim that I'm going to give money to his political opponents in his next election.

Nah this will only benefit local cops. Those big guys have network sniffing.

I'm not so sure about that as the language of the bill states:

"(d) (1) ...that is not capable of being decrypted and unlocked by its manufacturer or its operating system provider shall not result in liability to the seller or lessor if the inability of the manufacturer and operating system provider to decrypt and unlock the smartphone is the result of actions taken by a person or entity other than the manufacturer, the operating system provider, the seller, or the lessor and those actions were unauthorized by the manufacturer, the operating system provider, the seller, or the lessor."

Presumably the "those actions were unauthorized" could be construed as prohibiting a FDE option from being built into the OS and provided by the manufacturer and this in conjunction with signed kernels in phones, would present a very high barrier on the user to be able to obtain device encryption without key escrow as we understand it today.

This has been my understanding of what they really want, in particular when using the word "front door". That's key escrow. Not weakening encryption so that they can break it, but they want manufacturer or OS provider to have a copy of the keys used and in particular the law seems worded to burden the company to actually perform the decryption, not merely hand over the keys.

Addition: While I don't think either funded or unfunded mandate to do this decryption is OK; I think it's untenable for the company to hand over keys to just any government. With those keys, the government can not only decrypt, they can decrypt-modify-encrypt and thus frame dissidents or political enemies.

The argument has been around for a long time. The first crypto wars had their policy papers and summary pros/cons such as https://www.cs.cornell.edu/html/cs513-sp98/hw.policy.keyEscr....

This is where the bill breaks down logically. A seller of an unlocked/decryptable device can say "you're not authorized to encrypt this" all they like. As a user though, I don't require their authorization to do what I like to a device I own.

A gun seller does not 'authorize' someone to use the gun to commit murder. Best buy, AT&T, etc. likewise do not authorize a user to encrypt their device. Nor should they. What I do with my device is none of their concern so long as I pay my bill.

Reply on news.ycombinator.com