What i don't get, yes you can force Facebook to implement Backdoors, but how would you do that with a opensource project like Matrix or even the full opensource Android?
- block access ala GFW, ensuring that most people will have difficulty accessing it or using it
- block access to any data you cannot decrypt or from an endpoint you cannot backdoor
- go after creators and ensure some kind of backdoor is inherent to the project
- shut down projects by exerting pressure on developers
- run some kind of propaganda campaign on the evils of using unsanctioned software (supporting terrorism etc.)
- do nothing, knowing that most users will avoid using anything that isn't one of the major web platforms
>shut down projects by exerting pressure on developers
The developer probably just going to the press with that, no need to damage your own private centric project, sure the NSA can say they never did that so the developers can ignore it OR they openly say it was them, then the project just can change the country.
>run some kind of propaganda campaign on the evils of using unsanctioned software (supporting terrorism etc.)
>do nothing, knowing that most users will avoid using anything that isn't one of the major web platforms
Those are probably the only viable solutions, but on the other hand it's pure marketing for the product, like banning telegram in Russia.
Because i don't like pressure from a Secret Services...do you?
OK with one exception...Xenia Onatopp
depending on sofistication of that solution you could imagine some forms of tunnelling to be efficient against that (IP-over-X). Then of course due to the complexity this workaround will be used by a tiny fraction of users.
>- block access to any data you cannot decrypt or from an endpoint you cannot backdoor
steganography would be a solution to this, you can decrypt the cat pictures I'm exchanging with friends but you may not be able to notice that those images have hidden content (which may also be encrypted)
>- do nothing, knowing that most users will avoid using anything that isn't one of the major web platforms
this seems to be a guaranteed-to-succeed solution. Probably much better than
>- run some kind of propaganda campaign on the evils of using unsanctioned software (supporting terrorism etc.)
since there is always a risk that this may backfire and encourage resistance in some groups
Plus if you really really want to know what's happening there, call the NSA. They'll send a few chaps to join the matrix dev community. Or they'll use other tools to access the machines in question. And you can do that to the 0.01% of people that actually switch after mainstream tools become insecure in a way you can't when there are billions of people using encryption by default.
Not sure if they give me any information as a Swiss citizen :-)
>They'll send a few chaps to join the matrix dev community
That's probably more on the James Bond side of reality
>Or they'll use other tools to access the machines in question
Yes that's what they probably will do, but that is targeting and not a Backdoor/break encryption by law.
https://www.androidauthority.com/nsa-android-code-239118/
They're also involved in the Coreboot alternative BIOS project:
https://www.tomshardware.com/news/nsa-contributes-low-level-...
One of the key revelations from Snowden was that all that stuff that seemed far fetched or paranoid to us, wasn't just happening, it was routine and much more advanced stuff was also going on.
It's also much easier to target Matrix etc when you don't have to target all of Facebook because you have a backdoor there. Reducing the NSAs workload by 99% makes the other 1% much easier because they have 100 times the resources to spend on it.
You should also consider as a swiss citizen that US law is increasingly world law. If you sit in Switzerland and contribute to a project banned by US law, they may well have you extradited to spend the rest of your life in a US prison. They're doing that to Assange right now. They've done it to others as well. Locking up foreigners is quite in-style in the US at the moment... I haven't read the bill, so I don't know what the criminal sanctions are for failing to provide backdoors...
Best of luck
>You should also consider as a swiss citizen that US law is increasingly world law
That's Bullshit, was probably half true in the Cold War era but for sure not today.
> They're doing that to Assange right now.
That's England, you know those little dogs of yours.
In the cold War it was true of the western world and the USs use was limited because the US wanted to look gentle and reasonable. Today it's true for most of the planet and the US wants to look tough.
If you don't like the Assange case (I agree the brits are lap dogs, but that case actually got kicked off in Sweden and was handled under EU law much more aggressively than the in UK), try the FIFA case. The US ordered Switzerland to arrest and extradite foreign nationals, many had never set foot in the US for trial, Switzerland obeyed...
https://www.washingtonpost.com/news/the-fix/wp/2015/05/27/ho...
I don't like any of this. But it's time to abandon our innocence. If you're working on any meaningful project in encryption, the NSA are at least aware of you. The US are happy to use covert methods to undermine you if they think its worth it (and the bar is low). If you're important enough (or a DA wants to expense some flights) they'll use overt methods. Proceed at your own risk and don't assume that America banning encryption doesn't make it illegal for you just because you're a Swiss citizen in Switzerland.
No problem with that, from the article:
>With wire fraud, one needs a wire that originates in the US
Sometimes we even ask for it...that's normal international business:
https://www.admin.ch/gov/en/start/documentation/media-releas...
>Proceed at your own risk and don't assume that America banning encryption doesn't make it illegal for you just because you're a Swiss citizen in Switzerland
Yeah i stop here...
BTW from your first article about android:
>So, if it’s not looking to plant backdoors, what’s the NSA’s business with Android? Ironically, the agency has been working to make Android more secure.
AND
>It is just as preposterous to think that the best way to gain access to any operating system is to publicly announce that you are contributing to the OS, and make the tainted code accessible to anyone with an interest in it.
So it was NOT Snowden, but NSA itself.
Second Article about Coreboot:
>Myers published a paper about STM last year on how NSA’s STM implementation could work. All Coreboot code, including all the STM contributions from the NSA, are open source, so anyone could verify that there is no backdoor in there -- in theory.
Even if the project is open source and development is distributed, there is often a major entity behind it driving it on which the requirements can be enforced.
Again i was talking about the opensource android, not the googlified closed version.
>for Matrix force the hosted Element.io instance to provide it
How? If they are not US Citizens?
The parts that control doing calls, connecting to cells, etc.
They are called "Radio" firmware.