Hacker News Reader

Comment by EnderMB | Hacker News Reader

This is probably a stupid comment to make, but when the feds request these passwords what is stopping a firm from giving over a set of tampered passwords?

Let's say a request is made for Google give over loads of Gmail passwords. Could they not silently implement an extremely strong password encryption on the affected accounts, and hand over these passwords, knowing that the feds wouldn't be able to crack them without a significant amount of time.

Also, are the feds likely to check to see if these passwords are legitimate? If my password was 12345 and Google simply told them that my password was 54321 then how could the feds possibly know that the passwords sent over are real?

EDIT: Obviously, I know this is highly illegal, and would land any company in trouble. I'm just wondering whether, theoretically, this is possible for a firm to do to circumvent any action from the feds.

View on HN

Silently sabotaging LEOs efforts like that would be rightfully highly illegal. "Perverting the course of justice" in the UK. I assume there's a US equivalent.

It's just not worth a company risking this kind of tampering. They could go to jail for that.

By all means, companies should fight back legally, and it sounds like they all are. I applaud them for that. But I think it's unreasonable to expect them to break the law for you.

You're absolutely right. However, is it a crime that could be tracked, without an employee explicitly whistle-blowing to the feds? Even then, could the feds prove this? I'm no expert, and I'm probably wrong in saying this, but in my mind it'd be near impossible to prove that a provided hash had been tampered with, instead of a user just changing their password.

It's morally wrong, and obviously I'm not saying it's the way to go. It's just a theory that I had, and I wanted to know if it was feasible for a company to do this.

FWIW if a fed has an account with the service (which is fairly likely for big services like Gmail et al), and knows the hashing algorithm (if they've successfully got the passwords this is pretty likely too) they could prove it easily by hashing their password themselves and comparing it to the stored version.

>Also, are the feds likely to check to see if these passwords are legitimate? If my password was 12345 and Google simply told them that my password was 54321 then how could the feds possibly know that the passwords sent over are real?

By them NOT WORKING?

Well, they're not going to crack a ton of passwords that quickly, and I'm guessing that they're testing against the live server, so if the password doesn't work then surely the most obvious answer is that the password has changed.

A lot of people have already stated that one way around this would be to change your password before the feds have had a chance to crack the provided hashes. This would surely be a similar system.

Of course, I don't know if this would work at all. I was basically thinking aloud to see if this idea would have some merit.

Google will tell you that you changed your password {0} days ago if you try to log in with the previous password.

Why not implement said extremely strong encryption algorithm by default, before it becomes an issue?

Reply on news.ycombinator.com