Hacker News new | past | comments | ask | show | jobs | submit login
The FBI Should Stop Attacking Encryption (eff.org)
436 points by KubikPixel on March 15, 2021 | hide | past | favorite | 126 comments



Another argument against the "going dark" claim is that before smartphones and the internet, the only conversations the FBI could monitor was through phonelines and mail. These were known to be easily monitored and I doubt there was much more criminal activity happening through those then than now.

I would argue that the conversations that have gone online are the interactions that were previously happening in-person (at least in term of criminal activity), to which the FBI didn't have access before.

There is something Orwellian with the idea that there shouldn't be a word that can be pronounced in the country that the government cannot record and listen to after the fact. The limits of what is legal or not have always moved (see homosexuality, drug and alcohol consumption, etc). So a 100% enforcement of the law is counter-intuitively undesirable.


I find it extremely alarming that law enforcement almost everywhere around the world is attempting to undermine almost a century-fold of legitimate mathematics and science with regards to encryption and cryptography.

It's a tad embarrassing that lawmakers (who aren't even computer scientists like c'mon are we for real here?) somehow forgot how and who broke the Enigma Machine. Alan Turing did that.

Same thing with the Tor browser developed by the US Navy. Either everyone has access to a tool which can guarantee that you can blend in with the rest of the crowd, or every civilian has a special color and we all pop out while the lawmakers and police are somehow wearing grey.

How did cypherpunks and computer scientists get blasted from the government like this? Shouldn't there be some laws regarding digital privacy for US citizens?

Somehow AD revenue is caked everywhere but I can't use a computer without the FBI wanting my social security card? What the duck. Shucks I thought this was America.


We need to make it strategic to hide our communications. The day the CIA decides that [place any enemy] has routers all over the place in US territory and that their spying is bad, they will mandate the use of Tor instead of discouraging it. We don’t need to be at war, but we need a capable enemy.


I heard the balance of power argument before and, well, you were already granted this wish ( and I would argue that you had it granted twice ). Both China and Russia are very capable adversaries at this time and US is slipping from its top dog position. It is genuinely sad to watch.


Russia isn't a threat to the US. Foreign policy maybe, but not existential like China.


Russia is a terrible threat to the US. How much/many of their disinformation and memes (in the traditional sense) are correlated with disrupted political discourse, extremism, and disunity in the US? They don't sponsor squads of disinfo/misinfo actors just for giggles. It has a profound destabilizing bang for their buck.


Similar disinformation happens domestically, see russiagate


Tor is not an end-all solution. Hidden services can be trivially unmasked (for an actor like the CIA/NSA) with traffic correlation attacks


Targeted surveillance is different than mass surveillance, different threat models call for different tools.

https://everytwoyears.org/2020/07/13/tactical-privacy.html


When all it takes is a quick online search for any agent to access the mass surveillance, all privacy invasion is targetable.


>> Either everyone has access to a tool which can guarantee that you can blend in with the rest of the crowd.

This is already happening. When the NSA decided the best approach to combat terrorism was to scoop up all emails, text, voice and internet browsing of every citizen on a daily basis, they inadvertently created a way we can all "blend in" now.

A perfect example is the Jan 6th capitol attack. It was being planned out on the open, on social media channels. They didn't use any obfuscation in their language and still, even with all the technology they have, the massive surveillance machine couldn't stop it from happening.

I still firmly believe encryption is needed for privacy, but over the last 10-15 years, the insane amount of data being vacuumed up is allowing people to hide in plain site.


>A perfect example is the Jan 6th capitol attack. It was being planned out on the open, on social media channels. They didn't use any obfuscation in their language and still, even with all the technology they have, the massive surveillance machine couldn't stop it from happening.

While the rest of your point is salient, this example is flat out false. The FBI and multiple police departments were aware of what was about to happen and warned those in charge. It was summarily ignored, because the people in charge believed the rioters were on their side. It could have easily been stopped had they reacted with even a fraction of the force they did with the BLM protests a year earlier. The events of January 6th was a result of institutional prejudice and nothing less, not a lack of information from surveillance.


15 years ago, if I had said that society would build a tracking system and that most people would happily carry a tracker in their pocket and pay monthly fees to support the tracking networks, I would have been laughed out of the room.

But that is what happened, and most people are oblivious to this fact.


I don't think, "Most people are oblivious," they just don't care and/or don't understand the implications.

The idea that the government can use your mobile phone to spy on you is so widely understood that even the dumbest popcorn movies make sure to show fugitives ditching their phones and criminals collecting/discarding them before they discuss business without explaining why. Everybody understands the purpose of a "burner" phone.


Yes, most everyone knows that they can be tracked.

The point is that we voluntarily paid/pay to build and maintain the tracking infrastructure. That's what most people don't realize.


>I don't think, "Most people are oblivious," they just don't care and/or don't understand the implications.

But they do, that's what's baffling. The number of people I have heard parrot the "Bill Gates put a tracking chip in the vaccine" has me both baffled and worried. These are people who appear to be otherwise completely sane and mostly rational. When I've pointed out that's literally what their phone does, so why would Bill Gates waste any money putting something in a vaccine (ignoring that's not even physically possible) - I get a "well that's different".

They are concerned, but as a non-technical person for some reason they just can't quite wrap their heads around what is happening.


>But they do, that's what's baffling

I think it's more that there's no other option.

They need their phone, and they don't like all the tracking just like you or I don't like the tracking, but that's their only option if they want to use a phone.


They can, but they wish it weren't true. Cell phones have an obvious huge upside, and society has adjusted itself so that you pretty much have to have one. (Ever asked to use somebody's phone?). Meanwhile, one of these technocrats is pushing a vaccine that might as well be magic, developed in an unusually short time, to cure a disease that people think might occasionally kill somebody else, but probably not them. The response makes complete sense.


Would it not lead to a horrifying dystopia, it wold be interesting to see how the response changed it the vaccine were marketed as a status symbol.


It is notable that vaccine acceptance has gone up now that it is widely available, which also coincides with the departure of an influential politician who had been downplaying the significance of the disease.

It's hard to disentangle the two effects, but there is a burgeoning symbol of status in people literally displaying their vaccine cards. It hasn't completely undone the damage, but it does seem to ameliorate it.


Most people simply have no choice unless you are willing to switch to GNU/Linux phones. Those are not 100% ready for everything yet.


Not a silver bullet unless you never let your phone talk to a cell tower - in which case it stops being a phone and starts being a miniature tablet.


At least with Librem 5 you can use the hardware kill switch whenever you need privacy.


It doesn't matter what your phone runs. As long as it's communicating with the network, the carrier knows its location.


Cell towers is far from the only tracking possibility.


Yes but it's the only one that's a requirement if you want to actually use your phone.


15 years ago was 2006. Almost every adult carried a cellphone everywhere back then.


I certainly didn't. But will concede I was definitely a late adopter.


It was 66%. Most adults, but less than “almost every”.

https://www.pewresearch.org/internet/fact-sheet/mobile/


I don't know if people are oblivious - it's just that there are a lot of perceived benefits for the user of the 'tracking device'. Tracking people is a byproduct of all the services a modern phone offers (due to technical or monetization reasons).


Those devices have addictive properties, especially casual mobile games and social media.

In the past addictive properties were enough to get people to do absurd things like roll up leaves, light them on fire, and deliberately huff the smoke. That's arguably more harmful than what mobile devices do to us.


I watched Citizen of the State recently, and the paranoid old man in that movie looks like a normie today.



>> Citizen of the State

> I think you mean Enemy of the State?

Given the topic of mass surveillance, this doesn't sound like much of a distinction...


"Hey wiretap, can bunnies eat pancakes?"


15 years ago people did carry a tracker on their pocket already.


> Another argument against the "going dark" claim is that before smartphones and the internet, the only conversations the FBI could monitor was through phonelines and mail. These were known to be easily monitored and I doubt there was much more criminal activity happening through those then than now.

It doesn't really matter that they quantitatively have access to more to them, from the POV of law enforcement though they had access to everything that was available if they wanted it then and they don't now. Law enforcement chafes and pushes against any attempt to limit them because their self image is that of protectors and good guys so what they do has good reason even if people don't want them to, it's a whole self justifying greater good/ends justify the means self justifying loop a lot of place fall into, including tech companies. You see it constantly with unjustified searches, stops and seizures, given a limit, eg the requirement for probable cause for a search, police find any way around it they can to justify the action they already want to take, eg smell of drugs or 'acting suspicious'.

There are definitely crimes that go unsolved because police can't monitor everything 24/7, that irritates a group tasked with 'protecting' society so they push back. We feel the same thing in software engineering to a certain extent, governance, architectural approval, etc all suck to work with but they exist for a reason in big orgs but just because they're useful agencies doesn't mean they suck less when you're held up because the architects take 3 months to approve something and want 20 Powerpoint decks to do it.


I’ll take 15kg of pastrami for the Miami delivery. I’m getting a pushback on the new price on Genoa but Eddie tells me he knows he can smooth it over.

The dates however are spoiled,it’s going to need a total clean.

I am the walrus.


Metadata --- who you talk to and when, is both easier to code and often provides more useful information than message contents.

See Lasswell. "Who (says) What (to) Whom (in) What Channel (with) What Effect".

https://en.wikipedia.org/wiki/Lasswell%27s_model_of_communic...


The chihuahua flies at noon.


Yeah, these things are scary. My test for people who ask for these backdoors is to ask for them to hand me their unlocked mobile. I promise to not share any information I read/see. There is an expression in this area that I love (but I can't remember the exact phrase): If you follow anyone around for some small period of time, you will find them guilty of breaking the law.


"If you give me six lines written by the hand of the most honest of men, I will find something in them which will hang him." - Cardinal Richelieu (disputed)


I don't think that is quite comparable to now.

Back in France at the time of Richelieu, there wasn't a concept of free speech or religious freedom. Thus if you said that you thought the king was an idiot, you could be hanged. Or you doubted the Church, or doubted God existed.

Remember, blasphemy could be punished by death at that time.

Nowadays, in most free democracies you are free to say you don't believe in religion, or think the leaders are idiots and there are minimal consequences.


Indeed, the internet amplified and accelerate everything - but as we've seen, arguably the largest harm that can come is through mass manipulation via public propaganda that's promoted - and that's not encrypted.

It's arguably different industrial complexes that have lead to mass surveillance, perhaps mostly the military-security industrial complex, that has lead to the current path; fear as a distraction from what's really needed is healing and strengthening the individual to not be brittle and prone to manipulation.


> I would argue that the conversations that have gone online are the interactions that were previously happening in-person (at least in term of criminal activity), to which the FBI didn't have access before.

Indeed. But those conversations/meetings were visible, risky etc. They were thus possible to monitor/attack and they weren't scalable.

From the perspective of law enforcement, criminals being able to discuss crimes or make payments without there being a phyiscal exchange is a nightmare. In the past, they could monitor meetings between criminals. Now they basically need to look over the shoulder of criminals in order to prove that CriminalA spoke to CriminalB. It must be extremely difficult.


Nah, they just need to issue a wiretap order to the encrypted messenger app's centralized servers.

Even end to end encrypted systems know who is talking to who, and how often, and where those two parties are (due to client IP geolocation).


Not really, even at my work we have (well, had) regular swap-meets for supermarket discount trackers. So one week I would shop as badge #1, the next week I would be badge #2. Just knowing the identity of the person who was issued the account doesn't give you any information about who's using it now.

In aggregate, you would still be able to identify which group of people used which endpoints, but aggregate information won't hold up in court.

Yes, geolocation would solve that, but I would expect such people to absolutely disable the GPS, so you'd need to rely on cell tower pings, which are not found on the same servers.


With a decentralised protocol + Tor that sort of metadata could be either unavailable or extremely difficult to ascertain.


But mail and phone were essentially the only methods of long-distance communication. The new methods of long-distance instant communication are not just groundbreaking for organizing legal business.

Something really has fundamentally changed with the introduction of instant encrypted messages. I'm for that change, and against the government attempting to ban it.


it's not like you can't implement encrypted comms over mail and phone in the first place. people with a strong enough incentive (and nerds) have been using symmetric encryption for a long time.

what has changed is, like you say, how trivially easy it is to send instant encrypted messages. what was once the domain of spy agencies and organized crime is now practical for my mom to ask me what I would like for dinner. one wonders why the FBI finds that so concerning.


> The limits of what is legal or not have always moved (see homosexuality, drug and alcohol consumption, etc). So a 100% enforcement of the law is counter-intuitively undesirable.

This is perhaps one of the more simple and persuasive arguments against domestic surveillance and spying that I’ve heard.


Anybody serious about this issue should contact their representatives to let them know it’s a concern.


I dont understand why the US people still trust these agencies. FBI, CIA, NSA have all shown to act against the democracy in many cases. If they could be trusted, they could be trusted with a backdoor. Since they cannot be trusted, the backdoor only makes them a more dangerous enemy of the people.


Nobody can be "trusted" with a backdoor, because it isn't really a valid concept.

A backdoor is a vulnerability that doesn't care who you are or what your purpose is or who pays you. If you found the backdoor it is open to you.

However hard the backdoor's security is, an insider recruited by Swedish intelligence (or Russia whatever the bogeyman du jour is) will leak the key at some point. Now all your "secure" shit can be accessed invisibly by Swedish hackers. By its very nature, the backdoor cannot easily be changed and its use cannot be detected.

A mundane example is the TSA keys. In addition to being leaked by greedy insiders making a quick buck, they've been leaked by accident several times. E.g. https://hackaday.com/2015/09/18/dear-tsa-this-is-why-you-sho... They are now public knowledge, and a backdoor into your luggage from anyone who cares enough to file up a key.


The TSA masterkey case is an interesting analogue example.

I don't know much about locks, but I wonder how it could ever be secure, even if they never leaked photos of the masterkeys. In principle, it should be possible to reverse-engineer the shape of the masterkey from any masterkey-compatible lock. Would it be practical to do this?


- It is not secure

- You can make/buy them

- Luggage locks are all garbage anyway

Most mechanical locks are garbage and neither resistant to practical physical attacks nor at all pick resistant. Many are vulnerable to super-generic low-skill attacks like bump keys and comb picks.

Many electronic locks are garbage.

Smart locks are complete garbage.

See https://www.youtube.com/channel/UCm9K6rby98W8JigLoZOh6FQ for many practical examples.


physical locks are meant only to deter casual/opportunistic attacks. LPL essentially makes this point in the video on his home security setup. it's pointless to spend a lot of money on a front door lock that takes more effort to pick than it takes to force open the door or smash a window.


This is the same TSA that's shown those keys in photo ops?


Just give the government a copy of the private key. What could go wrong? It’s not like anyone is hacking into the government these days.


What about hardware backdoors where you would need physical access to the device?


All governments (potentially) being (the deadliest) enemies of the general public used to be generally understood in all democratic circles. Most people seem to have forgotten, and/or don't read their histories.


> I dont understand why the US people still trust these agencies

We DON'T trust them. We have about as much say in what those agencies do as a random shop keeper in 1980's USSR does with the KGB.


What's the alternative to having law enforcement agencies at any level (whether that is on a regional or national level doesn't really matter?) with democratic oversight?

If the democratic oversight fails and transparency suffers, then the outcome will be less than ideal. But the answer is hardly "remove law enforcement authorities from level x", surely it must be improved transparency and oversight?

Also, no agency can be trusted with a back door. Back doors are available for all actors or no actor. An NSA back door to encryption is also a back door used by an authoritarian regime. There are no "exclusive" back doors.


>But the answer is hardly "remove law enforcement authorities from level x", surely it must be improved transparency and oversight?

You can use this to argue that the FBI and parts of the DHS should still exist in some form, but the CIA, NSA and military intelligence agencies are not law enforcement.


This is a wrong premise. The US people don't have to trust them, ultimately, their opinion is not important. What is important is that whoever currently is in power considers them useful - which is easy to achieve. And no political candidate who is likely to take office will take a stand against what in the end will be the tools they use once they are elected.

For the citizenry, the only way to deal with this situation is to avoid storing data, and hardening their devices.


Or fix the demoncracy back into a democracy.


I disagree that the elected officials are the ones that ultimately hold the power here. Part of both the CIA and NSA's job is to control elections, any candidate truly opposing them would have to overcome that.


I voted with my feet. Life outside the five eyes has been... interesting


I would love to hear more about this. Have you written about the process anywhere? Would you be comfortable saying where you moved?


What’s the alternative?


The alternative is to design systems, structures, and procedures more robust against infiltration by selfish actors or actors loyal to foreign governments. "Defense in depth" instead of assuming you can ring fence the good guys, etc.

Law enforcement ends up having to rely more on undercover work and informants, as it used to in the past. The CIA and NSA end up getting less intelligence for the same budget, but conversely, spies who infiltrate the CIA, NSA, etc. get less bang for their buck, as well.


We don't trust them, but we do expect them to stop exceedingly violent crime, ie. terrorism and csam - and they do that well. A lot of americans don't care at all, though, and trust them regardless because they 'have nothing to hide'.


Why do you think we have any control or say over the situation?


Well, you shout really loud yr a democracy.

Basically saying you have no control is saying that the US is no democracy.


The US does not have equal protection under the law, and the laws are enforced arbitrarily to carry out the will of the military and the ownership class.

The thing you reference is just a cover story. It's plain as day to anyone paying attention who runs that country.

There is no party you can vote for that will stop the perpetual war or perpetual ubiquitous surveillance, despite a vast majority of people in the country being against both war and surveillance.


Is there a vast majority against surveillance?

> A majority of voters say they are satisfied with the authority given to U.S. intelligence agencies to monitor Americans suspected of committing a crime, according to a poll released Thursday.

> Fifty-one percent of respondents in a recent Hill-HarrisX survey said the intelligence community has the "right amount of power" in determining who should be subject to government surveillance.

https://thehill.com/hilltv/what-americas-thinking/433071-pol...


Two things:

1) Despite Snowden, most Americans are not aware of the extent of the surveillance to which they are subjected.

2) Your first quoted paragraph mentions "suspected of committing a crime". This suggests to me that they were asked about targeted surveillance, that is, of criminal suspects. The issue is one of mass surveillance: the surveillance conducted of those who are not suspected of criminal activity.

Most people aren't okay with that, when informed of the full scope of that to which they are subjected.


Snowden himself is not particularly popular these days. If there isn't an outright majority who view him as a traitor, then it's certainly a sizeable minority. Opinions were almost evenly split back in 2013, and opinions on pardoning vs. prosecution were likewise evenly split when this was polled in 2017 (about 30% each, however). And over the past couple of years, the intelligence community appears to have convinced many more people that Snowden is a Russian asset - I suspect American attitudes towards him have cooled somewhat, or perhaps become partisan.

If you look at polling on concerns about surveillance in general in 2015, it was pretty much an even split, with a slight majority who were concerned about surveillance.[0] A majority did say it was unacceptable to surveil American citizens, at 57%, with 40% saying it was acceptable - I would not call that a vast majority, though.

Even if somebody says they're against this sort of mass surveillance, that does not change anything unless people vote based on it. Like it or not, things like surveillance and war take a back seat to all the other issues voters care about, especially since those two are among the least likely to actually affect the individual voters in question. The result of this is that few Democrats are going to vote for Rand Paul or Ted Cruz just because they happen to position themselves against the NSA or war in Syria, and few Republicans are going to vote for Bernie Sanders based on the same, even if they have strong preferences against surveillance and war - and that's ignoring the fact that there are definitely people on the other side of these issues, who believe that pardoning Snowden and withdrawing from Afghanistan is bowing down to Russia or something.

Ultimately, people get the government they deserve.

[0]: https://www.pewresearch.org/internet/2015/03/16/americans-pr...


Wholeheartedly agree. Hence it is about trust (my first point) and/or absence of democracy. And this is a bigger issue than encryption, IMHO.


Sure, but life continues in the absence of democracy, and encryption is useful in the short term in that life. Building a democracy where none exists is a multigenerational task.


The article's title is a little misleading, but I agree with their overarching message.

Law enforcement should never be given the easy way out in terms of breaking encryption. Asking for backdoors to be installed in every device is extremely lazy police work. I'm sure there are other ways of breaking encryption like the rubber-hose technique (of course with valid arrest warrant).

Arguing that law enforcement should stop attacking encryption because it jeopardises privacy seems a little naive to me. What about criminals that profit from creating spyware? In fact, allowing law enforcement to actively research new ways to break encryption can be productive for improving security in the long run. Stop using weak passwords people.


What I find most upsetting about this is that it seems the real goal is to defend the monopoly of big pharmaceutical companies and it has nothing to do with protecting the public. Cannabis is a great enemy of some corporations that are heavily pushing their opiate based drugs and they corrupt law makers and law enforcement to protect their markets at the expense of public who pays for it. This is obscene and erodes trust in any public services.


1. researching ways to break encryption is only productive if people are allowed to use the stronger encryption that comes from that research.

2. FBI isn’t arguing for new ways to break encryption, they’re arguing that old ways to cripple encryption should be used on purpose.


> I'm sure there are other ways of breaking encryption like the rubber-hose technique (of course with valid arrest warrant).

"rubber-hose technique" refers to torture, not to something that a warrant would allow.


FWIW, I've had a warrant executed against me by the FBI. They seized every electronic device I own, and forcibly took my biometric data(fingerprints, face scan, retinal scan) in the hopes they could unlock my devices with it. They were unable to access any LUKS-encrypted volumes, and were less than happy about that situation. Can't say much else unless I'm good with 99x anxiety for the next few days.

ps: not charged, not convicted, very innocent. not a fan of the justice dept.


Very depressing how in the UK you could've been forced to disclose your password under section 49 of the Regulation of Investigatory Powers Act, and gotten even 5 years jail time if you refused. I presume there isn't a US equivalent?


It's complicated. There's no specific law in the US regarding key disclosure, but you can be punished for e.g. contempt of court, maybe spoliation. In theory, the Fifth Amendment should protect individuals from self-incrimination, but courts have ruled that forcing people to disclose keys is not that.

See In re Boucher for a case where Fifth Amendment protections were not upheld and US v. Doe for a case where they were.


The Boucher case is special because the ruling held that Boucher had waived fifth amendment rights for the computer by showing some of it to law enforcement. If you exercise your fifth from the start I do not believe you can be compelled to provide the state with passwords, although they can use your biometric data.


The highest-ruling decision so far doesn't allow biometric use: https://www.usnews.com/news/national-news/articles/2019-01-1...


Do you happen to know the case regarding the biometric data?


How about that you really don't know the passwords? By using RAM as USB with battery to store your passwords. Whenever unplug the USB, the passwords exist until out of battery. After that, everything vanished.


What if you "forgot" the password?


In the US, contempt of court is a possible outcome.


What software do you use to encrypt your phone and computer?


My phone at the time was a stock Android device with encryption enabled. Computers were all linux with LUKS encrypted volumes.


The FBI Should Stop Attacking Encryption and Tell Congress About All the Encrypted Phones It’s Already Hacking Into


I didn't realise this was the listed title of the article. I like it than "the FBI should stop attacking encryption" a lot better.


I like how these policies illustrate clearly what the real agenda of these agencies is.

It clearly isn't to protect the American People in general. The way to do that would be to give them the best security measures available ie: E2E encryption.

It is to strengthen the government against it's citizens. By having an encryption asymmetry between the government and it's citizens, the victory is that actions can be made easier in the case where the government and it's citizens are opposing forces.

It's pretty clear in my mind that the FBI views "it's team" as exclusively law enforcement, other three letter agencies and other governmental organizations and it views everyone else as a hostile. The FBI is not on your side.


"Non-backdoored communication, being necessary to the security of a free State, the right of the people to strong encryption, shall not be infringed."


Just wait until they tell us that encryption back doors are necessary to stop racism and watch as half the population claps excitedly for the total elimination of privacy in the U.S.


I don't believe that is true (and pray it isn't). I don't think the populace is that stupid. Also, unnecessarily political. I could replace "racism" with "immigration" or "socialism" just as easily, that doesn't make it true.


I don’t care if it seems political, it’s reality. This is just the most effective tool the government has for manufacturing consent at the moment.

This is the just the thing we’re already clearly willing to give up civil liberties for in another areas, primarily in freedom of speech and basic property rights. Complaining about it this seen as unacceptable — you can’t criticize or question any mainstream view put out by the media on this issue.

Identity politics is the clear and only vehicle for this kind of suppression of basic rights at the moment.

Support encryption backdoors, we need them to fight White Nationalist Terrorist Insurrectionists!

If there is some sort of PATRIOT Act 2.0 under the current administration targeted at “domestic terrorism” I absolutely guarantee you someone will at least try to put an encryption backdoor in it.


>Complaining about it this seen as unacceptable — you can’t criticize or question any mainstream view put out by the media on this issue

This is completely false: entire media companies are dedicated to it.

>Identity politics is the clear and only vehicle for this kind of suppression of basic rights at the moment.

Again, I could just as easily say >Fear of socialism is the clear and only vehicle for this kind of suppression of basic rights at the moment.

That does not make it true.

>If there is some sort of PATRIOT Act 2.0 under the current administration targeted at “domestic terrorism” I absolutely guarantee you someone will at least try to put an encryption backdoor in it.

That's literally a given. I don't know what you're arguing. https://www.c-span.org/video/?c4876107/user-clip-joe-biden-w...


Why not? "We need lie detectors to stop communism" worked fine before, didn't it?


I'd like to think that it wouldn't work now, given the interconnectedness of the world today. I also wouldn't be very surprised if it did work, though.


Did you know that 75% of Neo Nazi's use encryption! \s


When the FBI is hurting bad for talent to secure the interests of the US, why on earth would I sign up when this is their stance on encryption?


Yeah they've got billboard up all over my city recruiting for 'special agents'.

Whatever they are paying i could not imagine it's even close to enough to deal with what you are signing up for.


The metamessage to me, especially in light of the Crypto AG disclosures (https://en.wikipedia.org/wiki/Crypto_AG https://www.washingtonpost.com/graphics/2020/world/national-...), is that backdoors have always been the principle means of signals intelligence.

Intercepting the phones, tapping the lines, listening on broadcasts, surveilling deaddrops, compromising encryption, are all far easier than the computationally hard work of cracking strong crypto.

And LEO / Intel don't like to break a sweat.


In my humble opinion, at the end of the day anything that is a valid crime must have a victim.

So if you find a victim, you should be able to trace backwards to find the criminal.

It's just lazy crap policing to expect everyone to accept their security being compromised so you can dragnet everyone, including the vast majority who are innocent of any crime, and expect to sit on your ass and have your job done for you by google alerts.

This kind of dragnet surveillance of the entire populace was impossible (without unlimited manpower/funds) until very recently. It was not impossible to find criminals before smartphones/encryption, and it's not impossible now.

The authorities have so many more ways to catch criminals than at any time in history, but they still want more.

I don't want to live in a world where my every move and conversation is tracked and stored in a database forever.


I read this in a whiny voice. Seriously the FBI doesn't give two shits what you think, they take power by force.


I've been reading the Constitution, and I noticed an interesting point: the only federal law enforcement authorized by the Constitution was the state militias, which at the time consisted of all the able-bodied men of each state, and was commanded by officers from that State. This provided a check on the government that we have given up: how comfortable could the federal government be asking a non-professional group drawn from the general public, with their primary allegiance not to the federal government, but to a single state, to enforce a law that is inimical to their interests? I wonder if abandoning the state militias has helped cause the out of control federal law enforcement we see now.


We've massively increased the role of the Federal government vs. what was outlined in the constitution. The most significant reason for this by far is war, particularly WWII and the Cold War.

Other wars before these played a role but I feel like WWII was the turning point after which the US was a different place. We entered more or less a permanent state of war or war-readiness since then, and the Cold War provided a rationale to massively increase the size of our espionage apparatus. Originally the idea was that this spy apparatus would only be aimed outward, but that was always a fantasy. Anything we aim outward will eventually be aimed inward.


I'd say that an even larger reason for federal-level law enforcement is the mobility that modern means of transportation brought. When the US was founded with its vision of autonomous states, there was not much mobility between states. It is no accident that the boom in the use of US marshals, postal police, and the Secret Service came with the building of the railways, making for crimes that spanned across states, for instance, while the FBI appeared in the automobile age.

Once you get national-level police that inherently see themselves are superior to and unaccountable to state-level bodies, then it is no surprise that they might want to wield that power, and that might have happened even without those foreign wars the US was involved in.


can anyone speak to companies like Cellbrite? how haven't they been sued into oblivion by phone manufacturers?


Because it's a PR win that they exist. It isn't lost sales. You have the perfect excuse for what security holes slip through, an eventual LE win where a scumbag gets taken off the streets, and oh... We think we know how they did it. Patch comes next Tuesday.


Why should they be? Next step is pentesting, which massively benefits overall security.


> When the FBI says it’s “going dark” because it can’t beat encryption, what it’s really asking for is a method of breaking in that’s cheaper, easier

The way I see it, authorities all over have zero difficulty in breaking into devices (deus ex Cellebrite).

I always believe that any password we use (computers, phones, etc.) is only to protect us against the common criminal. Someone who will take your phone, and a strong PIN/password will only stop them from using your Apple/Android-Pay, read your emails, read your messages, etc.

If the gov wants to get something from you, then the gov will take something from you.

"Give up your password or go to jail: Police push legal boundaries to get into cellphones" (https://www.nbcnews.com/news/us-news/give-your-password-or-g...)

Also the Security by XKCD. (https://xkcd.com/538/) (in non-democratic countries, or really dark scenarios).

Also.. let's be honest, when the "default" on all devices is to "sync all with Google/Apple cloud", then there is minimal need to even alert someone to the fact that you need their data (e.g. by arresting them, confiscating their devices, etc.)

Just warrant+gag to Apple/Google/Dropbox/etc. and you got their "latest" backup easy-peasy.


App updates has always struck me as the big one.

I can't turn them off, I can't easily validate them, and there's little preventing an update just for my device being shipped.


Without fail I was always getting carrier “upgrades” before big protests and police sweeps. It became my warning signal.

Once the virus hit the news in Wuhan, and the protests started to dial down the updates got fewer and fewer. And with the closing of the border I haven’t gotten a carrier upgrade in months. As part of the 2 million + crowd I know I’m tracked like a rat. But that’s how cellphones work


You can indeed turn them off, at least on mobile devices.

Desktop apps are much worse in this regard.

https://github.com/signalapp/Signal-Desktop/issues/4578

https://github.com/bitwarden/desktop/issues/552


Whether you can turn them off depends on your operating system. Most of them allow you to turn them off. What are you using? And if it really bothers you, why don't you switch?


The point XorNot made (and I agree) is that "it is switched on by default". And then you need to go to 5 different settings to switch them off (OS update, App update, iCloud login, iCloud sync of Backup-StockApps-Messages-etc).

The "welcome" should not be "all your data are belong to us". It should be "Hi, iCloud-Y/N, AutoUpdateOS-Y/N, Backup Message-Y/N, Backup Notes-Y/N, etc.).

I get it that for MANY reasons Apple wants everyone to run the latest OS/Apps versions, but.... did they ASK me?

Exiting their ecosystem is painful. Apple/Google rely on this. There are plenty of discussions on 'how to exit' and alternatives, but this is HN. The average HN-er is not exactly the same as the average smartphone user.


Honestly it's more that there's no reason to think any of those buttons do what they say they do. Why should they? I haven't inspected the source code which controls them, I didn't build the firmware images which go on my devices.

Without reproducible builds from multiple sources, how can we be sure of anything?

If there's a service we have a desperate need for, it's a change in ecosystem priorities that core functionality - OS's, chipsets, etc. - are open source, and updates go out as inspectable patches which get pulled into reproducible build farms and bittorrented out to users.

Start with C compilers and work your way outward from there, but I should be able to cryptographically prove to myself that the firmware update going into my Android phone was independently reproducible from public source code from users in a few different nations.


> Just warrant+gag

And ... that’s probably ok? The people are not meant to be protected against all searches, only warrantless search.


>And ... that’s probably ok

1000% ok. Caveat: the warrant is legit and they (judges/appropriate authorities per country) do their job right and don't have 100 pre-printed approvals (a la blank cheque) lying around and just hand them over to any policeman and/or torturer walks in asking for one.

(Also) I am thinking the people in China, Iran, Turkey, etc. where people dissapear in the middle of the night (even public figures). Do we not care for those 1.5bn people because they are outside the EU, USA, CA, AUS, NZ, etc?

My initial point is that one cannot hide from the State. One can only hide their data from the common criminal.




Guidelines | FAQ | Lists | API | Security | Legal | Apply to YC | Contact

Search: