Slashdot Mirror
The NSA Wants Tech Companies To Give It "Front Door" Access To Encrypted Data
An anonymous reader writes The National Security Agency is embroiled in a battle with tech companies over access to encrypted data that would allow it to spy (more easily) on millions of Americans and international citizens. Last month, companies like Google, Microsoft, and Apple urged the Obama administration to put an end to the NSA's bulk collection of metadata. "National Security Agency officials are considering a range of options to ensure their surveillance efforts aren't stymied by the growing use of encryption, particularly in smartphones. Key among the solutions, according to The Washington Post, might be a requirement that technology companies create a digital key that can open any locked device to obtain text messages or other content, but divide the key into pieces so no one group could use it without the cooperation of other parties."
A government body gets the whole key and then has it stolen from them and we're all left with our trousers down in a changing room made of glass.
No. If there is an EASY way to decrypt information, then that data is NOT SAFE and the encryption is useless.
As you all know, our country is subject to terrible terrorist threats. It has come to the attention of your friends at the National Security Agency ("we put the security in the national") that terrorists have, under certain circumstances, used the United States Postal Service, United Parcel Service, and Federal Express in order to facilitate their terrorist doings. Therefore, we would appreciate it if, effective immediately, you stop sealing your parcels and envelopes, to make inspection easier.
This is for your protection. Please don't object, or we'll have to illegally open your items and lie about it. Thank you.
The fact that the NSA thinks it can achieve this shows how far our civil liberties have fallen.
Wow. And how long do they think their magical key will remain secret? If a single key can open all the doors, finding that key will become more important and the resourced dedicated to discovering it will be increased. The secrets that are being protected are not only -- or even primarily -- the secrets of criminals. There are millions of bank accounts and private medical records along with political dissidents.
Every weakening of security aids not only law enforcements but criminals as well.
===== Murphy's Law is recursive. =====
When the NSA says these kinds of things, it's like they are saying that they are immune to being cracked.
While we're asking for stuff we want, I want one billion dollars a year of NSA funding redirected to me. I'll spend it all on providing college scholarships.
I believe my idea is better than theirs: educated, autonomous individuals make for a better society than fear and authoritarianism. Who's with me?
One (partitioned) Key to rule them all, One Key to find them,
One Key to bring them all and in the darkness bind them
need anyone say more?
This story was posted yesterday. http://it.slashdot.org/story/1...
If I can be modded down for being a troll, can I be modded up for being an orc, or a balrog?
Such backdoors aren't enforceable in open source projects. If this comes to pass then free software will have a great competitive advantage.
The designers of the Clipper chip (http://en.wikipedia.org/wiki/Clipper_chip) had just about the same method in mind: encryption for the users, with an independent organization knowing the master keys and being able to hand over session keys to decode communications to government institutions. It was actually the reason why PGP etc were invented.
We have a similar situation here: the gov wants to have the keys to encrypted machines. Theoretically, the same arguments can be brought up again: it's bad because the keys may leak, it weakens the encryption because there's another set of keys that can be bruteforced or found in a smarter way, but it's also pretty ineffective: the phones that allow people messing around in their systems (Jolla, Ubuntu phones, rooted Androids) will just have third-party, non-gov-approved encryption in them and criminals (and people not really comfortable with NSA snooping) will subsequently use these.
That's the wrong attitude to take. The attitude you SHOULD take is to become one of the data controllers holding part of the key...which you simply delete.
Problem fucking solved.
If one the parties is the user and he gets to keep HIS part of the key, so that nobody can decrypt his data without him giving up his key, fine.
Would miss the point though...
There's no "centuries-old social compact" or whatthefuck ever, let alone one around warrants.
What a sack of shit.
And, yeah, the idea that you're going to have this magic key that only good guys can use is also technically and operationally impossible... as every single person in the NSA or anywhere else in the federal intelligence or law enforcement agencies knows damned well. I assume they want to create it so that they can steal it and use it for mass attacks. If they don't want me to believe that, well, they need to overcome their decades-long pattern of established behavior.
Really? Republicans? That's what you're going with? Get me if I'm wrong, but didn't a major Democrat (who's running for US President) stop using her State Department provided email account so she could send her mail through a mailserver she controlled, which would not be archived, audited or available to FOIA requests? And then when asked for the mailserver contents, said "hey, we went through it all and there's nothing of interest there. Hey, is that a squirrel over there?" God thing you're posting as AC. Should probably be AI, Anonymous Idiot...
Hell, I gave up unencrypted evidence that was left on my pc for 10 years by my ex wife about a person that works in "Blood Money" before the pricks killed my father, and they did fuckall about it. They want access only to justify a budget, period, they don't really give a fuck about anything else.
Even if it's completely illegal for the NSA to get the other pieces, they'll try. They'll hack in, or they'll snoop into the lives of everyone with access to find something they can use for blackmail...
Which is why, if this insane policy is enacted, there needs to be another requirement: if the NSA tries to get the other pieces, the director of the NSA gets executed on live TV for treason. So does every official or agent involved in the operation. Same goes for every other government agency.
Really, though. Hearing the NSA complain that they can't access my private data sounds exactly like complaining they can't bug my apartment. If they want to stop the "turrists" they'll have to learn to do it without creating a worldwide police state.
The right to protest the State is more sacred than the State.
Ist der Ruf erst mal ruiniert, lebt sich's völlig ungeniert.
It loses a bit in translation, but essentially the meaning is "once your reputation is ruined, you can as well stop having any shame".
We used to have a Bill of Rights. Now, with the rights gone, all we have left is the bill.
This exactly. Even IF somehow open source projects were "forced" to include a back door...then knowledgeable people could easily just remove the back door from their copy. And explain to others how to easily do it on some forum hosted outside the US.
The US government has lost sight of the larger issue here. The tail (NSA and law enforcement) is wagging the dog.
The NSA and law enforcement agencies want to be able to intercept anything, since it makes their jobs easier. However, this runs counter to the larger national interest of the United States.
Which country has the highest level of connectedness and dependence on the Internet? Which country would be worst hurt if a sophisticated attacker was able to penetrate and conduct malicious actions using the systems connected to the Internet? The US, that's who. It is by far in the US's overall national interest to properly secure the Internet and communications infrastructure. Eavesdropping on everyone else is a secondary benefit, in comparison.
The proper role of the President and the Attorney General is to separate the desire of the NSA and law enforcement to make their jobs easier from the greater benefit to the country as a whole. They need to tell the ambitious underlings "NO" in unequivocal terms, then bitch slap them if they keep whining about it.
--Paul
Could you imagine if the NSA actually was permitted to do this? The moment something like this came to be true, every tech company cooperating would simply go out of business. Who would buy anything with a backdoor built into it? I wouldn't.
Shut down the NSA, to even suggest this is economic armageddon. I don't even need to go anywhere near the freedom and privacy aspects of this, I can appeal the capitalists, this is just bad for business.
This is moronic, if this is put in place only Americans will use American software (and then only some of them). NO other country is going to voluntarily use software they know has a "front door" regardless of all the "good intentions" promised by splitting the key up. May as well shoot Microsoft in the foot.
There are three kinds of falsehood: the first is a 'fib,' the second is a downright lie, and the third is statistics.
Reminds me of warnings on grape juice concentrate sold during prohibition: "After dissolving the brick in a gallon of water, do not place the liquid in a jug away in the cupboard for twenty days, because then it would turn into wine."
Could we get something similar: "After downloading the code, do not remove lines 33-67 of Encrypt.c, as this will disable the legally mandated NSA back doors"
Could we get something similar: "After downloading the code, do not remove lines 33-67 of Encrypt.c, as this will disable the legally mandated NSA back doors"
Or... do not compile this code without #defining INCLUDE_BACKDOORS as this will disable the legally mandated back doors.