Slashdot Mirror
Obama Administration Explored Ways To Bypass Smartphone Encryption
An anonymous reader writes: According to a story at The Washington Post, an Obama Administration working group considered four backdoors that tech companies could adopt to allow the government to break encrypted communications stored on phones of suspected terrorists or criminals. The group concluded that the solutions were "technically feasible," but they group feared blowback. "Any proposed solution almost certainly would quickly become a focal point for attacks. Rather than sparking more discussion, government-proposed technical approaches would almost certainly be perceived as proposals to introduce 'backdoors' or vulnerabilities in technology products and services and increase tensions rather [than] build cooperation," said the unclassified memo. You can read the draft paper on technical options here.
..and at that point it's useless. By all means, try to break it; if you can then that means it needs to be improved.
Are YOU using the TOOL, or is the TOOL using YOU? Think about it!
would almost certainly be perceived as proposals to introduce 'backdoors'
Yes, that is exactly the definition of a backdoor: a way to bypass the owner's security measures. Any suggestion that it isn't would mean that the government is the owner of the device, not you or me.
"First they came for the slanderers and i said nothing."
Unfortunately he was thinking of one-way glass with the ability to look into our affairs.
Left MS Windows for Linux Mint and never looked back!
Vote for Bernie in 2016!
Transceivers are often hooked directly into sensors such as microphones, and run very complex proprietary firmware that is given undue privileged access to the rest of the system's resources.
Furthermore, for nearly 15 years, Intel as been quietly introducing an entire, higher-priority computing system within your consumer laptops and desktops and probably now your tablets and smartphones: This is known as the Intel Management Engine, specifically the Intel Active Management Technology. If your computer's Intel sticker lists "vPro", then you've probably got it!
It's frightening stuff.
These systems involve their own little processors, memory, storage, network interfaces, and proprietary operating systems; as long as the machine is plugged into a power source and wired network—even if the user thinks that it's switched "off"—that little computer within "your" computer can be contacted and used to access the rest of the machine, including your storage drives (hard disks, SSDs, etc.), RAM, main CPU, GPU, etc. It has higher priority than "your" system, can take control of the display and keyboard/mouse/touchpad input so that Intel's AMT can provide VNC access from the moment the main system's boot process begins. It can do all of this while your system is running, including reading your private encryption keys from your RAM or twiddling bits on your hard disk.
Any attempt to remove or alter the proprietary software and hardware that composes the AMT can be made to and likely will be made to brick your system or make it otherwise unusable.
So what will happen is this: The US Government will mandate all phones be PRISM compliant, or at the least have the master encryption key to the data. Apple, and perhaps Google if I recall, took an engineering route to make it physically impossible to respond to an FBI request. Primarily because Apple doesn't want the liability, and secondly it costs money to staff an entire department of warm bodies to fulfill said requests.
Now comes the fun part. China is basically mandating that the top Silicon Valley CEOs fly to China and agree working with the government at backdoor access to all user accounts and data with regards to its own citizens. The US, as does EU and Australia want something similar. At some point, there will be a treaty among all major nations to mandate a Government API written into all software and cloud based services. This way, each Government can plug right into the application layer and pull data upon request.
Welcome to a period of darkness!!!!!
Life is not for the lazy.
One of the example solutions in the document is to force the device provider to update the device with a malicious update the decrypts the device. Talk about a way to encourage people to allow the device update to run! They even acknowledge this. It's quite humorous, people should read it. The paper discusses how even if a solution is implemented device owners could simply layer their own encryption on and make all data inaccessible. So if that's the case, exactly what is the point in the paper or the working group? They acknowledge right at the start that whatever you propose could easily be defeated by the consumer simply encrypting things themselves. So if the entire thing is technologically unfeasible why on earth would you even study it?
The one thing I haven't seen covered in the paper at all is that IF the US were to implement these requirements that all business involved in encryption would simply move off shore and destroy a thriving US business ecosystem. The paper's assumption is that any US developed protocol would then be exported world wide. This is profoundly illogical on many fronts. There would be numerous countries that would simply not participate in some US encryption compromising ring.
For purposes of making policy, we should absolutely assume that if the government can get in, so can the bad guys. (Ignoring the fact that sometimes the government IS the bad guys).
Having said that, it's an interesting intellectual exercise to consider that's not NECESSARILY true. For example, each year the encryption could be increased with a longer key, such that at any given time it costs about $1 million in computer time to decrypt a phone. The government could easily spend a million, or ten million, to decrypt Bin Laden's laptop, but nobody is going to spend a million or ten million to decrypt yours or mine.
I'm not suggesting that's actually a good idea in terms of policy , just an interesting puzzle to think about.
Also, years ago we thought it was impossible for you and, who have never met before, to publicly post messages to each other in such a way that nobody else could decrypt them - without ever talking privately to share an encryption key. Now, we use Diffie-Hellman every day to do exactly that, as part of https. We thought it was impossible to share a secret on a public forum (or network) without everyone else on the forum being able to read the secret, but we were wrong. Diffie and Hellman invented a way. Theoretically, it's entirely possible to invent something that allows access only to authorized individuals, with a public audit trail. We haven't invented it yet. Block chains like Bitcoin uses suggest that encryption can be tied to a publicly accessible log, so we know whose data they decrypted, or at least how many they did.
Now, we use Diffie-Hellman every day to do exactly that, as part of https. We thought it was impossible to share a secret on a public forum (or network) without everyone else on the forum being able to read the secret, but we were wrong. Diffie and Hellman invented a way.
Just thought I'd mention Ralph Merkle, the guy gets nowhere near fair credit for having co-invented public key cryptography. In fact, Hellman argues we should talk about Diffie-Hellman-Merkle key exchange.
And there were some guys at GCHQ who independently did pretty much the same. But I credit them less because it was all kept secret and they work for, you know, evil.
Gosh, thanks. That must be why the other ships call me Meatfucker -- GCU Grey Area (Eccentric)