Slashdot Mirror
Tech Giants Hit by NSA Spying Slam Encryption Backdoors (zdnet.com)
A coalition of Silicon Valley tech giants has doubled down on its criticism of encryption backdoors following a proposal that would give law enforcement access to locked and encrypted devices. From a report: The group, which focuses on efforts to reform government surveillance, said in a statement that it continues to advocate for strong encryption, and decried attempts to undermine the technology. "Recent reports have described new proposals to engineer vulnerabilities into devices and services -- but they appear to suffer from the same technical and design concerns that security researchers have identified for years," the statement read. The renewed criticism follows a lengthy Wired article, in which former Microsoft software chief Ray Ozzie proposed a new spin on key escrow. Device encryption has hampered police investigations, and law enforcement officials have pushed tech companies to fix the problem -- even by way of suing them.
They already could have had backdoors, but noooo, they had to forbid Huawei to enter the US market.
Oer perhaps Huawei did not have any backdoors and they knew it would be unpossible to convice them to have backdoors and they thought they at least had a shot with the other players. (Or all the rest already HAS NSA backdoors)
Or the backdoors are already in placve and this is to both safe face for the companies AND to let people believe their data is safe.
I remember a time when I was innocent and thought that all those people with tinfoilhats where crazy. Times have changed.
Also remember that it is only paranoya if you THINK you are being followed, not when you actually are.
Don't fight for your country, if your country does not fight for you.
This is the battle for the future of the Internet, computing, and ultimately the privacy rights of every single citizen of the United States, and perhaps the entire world.
If the anal-retentive, power-grubbing law-enforcement and politician types get their way, then there will be no such thing as 'private communications', 'secure data', or for all intents and purposes 'privacy' -- unless you're law enforcement, a politician, or (of course) The Rich. There will also, ironically, be less of things called 'justice' and 'law and order', because in their mad, foaming-at-the-mouth dash to have access to all things at all times, bar none, they will open the door for criminals to freely and easily take whatever data or communications they want; even your average script-kiddie would soon enough be able to break into whatever data-store they want. Your financial accounts? Your very identity? Up for grabs -- unless you're a cop, are a politician, or have money.
THAT IS WHY THERE HAS TO BE A LINE DRAWN IN THE SAND; HERE, AND NO FARTHER.
In the article Ozzie proposes a slight modification to the golden key solutions previously proposed. Instead of a single master key that would unlock every single device or system, his system relies on the manufacturer or creator to create specific asymmetric paired keys. When law enforcement requires a device or account to be unlocked, the manufacturer can unlock with their private paired key. In the case of San Bernandino, Apple would unlock only that particular iPhone.
The problem with this is that it requires the creator or manufacturer to be the stewards of these keys for an indefinite amount of time. In the case of Apple, they have to maintain keys for as long as an iPhone could exist which could be decades. It is also going to be problematic for companies or organizations that no longer exist. When companies go bankrupt, one of the few remaining assets they could sell is their data.
It doesn't shift the problem of risk to the stewards. It is still possible that the keys could be stolen; it just means hackers do not have to steal a single key.
Practically how will this work with independent developers? Open source developers would never follow this system.
Well, there's spam egg sausage and spam, that's not got much spam in it.
Simple Constitutional Argument.
There's a reason why you don't want backdoors to be open to the government.
-- Tigger warning: This post may contain tiggers! --
PGP came out how many decades ago? And yet it's still better than what most people use today.
There's a technologicially-easy but socially-hard solution to this problem: stop using "tech giants"' products to secure your communications. Free is the right way to do this genre of software, because there's no one particular individual to coerce into weakening it. And that's really what we need: independence from meddling, because purposely-making-it-wrong is pretty much the main weakness we're facing today.
Proprietary software makes have obviously gone to extreme effort to avoid making their stuff work well, and it's time we relieved them of this expensive burden. That's how it should be presented to them.
Is that Qualcomm (who is used in basically all the chinese phones not using MediaTek SoCs, since afaik RockChip doesn't produce any cellular SoCs) already has a master signing key for all their SoCs, with a per vendor child signing key. So in theory any Chinese phone should be compromisable by the Chinese government, and those phones are a subset of the phones compromisable by the NSA and select 5 Eyes partners. When you factor in that all ARM/MIPS hardware was effectively designed by British companies (now owned by Softbank and... who for MIPS?), and all x86+PPC hardware is designed by US controlled corporations with much of it designed in foreign countries (Intel's Israel branch doing major portions of both x86 design and Intel ME today.) the picture of just how backdoored modern hardware should be considered is *NOT* pretty.
In order to have a chance at any sort of national security, or secure processors, we really need either openly audited designs produced internationally, published transparently, and then audited by parties suspcicious of the manufacturing nation. And we need fabs producing versions of these chips on each of the major continents, ideally under politically hostile regimes. Only by playing each party against the others will we have a chance at sabotage free chips, as each party is jockeying for a bigger piece of the trust pie.
Even China, one of the most restrictive countries with a surveillance state that would make Orwell wonder whether they used his books as manuals, wasn't foolish enough to demand something like this from its industries. That alone should tell you just how bad an idea it is.
However, China does mandate that certain people groups physically install spy software on all their devices under penalty of law. Installation that must be verified by the local law enforcement.
Which if the US Gov't doesn't get back doors, will be the next big push "Protect America! Install this great piece of spyware, er security software!"
Yep. 1st, 2nd, 3rd, 4th, and 5th amendment violations.
1st: Crypto is speech. Courts have ruled. .GOV needs a warrant
2nd: Crypto was under ITAR, therefore it's an armament.
3rd: specified here
4th: Beaten to death.
5th: Obvious
General Relativity: Space-time tells matter where to go; Matter tells space-time what shape to be.