touch screen phones are difficult to secure with complex passwords
That's why one of the built-in security features is to accept password input only via the touchscreen, and only with escalating time delays after a few wrong guesses. Those are two of the features the government wanted Apple to bypass by writing a custom FBiOS.
Suppose they've done the good old detective work, infiltrated and done what the national security services were expected to do and gotten this result:
"The target for assassination is 89HWE79G and we will do it by planting explosives in *()H(& DJKSDF and beneath ((*BBSEUFU^. We will also target the following: SDF^KJDSDF&Gm, ##()*#&$)L#K, and *^)(()*WERWER, ( and if we have time %QAWERA)."
Well, then, the detectives and infiltrators get called into the boss' office and emerge to stand at their computers (their asses having been chewed to bits for failing the Tradecraft 101 step of planting keyloggers, hidden shoulder-surf cams, etc) to send out resumes before HR gets around to revoking their login credentials.
Next stupid question?
Sounds like an interesting idea... for some other planet, with some other species besides humans (maybe something evolved from social-insect-type hive dwellers).
Baloney. Comey isn't being "reasoned and nuanced"; he's engaging in rhetorical bafflegab to pretend to be reasoned and nuanced. His definitions of "skepticism" and "cynicism" are, respectively, "tut-tutting and letting me go back to doing things the way I want" and "actually making my start complying with the Constitution".
More like "The people in power are scared shitless that they will lose control of the country, and perhaps even be held accountable for their crimes against the people."
And why should it? For the sake of argument do you think the government should tell you that you MUST install a home security system, have dead bolts on every exterior door, require exterior doors be steel or solid wood, limit the side of windows to no more than 1" by 1" or require bars?
If you're in business and promising your customers that you're keeping their stuff secure, well, yeah, there should be legal penalties for not meeting some standards of due diligence (admittedly, there's quite a bit of wiggle room as to where those standards should be set).
A lot of them are in Germany. For obvious historical reasons (with half the country getting a more recent second reminder), they're more sensitive about this sort of thing.
I couldn't help noticing that this particular NYT article doesn't have the usual comment section. I wonder why. Surely it can't be that the authors requested it, knowing that their case would otherwise be driven off the stage by the cyberspace equivalent of a rotten-tomato barrage.
Tell me honestly that you wouldn't want a genie to appear to you and give you the numbers for the next lottery drawing.
Wanting things doesn't mean you get to have them.
Smartphone encryption uses composite keys, made by combining the password the user punches in to gain access with a digital key baked into the phone. The latter is hard to extract by physical examination, and too strong to brute-force (256 bits, IIRC). Thus, an attack against an offloaded copy of the encrypted data is very difficult (effectively impossible if the attacker botches the attempt to extract the device key and burns it), and an attack against the user password alone can only be done on that device.
Apple and Google replied, in essence, that they could not [access the phones] — because they did not know the user’s passcode.
(...United Way Update...)
There is no evidence that it would address institutional data breaches
In words of one syllable (well, I can't do anything about the fact that "Apple" and "Google" are two syllables, so the authors of the article will just have to pop an aspirin and such it up): The whole point is to stop that kind of data leak -- if Apple and Google don't have it, a bad guy can't steal it from them.
Safes can be accessed with a warrant only because it is beyond our ability to make an uncrackable safe.
That's not really a significant difference, since is is within our ability to make safes that are effectively impossible to crack without destroying the contents, which is equivalent from the point of view of government agents seeking information.
Another approach would be breakable encryption with an auditable trail such that anyone who breaks an individual's encryption would have to defend such actions in court.
Voo-doo magic does not count as "another approach".
(I am using the term in its precise technical sense. Unless the Feds' actions in breaking one copy of the file somehow produce observable effects upon the owner's copy of the same file (i.e. voo-doo magic), there is no way to "audit" their behind-the-scenes actions.)
The government repeatedly got caught spying on We The People... without a warrant. They are now being sat it the corner, with modern technology enforcing their time-out.
In 2013, Reuters reported that documents released by Edward Snowden indicated that the NSA had paid RSA Security $10 million to make Dual_EC_DRBG the default in their encryption software, and raised further concerns that the algorithm might contain a backdoor for the NSA.
Perhaps if they weren't so busy snooping on the rest of us, they would have paid attention to specific warnings about the Boston Marathon bombers, the preexisting terrorism-related criminal record of the Garland shooter, etc.
Slashdot Mirror
That's why one of the built-in security features is to accept password input only via the touchscreen, and only with escalating time delays after a few wrong guesses. Those are two of the features the government wanted Apple to bypass by writing a custom FBiOS.
The instructions are clearly posted on the bottom of the filing cabinet in the disused lavatory behind the door marked "BEWARE OF THE LEOPARD".
Suppose they've done the good old detective work, infiltrated and done what the national security services were expected to do and gotten this result: "The target for assassination is 89HWE79G and we will do it by planting explosives in *()H(& DJKSDF and beneath ((*BBSEUFU^. We will also target the following: SDF^KJDSDF&Gm, ##()*#&$)L#K, and *^)(()*WERWER, ( and if we have time %QAWERA)."
Well, then, the detectives and infiltrators get called into the boss' office and emerge to stand at their computers (their asses having been chewed to bits for failing the Tradecraft 101 step of planting keyloggers, hidden shoulder-surf cams, etc) to send out resumes before HR gets around to revoking their login credentials. Next stupid question?
Sounds like an interesting idea... for some other planet, with some other species besides humans (maybe something evolved from social-insect-type hive dwellers).
Baloney. Comey isn't being "reasoned and nuanced"; he's engaging in rhetorical bafflegab to pretend to be reasoned and nuanced. His definitions of "skepticism" and "cynicism" are, respectively, "tut-tutting and letting me go back to doing things the way I want" and "actually making my start complying with the Constitution".
More like "The people in power are scared shitless that they will lose control of the country, and perhaps even be held accountable for their crimes against the people."
And why should it? For the sake of argument do you think the government should tell you that you MUST install a home security system, have dead bolts on every exterior door, require exterior doors be steel or solid wood, limit the side of windows to no more than 1" by 1" or require bars?
If you're in business and promising your customers that you're keeping their stuff secure, well, yeah, there should be legal penalties for not meeting some standards of due diligence (admittedly, there's quite a bit of wiggle room as to where those standards should be set).
Nope, the NA votes were the fans dumping the punch bowl after they caught the puppies pissing in it.
"You yellow bastards! Come back here and take what's coming to you! I'll bite your legs off!"
Bottom Line: The puppies pissed in the punch bowl, which then had to be dumped.
Personally, I hope Trump gets out of the GOP sideshow and starts up his own independent sideshow (blackjack and hookers optional).
I believe Americans are overly obsessed with so-called privacy.
by Anonymous Coward
Speaks for itself, doesn't it?
A lot of them are in Germany. For obvious historical reasons (with half the country getting a more recent second reminder), they're more sensitive about this sort of thing.
I couldn't help noticing that this particular NYT article doesn't have the usual comment section. I wonder why. Surely it can't be that the authors requested it, knowing that their case would otherwise be driven off the stage by the cyberspace equivalent of a rotten-tomato barrage.
Tell me honestly that you wouldn't want a genie to appear to you and give you the numbers for the next lottery drawing. Wanting things doesn't mean you get to have them.
If the lab techies can't extract the murderer's image from the deceased's eyeballs, they must not be trying hard enough!
Smartphone encryption uses composite keys, made by combining the password the user punches in to gain access with a digital key baked into the phone. The latter is hard to extract by physical examination, and too strong to brute-force (256 bits, IIRC). Thus, an attack against an offloaded copy of the encrypted data is very difficult (effectively impossible if the attacker botches the attempt to extract the device key and burns it), and an attack against the user password alone can only be done on that device.
In words of one syllable (well, I can't do anything about the fact that "Apple" and "Google" are two syllables, so the authors of the article will just have to pop an aspirin and such it up): The whole point is to stop that kind of data leak -- if Apple and Google don't have it, a bad guy can't steal it from them.
Safes can be accessed with a warrant only because it is beyond our ability to make an uncrackable safe.
That's not really a significant difference, since is is within our ability to make safes that are effectively impossible to crack without destroying the contents, which is equivalent from the point of view of government agents seeking information.
Another approach would be breakable encryption with an auditable trail such that anyone who breaks an individual's encryption would have to defend such actions in court.
Voo-doo magic does not count as "another approach". (I am using the term in its precise technical sense. Unless the Feds' actions in breaking one copy of the file somehow produce observable effects upon the owner's copy of the same file (i.e. voo-doo magic), there is no way to "audit" their behind-the-scenes actions.)
The government repeatedly got caught spying on We The People... without a warrant. They are now being sat it the corner, with modern technology enforcing their time-out.
That's the whole point of making good communication security as close to universal as possible.
In 2013, Reuters reported that documents released by Edward Snowden indicated that the NSA had paid RSA Security $10 million to make Dual_EC_DRBG the default in their encryption software, and raised further concerns that the algorithm might contain a backdoor for the NSA.
Perhaps if they weren't so busy snooping on the rest of us, they would have paid attention to specific warnings about the Boston Marathon bombers, the preexisting terrorism-related criminal record of the Garland shooter, etc.