a thoughtful web.
Good ideas and conversation. No ads, no tracking.   Login or Take a Tour!
comment by user-inactivated
user-inactivated  ·  2954 days ago  ·  link  ·    ·  parent  ·  post: Why Apple is completely screwed in the FBI/San Bernadino case

You are right about nearly everything in your statements, I don't really want to respond to all of it I just want to respond and make clear one thing here that I think you are already aware of. I feel weird that I have to add this disclaimer since generally when I read people quote a single part of an statement and comment on just that it looks like they are trying to take down the whole factual platform of the other guy off one thing, which I'm not. It's weird how quotations and discussions that are civil can even look confrontational when they are direct responses back and forth between two users.

Anyway, I just wanted to point out:

    the FBI is arguing that they can compel Apple to cripple encryption after the fact. Apple is arguing they can't. It's a hell of a precedent to set, and most manufacturers have been trying hard not to set it.

Technically they aren't crippling encryption after the fact, it was poorly designed from the beginning and they instead relied on tamper-proofing the device itself to protect the data on the phone. It's not actually possible to cripple encryption after the fact without solving a new research problem on the algorithms themselves. It happens from time to time, but would be remarkable on some of the most well researched algorithms like AES and RSA that the NSA can't even get around. PRISM and many other programs wouldn't need to exist if they could break AES or RSA (keep in mind the usage of "or" and not "and" there, if they break one the other naturally fails in hybrid encryption like SSL/TLS for instance).

    American manufacturers are already hindered by laws against strong encryption in the United States

I'm actually unaware of this, could you talk about which laws you are referring to? I know of no strong encryption laws on the books, as basically every project that calls SSL (basically everything) is using strong cryptography. Every phone or other device manufacturer simply by installing OpenSSL have packaged in strong crypto and regularly use it.





kleinbl00  ·  2954 days ago  ·  link  ·  

    Technically they aren't crippling encryption after the fact, it was poorly designed from the beginning and they instead relied on tamper-proofing the device itself to protect the data on the phone.

See, I'm not sure that distinction matters. It's like this:

- the device shipped with mediocre encryption, protected by tamper-proofing

- stronger encryption is currently available

- the FBI wants an end-run around the tamper-proofing

So whether the FBI wants to cripple "encryption" or "security" is a legal point, to be sure, but the precedent set is all about the after-the-fact part. They want to be able to compel a company to crack open something that was secure. That makes everything that is secure potentially insecure whenever the government can shove a writ through.

You're right - strong encryption will protect you. But there's also the pain-in-the-ass factor: if most people are using weak encryption, then using weak encryption is a great way to blend into the crowd. If everyone uses strong encryption, then using strong encryption becomes anonymous. In the NSA/FBI/CIA/TLA's horror world, everyone shifts to strong encryption, meaning that they can't single people out just by what encryption they're using.

And then, they're sure going to want to be able to compel Apple into cracking that strong encryption, rather than just weak encryption.

    I'm actually unaware of this, could you talk about which laws you are referring to? I know of no strong encryption laws on the books, as basically every project that calls SSL (basically everything) is using strong cryptography.

https://en.wikipedia.org/wiki/Export_of_cryptography_from_the_United_States

http://www.cryptolaw.org/cls-sum.htm