US Tech Giants Ask Obama Not To Compromise Encryption 108
An anonymous reader writes: Two industry bodies which represent Microsoft, Apple, Facebook, IBM, and others, have written to President Obama urging that the U.S. government not seek to legislate "official back doors" into encryption techniques. The Software and Information Industry Association and the Information Technology Industry Council sent the "strongly worded" letter on Monday, saying, "Consumer trust in digital products and services is an essential component enabling continued economic growth of the online marketplace. Accordingly, we urge you not to pursue any policy or proposal that would require or encourage companies to weaken these technologies, including the weakening of encryption or creating encryption 'work-arounds.'" The letter is the latest salvo in a public battle for secure communications, one that has reached the public eye in a way that few security stories do.
Easier for US gov to call them ISPs? (Score:2)
After the last renewal of the Patriot act, wouldn't it just be easiest for the US government to name each of these companies an "ISP" so they'd be compelled to collect information on their (unencrypted) servers?
Re:Easier for US gov to call them ISPs? (Score:4, Insightful)
After the last renewal of the Patriot act, wouldn't it just be easiest for the US government to name each of these companies an "ISP" so they'd be compelled to collect information on their (unencrypted) servers?
And when they ("they" being industry, in a continued response to this attack on privacy) discover the government has done this maneuver and start encrypting said servers/services end-to-end, what will be deemed an acceptable configuration for ISPs then?
The entire point of industry here is there should be no middle ground when it comes to weakening privacy. Justify your access through proper (read: Constitutional) channels, or piss off. You haven't proven that the abuse of this power is effective at doing anything but crushing consumer confidence.
Re: (Score:1)
They should just be honest and ban all data storage except the one that the government provides. Because that is effectively what they want.
Are you sure? I think people running around naked which will preclude 'dick pics' or junk pics in general with their credit card numbers tattooed to a visible part of their skin, and all industry in every sector in general dead is what they want. Then they could perhaps get what they really want; default and a global economic reset. Some call that collapse but I'm c
Amusing... (Score:1)
The article lists five representative companies, but the summary omits the second one of the five for some reason.
Re: (Score:3)
Re: (Score:2)
Re:Brace yourselves Canada (Score:4, Funny)
How about Iceland? Lots of privacy, and plenty of cooling for data centers... Either way, when exports become hard, companies can just leave.
Why not Iceland?
Too many damned diacritical marks for one thing.
Re: (Score:2)
Re: (Score:2)
I'm afraid the situation is not that much better up here.
At least not as long as Stephen Harper and his Progressive Conservatives are still in power, a center right party.
The fact that they are "center right" has nothing to do with the present issue. I'm not aware that any Canadian government, current or previous, has even suggested the idea of restrictions on encryption or mandatory back doors in consumer products. In the U.S., the idea typically comes when Democrats are in the White House. (Remember the Clipper chip? That was under Clinton's administration.)
Re: (Score:2)
Now don't go getting all technical and pointing out history and such. Actual facts often destroy the liberal narrative.
Re: (Score:3)
Would Canada under Harper and the Conservatives be that much better? His government brought forth the Protecting Children from Internet Predators Act [wikipedia.org] which did not mention children or predators anywhere but in the title, and would have expanded government surveillance powers had the bill not been stopped by public outcry.
Scotland would have been a good choice had the independence referendum passed. So I guess now you're going to have to learn Swedish.
Re: (Score:1)
Suppose I should have expected people taking the post seriously.
Wouldn't have to learn swedish though, since it's my mothers tongue.
Unless you throw your passport away and claim to be from Syria there is no use coming here.
Guess we are stuck with
http://en.wikipedia.org/wiki/Principality_of_Sealand
Re: (Score:2)
https://openmedia.ca/blog/bill... [openmedia.ca]
Re: (Score:2)
U.S. American tech company immigrants are coming, with their educations and disposable incomes.
As a Canadian, I would welcome this. We are also well educated here (the University of Waterloo has a world class computer science program) and any infusion of tech capital would be a good thing. I'd be very happy to work alongside American immigrants in the tech sector. I think there'd be plenty of jobs to go around.
TPP (Score:3, Interesting)
Why do we need encryption rules in the TPP?
A key priority for the U.S. semiconductor industry regarding the Trans-Pacific Partnership (TPP) Agreement currently under negotiation has been to introduce rules to prevent restrictions on the import and use of commercial encryption technologies.
You can bet VPN and other technologies are on the plate too.
If you Google "encryption and TPP" you will find a link to the PDF without having to fill anything out.
http://go.semiconductors.org/w... [semiconductors.org]
Re:TPP (Score:5, Funny)
Large corporations writing a secret treaty that won't be revealed until it has already been voted into law. Mass spying programs overseen by a secret court responsible to nothing and no one.
Shenanigans like this wouldn't be happening if a Democrat were in office.
Re: (Score:3, Insightful)
Shenanigans like this wouldn't be happening if a Democrat were in office.
You're joking right?
R or D, new boss same as the old boss, no one gets into any position of power without being vetted and beholden to the status quo.
There's literally no point in voting.
Re: (Score:2)
Someone is in office, and he is a member of the lost and wandering political zombie party that was the Democratic party when it was still alive.
Re: (Score:2)
i think you misspelled Democrates
Last step: TV ads (Score:4, Interesting)
If the same message is brought to people in adverts by Apple, Google, Microsoft, Facebook, Amazon, eBay, and they all tell you that the politicians want to mess up your life, that would get people's attention. Not just on Slashdot.
Re: (Score:2)
Won't happen.
Why would crooks mention that they have done something.
And that something is hard to understand.
Back doors = Security Weaknesses (Score:5, Insightful)
Re:Back doors = Security Weaknesses (Score:5, Insightful)
Regardless of if the government was somehow able to indemnify and protect all parties involved, there should be no back doors. End of story.
FTFY.
Re: (Score:3, Insightful)
Well intentioned? Even if it worked perfectly so only the government had access, WHO THE FUCK TRUSTS these 'good guys'!
NSA/CIA spies on Senate and nobody is prosecuted, FBI does bulk tracking wiretapping, and nobody prosecuted. Obama asks court to ignore legal rulings, we're heading into Presidential elections where every candidate has a big NSA file on him, and an out of control General capable of leaking it if they voice opposition to the spy machine.
No good guys there.
Even if it was for law enforcement o
Re: Back doors = Security Weaknesses (Score:3, Insightful)
Especially when government can't keep its own data safe. Someone will break in and steal the private keys in days... rendering encryption useless worldwide.
Good luck with that (Score:1)
Obama will take your money, and he'll do what the security agencies want.
The Folly of Government (Score:5, Insightful)
These idiot authoritarians need to be taught that their idiocy KILLS American business. But then, I guess they don't care. They think they can just print their way to prosperity.
Re: (Score:2)
Re: (Score:3)
Exactly this. Even if we were to make the huge assumption that US law enforcement would only use their double-secret encryption backdoors for good, it would only be a matter of time before $RANDOM_HACKER figured out how to get into that backdoor. If you add "law enforcement only back doors" into encryption, you might as well just unlock the front door and put down a welcome mat.
Re: (Score:2)
Re: (Score:2)
"These idiot authoritarians need to be taught that their idiocy KILLS American business." What do you think Obama meant when he said that he "wants to fundamentally change American society?"
Re: (Score:2)
The things Obama likely thought about. Do I look good, do I look sincere, is my voice pitched right, how much is this speech earning me, what's for dinner, I'm bored, suckers, I wonder what I will be paid to say next, Hillary is lame ass and is going to lose etc. etc. etc. So what he meant, he meant nothing at all, just a public speaking event with message from his handlers delivered to a gullible public.
Not much the US can do. (Score:5, Insightful)
Most of the recently proposed crypto algorithms aren't American. The cat is out of the bag - crypto is an academic subject now, and everyone's participating.
Re: (Score:2)
Re: (Score:1)
Export ban perhaps, using the sophistry of defining encryption as munitions. But internal to the US I believe the Supreme Court has already ruled freedom of speech includes the right to speak encrypted.
Re: (Score:2)
Oh, they're so *cute* thinking they matter. (Score:3, Interesting)
A government that does this:
http://www.theguardian.com/wor... [theguardian.com]
is simply no longer interested in the rule of law other than to further their handler's interests.
So, request away! Ask for a pony while you're at it.
Weak encryption = No encryption. No exceptions. (Score:5, Insightful)
Weak encryption is effectively the same as no encryption. Encryption has no value unless it cannot be broken. You cannot make encryption only weak for the "good" guys. It simply doesn't work that way and wishing will not make it otherwise. Any government official that argues in favor of weak encryption is either ignorant of how encryption works or is corrupt/self-serving and just wants their job to be easier without regard to the consequences.
Yes I am fully aware that "bad" guys having access to strong encryption presents certain challenges. However weakening your own encryption to the government can spy on the populace will not EVER solve that problem.
Back doors are weak for everyone (Score:3, Insightful)
Are you saying that backdoor'ed encryption is a mathematical impossibility, or that it won't work in practice because the backdoor key will eventually leak due to hacking, rogue employees, etc?
It is almost certainly a practical impossibility and I'm confident it is a mathematical impossibility too. A key is either possible to crack in a reasonable amount of time or it isn't. There is no middle ground. You can hand a key to whomever you like but if you create the backdoor by weakening the encryption then it is weak for everyone who would be interested in cracking said encryption. If the NSA can figure it out, so can others. Furthermore, each additional party you had a key to creates another v
Re: (Score:1)
What if you create a backdoor by creating an encryption method that accepts 2 decoding keys instead of one? Obviously the encryption is now twice as easy to bruteforce, but this doesn't seem to be a big deal. Are you worried about this factor of two, or is the theoretical weakening more severe?
Re: (Score:1)
Re: (Score:2)
The point here is that the backdoor could be a second key instead of a way to break your key. Assuming that second key is also resistant to breaking then you haven't introduced any vulnerabilities to an outsider--assuming that the second key is kept secure. And that, it must be admitted, is a pretty damn big if.
Re: (Score:3)
The point here is that the backdoor could be a second key instead of a way to break your key. Assuming that second key is also resistant to breaking then you haven't introduced any vulnerabilities to an outsider--assuming that the second key is kept secure. And that, it must be admitted, is a pretty damn big if.
That makes it an exercise in futility, easily defeated by hacking the system to substitute some other second key (which could be random gibberish, since it's not actually used, just put in to defeat the backdoor).
Re: (Score:2)
That was essentially the flaw in the Clipper Chip which used key escrow in the form of a law enforcement access field (LEAF). The hash protecting the LEAF was only 16 bits allowing a easy brute force attack which could forge a new valid looking LEAF.
http://en.wikipedia.org/wiki/C... [wikipedia.org]
Use a strong cr
Re: (Score:1)
Re: (Score:2)
"You cannot make encryption only weak for the "good" guys. It simply doesn't work that way and wishing will not make it otherwise"
The broken elliptic-curve random generator actually had such a feature: it was likely that the NSA has a secret key that could be used to recover the internal state of the random generator. However, recovering this secret key was impossible for all practical purposes.
For encryption, one could demand that encrypted data includes a header that contains the key to decrypt the data,
Re: (Score:2)
Weak encryption is effectively the same as no encryption
I disagree. Weak encryption is significantly worse because it is misleading. At least with no encryption you know that your information is unprotected. With weak encryption you run the risk of being misled into believing that your information its protected when, in fact, it is trivially accessible.
This is just P.R., folks. (Score:1)
What else are these companies going to say? Public statements and actions like this are meaningless.
In the marketplace of encryption, all it takes is one covertly compromised new algorithm that beats the competition for commercial use. The compromise itself must be computationally hard to detect, and there are approaches to that. Bottom line, however, is that I don't see how anything industry says could have the slightest bearing on whether this asymmetry is pursued.
Re: (Score:2)
They could say nothing and stay quiet. They could not bring the matter to the public light.
Companies that make money in trust have an invested interest against this (just like the public should.)
Ask Obama? (Score:5, Insightful)
What is this, the Third Reich?
Blind sight. (Score:1)
Re: (Score:2)
They are just making this hubub to throw people off. They have key loggers and ways to view your screens that can not be detected with normal means. Using some other form of network that is hard to spot. Don your tin foil hats cause they can read brain waves too. Who really knows? With all the things I have read on USB and viruses being able to bridge air gaps; I don't know, it could very well be as advanced as I am making fun of. Mosquito sized drones and all.
That's true, and it shows that the ONOZ OMG TERRAISTS!!1! rhetoric is a pack of lies. You've listed (setting aside the facetious "tin foil hats" part) some techniques available to the government for monitoring legitimate targets of suspicion. However, it wants to snoop on everybody, and those techniques don't scale large enough to make that possible.
I remember storys like this about USSR ... (Score:4, Informative)
when I was a kid, this is the sort of thing I would expect to hear of the USSR... now it's here...
it seems to me that if they force backdoors or weak security, wouldn't that hurt most us based IT security vendors?... wouldn't that force any that wanted to sell internationally to relocate outside the US?
what is the point of any encryption at all if there is a backdoor built in, or it's weak to begin with....
Re: (Score:2)
the terrorism angle on this is a bunch of BS... unless your in the middle east, the odds of being killed or hurt by a terrorist attack are up there with getting hit by lightning... your actually more likely to drown in your own bathtub than have a terrorist kill you.
all this really equates to the boogyman might jump out from under your bed... so don't use encryption
This will never happen anyway (Score:2)
"Misuse" of Encryption (Score:5, Interesting)
Anyone else catch the nonsensical bomb-threat at the White House yesterday?
I was passing a TV set to CNN and that was the focus. I've not seen much about it otherwise.
But they evacuated the Press Room once or twice.
Eventually somebody stood at a podium to opine about how we all need to address this issue of Encryption because it hinders their ability to catch the bad guys when the bad guys "misuse" encryption.
I was incredibly offended at the very idea. It's so stupid - you either use it or you don't. Using encryption to keep the feds from looking over your shoulder and reading your communications is not "misuse". It's the entire purpose and absolutely correctly used as such. And in the context of the US, it would seem we have the 1st, 4th and 5th amendments to consider.
Not only was I disgusted at this moment of sheer propaganda, I found myself very inclined to believe the entire thing was completley staged.
There are no secrets (Score:3)
Have they forgotten that we had multiple people over the years trying to sell/give away nuclear weapons secrets from the very beginning of the program?
And I bet for every person that would sell nuclear weapons secrets, you could find a thousand that would sell backdoor encryption keys.
How can they possibly imagine that no one could be found to divulge the backdoor for a few million dollars?
For one thing, certain Wall Street firms would have the backdoor keys within days, if not hours.
And if money didn't work, those firms aren't at all afraid to use their ex-FIS/GRU employees to do whatever it takes.
Am I the only one ... (Score:2)
Re: (Score:2)
Re: (Score:2)