Hacker News Reader

>I think this will come down to the makeup of the user base. If say only 10% of your customers are using it for illicit purposes, you can claim you didn't know, of couldn't have know because the messages are E2E encrypted, however if that number is 50+%, then I think the case could be made that yes even though you couldn't read the exact messages, you can still be held liable.

But what are you supposed to do in this situation? You get an inkling that the service you're providing is used by drug traffickers. If you start taking actions against that then it means you know, therefore more likely to be guilty in the eyes of the law. If you tell law enforcement then you're also taking a risk, because it's still happening in your backyard. On top of that, anything you do has a good chance of destroying the business as well.

You let law enforcement do their job, and forward what little you can. If you implemented e-2-e encryption properly it isn't your problem you have no access to anything but metadata.

If you didn't, and you really have access to keys that enable law enforcement to intercept or crack the encryption, then you weren't really end-to-end encrypted were you?

Law enforcement interaction, and adherence to the law is not that much different than following and implementing a protocol. They can ask. You are expected to make a best effort attempt at accomodating what they ask for, given they have probable cost and a warrant. If they say that isn't good enough, you fight it in Court until either a judge modifies the protocol, or stipulates it's a legislative question. Queue lobbying.

At all times, law enforcement are bound by probable cause. If they have it, you have to assist to the best of your ability, which for an e-2-e encrypted data stream is pretty much just metadata submission, or production of ciphertext if you're really going full centralized comm-stream tapping CALEA. Design your comm system like WebRTC, where your infra is only there to help two endpoints meet, and you have not even that.

That's all there is to it really. Awful people doing awful things is a certainty. LE just have their knickers getting in a twist because their prey are starting to play the game with the blinders of technical ignorance off.

What Law Enforcement wants is everyone to agree that they get privileged access to any message propagating through societal infrastructure... I sure hope everyone here understands why it is essential that they don't have it.

Great idea, until "law enforcement" comes back with a "demand letter". Take a look at how that worked out for LavaBit: https://en.wikipedia.org/wiki/Lavabit#Suspension_and_gag_ord...

The correct response in his case was civil disobedience, cracking open every last detail of what he was being put through, and counting on the rest of us to come to our senses.

It's sad, but there really is no other way to reasonably confront tyrannical overreach. If you play by the rules and refuse to be non-compliant, you also sacrifice the one weapon an overreaching Administration has to fear: the Truth.

Now in a more naive mindset in my life I'd say go to the press. Nowadays though? It's a hard call who to go to to get the thumbscrews turned on those in power.

Normally I would disagree with you and say that following the law is the best course of action, but the article that Ladar Levison wrote for The Guardian (here: https://www.theguardian.com/commentisfree/2014/may/20/why-di...) makes it clear that he should have disobeyed the court summons and allowed himself to be arrested. Had that been the case, he should have been afforded the right to counsel because his liberty was at stake.

>Someone please correct me If I'm wrong but I thought If your systems are all E2E encrypted, then you as the service provider have no way of seeing what your users are discussing on your platform.

In the past the issue has been did the company intentionally develop and market the product for drug trafficking. For instance did they send sales reps to contact criminal organizations and offer their products as a way to do crimes.

One company produced electronic devices for the purposes of evading wiretaps and then visited various mafia owned bars to meet criminals and sold those devices to members of those syndicates [citation needed] specifically for the purposes of evading wiretaps. You might have heard of that company, it later became Apple Computer.

>"Somehow, despite the fact that many of their blue boxes had been seized by law enforcement, and there were definitely indicators that they were all made by the same outfit, the boxes were never linked back to Woz and Jobs." - [0]

Edit: I can't find anything to back up my memories that Woz talks about selling blue boxes at a bar. I may have misremembered. I have added a [citation need]

[0]: Concerning Steve Wozniak’s Blue Boxes https://512pixels.net/2018/03/woz-blue-box/

From my understanding, a Blue Box doesn't evade wiretaps, but allows one to make long distance calls for free.

A blue box gives you administrative access to the switching equipment by tricking the switching equipment into thinking it is receiving control plane information from another switch. It's like being able to send BGP messages to routers.

This means you can make long distance calls for free, but it also means you can route your call through whatever switches you want and lying about both the source and destination at each hop. Because wiretapping systems often rely on the switching infrastructure and with a blue box you control the infrastructure, you can make yourself invisible. It was God-mode for the phone network.

Fundamentally, a blue box is, along with the essential 2600Hz tone, simply a DTMF dialer, like what is built into touch tone telephones, only it used operator dual tone frequencies, not the same dual tone frequencies used by touch tone telephones. You can't do much at all with a blue box unless you understand how the switching equipment that detected those frequencies worked, and that was only documented in unpublished Bell Telephone Company and then AT&T manuals, then subsequently by phone phreaks who either learned by trial and error or somehow came across one of those manuals. Blue boxes stopped working due to the change to digital switching equipment.

A red box, which emulates the tone that tells a pay telephone or a long distance operator that a quarter has been inserted, should still function, if you can find a pay telephone that still accepts quarters.

> One company produced electronic devices for the purposes of evading wiretaps and then visited various mafia owned bars to meet criminals and sold those devices to members of those syndicates specifically for the purposes of evading wiretaps. You might have heard of that company, it later became Apple Computer.

While Steve and Woz definitely made and sold Blue Boxes, this conjecture is entirely false otherwise. Blue boxes had nothing to do with evading wiretaps, but rather making free phone calls. Further, your farcical story of them visiting mafia owned bars is utterly fantasy.

>While Steve and Woz definitely made and sold Blue Boxes, this conjecture is entirely false otherwise. Blue boxes had nothing to do with evading wiretaps, but rather making free phone calls.

You are incorrect, blue boxes were and can be used to evade wiretaps.

"in wiretapping systems: common phone-tapping equipment was designed to be backwards compatible with in-band signalling, with the result that you can evade surveillance by using a blue box to convince the police equipment that you’ve hung up. The telephone exchange ignores this signal, so you remain on the phone but with the police recording stopped" - [0]

>Further, your farcical story of them visiting mafia owned bars is utterly fantasy.

I can't find the exact quote where I think Woz talks about this in an interview. It is that not absurd at face value since one of the main purchaser of blue boxes was bookies. If you're selling blue boxes at that time, a bunch of the buyers are going to be bookies. Both for their ability make free calls, but also for advantages like evading wiretaps that blue boxes provide. See quote below:

"Since the early 1950s [mafia] bookies had been using every trick they could think of to make free and, more important, unrecorded long-distance telephone calls. One method was as simple as bribing telephone company operators and technicians to place calls for them so that the calls never appeared on their own telephone bills. [..] Blue boxes were active devices: they allowed you to call people — anybody — without leaving a record that the call was ever made. It’s not clear exactly when the bookies learned about blue boxes, or from whom, but the best guess appears to be about 1 963 or 1 964. One source was Louis MacKenzie, the electronics engineer who offered to fix AT&T’s network, for a price, in the early 1960s. MacKenzie, who later became a witness for the government in several blue box prosecutions, sold blue boxes to bookies in 1965 or perhaps earlier." - [1]

Edit: Really having trouble finding that quote from Woz. I could have misremembered this. The article that inspired Woz to build blue boxes was about people selling blue boxes to bookies, perhaps I conflated those two stories.

[0]: Telecom System Security: Chapter 20, https://www.cl.cam.ac.uk/~rja14/Papers/SEv2-c20.pdf

[1]: The Untold Story of the Teenagers and Outlaws Who Hacked Ma Bell by Phil Lapsley, https://archive.org/stream/ExplodingThePhoneTheUntoldStoryOf...

> You are incorrect, blue boxes were and can be used to evade wiretaps.

That was not why Woz (and Jobs) were interested in them, which is my point. They were interested in the free phone calls and geeking out on the system. I know, because I asked him. I’ve also read all the history that’s been written down on the subject too, and nothing has remotely said what you claimed, including the source article to this post.

> Edit: Really having trouble finding that quote from Woz

Yeah, because it doesn’t exist.

>Yeah, because it doesn’t exist.

I probably remembered it wrong and conflated the Rosenbaum with being about Woz and Jobs.

>That was not why Woz (and Jobs) were interested in them, which is my point.

Woz and Jobs decided to learn about blue boxes because they read "Secrets of the Little Blue Box" [0], an article which covers people selling blue boxes to mafia bookies [1]. My understanding is that Woz thought that Blue Boxes were neat and that Jobs wanted to turn it into a business so they began mass producing them. They were looking for a market, they knew based on the article that got them excited about Blue Boxes in the first that Blue Boxes can be used to evade wiretaps and that also based on that article they knew organized crime was willing to pay for them. At the very least they must have talked about it as some point, perhaps just to say we are never selling these to the mob".

If you ever get a chance to ask Woz about this, I'd love to hear his answer, who did they try to sell blue boxes to and if they didn't try to sell blue boxes to bookies what was their thinking at the time about why not?

"And with Wozniak, of course, the story goes that he discovered the blue box via reading Ron Rosenbaum’s article, Secrets of the Little Blue Box" [0]

"We [not Woz or Jobs] had this order for a thousand beeper boxes from a syndicate front man in Las Vegas. They use them to place bets coast to coast, keep lines open for hours, all of which can get expensive if you have to pay. The deal was a thousand blue boxes for $300 apiece. Before then we retailed them for $1,500 apiece" - [1]

[0] Concerning Steve Wozniak’s Blue Boxes, https://512pixels.net/2018/03/woz-blue-box/

[1] Secrets of the Little Blue Box by Ron Rosenbaum, http://www.lospadres.info/thorg/lbb.html

Post edit as it’s unclear, “blue boxes had nothing to do with evading wiretaps *for them*”

Yes, in general some did, but that is not why Woz/Jobs were interested and to say otherwise is just showing your own knowledge of the subject.

Woz/Jobs were also interested in making a business out of it. They were trying to mass produce blue boxes. That could mean selling the device to people who wanted to use if for other purposes.

> That could mean selling the device to people who wanted to use if for other purposes.

There’s a huge difference between that and your prior libelous accusation that they intentionally went to bars frequented by mafia to sell them. Maybe rather than spouting fairy tales you dreamed up, you could actually read the article you linked and learn who they sold the few dozen of them they made too.

>There’s a huge difference between that and your prior libelous accusation that they intentionally went to bars frequented by mafia to sell them.

I probably got the stories mixed up with the other group that did sell blue box to mob bookies. If I could edit that comment to reflect that I would, but hn has turned off editing on that comment.

>Someone please correct me If I'm wrong but I thought If your systems are all E2E encrypted, then you as the service provider have no way of seeing what your users are discussing on your platform. At least from a technical aspect, the state's case doesn't really hold up.

When has a prosecutor ever let reality stop them from throwing shit at the wall to see what sticks?

It is highly unlikely that anyone developing an app that facilitates crime will leave themselves access to user data. It's a pointless risk from a business and criminal liability perspective. Pretty much everything illegal runs on the "don't ask don't tell" principal. The less you know the less of a target you are.