Comment by upofadown | Hacker News Reader

Comment by upofadown | Hacker News Reader

>“The only way to clean it up would be to have the FBI act as the sole identity provider for all state and local law enforcement,” Weaver said. “But even that won’t necessarily work because how does the FBI vet in real time that some request is really from some podunk police department?”

There are already preexisting systems for solving this sort of problem. For example the FBI could set up a PGP based certificate authority[1] for email. Then the FBI signs the identities of the podunk police departments ahead of time. All the service providers would need would be the FBI identity (PGP public key) which they would sign once to authorize it and then they would be able to verify emails coming from any of the podunk police departments with no extra work on their part. This example comes with a revocation system that actually would work in this case.

All secret key material would remain under the control of the specific FBI department acting as the certificate authority. No third party involvement would be required.

[1] https://sequoia-pgp.org/blog/2021/05/12/202105-hello-openpgp...

How does this solve the issue? If a local police department laptop gets pwnd, or a local police officer's credentials get compromised through a reuse attack/stuffing (as seems to have happened here), what oversight mechanisms would prevent their email from getting PGP signed? In this case, these emails were probably DKIM and SPF verified already, which (as I understand your proposed system) seems entirely equivalent.

There's no "magic bullet" in security, you can't just "authenticate" individual emails "with no extra work" and hope that that solves things without addressing the gaping security holes that allowed those emails to be sent from official servers in the first place.

Normally the secret key stuff is protected by a passphrase for a PGP verified email. So the entity owning the laptop would have to wait for the department to make a request first (rare) to keylog the passphrase and would only get to make one bogus request before revocation of the identity.

DKIM and SPF only prove that an email passed through a particular email server. The whole point of doing the verification end to end is that the stuff in between does not have to be secure.

Yes, if you're assuming that police departments can keep a rarely-used passphrase secure and not written down in online documentation anywhere, while also being accessible in emergencies, then that system might work. (But then you also have to remember to rotate the passphrase when anybody in the entire department leaves or gets fired).

Access to the passphrase would not by itself provide access to anything. The malicious person leaving would also have to take along a copy of the encrypted private key.

In practice you would just register 2 or more keys left in the care of 2 or more people. Each person would be individually responsible, as it should be. When someone left you would revoke the key. You would not have to go super hard on this, most of the requests would be routine and not time sensitive. In an emergency you do the best you can with what you have available.

Dongle

The alternative is due process, where a judge issues a court order and the police have to wait a few hours for that to happen.

Probably take 5 minutes to find an example order online from most judges in the country. Make a fake document to look just like it saying whatever you want. Send it in - how do they authenticate it?

Same way they validate them now. Call up the court and ask. The clerk will be happy to help you. If you can fake a district court into existence we've got bigger problems.

Slim to no chance that a US telecom actually bothers to call up the court and verify an order with the clerk except for orders that are unusual (say: overly broad in scope, or targeting a recognizable name such as a politician or celebrity). My guess is that at best they look at the fax caller ID and/or email headers and that's that.

Their position is likely "it looked like it came from a cop, not our problem if the cop is forging court orders."

So punish them for not verifying?

We're already very familiar with the concept that ignorance of the law isn't a valid reason for violating the law. What's wrong with that in this scenario?

Then make it their problem with regulators or legislation. KYC is law of the land when dealing with private individuals, same logic should apply to verifying court orders or law enforcement requests.

Judges can be phoned up at late hours to e-sign time-sensitive warrants. Hours that court clerks will not be sitting at their desk answering calls or emails. They also don't work weekends.

If they're already building a central identity provider then something built upon Web/EU standards would work much much better. Tried and tested for decades, ASiC-E (or S/MIME if you really really want) works great.

A simple web application on the FBI's end that takes requests from verified parties and then forwards them to companies would be enough. No need for PGP or anything like that.

Real subpoenas would also work.

wouldn't this just shift the trust from the police email address to the police email PGP signer? wouldn't hackers then just target that part of the infrastructure?

That would be significantly harder, especially with hardware key storage.

Reply on news.ycombinator.com