FBI Calls Apple's Enhanced Encryption 'Deeply Concerning' | Hacker News Reader

FBI Calls Apple's Enhanced Encryption 'Deeply Concerning'

macrumors.com

30 pointsmarban10 comments

> The bureau said that end-to-end encryption and Apple's Advanced Data Protection make it harder for them to do their work and that they request "lawful access by design."

Isn't "lawful access by design" another way to say "government backdoor to be abused whenever we want"?

More like, the people, and not some hypothetical government abuse conspiracy.

In more detail,

It's more complicated because "companies" themselves are concepts which the government is obliged to oversee, to a degree.

And companies need regulation because they are intrinsically powerful collections of money and influence, physical and otherwise.

So if you want to like get big picture about it and talk about government oversight and abuse, really it's The People choosing to put into place a cascade of systems of management to mitigate risk and provide the citizenry, convenience and safety.

It's us who are wanting to make sure that when we are suspicious of the behavior of some entity, who happens to be using double secret communication, that we by our government and our companies, can have some power to reduce the magnifying impact of that entity utilizing the massive amplification powers of a company, still.

Is this some theater? There's tonnes of metadata on everything that's E2E encrypted available to Apple, including raw checksums, creation and last accessed timestamps along with access counts - that would be more than enough for metadata crunching three letter agencies. It also seems that every file is encrypted with it's own checksum as the key (only way I know they can do de-duplication).

https://support.apple.com/en-us/HT202303#advanced

Actually, you're right, that's a concerning amount of data. Access and edit dates seem reasonable, but filenames and checksums feel like they go too far. In any case, there are just too many fingerprints here, even under the guise of "deduplication and optimization".

For over 20 years, feds had access to most major internet access points at telecoms/isps. Most traffic was trivial for them to collect. The problem was made even easier with social media and smartphones. Now that the products/apps are maturing with e2e (not ssl), its starting to make it harder to mass collect data without warrants.

Good.

It is deeply concerning that the FBI would want to conduct surveillance on such a scale, that targeted operations (planting a keylogger, recording password entry, etc.) cannot support them.

>criminal acts ranging from cyber-attacks and violence against children to drug trafficking, organized crime, and terrorism

When you can't pick one bugbear, pick them all.

Good. Law enforcement is supposed to be hard.

It would be deeply disingenuous to claim a concern where none is actually warranted but I distress.

They need to defund the FBI and split it in two, the counter intel people have run roughshod over the original mission.

I once (after making my whole thing for over fifteen years that I won't speak to the FBI because they beat my townsfolk and local journalists during the G20) walked into an FBI field office, handed them a stack of what are called CCR numbers, and described a series of serious issues with my local police department. The woman's eyes went wide and she promised to open a civil rights investigation, then they ghosted me like I was a bad tinder date (which, to be fair... I can be, but we're at work now dear, so do your job or don't DARE interfere with mine.)

They need to focus on believing victims and utilizing existing sources of investigation before they "express concern", especially considering some of their agents who obstructed on this issue literally ran up on Congress.

Conversely, I've seen folks the FBI claims they need these extraordinary measures for wander around conferences like Defcon, HOPE, and the Privacy Enhancing Technologies Symposium with their laptop unlocked like the venue was a hipster coffee shop.

(Not gonna name the guy, but he used to tweet a lot about opsec for someone who gets pilled up and runs around the venue loudly saying the N word with his laptop FULLY unlocked.)

Anyways... they need to rely more on human methods and less on computer intrusion, like the FBI agent who gave me my card back when I was an angry young man posting Facebook zero days on my blogspot.

(Apparently it creates a bit of an international incident if you find a way to spoof your location on Facebook, get angry they declined to interview your for a summer internship, and spoof your location as with the protesters when you're not retaking discrete math over the summer, and apparently in 2009 the best the FBI had was a guy who knew what IRC was and would basically just... do undercover stuff but on the computer? Guy couldn't even get the powerpoint to work when he came to speak at CMU, which I have, to be clear... never, ever attended. I just show up in Newell Simon occasionally to grab a refreshing grass jelly drink, ask lewd questions to the roboceptionist, and look at whatever posters folks decided to put in public view.)

Anyways, I'm not clear why we are listening to an agency staffed by criminals who misunderstand on purpose anytime their job involves anything other than messing up on purpose, but I'm speaking from the perspective of a lower middle class Appalachian thrust into these crypto wars by forces beyond my control :-)

Reply on news.ycombinator.com