Hacker News Reader

Comment by pilif | Hacker News Reader

To quote the article:

> In it, the FBI asks for a warrant to be served on Google. It wants to know:

> The subscriber's name, address, Social Security number, account login and password

I would hope the FBI is bright enough to know that in all likelyhood Google stores their users passwords in hashed form. How would Google actually be able to comply with this request for the password?

What would happen if they can't comply (they can't)? Would this eventually lead to legislation that forces services to store passwords in plain text or reversible encryption (which is pretty much the same thing)?

View on HN

Who cares whether the password is hashed or not. All other data related to X is not.

   select * from smses where login = ?

So if such a warrant will be issued Google absolutely can deliver.

The FBI apparently cares if they specifically asked for the users password. The article was specifically listing the users password amongst the items that were requested by the FBI, so my comment was about the password too.

Most of the other data they were requesting can easily be produced by Google - sure. I'm not denying that at all. I'm just saying that the (original, as set by the user in question) password is probably not retrievable and I'm also saying that the FBI should know that.

I agree, the password should be hashed and should be unrecoverable. That may or may not actually be true, however.

It may be the FBI intends to try the password elsewhere. Lots of people use the same password across multiple accounts of various different types.

Or maybe they intend to submit it as evidence if it's something like "masterpimp"

Quite. For whatever reason I was under the impression that the demanded information was on Google servers.

Unless the pimp is using Google Voice, why would Google have their text messages?

I used SMS as a placeholder for anything hold on Google servers.

Google can give you a new password if you forget yours. There is no technical barrier to giving the FBI access and clearly no requirement for plaintext passwords anywhere (setting aside how the request was expressed in the article as a request for a password).

That's assuming the device is associated with a Google account. It's not a requirement and losing the unlocking password/gesture may leave the phone completely unusable (except for 911 calls). Sadly, I speak from personal experience. I do not believe Google has a way of remotely associating a locked phone with a Google account to regain access.

You sure? I can't use my Android phone (Gingerbread) without a damn Google account - I have to use a throwaway one just to be able to use my smartphone...

They can even generate an application-specific password for the FBI, to be revoked after the time limit specified in the warrant is reached. (No idea if this is done or not, but in theory, there is no need to know the password in order to disclose one to the FBI. All they want to do is unlock the phone, but are too dumb to connect a USB cable and run adb.)

If the phone has a locked bootloader and USB debugging isn't turned on, which is most likely the case, then they can't do what you are suggesting.

OK. Open the mofo up and remove the flash chips. It's the government, they have the technology :)

> but are too dumb to connect a USB cable and run adb.

Or that would break the rules regarding forensic data retrieval, and make the information gleaned in that fashion inadmissible as evidence.

Physically unlocking the phone breaks the rules regarding forensic data retrieval as well, since the state of the phone has now been altered, how is the court to know that the FBI didn't plant the details.

This is why backup images are made first, which is not possible with phones when they are locked... the backup images are operated on when doing digital forensics, so that the result can be reproducible by a third party.

How does this violate the rules? He's already signed a waiver to his 4th amendment rights, so no court order is needed - he's essentially given them full control over his own property, including his phone (which I presume would include accessing the data via adb instead of the phone screen).

Because then the phone is no longer in the original state as when the defendant turned it over, and the FBI cannot prove it did not alter the contents of the phone (as images cannot be made while the phone is locked).

Even with the lock, how can they prove that? If they're able to get information off of it, they're able to modify it....

My initial thought was the same as the GP's then I read your statement. Then I thought about it for a moment.

I wonder. This is a subpoena, right? If so, it's not an order for Google to alter anything, just to give the FBI certain information that they have. It may very well be that Google cannot comply with the specific order as granted, but without the text of the order I can't be sure.

There is a difference between "Give us this user's password" and "Reset this user's password and provide the credentials to us."

Reply on news.ycombinator.com