Hacker News Reader

If the OEM can issue such a certificate, it probably isn’t necessary, because they can access the data and be subpoenaed directly, no?

View on HN

Yes, I am arguing for is requiring OEMs to implement this mechanism.

Frankly, if the NSA wanted to have Apple build a custom iOS version for a criminal so they could sniff his network traffic and flash content from the comfort of Maryland I don't believe that would be impossible today.

If an OEM could decrypt a users data, a government typically won’t bother to do it themselves. They’ll just use legal mechanisms to require the OEM to do the work for them.

Again, as a thought experiment, what legal protections can we put in place - an encryption ombudsman or independent authority - that would allow an arms length, controlled and expiring mechanism that allows limited access to a user's data? What would we as a society be happy to accept? I don't think the demand is an unreasonable one, but I'm trying to figure out what a reasonable collection of mechanisms looks like.

I think that’s more of a technical question. How would that entity be granted the ability to decrypt your data without the OEM being able?

Reply on news.ycombinator.com