Referring to "suspicion" at all here is a distraction that suggests it would somehow be okay in other circumstances.
There must not be a way to backdoor user devices, under any circumstances.
There must not be a way to backdoor user devices, under any circumstances.
I really appreciate Signal's public responses to warrants ("sure, here's all the information we have, by design we don't have anything important"). https://signal.org/bigbrother/
The method that works is to make it technically or practically impossible.
Any other backdoor mechanism can similarly be breached or misused. There is no such thing as a backdoor that can only be used for what it is "supposed" to be used for.
- Don't allow remotely installing things on a device, only doing so with physical presence on the device.
- Have "binary transparency" mechanisms to make sure that you're seeing the same binary everyone else is, and you're not getting served a special backdoored version nobody else sees. (This doesn't prevent global backdoors, of course, but those are more likely to get caught.)
- Relatedly, have multiple independent app stores in different jurisdictions, and make sure they are serving identical binaries. That ensures no one jurisdiction can surreptitiously demand and enforce a backdoor.
- Have signatures from the original app author that can be verified, and ensure that intermediaries (e.g. "app stores") can add signatures but can't add anything to the package that's not covered by the original signature. That reduces the number of parties you have to trust.
- In an ideal world, only install Open Source software that's reviewed and subject to multiple independent reproducible builds.
Also, democratically authorized state actors have a valid role to play in liberal democracies.
That's appropriate for a SCIF, not for someone's day-to-day life.
> Also, democratically authorized state actors have a valid role to play in liberal democracies.
They still don't get to have backdoors into everyone's device.
Also, many many events throughout history should demonstrate that "democratically authorized" is in fact laughably bad at curtailing abuses of power, and not a substitute for a sacrosanct right to privacy that's systematically enforced through both legal and technical means.
Make devices secure. When people tell you to make them insecure, refuse.
If you look at history, not sure why technical measures would offer much protection against violence based approaches against privacy, though.
When you said "If you can install stuff on the device, how could you protect against it?", that sounded like it was talking about how a device that can have new software installed onto it can have a backdoor for later use installed onto it, and that led into a discussion about how to protect against that.
Were you instead saying "on a device you have control over, how can you protect yourself against that?". Or something else?
> If you look at history, not sure why technical measures would offer much protection against violence based approaches against privacy, though.
They can at a minimal level (e.g. steganography, duress passwords), but yes, ultimately there is little you can do against someone threatening you personally with harm.
And, yes, there can be a debate if such warrants are desirable etc., but I think it's quite different from broad-based backdoors for potential mass surveillance etc. and liberal democracies can decide to have such tools available.
I think part of what I was suggesting still applies there: if you can't install things remotely, and you have oversight to ensure that any backdoor applied to you has to have been sent to everyone (which provides a measure of security), then what's left is physical control of the device. For instance, keeping the device in your possession, locking it down against peripherals...
That can't prevent you from being physically coerced, but it provides a lot of security in every other case. And if things have devolved to the point of you being physically coerced then you have much worse problems.
The only way is to avoid the jurisdiction altogether then, because any app can be remotely updated to disable encryption…
For the record, Signal pushes an update every few days.
Recently in the country I live some people from interpol accidentally withdrew a red notice, after initial prosecution, the prosecutor realized several mistakes were made and documents lost, so as a country with the rule of law, the prosecution withdrew the charges as there was insufficient evidence, compare and constrast with a corrupt country like Canada where the attorney general was fired for wanting to prosecute a company that had bribed Momar Ghaddaffi with 2 million dollars. Worse yet, they spread their culture of corruption through out the world instead of keeping it at home.
I agree that there shouldn’t be a backdoor by default. But, for example, planting a modified app update with backdoor on the device of a suspected high-risk felon, based on a court warrant, is something that can be more reasonably debated.
Backdoors are unacceptable 100% of the time, and should never be legal.
A backdoor is a lazy power grab that is either supported in ignorance by technically illiterate useful idiots or supported in full knowledge of the intended partisan abuses of basic civil liberties.
Hacking a criminal's phone with compromised software, and/or intercepting their voice & data, is not a backdoor. Backdoors mandate a violation of informed consent, and as such, should be criminalized without exception.
There's no place for backdoors in civilized societies.
Sure. And on the flipside, given the many ways such a capability is a security risk and an abusable backdoor itself, it's something to develop additional technical safeguards against, such as Binary Transparency to verify that everyone's getting the same binaries.
There are other channels for investigations that are enough, chat control introduces less security that we would gain (if there even is any gain).
Edit: My first read had me interpret backdoor as any undetected means of gaining access to a device/system. I have updated by definition to mean using a flaw in the system left intentionally to gain access. This somewhat negates the need for my previous comment, but I'll leave this for illustrative purposes.
One can make an argument that if there is strong evidence that someone is planning to commit an unusually serious crime, e.g. a terrorist attack, then secretly installing surveillance software on their device is warranted.
I would also add that this surveillance operation can't be used to collect any other data which is unrelated to the suspected serious crime (like terrorism), and if such data is collected by accident, that it can't be used as evidence in court. (I'm very sure that this is currently perfectly legal in the US, which sounds pretty bad.)
Because the language is far clearer in the US, you would and do hear "warrantless" being used in both the legal and general sense when it comes to these topics, but translating "Anlasslos" as "warrantless" would imply far too much confidence than is given.
"Unfounded" also reflects the weak perspective on hard boundaries of law and limitations on the state that simply do not exist in Germany and effectively all of Europe in the way that they do in the USA as de facto immovable law of the Constitution. "Anlasslos" implies a mental framework and conception that defers your rights (free speech in this case) to the subjective judgement of various people like politicians, judges, technocrats, bureaucrats, regulators, police officers, etc., i.e., someone does not like your speech so they will monitor your communication with our grandma for the abusive and narcissistic, manipulative concept of "hate speech", aka. "speech I hate".
Wiretaping a suspect's phone on the other hand is a fine (and often necessary) police operation, as long as it must be approved by an independent magistrate.
Slamming the door and making noise here is the way to go because your officials are dishonest about their intentions.
But, you can use that against them. Your phone doesn't have to always be with you. You can be where you are, and you phone's location can be hundres of miles away.
Use it to your advantage.... They do.
Imagine an architecture in which you had a pervasive cellular data connection that was intentionally uncorrelated with any identifying information, the way wifi is.
Right now, the only legitimate reason cell networks have to identify specific devices to users is for billing, and for PSTN. The latter could be made utterly irrelevant with VoIP. The former could be solved in various ways, either by making it a public good, or by integrating anonymous payment mechanisms for a "session". Then, we could just have pervasive data connections.
* Ideally the user id should be used only once and derived from some pre-shared secret.
First, in a case closer to the current world, I'm just suggesting that disabling the cell modem should power it off so it can't do any kind of location or tracking.
Second, in a more ideal world, the concept of "data connection" would be entirely separate from any identity attached to a phone or text message, and you could handle the latter via whatever connection you have, whether a cell data connection or wifi or something else.
In which case, the best you can do is use an obscure method that the attacker is unprepared for. If they've hijacked the AES CPU operation to store the key and include it in the output for a later syscall like when writing the output file, but you unexpectedly use some funky experimental cipher, you'd be lucky until they push an update. The device has a mandatory backdoor after all, so govt can also decide what new code it needs to run now, perhaps under the guise of detecting more situations of terroristic content or whatnot. There's no winning that game except through obscurity, and I presume everyone has heard about how reliable security through obscurity is