Hacker Newsnew | past | comments | ask | show | jobs | submitlogin
New York Wants to Force Vendors to Decrypt Users’ Phones (onthewire.io)
171 points by uptown on Jan 15, 2016 | hide | past | favorite | 104 comments


What is frustrating as always is that they invoke criminals and terrorists (and for once no reference to paedophiles!) but these laws will be used 99% of the time in civil cases (divorce cases, etc) and against petty crime. I remember when the UK used the terrorism act to freeze the assets of Icelandic banks. Terrorism has just become the keyword law enforcement officials add to the title of any law they want to see passed, no question ask.

http://news.bbc.co.uk/1/hi/uk_politics/7688560.stm


Almost like some sort of conspiracy.


This isn't really related to your main point, but it's disingenuous to describe the freezing of Landbanki's assets as a use of the "terrorism act" just because the legislation had "anti-terrorism" in the title. The Anti-Terrorism, Crime and Security Act is pretty wide-ranging, and as well as whatever anti-terror legislation it contains, also contains some legislation around economic security - which is what was used in the case of Icesave.


That's actually precisely my point. Voted immediately after 9/11, it's a prime example of a law titled "anti-terrorism" which actually has a much broader range and provides powers in domains that have nothing to do whatsoever with terrorism.


>but these laws will be used 99% of the time in civil cases (divorce cases, etc)

Would that be a bad thing?, so you are implying that encryption is wanted to actually hide crimes or unloyal behavior mostly?


The problem is that the public is misled about what the law is going to be used for. Mandatory decryption will get much less support if the electorate knows it's going to be used for non-terrorism related crimes.


But will still be used to fight crime, so?


Not everything courts deal with is crime. A divorce case isn't about crime (and I bet they will be major consumers of decrypting devices, looking for nasty pictures or conversations!). The president investigating who in his administration is talking to the press isn't about crime.


>(and I bet they will be major consumers of decrypting devices, looking for nasty pictures or conversations!).

OK, and why would that be a bad thing? if it is done in the context of a case investigation.


#1) because in many jurisdictions it has no bearing on the divorce itself, and

#2) in many jurisdictions a person who flirts with a consenting adult over text hasn't actually committed any crime in doing so

Which leads to...

#3) what is the point of decrypting said personal communications except to vindicate the estranged party's already fully-formed assumption that their spouse is a wicked person, or to exact some kind of court-sanctioned revenge.

I swear, sometimes in threads like this it's hard to tell if someone is trolling or legitimately can't ponder the unintended (or, perhaps, fully intended but thinly veiled) consequences of laws that serve to grant the state access to private communications.


> I swear, sometimes in threads like this it's hard to tell if someone is trolling or legitimately can't ponder the unintended (or, perhaps, fully intended but thinly veiled) consequences of laws that serve to grant the state access to private communications.

The post you're answering to basically asks why removing privacy from society is a bad thing. I think that a simple link such as [1] is enough as an answer to this fairly common question, troll or not.

[1]: https://papers.ssrn.com/sol3/papers.cfm?abstract_id=998565 ('I've Got Nothing to Hide' and Other Misunderstandings of Privacy)


Nobody is saying it is crime (I also mentioned unloyal behavior in my original post), but, in cases where there is evidence of infidelity why would that be a bad thing to decrypt the information if it helps in the case?

And why are getting angry? do you feel unfortable that my concerts my be legit?


If one suspects a spouse of infidelity, there are personal concerns related to trust and affection that need to be resolved. By the persons involved. Not by a judge, or a legislatively mandated compulsion to disclose every little thing, no matter how unrelated, you've ever said, into public record.

Edit: You keep using the word "case". I do not think it means what you think it means.


And what about those situations where there is actually a case, why is a bad thing to use decryption to find the truth?


You've asked this question at least seven times in this thread. People have been surprisingly patient and given you a few answers. You may or may not agree, but please stop repeating yourself as it adversely affects the quality of the discussion.


I'm responding to adrianlmm's child post here due to nesting limits.

1) Because (in the US) of the fifth amendment, as I had mentioned before and you, it seems, either missed or chose to ignore.

2) Decrypting the device would, due to forensic procedures, result first in an image being taken of the entire device, meaning that content outside the scope of any discovery process or search warrant would then become available to the judge/state/prosecutor/government, and said content, depending on specific judicial rules in effect, may also end up as a matter of public record. It also means that anything you've said on your device's record, no matter how relevant, can be held against you without your ability to exercise your rights to refrain from speaking.

Privacy isn't about keeping secrets, it's about controlling access to the truth and ensuring that you are able to take an active role in any action that results in the truth being disclosed to a party who has the authority to take said actions against you.

Similarly, the fifth amendment isn't designed to protect criminals from confessing a crime which they in fact committed, but to protect an innocent person's "truth" from being taken out of context and used to bias a judge or jury against them.

Honestly, the more I think about it, it does boil directly down to freedom from self-incrimination (e.g. saying something that would get you in trouble regardless of its applicability or truth). Leaders in our history had the presence of mind to recognize that an authority figure could easily choose to punish anything said by someone who was, according to procedure, supposed to be innocent.

It's a moot point (encryption) in civil issues anyway. A civil complaint should not allow any random person to use the power of the courts as a bully to force their enemies to disclose their private information. There's a reason civil and criminal procedure are so different.


>You've asked this question at least seven times in this thread

w/o a proper answer, all I get is "Is not a case" and if I ask wht if there is case? I get people like you, so, do you have answer to the next question?:

What if there is case? why is it bad to use decryption there?


Encryption enforces privacy. In a world with no privacy vulnerable people are easily abused by people in positions of authority. Also note that the legal system is not a perfect mapping to human morality - things that are are legal are not always moral and things that are moral are not always legal. Hence it is dangerous to have a world where right and wrong is determined only by an all-powerful legal system.

In my opinion it is important for society to maintain the privacy that humans have experienced for thousands of years. Remember that mass surveillance of every conversation that you have ever had is new thing. Before the internet society had much more privacy. Encryption is a way to ensure privacy in the internet era.


I'm getting the sneaking suspicion that you want to decrypt the device of your spouse/partner. Is that your intent?

I'm taking your speech and applying my own context to it. Precisely what would happen to someone whose private communications are laid bare in a court of law, or indeed, to anyone.


Civil cases are, by definition, not dealing with crimes. They're typically dealing with contractual obligations, or agreements of mutual and fair performance by two parties. If one was a good husband/wife in every respect, and occasionally got their libido raised by flirting with someone online, are they a bad person?

Or, as the saying goes, "it doesn't matter where you get your appetite as long as you eat at home." If the racy conversations are a result of unhappiness in a relationship, it's a symptom and not a cause. If it were medicine, we'd aim to treat the cause in order to mitigate the symptoms, not punish the symptoms by making the patient parade them for the world to see.


I'm not saying it is a crime, I'm asking if decryption would help to clear the case then why is a bad thing?


Not at all. Because your premise, based on there being a "case", is flawed. In many jurisdictions, infidelity doesn't matter in divorce. And in criminal matters, at least here in the US, there's that pesky fifth amendment right to contend with.


>In many jurisdictions, infidelity doesn't matter in divorce

In witch judiriction infidelity is no motive for divorce, I don't know any, and if that is the case? what about those judirictions where it is? why is a bad thing using decryption there?


In most, where divorces are "no fault".

Friend, if you suspect someone has cheated on you, HN isn't the place to go for validation. Talk to your partner.


You commit several crimes a day, just like the rest of us. Do you want them to use this law to fight those crimes?


> The justification for the decryption requirement in the bill, as has become the norm, is the threat of criminals or terrorists using encrypted devices for nefarious deeds.

meanwhile terrorists just roll their own encryption software, making regular citizens less secure than them.

http://www.defenseone.com/technology/2016/01/isis-now-has-ne...


All the eavesdropping is completely dumb, even the less technical of all terrorists can just change a word for another and all your billion dollar security goes to the dump. Example: when they talked personally they agreed girl=bomb

Their texts will look like:

- my girl is not with me, I left her at discowild

- nothing happened mate, no idea why?

- relax fam, ask mike to present you another girl, he is partyng next to dominoes. We getting wasted today tho, no bs

And now is completely impossible to differentiate that conversation from all the other 10 billions texts that happen at any Saturday night.


Of course, statistics and metadata analysis still help to crack these.


Most recent reposts that I saw showed that metadata had not lead to stopping terrorism.


Ready for Rockabye baby, from Goldfinger https://www.youtube.com/watch?v=VrUm0KY8dJA


You don't realise they don't want to be able to actually decrypt the texts, what they want is to frame you (or whoever they want) as a suspect just because you use some encryption software.


Or, you know, use none at all. [0]

This is extremely obviously a power grab at controlling normal, law-abiding citizens. "Terrorists" are the new "paedophiles" - a sad excuse to remove the privacy and rights of ordinary citizens while being able to ask whether you support terrorism (or paedophiles) if you stand against it.

[0] https://theintercept.com/2015/11/18/signs-point-to-unencrypt...


I agree. It has the same no-win smell to it as the question, "when did you stop beating your wife? Just the date please."


If you outlaw guns, only outlaws will have guns.


Won't happen, vendors just won't be able to sell in NY, so residents will have to buy elsewhere. And when the NY 1% can't buy their iPhone because Apple protects their privacy, I think any such law wouldn't last long.


And of course, criminals will certainly only purchase/steal device compliant with the law, because, you know, they want to obey the law.

And they won't install any apps or use any other means to hide their illegal goods/communications.

Just like the ones with violent felonies/intending to commit violent felonies will only lawfully acquire guns to commit violent felonies.

Can someone explain please what I'm not seeing? I give you our politicians are sometimes not the smartest, but it doesn't take even an average IQ to see the logical failure here. That being the case, these elected officials must know that this won't solve the problem.

So what is their ulterior motive in spending so much time chasing after a law that will do very little to stop real crime? Just so they can look like they're doing 'something?'


I want the bill to pass for this reason. I want to see how the courts interpret it. Just how much pull should local jurisdictions be able to exert on a corporation's business practices? Say the major vendors just decide to pull out of the NY market, yanking devices off of shelves. How exactly does NY think they can enforce the law?


Schadenfreude fan, huh? The courts will likely treat it the way they have wiretapping. That is, unless a skilled defense shows that unfunded and indefinitely key escrowing is impractical or unfair somehow, which is probably hard to do seeing as Apple used to offer a key escrow service (opt-in) on OS X's FileVault 2, and Microsoft offers one (opt-out after they have the key escrowed) still today.

This is what China wants, so if Apple isn't going to stop selling in China on principled grounds, then why would they stop selling in NY or anywhere else that decides to go down this path?

As for enforcement, every state has its own rules for merchants. NY State has the business license and if you don't follow their laws they can withdraw the license and now the company can't sell product in the state.

The thing that irks me is this transparently targets average Joe User and below average crook. Because only those two groups will end up with either weaker encryption (breakable encryption, including backdoors) or keys being escrowed. Anyone who understands this, including the above average crook and far worse, will just get some other product that uses escrow-free strong encryption that isn't subject to that state or that country's laws.


More likely "immediately worse present for a better future". It just seems that humans rarely learn unless they experience a painful failure (and sometimes a multiple ones are required) and get some reminders by the scars left. This, of course, doesn't work if worst is introduced gradually (it's how we got where we are) - only acute cases work.

The idea is, governments would never cease their attempts just because there are some objections and counterpoints. But after a grand fuck-up they won't dare to try it - and if they do they'll be told "you want another New York, eh?" and that will work.


I'm not a lawyer or an expert on the commerce clause, etc.

But is seems like these issues have passed muster before. Consider that California has stricter environmental regulations concerning the cars that are sold there than many other states. The manufacturers simply make cars that meet the California standard and sell them pretty much everywhere (at least I'm pretty sure that use the be the case, haven't kept up with it though).

If that local regulation has passed any and all legal tests, then I would be surprised if New York couldn't act independently in this case. And I think the manufacturers would simply do something similar: you'd end up with compromised security on all devices that come under the law even in states where that law didn't exist.


I buy equipment all the time that is not legal for sale in California.

But I don't go out of my way to do such. With the emissions argument, lower emissions is generally accepted as a positive feature, though some may dislike the reduced performance or increased cost associated with it in some instances.

Backdoored encryption is not something generally accepted as a positive feature, and I suspect many people will specifically seek out non-backdoored devices if the law is passed and manufacturers start making devices for the lowest common denominator.

But since this is a software feature, I see no reason why a single device couldn't serve both markets, with a fused bit somewhere permanently enabling the backdoor.

But, as said previously ad nauseam, the law would stop criminals about as effectively as the anti-radar detector laws keeps radar detectors out of Virginia.

The widespread use of instant-on radar and LIDAR has done far more to curb the widespread use of them, in all states, by simply making them ineffective.


Many people would seek out such devices... but many people can still be a small minority of your target market. If the economics makes sense to have two different builds they'll do it, if it doesn't then you'll get one size fits all. Also, consider how many people that buy these devices also use cloud services available for these devices where even fourth amendment protections are likely null/void. In some ways/shapes/forms it makes the device encryption backdoor already moot for many.


Yes...I'm curious to see how 'things stored in the cloud' will eventually work out with the 4th/5th amendment protections.

Seems most of the current law applies to them as electronic communications, but I think they are becoming more and more like a safe deposit box, which I think has fared a bit better. It's unfortunate that it will likely take a few guinea pigs with a lot of money and the right type of case to force the judicial system to work this out.

Of course, the prudent criminal would encrypt anything, using non-backdoored encryption, before it left his/her control thus making LEO/Government access to their cloud storage ineffective.


> The manufacturers simply make cars that meet the California standard and sell them pretty much everywhere (at least I'm pretty sure that use the be the case, haven't kept up with it though).

Many manufacturers still distinguish cars with "California emissions".


Another example: big name-brand beers have different alcohol percentages in different states.


This sort of thing isn't exactly without precedent. Look at gun laws in CA: there are many types of firearms and firearm accessories which are legal in most of the US but cannot be sold or possessed in California. Gun manufacturers have responded over the years by either pulling out of the state entirely, or producing California compliant versions of their products.


Most people just buy their phones without thinking, and would find this encryption debate a little technical. They probably also think that they won't be personally inconvenienced, and that only criminals would be specifically targeted by the authorities.

I think only an effortful, informed, and motivated individual would buy their phone out-of-state. Plus, I'm pretty sure NY won't be the only place enacting such anti-encryption measures.

Eventually, those who advocate for encryption and privacy will be out of the moral mainstream, and will have a tough PR road ahead of them.


    > Most people just buy their phones without thinking,
    > and would find this encryption debate a little
    > technical. They probably also think that they won't
    > be personally inconvenienced
I don't believe this. Everyone understands they have secrets (affairs, medical conditions, getting high on the side, their xvideos search history). Getting the messaging right is not so hard.

Take the UK "Draft Communications Data Bill". Once it had attracted the nickname "The Snoopers Charter", and you get the gutter press talking about how meddling officials in the local councils will use it check up on if you've been researching council tax banding, public opinion can be made to turn against it very very quickly. The replacement bill they're currently debating is far from perfect, but a lot lot better.

It's our duty, who do understand the technical aspects, to bring them to life for our friends and family. I've mentioned it before, but images like this[0] presented the exceptionally dull topic of net neutrality in a way that normal internet users cared about.

Extrapolate what this will mean in practice, and make stories from it. You get pulled over on a traffic stop, and a cop decides to copy the data off your phone, and finds your messages about buying your 20-year-old son beer. You lose your phone, it gets handed in to the police, and some jobsworthy sergeant decides to flick through, and find saucy photos of your ex-gf and sends them to his buddies. People may not understand encryption, but everyone understands privacy.

[0] http://images.huffingtonpost.com/2010-12-15-net_neutrality_l...


I don't know about what's common in UK politics, but striking down the Draft Communications Data Bill is just going to mean it's going to come back under the Agriculture and Rural Affairs Bill as a subsection for the USA. You stop SOPA and it's coming back under the general defense funding bill.

You vote against that bill and your opponents are going to mention that you obstructed the funding of the armed forces -- and you did. It's just that there was nuance to the event, nuance that always gets lost when the varying disseminators of information go out to organize votes.

That's because you haven't stopped the factors behind the bill. There's a natural bureaucratic motive to being able to control citizens. There are police unions lobbying for this kind of stuff, unions who will make note that you voted against their favor.

Reddit got tired of SOPA and CISPA-esque stuff. They probably couldn't convert the PR injury into actual votes that mattered in the states that matter, so it's just noise anyway.


Rules about Bill titles are meant to (and generally do) prevent riders for the UK Parliament.


Having a parliamentary system (where coalition-building is up front in the formation of a governing majority) rather than a US-style system where coalition-building is more ad hoc around particular bills makes riders less relevant, in the first place.


People buy phones out of state all the time, when they buy them online. I don't think that would be a particularly notable impediment.


When a voter can't go into a phone store / Apple store and buy a shiny new thing: Boom, recall election.

Presumably assemblyman Titone knows this, and is expecting the bill to do nothing other than provide the usual security theatre. That, or he is dumb as a post. Could go either way :-)

I expect to see congressional level legislation like this very soon. That'll be significantly more interesting.


I thought that businesses would simply create a NY-compliant version, just like I'm sure they create many variations of their existing products for compliancy around the globe. I also don't expect this to stay NY-specific. This sounds like something that would be generally desired by many nations.

Customers need not experience inconvenience if this is done right.

There are obvious reasons why the police would actually want this beyond security theater (PR). It actually makes their job easier.


It makes their job far too easy, which is of course precisely the point. It also makes doing things that are not "their job" at all quite easy, which is the other part of the point.


Yes, that's rather obvious. I'm pointing out why kabdib's perspective is mistaken. Kabdib makes it seem like companies and politicians are going to botch this, and that we'll soon see these measures rolled back.

I'm sure companies and politicians know very well that while you might not be able to organize a get-out-to-vote drive for privacy, you can do so for inconvenience. Compliancy with multiple devices is easy and already done.


Don't forget the loss of sales tax. It's a poorly considered way of achieving some poorly considered goals.


This is just politicians pretending to work. Someone's probably using this as a bargaining chip for negotiating their real goals, or to show they're a team player, or pander to their constituency.


Just wait till China, Russia and India get the itch for this. Just one of them have enough market and potential markets no vendors will leave money on the table and give up market share.

It has a good chance of happening in one of those markets if not here and then, it's just a matter of time till many nations demand the same.


Apple came to Russia relatively late (near iPhone 4, I think). People did buy lots of iPhones before that anyway. They would just buy in the USA and have it delivered via post (sometimes unofficial post). And Apple understands that.

I don't have any data on China and India. They might be more lucrative markets due to the size.


I don't think there are official Apple Stores in Russia, just retailers that carry the products. All the stores I see selling Mac stuff are usually under the name re:Store [1] and while they have certainly imp'd the Apple Store look, they very clearly are not Apple. I know they have an online presence for Russians, but the majority of sales either come through these reseller stores or through people buying online from abroad and having someone send the device.

That being said, the number of old ladies I see on the metro with iPhone 6's makes me somewhat envious.

[1] - http://www.re-store.ru


Really? I'm pretty sure that when CA passed the smartphone kill switch law all smartphones got kill switches.


One big difference with that was the phone makers were moving toward kill switches anyway. Apple touted theirs as a feature long before that law was introduced in California.

The main opposition to kill switches came from phone carriers because they make a lot of money selling (1) replacement phones to people whose phones are stolen and (2) theft insurance to people who fear their phones will be stolen, and from some privacy and civil rights groups that (1) misunderstood the bill due to not reading it carefully and/or (2) were basing their opposition on completely ridiculous scenarios [1].

[1] For example, some claimed that police could use the kill switches to quickly and without a warrant shut down all the phones of protestors to stop them from reporting and filming police brutality. That was a ridiculous scenario for several reasons.

First, the kill switch involves sending a targeted command to each specific phone to be killed, so the police would first have to bring in something to identify all the protestor phones. Then they would have to go to the phone maker or the carrier (which depends on how the particular kill switch works for that phone) and get them to send the command. There is no particular reason to believe that the companies would have a procedure for that, so this could be very slow...and there is also no reason to believe it is even possible, because nothing in the law requires that the company can kill the phone without the cooperation of the owner.

By the time they do all this, the protest is likely to be long over.

Furthermore, the law only applies to smartphones. People with feature phones would be free to report and record unfettered, as would people using tablets.

On top of that, the law allows (and as far as I know every implementation implements) the phone owner to turn off kill switch capability, so the "use the kill switch to cover up police brutality" plan only works if none of the protestors are smart enough to turn off the kill switch before joining the protest.

If the police actually, in the real world, were going to try to block protestors from reporting and recording with their phones they would do it by trying to get the cell towers in the area shut down, or by using Stingray-like devices in active mode to intercept and block communications.


> There is no particular reason to believe that the companies would have a procedure for that

This is where you go off the rails. There's little reason to believe that the companies would have a procedure for doing this for the first time, there's a little more reason to believe that they would have a procedure for doing this the second and third times, by the sixth and seventh times they want do do this, it will be surprising that they don't have a procedure, and by the tenth and eleventh times it will be negligent that after all this time, they haven't managed to put a procedure into place.

By the 30th or 40th time, there will be a police issued Android app to send in GPS coordinates and request a radius, and at headquarters, someone will type that into an app running on Windows XP and then click "OK."


Identifying the phones with stingray solves at least one of those problems.


That, or residents who want secure devices will just buy them elsewhere. It's very common now for people to have cellphone accounts from other states.


That or someone actually communicating with others with regard to illegal activities will install non-backdoored encryption software rather whatever came with their device.

The cops will backdoor the phone and decrypt it, only to find a file called "my-awesome-terrorist-plot.doc.aes".


I would be interested to see the cost of losing The Apple Stores in NYC. Some of the highest valued retail that there is from what I remember reading, but I guess real estate in NYC is super valuable in any case.


Turn them in to Tesla-style showrooms, where you can't actually buy a device directly.


I think more of what @CamperBob2 is alluding to will happen to be honest... Unfortunately.


This just shows the ignorance of the bill's author, Assemblyman Matthew Titone. If you live in New York and have the ability to vote for this person's opponent next time he is up for election, you should probably do so. Apple/Google et al are not going to make an insecure "New York Edition" of their operating systems and phones.

Cell dealers in the state would simply not have any phones to sell that comply with the law, and New Yorkers would either go without phones or would buy them from out of state on eBay. I'll let you guess which of those outcomes is most likely. Apple Stores in New York would have to stop carrying the iPhone. Of course none of this will ever happen, because this bill is idiotic and would cause enormous economic damage to the state. But dangerous, ignorant politicians like this should be voted out of office at the earliest opportunity.


The good news is that in New York, this kind of thing needs to be linked to the budget to go anywhere, and this isn't.

The endemic corruption and routine prosecution of NY legislators gives me hope that this thing will go nowhere, because they have something to hide.

The bill is more of a trial balloon.


When are we finally going to get fed up with the government's terrorism crap?


Simple solution don’t sell your products in New York anymore … They can go back to the stone age for all I care … honestly I’m tired of this … They understand by doing something like this they put more people in danger of fraud … Politicians need to get over themselves, they are not gods and just because they can’t as easily snoop on people as they have been since phones were invented they try to one up with this crap. The real Criminals will have strong encryption no matter what. It’s public knowledge and easy to implement and now it’s even easier to build your own phone with working sim … Beaglebone, raspberry phi, mino, etc… This stuff is cheap and you can customize a version of android that would omit this back door very easily … It’s open source. Anyone who is for this and thinks it will actually work on criminals is a complete moron.


I'm wondering - are big cities becoming obsolete? I suppose there is no coincidence that some of the worst anti-privacy stuff is coming from big cities like New York or countries that are totally centered around a big city such as the UK or France. A big city of 10 million seems far more vulnerable to terrorism than 10 cities of 1 million each.

In the past, if you wanted a decent life, you kinda had to live in a big city. Now, however, thanks to the Internet, that is perhaps becoming less the case? The Internet now has a fantastic selection of shops. You'll also find lots of radio stations, music and video streaming online. There are more and more opportunities for remote work.

On the other hand, a city of 10 million has far more restaurants, clubs and social opportunities than a city of 1 million. So I'm not really sure whether big cities are becoming obsolete. Still, I'll be reluctant to move to a big city if it means that I have to give up my privacy. Not saying I'll never make such a move, but the balance of pros and cons seems to be changing.


What does a city have to do with it? I live in semi-rural area and I would be impacted by this law if it were to pass (it's not going to).


Rural areas in jurisdictions that have big cities, such as the UK or the state of New York, will of course be impacted by such laws (if they pass). However, rural areas in other countries/states that don't have big cities are less likely to ever get such laws.


There doesn't seem any comment that considers the pro, so I'll try to raise two points:

* It is possible to ensure that encryption will physically destroy the phone. Preferably it destroys the antenna, the screen, the battery, etc. In that case the law must be pretty sure, you're the bad guy and the use of it as a backdoor becomes limited to people that value your data above the value of your phone.

* If manufacturers have to open up parts of the phone to certain parties, there is a possibility that they have to open up these parts to the consumer as well. It might have on the long term a positive effect on the ability to root your own phone. If the government might own my phone, perhaps I might myself own my phone as well.

Just my two cents!


>becomes limited to people that value your data above the value of your phone.

Pretty sure me and some random mugger are the only people who even care about the value of my phone.

>there is a possibility that they have to open up these parts to the consumer as well.

There is a whole lot of precedent that says this isn't going to happen. Even if manufacturers wanted to do this, I'd expect we'd see laws in turn which gag them so that " the terrorists can't break our backdoors".


These statehouse bills come up regularly. Ignore them. NY has seen a half dozen "must decrypt", "must register" and "must identify" bills come and go. Some lawmaker has dinner with a low-ranking officer at some agency and come away thinking the sky is falling because of some new technology.

The reality is that these statehouse bills are normally trumped (I hate that word now) by federal legislation. Even if not, there are enough people in places like NY that understand that the courts will shred these things. So they never pass. Once the news is over, once the bill proponents have made their peaches, they are quietly disappeared.


I think the most realistic anti-encryption legislation would be to ban a vendor from shipping a device with encryption enabled by default. If they were to provide an api to plug in a third party encryption module, then most people would probably leave the phone in the default settings. Which would return things to the previous status quo -- most devices would be searchable, and only people who new what they were doing (including a subset of "bad" people) would have encrypted devices.

Note: I'm not endorsing this, but I do believe it would satisfy the governments.


I doubt it would satisfy them, if the language of the bill, and the arguments being used thus far, is a valid indication. What they want is the ability to decrypt, and to get that means compelling companies to enduring cryptographic key escrow service, which law enforcement can use a subpoena to have Apple, Google, Microsoft, etc use to turn over plain text.

So far this is "data at rest" request. It's for data on the phone. It's not for data in motion which is another technology that PFS makes rather difficult to impractical to setup key escrowing for, that's sorta the point. But then, the basebands are all proprietary and probably compromised by state (nations) actors.


I feel like the reasons against such laws parallels the gun debates in the US: harsher laws won't effect the crimininal or terrorist, but the avetage citizen.


Another story also previously posted:

https://news.ycombinator.com/item?id=10906636


I think it's only a matter of time until back-doors are (re)added. At some point, Russia, or India, or China, or Europe, or America will come up with some legislation that says "backdoor or GTFO" and a few vendors will decide to adhere, and others will be forced to follow so they don't miss out and that'll be that.


We're gonna finally catch all the bad guys.



"New York" doesn't want anything - it's a state, not a person. This bill was introduced by Assemblyman Matthew Titone - mentioned in the 7th paragraph of the article. Gee whiz I wonder who's paying his election bills?

"The fact is that, although the new software may enhance privacy for some users, it severely hampers law enforcement’s ability to aid victims."

This is actually an argument against privacy itself. Astounding.



Government keeps wanting this sort of thing to help them find "the needle in the haystack" when all it does is make a bigger haystack.


"Never do anything against conscience even if the state demands it." --Einstein


I'm in the UK, with Virgin Media as ISP, and for some reason onthewire.io is blocked. WTF


Is that the "porn blocker", or general censorship?

Andrews & Arnold is pretty much the only uncensored ISP in the uk.


this is how I picture the discussion between politicians and their technical advisers: https://www.youtube.com/watch?v=vh3tuL_DVsE


#NewYorkValues


Great time for Apple to close it's stores in NY and open a few extra in the neighboring states.


This is the outcome Apple must have expected when they announced their encryption policy. They can now claim that they tried to do the right thing -- they would have taken the steps needed to guarantee their users' safety from illegal spying, warrantless surveillance, and unconstitutional gag orders -- but the evil government won't let them.

Pretty smart in retrospect to force the government to play Bad Cop.


Completely disagree. Apple sincerely wants to maintain its current encryption policy. It has substantial business value and improves the quality of their products. There is no evidence whatsoever that Tim Cook goes out and tells lies, as you allege, about major pieces of Apple's technology.

See also:

https://theintercept.com/2016/01/12/apples-tim-cook-lashes-o...


Agreed. No consumer is going to say I want to buy a less secure phone because that is better


No one is going to ask the question that way. "Do you want to buy a less secure phone?" is exactly the same question as, "Do you agree that law enforcement should be able to access a suspected terrorist or pedophile's cell phone conversations and data with an appropriate court order?"

You will get vastly different answers depending on which phrasing you use. That's what the politicians count on.


Where did I allege that he lied? He made a safe promise -- one that he presumably intended to keep if he could, but which, not being an idiot, he must have suspected he wouldn't be allowed to keep.


Even if it is done because they think it's moral, it's still a smart thing to do from a PR standpoint. They get credit for fighting win or lose.


I don't think attributing the sinister motive is necessary, but I do agree that's the ultimate outcome if a national law were passed. A purpose-built device integrated by a centralized company and locked down to end-users is not a defensible place to fight a battle for digital freedom!

It would be interesting seeing how this would play out with an individual state though. Would Apple make a special NY version and advertise loudly that it's defective by design, or would they kowtow to a backwards state government to avoid a legal showdown?


In particular, the commerce clause prevents states from regulating interstate commerce, so anyone can just buy a phone online to work around the problem. Unfortunately, this might have an impact on carrier stores, and many people still get their phones from the carrier. I don't just want technical folks to have security; I want everyone to have security.




Guidelines | FAQ | Lists | API | Security | Legal | Apply to YC | Contact

Search: