QuoteThe FBI is secretly breaking the encryption that secures our cell phones and laptops from identity thieves, hackers, and abusive governments, and it refuses to even acknowledge that it has information about these efforts — even though some details have been filed publicly in federal court. We're suing to get some answers.

Between our emails, text messages, location information, social media activity, and more, our cell phones hold almost our entire lives. In recent years, governments have stepped up efforts to gain access to the information on our cell phones and personal computers. The federal government has been pressuring companies to build encryption backdoors that would severely undermine our digital privacy and security, and both federal and state governments have regularly paid third-party vendors to break into people's encrypted devices.

https://www.aclu.org/news/privacy-technology/the-fbi-is-secretly-breaking-into-encrypted-devices-were-suing/

Stuff like this just confuses people:
a. they're talking about 'cell phone encryption' aka does not exist. 
b. You cannot 'break the encryption" unless you brute force.  Clearly they are referring to arrangements with Apple/Microsoft/Google to provide access to the private keys.
c. If you are using Signal, or Wickr for your encryption, do you alone possess your private key?
Or are you arbitrarily trusting some company to ALSO have access to your private key?


Criticism aside, go ACLU!  Brazen move.

Not sure if this is misplaced, but from my standpoint it seems like you are denying that the government is spying on us.
I'm not implying that you are against the clandestine chemist crew, but this post seems kind of odd.

Meh. Who am I to say anything?

Quote from: ketosis on December 27, 2020, 03:57:56 AM
Stuff like this just confuses people:
a. they're talking about 'cell phone encryption' aka does not exist. 
b. You cannot 'break the encryption" unless you brute force.  Clearly they are referring to arrangements with Apple/Microsoft/Google to provide access to the private keys.
c. If you are using Signal, or Wickr for your encryption, do you alone possess your private key?
Or are you arbitrarily trusting some company to ALSO have access to your private key?


Criticism aside, go ACLU!  Brazen move.

I agree that it is pretty vague but I attribute that to the nature of how limited ACLU's hunch is, hence the FOIA requests..

As for cell-phone encryption not existing, you have to be more specific. The cell network protocols do indeed have encryption baked into them, that's plain to see in the publicly available protocols for this type of stuff. That's how infosec researchers were able to uncover flaws in 2G and 3G and confirm their suspicions about IMSI catchers and the like. So yes, they could in fact break 'cell phone encryption' if that's the part of the pipeline you're talking about.

There are so many layers to the technology where encryption exists and a nefarious actor could attempt to break it.

I think ACLU is doing the right thing here despite a lack of evidence to prove their point. The FBI has a terrible track record for this, so for ACLU to sound the alarm bell at this stage in the game and remind people (which they often need reminding!) about their devices being vulnerable to attack from nation state actors, I think its the right thing to do.

Quote
c. If you are using Signal, or Wickr for your encryption, do you alone possess your private key?

Who/what is "you" in this instance? It is certainly not "your person," it's something on the device, maybe the OS. Ownership is a very murky concept in the digital world, we're still figuring this shit out as we go and tech companies and the government rely on this ambiguity and naivety to overstate risks and draft in draconian powers into law. It may sound like I'm splitting hairs and getting all armchair academic on it but this I believe is where the rubber really meets the road with these sorts of cases.

If the FBI is breaking into its own citizen's private devices - presuming for now that what is stored on the device is considered owned by you the phone owner/holder - then that it patently, morally reprehensible.

Meanwhile, what's the EFF's take on this? They're far more radical when it comes to internet censorship and freedoms. I wonder what they have to say about it.

https://www.eff.org/deeplinks/2019/07/doj-and-fbi-show-no-signs-correcting-past-untruths-their-new-attacks-encryption

Quit giving them the benefit of the doubt, they are untrustworthy.

If they want to know, they DO know, TOR cant stop them. Heads out of the sand, kids....

Any of your best chances are to stay off their radar in the first place.

Also, it is helpful to remember, they are playing the long game.

Ask yourselves where this is all going....

Quote from: aes256 on December 27, 2020, 05:55:55 AM

Quote from: ketosis on December 27, 2020, 03:57:56 AM
Stuff like this just confuses people:
a. they're talking about 'cell phone encryption' aka does not exist. 
b. You cannot 'break the encryption" unless you brute force.  Clearly they are referring to arrangements with Apple/Microsoft/Google to provide access to the private keys.
c. If you are using Signal, or Wickr for your encryption, do you alone possess your private key?
Or are you arbitrarily trusting some company to ALSO have access to your private key?


Criticism aside, go ACLU!  Brazen move.

I agree that it is pretty vague but I attribute that to the nature of how limited ACLU's hunch is, hence the FOIA requests..

As for cell-phone encryption not existing, you have to be more specific. The cell network protocols do indeed have encryption baked into them, that's plain to see in the publicly available protocols for this type of stuff. That's how infosec researchers were able to uncover flaws in 2G and 3G and confirm their suspicions about IMSI catchers and the like. So yes, they could in fact break 'cell phone encryption' if that's the part of the pipeline you're talking about.

There are so many layers to the technology where encryption exists and a nefarious actor could attempt to break it.

I think ACLU is doing the right thing here despite a lack of evidence to prove their point. The FBI has a terrible track record for this, so for ACLU to sound the alarm bell at this stage in the game and remind people (which they often need reminding!) about their devices being vulnerable to attack from nation state actors, I think its the right thing to do.

Quote
c. If you are using Signal, or Wickr for your encryption, do you alone possess your private key?

Who/what is "you" in this instance? It is certainly not "your person," it's something on the device, maybe the OS. Ownership is a very murky concept in the digital world, we're still figuring this shit out as we go and tech companies and the government rely on this ambiguity and naivety to overstate risks and draft in draconian powers into law. It may sound like I'm splitting hairs and getting all armchair academic on it but this I believe is where the rubber really meets the road with these sorts of cases.

If the FBI is breaking into its own citizen's private devices - presuming for now that what is stored on the device is considered owned by you the phone owner/holder - then that it patently, morally reprehensible.

Meanwhile, what's the EFF's take on this? They're far more radical when it comes to internet censorship and freedoms. I wonder what they have to say about it.

What I mean to say is that, using the word 'break' is misleading.
Properly used, i'm sure, one with such a username would agree(great encryption protocol developed by the NSA), would mean brute force.  Anything short of brute force would be some sort of 'Social Engineering', even up to and including spreading malware such as Stuxnet.

So my point, is the opposite, of how Johnathen Ferris interprets it.  The article makes it sound as if it would be possible for the FBI to simply 'break' an encrypted conversation, at their own whim.  Thus, we have only the ACLU to protect us .

Your nitpickery, AES, is called for indeed.  e.g.   There is a physical 'me', and then there is Google's isomorphic model of 'me', which of course is used only for better contextualized advertising.

But just like if you hand some random little kid a Liter of Sulfuric Acid and say "do some science stuff", if one does not understand how these things work, indeed one is as helpless and hopeless as Spice suggests.

But hand that same sulfuric acid to a skilled chemist, and they will use it to derive a variety of other acids, do some nifty organic oxidation reactions like make diethyl ether from ethanol.
That, to me, is the equivalent of keeping an air-gapped, linux environment, where all the software is built form its source code, and verified.  And all networking passes through a TOR proxie just for starters.  Now if I have my private key on such a device, and I know what I'm doing (recall the little kid with the acid analogy), then I really can do just fine even without the ACLU calling the FBI naughty for being the 3rd american agency, late for the party, after NSA and CIA, in hoping to brag of their signals intelligence.
Capiche, amigos?


TL;DR:(non-technical)  We as living beings are complaining about our 'rulers' breaking their own rules, and spying on us despite our windows being wide open and unobstructed.  And then we turn to the same archaic mindset , to those very same rulers, and complain?  Humanity needs to put on its big boy pants, and focus on honing their own anonymity methods, instead of crying that our governments are hypocrites.