UK Government Wants a Backdoor Into Windows 598
A user writes "The BBC is reporting that the British Government is working with Microsoft in order to gain backdoor access to hard drives encrypted by the forthcoming Windows Vista file system. Professor Anderson, professor of security engineering at Cambridge University, urged the Government to contact Microsoft over fears that evidence could be lost by suspects claiming to have forgotten their encryption key."
China & PGP (Score:5, Informative)
Oh, and there are a few people who also consider encryption a matter of freedom of speech [wikipedia.org].
Funny the U.S. government targets Phil Zimmermann [philzimmermann.com] for three years but hardly raises so much as an eye when an encryption enabled OS is distributed. From Mr. Zimmermann's homepage: I think that his "criminal activity" was creating an encryption tool that allowed messages to be encrypted beyond what the United States government was capable of deciphering in a timely manner. Does anyone know if this is still enforced? Does anyone know what the max key length is now if it is? I think it was something like 128 bits (that the government could crack) around the time of PGP.
Re:China & PGP (Score:5, Insightful)
Re:China & PGP (Score:4, Interesting)
Re:China & PGP (Score:3, Insightful)
Backdoor code (Score:5, Funny)
Up-Up-Dn-Dn-Lt-Rt-Lt-Rt-A-B-A-B-Ctrl-Enter
Re:Backdoor code (Score:4, Funny)
-Coach-
Re:Backdoor code (Score:4, Funny)
i'm old too...
Re:Backdoor code (Score:3, Informative)
"fee fie foe foo" gets your money back from the troll.
King George's Backdoor code (Score:3, Funny)
If president Jr. get to pick it, I'll bet it is 1-2-3-4-5.
Re:King George's Backdoor code (Score:3, Funny)
Osama is mostly just an asshole (Score:3, Interesting)
Maybe his long term goal is Muslim rule (though I'm not conviced he's anything more than a power hungry madman who's merely using Islam) but his short term goals generally revolve around hurting/killing people and the general undermining of societies he doesn't like.
He doesn't like our way of life, with our quasi-democracy and capitalism and relative tolerance of different faiths. And every time we change our way of life, every time we give up one of our rights in the name of "fighting terrorism" we are
Re:China & PGP (Score:3, Insightful)
Frankly I think it sounds insane.
Think of the number of people who work at Microsoft, even if you limit yourself to the people working upon the OS and not Office, etc, you're talking about literally hundreds of people who can view the source.
Then there are the people who gain access to the source code under educational licenses, NDAs, etc.
The idea that all of them could miss something that was a backdoor is a lit
Re:China & PGP (Score:3, Insightful)
Sure, but at the same time, such a 'backdoor' does not necessaraly need be a huge part of the code base. There could very well be a very small, controlled group working on that specific piece of code and no one else ever needs to see it in order to write their own part of the code. You don't have hundreds of people looking at ALL the code, you have hundreds of people looking at hundreds of pieces of the code.
Interesting Points (Score:4, Insightful)
This bring up an interesting point on ITAR and the US. Some encryption technologies could violate ITAR if they are done in the US and then exported to other countries. If I remember right, that was part of the reason encryption on OpenBSD was done in Canada.
Oh, and there are a few people who also consider encryption a matter of freedom of speech.
Some would, but how many governements and what is protected under the law. That is different everywhere. Others, also, consider it a privilege.
Some of these laws, in paticualr with the US, are actually there to protect it from other countries. Many people in the country may not want to protect the countires competitive edge but others do and that is part of what our government has been taked with for a long time.
Re:Interesting Points (Score:3, Informative)
Read about it here: http://www.openbsd.org/crypto.html [openbsd.org]
From the link:
"The cryptographic software components which we use currently were written in Argentina, Australia, Canada, Germany, Greece, Norway, and Sweden."
"When we create OpenBSD releases or snapshots we build our release binaries in free countries to assure that the sources and binaries we provide to users are free of tainting."
And a summary of Canada's expor
Re:China & PGP (Score:3, Informative)
Re:China & PGP (Score:3, Funny)
At the time I got it, it was fairly geek-chic, but now it's just outdated
Re:China & PGP (Score:5, Informative)
Not anymore, they have at last relaxed their restrictions, but they still did for a while - remember Debian nonus mirrors? The weak SSL in versions of IE4 shipped outside the US? OpenSSH having to be developed in Europe? The fact that you still have to download a separate file to get unlimited strength crypto in Java? And officially speaking you still have to notify the US government you're distributing strong encryption.
I think that his "criminal activity" was creating an encryption tool that allowed messages to be encrypted beyond what the United States government was capable of deciphering in a timely manner.
He was charged with exporting the munition - the problem wasn't so much that he'd created said encryption tool as that he'd put it on an ftp where $NASTY_REGIME could get it.
Does anyone know if this is still enforced?
As I said, officially speaking you have to notify the US government if you are exporting strong crypto from the US, and I think you're not allowed to directly export to anyone on their list of bad guys. In practice I don't think they care any more, crypto is so widely available.
Does anyone know what the max key length is now if it is? I think it was something like 128 bits (that the government could crack) around the time of PGP.
You weren't allowed to export more than 40, and AFAIK that hasn't changed.
Re:China & PGP (Score:3, Informative)
This information can be found from the Bureau of Export Administration's regulations [gpo.gov], in particular, the Commerce Control List (CCL), 15 C.F.R. 774 [gpo.gov]. The alphabetical index lists "encryption software" as deisgnation "5D002", and the numerical index places 5D002 under "Information Security - Software". A hop over to that section [gpo.gov] says the following:
Re:China & PGP (Score:3, Informative)
Re:China & PGP (Score:4, Interesting)
It'll be interesting to watch this play out. I'm sure any resolution will disappear deep within the inner pages of the paper, if it is discussed at all.
Re:China & PGP (Score:3)
Truecrypt (Score:5, Informative)
We have alternatives.
http://www.truecrypt.org/ [truecrypt.org]
If you are caught having... (Score:4, Insightful)
Oh wait, I forgot... civilized Western nations never commit torture upon their subjects.
Re:If you are caught having... (Score:3, Funny)
Dude, that idea is SOOOOO 20 years ago.
Get with the times man!
Re:If you are caught having... (Score:3, Funny)
Plausible deniability ... and continued access (Score:5, Interesting)
If terrorists or an oppressive government take your computer and hard drives away, anyone who depends on that data is very much out of luck.
For this reason, local encrypted filestores and plausible deniability are only part of the puzzle. Quite a lot more is required, in particular cryptographic online distribution.
A comprehensive solution will need to use a large population of fixed size raw dataspaces spread across the net, instead of local disks. Quite likely, it would be stored steganographically 1:<large-N>:1 so that (for example) changing webcam images could be used as repositories. And it will need cryptographically-random access for site selection and dataspace selection and to individual bits in the dataspaces. And it'll need huge redundancy since the online storage will be inherently unreliable, yet without laying the scheme open to pretty simple differential cryptoanalysis.
That's a very tall order.
Private Disk (Score:4, Interesting)
Institutions such as NIST test the implementations of the algorithms, then the program either gets certified or not.
The problem is that without certification, we do not know whether what they've implemented is what they think they've implemented*.
The point is that they might use some obscure algorithm nobody knows - which has no guaranteed strength; thus one cannot rely on it. They can also implement standard algorithms such as AES or DES - but were they correctly implemented?
Sure - "why don't you take the sources and look at them yourself?" some might say, but is everybody competent enough to do that?
On the other hand, implementing something and then certifying it, means that:
[a] it was done right
[b] it is as strong as the standard says
In the case of encryption, the strength is in the key itself and in the mathematical basis of the algorithm, NOT in the obscurity of the mechanisms applied within the software.
One minor thing - NIST certification is expensive, I doubt TrueCrypt will pass it, unless some company pays for this. Commercial encryption software is a different thing, if they want to be treated seriously, they must go for it. An example is Private Disk [dekart.com].
* an old saying:
Re:Private Disk (Score:4, Insightful)
But they don't (invalid point).
> They can also implement standard algorithms such as AES
Which they did.
> but were they correctly implemented?
Yes. Ever heard of test vectors? It's easy to verify if a cipher is correctly implemented using official test vector sets.
> One minor thing - NIST certification is expensive, I doubt TrueCrypt will pass it, unless some company pays for this.
Now, I bet you are the developer or seller of the commercial encryption software you mentioned. Your message basically is: "Look, without money they are worse than us. Commercial stuff is better. Free software sucks." You are just a troll.
The most important point is, however, that being open source is a _premise_ of any security software that is to be trusted by general public. Closed source security is not real security.
Re:Private Disk (Score:3, Informative)
It sounds like you haven't done that much research on Truecrypt. It uses industry standard algorithms like Blowfish, Twofish and AES.
For relying that a piece of software does what it says, you have to rely on Peer review.
I understand what your saying and how for business use
Re:Private Disk (Score:3, Informative)
Let's try this one more time, closer to how it actually works:
Lots of people come up with crypto ideas - DES in the US, Rijendael in the EU, GOST in Russia. If this a conspiracy, it's a pretty damn wide one. These are published standards, with reference implementations, test vectors and the works. Crypto analyzers from all over the world are whacking away at them, and if you can find a way
Re:Plausible deniability ... nice! not really! (Score:3, Informative)
The algorithm does in fact provide plausible deniability.
Why? (Score:2, Interesting)
Re:Why? (Score:3, Interesting)
You would be surprised how dim some crooks can be, like thinking that swallowing a sim card will destroy the data. Or even snapping it in two - might break the bond pad connections, but not the die. Easy to fix.
Re:Why? (Score:5, Insightful)
Laziness, ignorance; the same that prevents them from using encryption now.
Re:Why? (Score:4, Insightful)
The problem UK govt is having and US govt will have the moment they realise what is going on is that any media files on Vista PCs when distributed correctly via the supplied Vista Windows Media frameworks will be immediately encrypted and locked down using the TPM module to the specific machine. On top of that this will be determined by the people who distribute the files, not the users. This makes the current approach of taking disks out and hooking them to a forensic environment unfeasible. They will have to be decrypted on the machine after the user has logged in. It is sufficient for the user to refuse to log in on the machine and the police is stuffed.
As a result any attempt to collect proof of child pr0n and b00tleg movies/music will run into some serious difficulties as long as the providers of illegal goods have done their job of using Windows Vista right.
Frankly, the UK govt should whinge elsewhere. MPAA and the TP group is a good start. Whinging at MSFT is not going to get them anywhere because it will be not just MSFT, it will be everyone implementing this on every device in 5 years time.
Re:Why? (Score:3, Interesting)
Re:Why? (Score:3, Informative)
Even if the password is recoverable they will still have to go through a considerably more complex forensic exercise.
I am saying if, because TPM can allow any OS (be it Vista, be it Linux with TPM) to lock down access to any data (and even booting) based on a combination of machine keys and credentials. I can bet that this will be used massively in corporate
Re:Why? (Score:3, Informative)
Nothing, but in the UK it is an offence to refuse to pass encryption keys to the Police if you are requested to do so.
This TCP idea doesn't give users access to the keys, so it falls outside of the Regulation of Investigatory Powers Act - hence the supposed need for a backdoor into the encryption system.
Now we just have to wait for the media companies, that lobbied for TCP in the first place, to deman
The irony here is beautiful (Score:3, Interesting)
And so, inevitably, the Powers That Be(TM) competing to dominate the lives of the Minions(TM) come into conflict.
If the governments get their way, there will be no true encryption permitted, because otherwise they can't spy on people.
If there is no true encryption, there is no point whatsoever to having the TPM, the entire DRM
Re:Why? (Score:3, Insightful)
It is a mistake to attribute stupidity to either terrorists or criminals. When the DEA monitors traffic from offshore drug traffickers, almost all of the traffic is encrypted. Even emails to girlfriends. The DEA characterized drug traffickers as highly sophisticated and disciplined users of encryption technology.
If you actually believe that terrorists are stupid (instead of tragically misguided), then you're seriously underestimating their ability to
Suggestion (Score:3, Funny)
IE (Score:4, Funny)
Backdoor action? (Score:3, Funny)
Pfff (Score:4, Insightful)
Re:Pfff (Score:5, Interesting)
In the end, the bad guys will use real encryption and the backdoor won' effect them. It will only serve as a security risk for legitimate users.
-Eric
Re:Pfff (Score:3, Insightful)
They don't need to tell the court the exact methodology they used, only "We seized his hard drive, examined it, and found this." It's not like the judge is going to respond with "Did you use an encryption backdoor scheme built into Windows?"
Personally, I don't believe the backdoors exist.
I used to think the same thing about wholesale NSA fishing of emails and phone calls too.
What is MS getting from the gov
Re:Pfff (Score:3, Insightful)
How many GITMO prisoners have had a fair and just criminal trial?
Re:Pfff (Score:2)
Doesn't seem likely. IIRC, its the law in Britain that you have to turn over your encryption key if lawfully ordered to. Even if you feed them keys for a RubberHose-type system of deniable encryption, I'm sure they'll detain you until it turns up something good. Law enforcement wouldn't buy that a sophisticated encryption system like that was set up solely for keeping c
Re:Pfff (Score:5, Interesting)
For each level there are two passwords, one which will unlock it as normal, and another which will unlock it, and also begin a routine which will start securely erasing the third level data, then the second level, and then the first level + OS, and maybe trigger a lump of thermite sitting on top of the RAM for good measure. Or maybe it would be better just to get rid of the third level silently, so that it's as if it never existed. That's probably healthier, on second thought.
So that after you provide a good show of resisting giving out the password, you hand over the 'distress' one and let them have fun getting through the first level of junk data, while at the same time the system is slowly eating away at the stuff you really don't want, down on the third level.
You could even set it up so that the mal-effects caused by the distress passwords increase as you move through the levels of security. The distress password on the first level of security just starts the "silent erase" mechanism. The distress password on the second level speeds it up at the cost of less subtlety (because obviously they're getting closer to the actual data, so you need it gone faster). The distress password on the third level physically destroys the system in some sort of obvious (but quick) fashion. That way you're almost guaranteed not to compromise the data, but you also don't have to necessarily compromise yourself, unless they're really close to getting the stuff.
What is the point of filesystem encryption? (Score:2, Interesting)
About the only thing windows encryption seems to be able to do is prevent you from recovering your files if your PC ever dies.
Whats the point?
Obviously you have never used real encryption (Score:5, Insightful)
After logging in, the files are accessable. But not before. Someone who just swipes your PC would boot into Windows but would be unable to read any data files, even with a seperate boot CD. That's the whole idea.
But if the government adds a backdoor, you can bet that a hacker (white or black hat) would find it as well, probably within a few weeks of the OS being out. Thus making the encryption useless.
The whole government complaint is useless anyway because for all they know people can be using deniable encryptionn schemes *today* and they'd never even know about it.
Like all such tools, security depends on usage (Score:3, Interesting)
Having needed to break into someone's system to recover encrypted files, I can say it's not that simple.
Windows NTFS encryption is certificate based. For installs done by anyone not a professional paranoid, the user has access to the file recovery certificate, and the domain administrator may have access to a file recovery certificate valid domain-wide. To use a certificate stored
Re:What is the point of filesystem encryption? (Score:5, Funny)
No, it's stored on the PostIt note on the monitor.
Re:What is the point of filesystem encryption? (Score:5, Interesting)
Because all the sectors on my hard drive are encrypted on the fly. When you read it directly in other computer all you get is nearly random gibberish. There's not even a proper filesystem on it. Only after you mount it giving my long and convoluted passphrase the OS decrypts the sectors on the fly, so you can read the files. Switch the power off, reboot my machine or unmount the partition and there is no way to access my data again.
Is that easier to grok?
Robert
Keyloggers (Score:5, Interesting)
http://www.epic.org/crypto/scarfo.html [epic.org]
That's US v. Scarfo; basically a mobster was using PGP to encrypt his communications and rather than breaking the encryption the hard way, the investigators got a warrant to install a keylogger. I'm not sure exactly how they did it, but I'm pretty certain that it was a hardware device implanted in the keyboard, rather than software. (The warrant they got was pretty much a blanket thing, approval for 'hardware, software, and firmware as necessary...') However they didn't divulge the exact methodology in the trial, because they successfully claimed an exemption under the Classified Information Procedures Act.
They just need to wait... (Score:5, Insightful)
Let's be fair... (Score:4, Insightful)
Heil Clarke (Score:2, Insightful)
Eh? (Score:3, Funny)
Why don't they just use one of the hundreds of backdoors that everyone else uses? Seems to me M$ are already complying with this request several times over.
That's the point of encryption isn't it? (Score:3, Insightful)
When did a healthy mis-trust of government suddenly get you tin-foil hat status, and a visit from the FBI?
The day after the big attack (Score:4, Insightful)
In the US, 12 September 2001.
In the UK, 8 July 2005.
You get the idea.
After a major terrorist act, the population is angry, not rational. Many are personally affected by the attacks. Thoughts of proportionate responses and civil liberties are overwhelmed by fear and grief.
This is, of course, the ideal time for a government to try to increase its own power at the expense of the people it should represent. This goes double for governments with only a tenuous hold on power, as is usually the case in the US because of its two-party politics, or for governments whose very mandate is dubious, as is the case of Blair's UK government (which didn't actually win the popular vote in England, and has often relied on the votes of Scottish MPs to push through controversial legislation to which their own constituents will be immune because the Scottish Parliament will decide for them separately).
Hence it is precisely in the wake of a terrorist atrocity that we should be keenest to protect our civil liberties, for it is at these times that they will naturally come under the gravest threat.
What about the RIP bill? (Score:5, Insightful)
Re:What about the RIP bill? (Score:3, Insightful)
Ah, but according to the article you the user don't actually have access to the key - it's inside a chip. Quoth:
The system uses BitLocker Drive Encryption through a chip called TPM (Trusted Platform Module) in the computer's motherboard.
It is partly aimed at preventing people from downloading unlicensed films or media.
"This means that by default your hard disk is encrypted by using a key that you cannot physically get
Re:What about the RIP bill? (Score:3, Insightful)
According to 49(5)(a), the max punishment for not disclosing your key is two years. Compare that to whatever the max punishment is for having kiddie porn on your PC, or plotting to assassinate the PM/Queen/visiting dignitary or whatever. Two years is likely going to be far less, and you'll end up with a much cleaner slate afterwards. Having to tell people "I was put in jail for standing up for privacy rights" sounds a lot better than "convicted s
Re:What about the RIP bill? (Score:3, Insightful)
What is the maximum punishment for doing nothing wrong, and simply forgetting a password? TWO YEARS
That's right - two years might seem a lot less than the punishment for kiddy porn, or whatever, but it's a hell of a lot more than anyone should be imprisioned for without any evidenc
Re: Anybody know of a system that works like that? (Score:3, Informative)
Marutukku [wikipedia.org], pronounced rubberhose. [wiretapped.net]. (or is it rubberhose, pronounced maru tukku? I forget...)
Any politically active programmers out there want to take a crack at maintaining it?
Not "lost" (Score:5, Interesting)
Contempt of court (Score:4, Interesting)
Re:Contempt of court (Score:4, Interesting)
It's kind of silly to think that an average user with no incriminating evidence encrypted is going to be randomly ordered to turn over a password, and thrown in jail for legitimately forgetting it. It's a disturbing thought that the law, as written, could lead to that, but it's not a compelling argument against using encryption if you're not a criminal.
Using this sort of hypothetical scenario to argue against routine use of encryption is a bit like arguing against keeping sharp knives in your kitchen, because you're afraid the police might claim you stabbed someone with one of them and cleverly removed all forensic evidence of the stabbing from the knife.
Great! (Score:5, Insightful)
Re:Great! (Score:3, Insightful)
I don't - seeing as we're talking about TPM/"Trusted Computing" - the hardware level DRM system that only benefits Microsoft, Apple, RIAA, MPAA et al. A backdoor into TPM would break the fancy new DRM that's coming with Vista. Why would Microsoft build back doors into something that's suppossed to protect them ?
Inevitable (Score:3, Insightful)
What's the point when you have RIP? (Score:5, Informative)
The government has the RIP Act [wikipedia.org] (Regulation of Investigatory Powers Act 2000) which allows them to detain you, with a press gagging order if you refuse to hand over the encryption key they need to decrypt your data. If you refuse or claim you have forgotton and they don't believe you, then it's two years in gaol for you sonny jim.
They only really got this into law because most people don't understand it. Oh and don't forget that since this government came to power the amount of time they can hold you, uncharged, under the terrorism act has gone from 7 to 28 days... and the police want 90! Yes ninety days, 3 months, 2160 hours!
Re:What's the point when you have RIP? (Score:3, Insightful)
I'm not saying I like the idea of MS actually intentionally putting a back door in their OS, what with all the ones that are in it by accident. But I can see them trying to justify it. After all, depending on what you're likely to get busted for, two years locked up may be a cakewalk to what you'd get if they could get your data.
Of course this will only help catch stupid criminals. At le
Re:What's the point when you have RIP? (Score:3, Insightful)
keyloggers (Score:5, Interesting)
As usual, the wrong solution to the problem (Score:3, Interesting)
Everyone else* will have a computer with a guaranteed back door, which I am willing to bet will be open to hackers on about Day 3 after Vista's launch.
* - Well, everyone else who's not running Linux, of course.
Don't attribute.... (Score:3, Interesting)
Trusted computing? HAH (Score:3, Insightful)
since when... (Score:5, Insightful)
Re:since when... (Score:3, Insightful)
"Forgetting" your key is an offense (Score:3, Informative)
Time to switch! (Score:4, Interesting)
Re:Time to switch! (Score:3, Insightful)
Where will it end? (Score:4, Informative)
I recall some years ago, someone found supposedly secret NSA backdoor keys buried in Windows98. I don't recall if it was actually proven, but I would not be surprised if the NSA already has backdoor keys in 98/ME/XP and now Vista. Now the British Government wants their turn. Where will it end? Once MS bows to the British, surely other governments will also demand backdoor keys. Who decides which of those governments get it?
Sooner or later, other organisations (like the RIAA and the MPAA) will also want their keys too (if they don't already have them thanks to their DRM chips). Where will MS draw the line? I highly doubt MS would be very open about how many different governments or other organisations really have backdoor keys.
It is easy for us to say that we'll never use it, or that there are other options out there, but I'm more worried for less computer savvy members of the public who think they are buying a secure system. I know most of those users will never use encryption, but this will set another precident that will further erode all of our rights.
Re:Where will it end? (Score:3, Insightful)
Why use the back door...? (Score:5, Insightful)
Sorry, cheap jibe.
This is amazing - especially when the idea is being promoted by a 'Professor of Security Engineering' at a reputable university. How can adding a backdoor to security systems be anything other than a massive weakness just waiting to be exploited?
Imagine if this went ahead - the British government would want access to versions of Windows sold in this country, the American government to US copies of Windows, the German government ... and so on and so on... Would Microsoft allow the Chinese government access to their citizens' disks? The Chinese government are signed-up members of The War Against Terror - so they could claim they need access, and besides recent experience says that big businesses will always accommodate governments no matter how repressive.
And it gets worse. Microsoft would either have to make a single key that would open every machine in the World; or they would have to issue copies of all the keys to every government - the British government won't accept not being allowed into a suspected terrorist's (and we have a splendidly wide definition of 'terrorist' in this country) computer purely because the suspect happens to be foreign.
But it will all supposedly remain secure and not fall into the hands of wrong-doers.
The Home Office, IT and Microsoft - what an unholy trinity we have there. With this level of stupidity the legislation can't be far off.
Encrypts your whole hard drive by default? (Score:3, Insightful)
The system uses BitLocker Drive Encryption through a chip called TPM (Trusted Platform Module) in the computer's motherboard.
It is partly aimed at preventing people from downloading unlicensed films or media.
"This means that by default your hard disk is encrypted by using a key that you cannot physically get at...
The government shouldn't be the only folks horrified at this one. MS wants to turn your entire computer against you, encrypting all of its contents and allowing you to read it only if MS wants to allow it. Even if you're okay with that, imagine if something in the scheme goes wrong? I've used the Windows Encrypting File System in XP, and if you lose your encryption key (not that hard--say, if you reformat your hard drive) you are permanently locked out of all the data you've encrypted.
If this is true, MS really wants a death grip on your computer. I'd never use Vista under those circumstances.
This is fantastic news to hear. (Score:3, Interesting)
The pleasant result of all this is that it dispells the whiff of paranoid conspiracy-theory. The government has been advised to ask for the backdoor access. By a british Cambridge expert. There is every reason to think Microsoft will agree.
There is now simple historical evidence to point the public to. Previously there were more technical , less convincing ones.
The average person is not going to care if Microsoft accidentally included some debugging code in a patch. Even if that made it look like it had a backdoor key. "Whatever that means?", they'll say.
A BBC news article about an expert asking for such a backdoor is a lot more convincing.
Comment removed (Score:3, Funny)
Digitial Evidence IS NOT (Score:4, Insightful)
As more and more traditional forms of evidence (audio tapes, photos, DNA records, VOTES for god sakes) become digitized, the more we need to be skeptical of them.
And don't bring up digital signatures so long as keyloggers exist.
I don't trust the MS Encryption anyways (Score:3, Informative)
USA & 5th amendment (Score:5, Interesting)
The summary states that this black hole is desirable for "fears that evidence could be lost by suspects claiming to have forgotten their encryption key", but why would a suspect have to say they lost their encryption key? Why not just plead the 5th?
The 5th amendment states: "No person shall [...] nor shall be compelled in any criminal case to be a witness against himself [...]"
I honestly do not believe that the contents of a person's hard drive falls into the same category of evidence as eye witnesses or DNA. A personal computer's hard drive, particularly one with an encrypted file system, is effectively an extension of that person's memory and hence any data extracted from it seems very much like testifying against oneself.
Oppression by the Police State (Score:3, Insightful)
Unfortunately, some in the U.S. want that here. I hope the red states can save us.
Well..... (Score:3, Funny)
Makes a change, Tony Blair's been making his back door available to Bill Gates since he came to power.
Lotus Notes was 'compromised' thus long ago (Score:3, Informative)
oh please, yes please (Score:4, Interesting)
oh please, yes please. switch on encryption that uses TPM. then all it takes is a virus to overwrite the TPM keys in the BIOS memory and that's it - game over: your entire hard drive rendered useless. mwhahahahah
Decide for yourself (Score:3, Interesting)
He also has some really interesting papers on there. (Check out the "Cocaine Auction Protocol" and "Programming Satan's Computer" -- the first is a methodology for creating an un-mediated auction house, the latter is about programming on untrusted networks.)
Of course, to each his own.
Here's the link:
h [cam.ac.uk]
Re:This sounds like misreporting to me (Score:5, Insightful)
If you are an opponent of TCG / TPM / DRM it is really quite beautiful. As far as I can see it is something like:
"Hey Mr. Government Committee, while you're asking me about terrorist suspects you might want to note that this new TPM / DRM stuff coming real soon from MS/**AA now will make it virtually impossible for you to get info off suspects' PCs. Oh, and the PCs are setup that way by default so no chance of using that fact against suspect. Also, you know that law you fought so hard for where you can jail people for not handing over encryption keys ? - well with this new stuff the key's in hardware and the suspect never has it. If you're worried by this, then maybe you should speak to these guys about crippling the tech..."
Aim big nasty government machine at big nasty corporate machine, stand well back...
Sweet.