Backdoors: The Road to Hell is Paved with Them

FrgMstr

FrgMstr

Just Plain Mean
Staff member
2FA
Joined
May 18, 1997
Messages
58,553
I was watching FBI Director James Comey talk last week on TV during his Congressional hearing, and he revealed that almost 50% of its current investigations were in some way hampered by encrypted devices.

First six months of this fiscal year, FBI examiners were presented with over 6,000 devices for which we have a lawful authority search warrant or court order to open and 46 percent of those cases we could not open those devices with any technique. That means half of the devices that we encounter in terrorism cases, in counterintelligence cases, in gang cases, in child pornography cases, cannot be opened with any technique. That is a big problem. And so the shadow continues to fall.
Click to expand...

Orrin Hatch went on to suggest that back doors could be inserted into these devices without compromising our privacy as users.

Now I remain convinced that such back doors can be created without seriously compromising the — the security of encrypted devices.

The [H]News Crew and I keep an open channel for IMs, and this was my first reaction to that, albeit somewhat sanitized: "Effin Orrin Hatch on TV saying that back doors can be created for phones without any impact on security. WOW. Should not be allowed in the Senate once you break the 80 year old barrier." Now while this is of course full of vitriol, it does point out that some folks in our government think that back doors into encrypted devices are not that big of a deal, but I would expect that most of us have a bit different point of view.

DARKReading has a good writeup on why exactly these types of back doors are simply not a good idea.

Good guys will be vulnerable. That's because hackers will ultimately breach backdoors. Mandated backdoors will make law-abiding individuals less secure because the potential for hackers to get the keys to these backdoors will compromise everyone's information. These risks are not just theoretical; backdoors have been breached many times.

LET'S KEEP THIS DISCUSSION ABOUT TECHNOLOGY AND NOT ABOUT POLITICS PLEASE.
 
"Orrin Hatch went on to suggest that back doors could be inserted into these devices without compromising our privacy as users."

That's pretty much an oxymoron, no backdoor is guarenteed to be hidden forever, be it technological (someone finding it) or human related (someone leaking the existence of such backdoor).
 
In the good ole days countries made their own technology or they didn't have any. With everything now outsourced by many different countries no one really knows what the others are exactly doing. None of us 'normal' citizens who don't have a job with some 3 letter agency (foreign or domestic) have any clue what goes on behind hidden doors.

Corporations have elevated themselves to government status and hence have their own 'private' doors that also are hidden from 'normal' citizens.

Throw in the advertising agencies and we are left as just pickings for the all the powers that be. We are left tossing around fake news because we are all getting played by someone.

Maybe we need to start certifying our hardware via X-ray and public documentation that violates all patent and trademark law. I am sure that will go over well.
 
This is what happens when the lawmakers are at the age where operating a TV remote is difficult. They simply don't understand the technology and don't understand how allowing one person in through the backdoor means it could be open for anyone. At some point they almost need a group of people under 50 to become responsible for technology related decision making.
 
First off, I hate the idea of backdoors and readily admit that it's a shitty idea for privacy and security. They'll be compromised, and people will get screwed over in a variety of ways from them. There are no ways to implement these without significant risk.

That said, at some point, this is going to be reality and people in the industry need to start planning ahead. Governments will not passively accept the proposition that you can commit a crime and as long as all documentation (or at least enough to cross the beyond-reasonable-doubt line) exists on an encrypted system they can't touch you. We've all seen the "for the children" and "OMG terrorism" cases that touch on this get floated around. So far, the phones and data have been secondary and convictions have come through from normal evidence sources. However, in the future there will almost certainly be a case that doesn't have enough physical evidence to run with that causes enough public outcry that these backdoors become a mandated "feature." It's also possible that as more and more of our data and communications become insulated from law enforcement that the sheer mass of untraceable information tips the scales instead of some single case doing so.

Again, not saying backdoors are a good idea (they aren't), but that government will not indefinitely accept the proposition that citizens can put evidence beyond the reach of a subpoena by using encryption.
 
If they legislate back doors, the US will never sell tech outside of our borders again. The rest of the world will find alternatives that the US can't spy on. That would massively decimate our best companies.
 
The same backdoor can plant evidence where it would not be otherwise. I would kindly like to tell these politicians to go fuck themselves with a rusty baseball bat. Usually they frown when I say such things to them.

Backdoors are a bad idea and it's a lazy excuse for not finding a better way to stop a problem.
 
Yes, because an 83-year old man who was ALREADY retirement age by the time the IT industry boomed is someone we should listen to about software engineering.

Yeah. NO. The only reason the guy uses a computer at all is because he has a support staff to talk his senile ass through things.

And while his advisors may give him good advice in other areas, if they're telling him this is possible or a Good Thing, they're ignorant beyond belief.

CAN this be done? Sure!
Should it? OH HELL NO! Not in a billion millennia!

This is the equivalent of building a screen door in a below-grade foundation (without an accompanying stairwell).

Sure. Only the people who SHOULD use it are likely to get at it.

But one good rain and that foundation and everything on that lower level are ruined.

Back doors simply aren't intelligent. So they cannot discern between legitimate uses and illegitimate.
They simply go "Oh! I expected that behavior! Here's access!" If it's a government agent, that's already bad enough. But if it's Boris McHackinov, YOU ARE FUCKED!

And anyone who talks about "securing" a back door is an imbecile. See "not intelligent".
And if an access method can be locked down, it destroys the point of having a back door in the first place.

Can we PLEASE purge our government of these idiotic dinosaurs? They have no business making laws regarding technology newer than a typewriter, because they simply lack the faculties to wrap their heads around the realities of any tech born after about 1990.
 
There are other types of investigation, fact finding, evidence gathering vice plowing through electronic devices on fishing expeditions. FBI before the new age of modern devices was able to investigate and prosecute very effectively.

Just like virtually anyone could go out find a dope dealer and buy what you want yet the police ignore or just don't know how to do that, to find and put away the dope dealers selling to kids even. Same for pedophiles, they can go out and get child pornography, even encrypted I take it yet the FBI can't? Can't trace the source? Obtain evidence and put away the people promoting it and actually making it? BS.

A back door is an open door to unknown people who can and will rob you. It is just plain lazy or lazy thinking to force everyone to have their doors unlock so that the police can easily can come right in. Problem is the police will come in when they probably shouldn't and worst is those that will harm you will also since you have no barrier now.

What will then happen is a black market of sorts for protected communications which would make things even worst not for the government but for us too.
 
Hrmm... take a basketball. Punch a hole in the side. Glue that hole shut.

What do you want to bet, when that ball goes flat, its going to leak right at that hole?
 
Last edited:
While I agree that back-doors are a terrible idea, I have a problem with so much focus going towards the "but haxorz will gain access" aspect. Back-doors are bad for lots of reasons, let's not distract people from the reality that they are WAY more likely to be "hacked" by their own shitty passwords, their tendency to reuse said shitty passwords across devices and websites, or the websites they use storing password hashes using MD5 or sha-1. I'm betting way more people will be "hacked" by someone calling up a company that has their info and gaining access through social engineering than will be hacked through a backdoor. But how many people are going bananas about the cavalier attitude companies take towards educating employees and users about phishing / vishing attacks?
 
Having a backdoor embedded into your tech is literally the same thing to privacy as walking around in only assless chaps. The breeze may feel nice but it's all in the public view. Very concerned that people think that because electrons runs through it that technology devices are somehow different than fences or clothing or *safes*. All of these standard archaic tech are in fact basic low level security devices and in the later are difficult to crack (Origin of the word btw). People expect privacy the same way the expect their clothes to keep their nether regions protected and hidden from people they don't want preying.
 
capt_cope said:
While I agree that back-doors are a terrible idea, I have a problem with so much focus going towards the "but haxorz will gain access" aspect. Back-doors are bad for lots of reasons, let's not distract people from the reality that they are WAY more likely to be "hacked" by their own shitty passwords, their tendency to reuse said shitty passwords across devices and websites, or the websites they use storing password hashes using MD5 or sha-1. I'm betting way more people will be "hacked" by someone calling up a company that has their info and gaining access through social engineering than will be hacked through a backdoor. But how many people are going bananas about the cavalier attitude companies take towards educating employees and users about phishing / vishing attacks?
Click to expand...
Woosh. You just stated the number one flaw in all backdoors without even realizing it. Bad passwords. Think each and every device is going to use one time unique PK with a distributed non centralized key management policy or that the feds will just use one password for all devices that once broken CAN'T BE FIXED REMOTELY. technology with backdoors makes it insanely easy to breach because you only need to compromise one device and boom you have the keys to the castle not just the one thing you wanted to break into. With password based protection utilized by citizens themselves the surface area for attack becomes insanely large as each device meets the requirement of have a decentralized authentication network namely each customer. You break one device you only gain access to one or anything with that password. backdoors are basically tech evil in all ways.
 
JosiahBradley said:
Woosh. You just stated the number one flaw in all backdoors without even realizing it. Bad passwords. Think each and every device is going to use one time unique PK with a distributed non centralized key management policy or that the feds will just use one password for all devices that once broken CAN'T BE FIXED REMOTELY. technology with backdoors makes it insanely easy to breach because you only need to compromise one device and boom you have the keys to the castle not just the one thing you wanted to break into. With password based protection utilized by citizens themselves the surface area for attack becomes insanely large as each device meets the requirement of have a decentralized authentication network namely each customer. You break one device you only gain access to one or anything with that password. backdoors are basically tech evil in all ways.
Click to expand...
I'm not disagreeing with you at all, I just wish people would focus more attention on basic security. Sure a backdoor that's cracked makes it insanely easy to breach tons of systems, but it's already insanely easy to gain access to people's data — backdoor or not. It feels like no one pays attention to current vulnerabilities because all anyone can talk about is the latest spectacular security threat that's on the horizon. I mean seriously, people are still using word and excel macros to gain access to systems. To use the ass-less chaps analogy, it's like people who have been walking around with their pants around their ankles are getting upset when they realize the pants around their ankles are actually ass-less chaps. Whether they're ass-less or not doesn't make all that much of a difference.
 
I think the only REASONABLE answer would be something along the lines of anytime there is an encryption, a log must be created and updated consistently that outside of the encrypted data. The only problem is what they expect to be in the Log, etc...

How does that sound? Don't get me wrong, I'm not in favor of anything - but it would be way better than a backdoor that can be exploited.
 
Keep the conversation out of politics? Well... that stinks. There isn't much technological to be said, it's factual that backdoors are terrible for security. The problem is, humans. Enter, politics.
 
capt_cope said:
While I agree that back-doors are a terrible idea, I have a problem with so much focus going towards the "but haxorz will gain access" aspect. Back-doors are bad for lots of reasons, let's not distract people from the reality that they are WAY more likely to be "hacked" by their own shitty passwords, their tendency to reuse said shitty passwords across devices and websites, or the websites they use storing password hashes using MD5 or sha-1. I'm betting way more people will be "hacked" by someone calling up a company that has their info and gaining access through social engineering than will be hacked through a backdoor. But how many people are going bananas about the cavalier attitude companies take towards educating employees and users about phishing / vishing attacks?
Click to expand...

Until that backdoor gets exposed. Then, the password's don't matter. It will get exposed, it's just a matter of time. "Haxors" gaining access is the first step, and not the one I'm scared of. The one I am scared of is when it becomes trivial using "script kiddie tools". Doing things manually is hard. Hacking using Ophcrack, Metasploit, other premade tools is extremely easy and doesn't require any l33t skills whatsoever. That's when that backdoor becomes a huge deal. Password? If it's faster to crack using a tool than it is to try a few passwords, then it's fucked.

That, and I don't trust government agencies to be able to implement this well.
 
I'm sure our current search and seizure protections, as well as chain of evidence rules, Miranda rules, etc. also make it more difficult for law enforcement to do their jobs. Too bad. Freedom isn't free people, and one of the costs is the reality that criminals will commit crimes, and many times get away with it. If you want total security, then go somewhere that has a police state. I'm really getting tired of law enforcement complaining that strong encryption allows criminals to evade them. Too bad they can't legally beat confessions of of people either (/sarc for the sarcasm impaired).
 
PaulP said:
I'm sure our current search and seizure protections, as well as chain of evidence rules, Miranda rules, etc. also make it more difficult for law enforcement to do their jobs. Too bad. Freedom isn't free people, and one of the costs is the reality that criminals will commit crimes, and many times get away with it. If you want total security, then go somewhere that has a police state. I'm really getting tired of law enforcement complaining that strong encryption allows criminals to evade them. Too bad they can't legally beat confessions of of people either (/sarc for the sarcasm impaired).
Click to expand...

I agree with your points, but you can't blame law enforcement for complaining. Their job is to catch bad guys. When they can't do it because of these rules, they catch hell from their own bosses, the media, and the public. They're just trying to do the best they can, and the rules they operate under with this stuff makes it much, much harder. It's not an easy problem by any means.
 
PaulP said:
I'm sure our current search and seizure protections, as well as chain of evidence rules, Miranda rules, etc. also make it more difficult for law enforcement to do their jobs. Too bad. Freedom isn't free people, and one of the costs is the reality that criminals will commit crimes, and many times get away with it. If you want total security, then go somewhere that has a police state. I'm really getting tired of law enforcement complaining that strong encryption allows criminals to evade them. Too bad they can't legally beat confessions of of people either (/sarc for the sarcasm impaired).
Click to expand...

If we took away all the rules, we could have near zero crime. Search every house, car, phone - anytime. Monitor all communications. Remove weapons for any reason. I like rules that hamper some things. Yes, there is crime because of it. But, changing the rules makes it seem like "We want to break the law, but we can't. So, let's change the rules so it's legal...". It's for our safety... wait - It's for the KIDS safety, right? If you're against this, you hate children. :D

I am 100% with you. And I'm fine with the trade off.
 
Last edited:
Bounty said:
That 50% number seems like pure spin. Every investigation that's ran into encryption gets stuck open and adds to the number of 'current investigations.' While most investigation that doesn't involve encryption is quickly processed and closed. Therefore the total cases they've worked on this year may only have 1% of cases hampered by encryption while 50% of currently open cases are hampered by encryption.
Click to expand...
Well, I am sure you know better than James Comey testifying under oath, but as noted, this thread is about TECHNOLOGY. Please get back on topic.
 
Do it. Sign it into law, make it official. It could weaken the US tech giants big time, right? What if it gives them even more power. We seem to be way past the point where society gives a fuck about such things. The things Snowden revealed through the Guardian didn't change much on the surface.
 
Paladin21 said:
Governments will not passively accept the proposition that you can commit a crime and as long as all documentation (or at least enough to cross the beyond-reasonable-doubt line) exists on an encrypted system they can't touch you. <snip> However, in the future there will almost certainly be a case that doesn't have enough physical evidence...
Click to expand...
What crimes exist solely in the digital domain?
 
The comment should be 54% of their case investigations are enabled by little/no encryption.

And if you put in backdoors, people who know they are up to no good, will protect themselves (firewalls, 3rd party firmware, Private VPNs, backdoor-less encryption). Much like gun control, this is meant for the law abiding. Maybe poorly planned crimes of passion at best.
 
HammerSandwich said:
What crimes exist solely in the digital domain?
Click to expand...

There are all sorts of digital-only crime available these days such as bank fraud, identity theft, and so on. If you commit one of these offenses and all your communications and work are on an encrypted system, it could be exceptionally hard to get any non-circumstantial evidence against the individual. That said, there's no reason that a crime has to be purely digital for encryption to make a conviction exceptionally hard for police. Many crimes and their sentences rely on the state of mind of the person committing them. For example, the difference between murder and manslaughter is planning. If the police suspect you meant to "accidentally" kill someone, but all records that might relate to that are on an encrypted computer, it would be extremely difficult if not impossible for them to bring a murder charge. Many other crimes have sliding scales of severity in a similar fashion.

I am, again, not advocating for this. I don't want this. I'm just pointing out that if you think the public can just say "Privacy!" and get the government to go away indefinitely, I think you are very wrong. While the technology people will tell the government that this is a solution that won't work, do you think they'll listen? Something like 90% of the population thinks the FCC getting rid of Net Neutrality is a shit idea and it's full speed ahead on that train anyway. Same with wanting to be able to make backup copies of your own music/movies. And on, and on. The government makes laws to support the government, not the public; that's not politics and it doesn't matter what party you're talking about.
 
You must log in or register to reply here.
Back
Top