Anti-Surveillance Coalition That Includes Apple Condemns Proposals for Device Backdoors

MacRumors

macrumors bot
Original poster
Apr 12, 2001
49,133
10,476



The Reform Government Surveillance coalition, which includes several major tech companies who have teamed up to lobby for surveillance law reform, this week released a statement condemning recent proposals for backdoor access into electronic devices and reaffirming a commitment to strong encryption.

The coalition is made up of multiple tech companies who have taken a strong stance against weakening encryption, including Apple, Google, Microsoft, Dropbox, Snap, Evernote, LinkedIn, Oath (owned by Verizon) and Facebook.
Reform Government Surveillance recently announced a new core principle on encryption that will guide our advocacy efforts, and we continue to believe that strong encryption helps protect the security and privacy of individuals and companies around the world. We have consistently raised concerns about proposals that would undermine encryption of devices and services by requiring so-called "exceptional access" for law enforcement. Recent reports have described new proposals to engineer vulnerabilities into devices and services - but they appear to suffer from the same technical and design concerns that security researchers have identified for years. Weakening the security and privacy that encryption helps provide is not the answer.
As ZDNet points out, the statement comes following a WIRED article profiling Microsoft chief technical Ray Ozzie and his suggestion for a solution called "Clear" that would supposedly provide law enforcement with access to encrypted data with less security risk.

Ozzie's proposal uses a public key and a private key (housed and protected by a company like Apple) that are used to encrypt and decrypt a PIN generated on the device. No one is meant to be able to decode and use the PIN to unlock the device aside from the vendor, using the aforementioned private key.
So, say the FBI needs the contents of an iPhone. First the Feds have to actually get the device and the proper court authorization to access the information it contains--Ozzie's system does not allow the authorities to remotely snatch information. With the phone in its possession, they could then access, through the lock screen, the encrypted PIN and send it to Apple.

Armed with that information, Apple would send highly trusted employees into the vault where they could use the private key to unlock the PIN. Apple could then send that no-longer-secret PIN back to the government, who can use it to unlock the device.
Ozzie demonstrated his "Clear" solution to representatives from tech companies that included Apple, Google and Facebook, according to WIRED, but unsurprisingly, none of them had "any interest whatsoever" in voluntarily implementing that kind of access into their devices and services.

The coalition Apple is a part of in April published a core principle pledging to ensure device security through strong encryption and calling on governments to avoid taking actions that would require companies to "create any security vulnerabilities in their produces and services."
Strong encryption of devices and services protects the sensitive data of our users - including individuals, corporations, and governments. Strong encryption also promotes free expression and the free flow of information around the world. Requiring technology companies to engineer vulnerabilities into their products and services would undermine the security and privacy of our users, as well as the world's information technology infrastructure. Governments should avoid any action that would require companies to create any security vulnerabilities in their products and services.
The renewed activity from the Reform Government Surveillance group follows reports that have suggested law enforcement officials are quietly revisiting proposals that would require tech companies to add backdoor access into electronic devices for use by law enforcement officials.

FBI and DOJ officials have been meeting with security researchers with the aim of developing approaches that would offer "extraordinary access" to encrypted devices like the iPhone, with DOJ officials reportedly "convinced" there is a way to create a backdoor without weakening a device's defense against hacking.

Apple software engineering chief Craig Federighi recently said that this kind of backdoor access would "inject new and dangerous weaknesses into product security."

"Weakening security makes no sense when you consider that customers rely on our products to keep their personal information safe, run their businesses or even manage vital infrastructure like power grids and transportation systems," Federighi said.

Apple vehemently opposes backdoor solutions like the one Ozzie proposed because they have the potential to weaken device encryption and provide new ways for bad actors to access device data.

Apple's strong stance against weakened device protections for the sake of law enforcement access was highlighted in the 2016 Apple vs. FBI conflict that saw Apple refuse to create a backdoor access solution to allow the FBI to crack the iPhone 5c owned by San Bernardino shooter Syed Farook.

GrayKey iPhone unlocking box via MalwareBytes

Without device backdoors, law enforcement officials have still found ways to crack devices like iPhones through other means. At the current time, for example, agencies like the FBI and DOJ have access to an iPhone unlocking box called GrayKey, which is capable of unlocking Apple's most recent iPhones running modern versions of iOS.

Note: Due to the political nature of the discussion regarding this topic, the discussion thread is located in our Politics, Religion, Social Issues forum. All forum members and site visitors are welcome to read and follow the thread, but posting is limited to forum members with at least 100 posts.

Article Link: Anti-Surveillance Coalition That Includes Apple Condemns Proposals for Device Backdoors
 

litmag01

macrumors regular
Jul 16, 2009
248
90
Silly! Privacy is for chumps. Where there is a will and money the will always be a way. Right now, the US Government is the wealthiest entity on the globe.
 

nt5672

macrumors 68020
Jun 30, 2007
2,027
4,413
Weakening security is dumb.
Its actually pretty smart if you are a government that want to be in control of everything, think Venezuela, etc. In fact it is so important that history has shown it is one of the very first things done by dictators/rulers/kings when they take over over.

Reading sealed notes being sent from the castle was important. They did not have smart phones, but the strategy is the same. Dictators cannot exist when the people have secret communications.

Ever wonder why America is as fixated on this as China and Russia? Government transparency and personal privacy are both anathema to the ruling elite in all countries. If we don't fight for both, then we will have no freedoms. Our American Founding Fathers knew this.
 

madKIR

macrumors 6502a
Feb 2, 2010
849
801
NYC
1984 much lol
They’re talking about having these PIN codes stored somewhere, “highly trusted employee” will have access to it. Jeez! It sounds hilarious! It all would be hacked and/or sold by those “highly trusted employees” in a blink of an eye!
 

78Bandit

macrumors 6502a
Jun 13, 2009
660
1,190
This is the Clipper Chip from back in the 1990's all over again. It didn't work then and it won't work now.

I'm sure requests to access the backdoor keys will be shrouded in secrecy like FISA requests currently are. Nobody will ever know how often police are allowed to crack open devices and use that information to identify a path to other evidence they will say was independently obtained.

Any backdoor is bad policy from a privacy or a technical standpoint.
 

now i see it

macrumors 603
Jan 2, 2002
5,368
10,872
That GrayKey password cracking box is tiny. Looks like a Mac mini. As I recall, it can crack a 6 digit password in a few days. Who needs a back door?
In case anyone chimes in saying to use a 10 digit passcode with Touch ID or face Id disabled- just try using your phone for a day with an alphanumeric 10 digit passcode. I guarantee you'll want to throw your iPhone in the trash. Too much trouble.
 

chucker23n1

macrumors 601
Dec 7, 2014
4,152
5,294
That GrayKey password cracking box is tiny. Looks like a Mac mini. As I recall, it can crack a 6 digit password in a few days. Who needs a back door?
In case anyone chimes in saying to use a 10 digit passcode with Touch ID or face Id disabled- just try using your phone for a day with an alphanumeric 10 digit passcode. I guarantee you'll want to throw your iPhone in the trash. Too much trouble.
Six digits in a few days, but seven digits in about a month. So that’s plenty.

As for longer passwords: mine is 11 characters. I have to type it a few times a day; other than that, I use Touch ID.
 

vladi

macrumors 6502a
Jan 30, 2010
532
218
What a bunch of bollocks. Try running encrypted communication service based in US and you will see it yourself that whole backdoor policy is already very well implemented. Just ask Lavabit guy.
 

Rhonindk

macrumors 601
While Ray Ozzie's thoughts may have some merit (may have) overall I fail to see why companies would want to implement this. It places the ownership in the event of a failure or leak of keys on these companies. Then you start thinking about a remote option (NSA / Nation States) or OEM's that reside in foreign countries.

Backdoors that are absolutely safe and cannot be misused? Don't see that happening anytime soon.
 
  • Like
Reactions: DoctorTech
Register on MacRumors! This sidebar will go away, and you'll see fewer ads.