Macs frustrate the FBI

[bosrs1]

Some of us get quite a bit of entertainment out of people that think reposts are a fun and exciting way to get banned. 😉

I'm with the people that think it's ok to repost. Frankly no one is going to go hunting for a particular thread if it's not readily available. It takes too much time and effort. And frankly unless you have no life and never leave the board you're bound to find someone who hasn't read it and would like to talk about the issue.

 

[Sun Baked]

I'm with the people that think it's ok to repost. Frankly no one is going to go hunting for a particular thread if it's not readily available. It takes too much time and effort. And frankly unless you have no life and never leave the board you're bound to find someone who hasn't read it and would like to talk about the issue.

I thought I saw you get in trouble yesterday for reposting a couple times. 😛

 

[Applespider]

Reposting when the original thread has been dormant for several months seems fine, even logical, to me. What's the point in bringing it back up since some of the original arguments/technical points may be out of date which means you'll end up with lots of corrections to things that probably were correct at the time they were written. Those who remember it's a repost could put a link to the original discussion for those curious to see if the arguments have changed.

Reposting when there's another thread with the same title on the first page of that forum is a little different though since it takes little effort to scan that first page to see if there's a response. Similarly with technical queries, searching and looking at first page of results to see if there's a match isn't time consuming - and may save you time if the question's been answered in the past.

If your query isn't answered fully though, then starting a new thread that registers you know a similar one has been asked is better than restarting the old one. Many people only read the first post and answer that rather than reading all the comments; your subsequent question becomes an unread comment.

 

[Mitthrawnuruodo]

Apple's filevault, being proprietary, is therefore almost certainly less secure than an open and tested system like PGP/GPG. Guys like Bruce Schneier laugh their ass off when a company shows them their "uncrackable" "secret" encryption routines. Security through obscurity does not work here. The math makes it ridiculously hard to crack, not hiding what's going on. That said, I'm not really up on the literature for Filevault. It could be based on a tested and proven routine with mounds of peer review.

FileVault uses AES, the standard that took over for DES (or 3DES) not too long ago. Should be secure enough. It's proberbly easier to guess passwords (either your login or master password)...

 

[bosrs1]

I thought I saw you get in trouble yesterday for reposting a couple times. 😛

Yep, I was banned too by some newbie mod. A senior mod then unbanned me because of how ridiculous the banning was. Reposting is not a bannable offense, especially if you're not reposting in the same category.

 

[kettle]

FileVault uses AES, the standard that took over for DES (or 3DES) not too long ago. Should be secure enough. It's proberbly easier to guess passwords (either your login or master password)...

There is a feature on the AES when making encrypted .dmg files. - there is a little "i" bottom left when it asks for password and confirmation that reports the security of your chosen password as you type it in. Is this feature on filevault too?

 

[Mitthrawnuruodo]

There is a feature on the AES when making encrypted .dmg files. - there is a little "i" bottom left when it asks for password and confirmation that reports the security of your chosen password as you type it in. Is this feature on filevault too?

Don't think so (it's a long time since I sat my master password)...
...but a random password (not found in ANY dictionary in ANY language) using all large/small letters, some numbers ang maybe some additional signs, with a length of 20 or maybe 30 should keep even the NSA busy for quite a while... 😉

Remember you have to use that long passwords not only as master passwords, but also for all users (including root) to be "safe"...

 

[rainman::|:|]

Erm...wow. The NSA might be a light-year ahead of civilian cryptographers, and they might not. They absolutely refuse to say a single word about it. But the NSA ain't letting the FBI in on the fun.

And I'm willing to bet (and do everytime I use it) that there aren't backdoors to most of the popular encryption schemes (Like PGP and GPG). That's why the FBI and NSA get pissed when citizens encrypt their data. I don't know where you got the "backdoor" idea, but go do some reading on the history of cryptography. Real "strong encryption" has years and years of dedicated peer review behind it and absolutely no "backdoors". Apple's filevault, being proprietary, is therefore almost certainly less secure than an open and tested system like PGP/GPG. Guys like Bruce Schneier laugh their ass off when a company shows them their "uncrackable" "secret" encryption routines. Security through obscurity does not work here. The math makes it ridiculously hard to crack, not hiding what's going on. That said, I'm not really up on the literature for Filevault. It could be based on a tested and proven routine with mounds of peer review.

And then again, the most common weak link is the meat sitting in the chair. Whether it's choosing your own birthday or "password" for your password or being susceptible to "social engineering", it's almost always easier for someone to crack the user than the encryption.

I'm taking this from a blog because I can't find a better source, but I'll keep looking...

Some have hoped for compromise solutions that would allow strong cryptography to be widely used while still enabling the NSA and the FBI to decrypt messages when lawfully authorized to do so. For example, there have been key-escrow proposals that would require users to register their software encryption keys with law-enforcement agencies, and key-recovery proposals that would give government agencies backdoor access to the keys. In a typical key-recovery scheme, an encrypted version of the message encryption key is sent along with each message. An FBI-authorized key-recovery center can use a master backdoor key to decrypt the message key, which is then used to decrypt the message itself.

Speculation is that a number of software developers are voluntarily implementing similar systems... Or simply offering up any cracks they know about, which the public might not. But there have been cases where the FBI appears to have decrypted files that they shouldn't have been able to. Of course as you said, the human element is the weakest and perhaps that's all they're exploiting. Certainly publically the FBI is just beginning to acknowledge that they use viruses and loggers to obtain passwords in some cases...

So I guess my point is, even if it's not happening yet, it will be soon...

Also, it's rubbish to think Filevault is going to be secure for ever. True, with today's technology it would be an unfathomably long time to crack... But with the hardware available in 2010? 2008? Sure, piece of cake. They've made similar claims in the past and they're always shattered by the exponential growth of technology.

 

[Thomas Veil]

Dave also had a great quotation for us: "If you're a bad guy...use a Mac."

Oh, so that explains why Rush Limbaugh and Karl Rove use Macs... 😀

 

[panphage]

So I guess my point is, even if it's not happening yet, it will be soon...

Ah, yes, the old "key-escrow" thing. That's been around as long as "amateur" cryptography (amateur meaning not NSA). And everyone in the crypto community has rejected it as ludicrous. Or course, companies aren't really in the crypto community so maybe they will try to build in backdoors. But I don't think real cryptographers would, it goes against their principles. And being scientists, what the NSA and FBI want hopefully won't be foremost in their thinking. Hopefully. 😉

 

[Mechcozmo]

I'm with the people that think it's ok to repost. Frankly no one is going to go hunting for a particular thread if it's not readily available. It takes too much time and effort. And frankly unless you have no life and never leave the board you're bound to find someone who hasn't read it and would like to talk about the issue.

It just clutters up the boards, that's why the mods don't like reposts. And its against the FAQs/Rules so thats a major reason why they don't like it either. And don't make fun of us who can't leave the boards... it isn't OUR fault that we only exist on the internet and choose to live here... what is life anyway?

 

[Mechcozmo]

Don't think so (it's a long time since I sat my master password)...
...but a random password (not found in ANY dictionary in ANY language) using all large/small letters, some numbers ang maybe some additional signs, with a length of 20 or maybe 30 should keep even the NSA busy for quite a while... 😉

Remember you have to use that long passwords not only as master passwords, but also for all users (including root) to be "safe"...

Also, you should wear tin foil (NOT Aluminum foil, doesn't work) and live in a bomb shelter to be extra safe. But what you said was good, too. That is, if you don't work for the government... maybe you are trying to trick us? 😱

 

[SiliconAddict]

Actually I would just plain piss the hell out of the FBI. My Thinkpad had a built in encryption subsystem that supports on the fly 128-bit encryption of the local hard drive that also integrates into the OS at a pretty low level. ( There is a reason why the gov uses IBM after all. ) Since there is a subsystem dedicated to encrypting and decrypting the disk there is virtually no strain on the CPU and overall system performance still flys. Apple isn't the only one in the industry who can innovate. 😛

 

[Sun Baked]

Also, you should wear tin foil (NOT Aluminum foil, doesn't work) and live in a bomb shelter to be extra safe. But what you said was good, too. That is, if you don't work for the government... maybe you are trying to trick us? 😱

And you'll be in big trouble if they stuffed the transmitter up your south end instead of putting it in your teeth.

 

[cb911]

great article, hadn't seen that before.

and good work Apple. 😉 😀

 

[Mitthrawnuruodo]

Also, you should wear tin foil (NOT Aluminum foil, doesn't work) and live in a bomb shelter to be extra safe. But what you said was good, too. That is, if you don't work for the government... maybe you are trying to trick us? 😱

D*mn, you got me. Now I have to take down that Norwegian proxy and set it up somewhere else...

Don't worry, the big black vans, gathering in front of your house right now is nothing to worry about...

😛

 

[dsharits]

That's awesome. So, essentially, even the government hates Windows. Nice.

 

[Mechcozmo]

And you'll be in big trouble if they stuffed the transmitter up your south end instead of putting it in your teeth.

Why do you think I crap in a hole that I dig myself? 😛

D*mn, you got me. Now I have to take down that Norwegian proxy and set it up somewhere else...

Don't worry, the big black vans, gathering in front of your house right now is nothing to worry about...

😛

Good to know.... ~checks outside~
~Grabs PowerBook, A/C adapter, and emergency government-is-coming-to-kill me kit, decides to drop it and instead grabs the government-is-coming-to-hurt-me-badly kit and then runs~