News for hackers. Stuff that matters.
Re:California Governor Signs Law Requiring a ‘Kill Switch’ o... by tzs on Tuesday August 26, 2014 @04:14AM (#8226153)
You need to determine how to send the message to the phone. Flipping the kill switch on an iPhone will require talking to Apple, for instance, whereas I'm pretty sure you would not talk to Apple to flip the kill switch on a Samsung phone. There will be at a minimum three different mechanisms you'd have to deal with (Apple, Google if they build this into Android and all Android phone makers and carriers leave it in place instead of replacing it with their own version, and Microsoft). There could be dozens if Android phone makers go their own way, or if the phone carriers customize the firmware to replace the kill switch from the hardware maker or Google with their own.

There is no requirement that an API be provided to law enforcement. That "sendmessage" method could come down to someone on the law enforcement side getting on the phone with Apple or Google or Microsoft or a service provider and telling them the numbers to kill.

This is assuming that Apple or Google or whoever even can flip the kill switch without the assistance of the phone's authorized user. They could easily design the kill switch system so that the person flipping the switch has to know the authorized user's password [1]. There is nothing in the bill that I see that says they have to design the kill mechanism to allow law enforcement or the manufacturer or the carrier to be able to use it.

[1] For instance, the phone could ask for your iCloud or Google account information when you set up the kill switch for the first time, and then it could store on the phone a hash of the concatenation of your password and the phone serial number. The kill switch mechanism could require that the kill command include that hash, thus proving to the phone that the sender had access to your password.

There are no comments on this comment yet.