News for hackers. Stuff that matters.
Re:Apple’s dangerous game, part 2 by GuiA on Monday September 22, 2014 @06:39AM (#8349987)
The guy doesn't really understand how encryption and cryptography and infosec work, making the whole article very laborious to read and quite misguided.

Weep for the future of our world governments, which will be shaped by people like this.

Re:Apple’s dangerous game, part 2 by arjunnarayan on Monday September 22, 2014 @09:54AM (#8350526)
Before we start tossing about accusations against "this guy", let's take a step back to recognize the following simple facts:

1. The author is Orin Kerr, a nationally recognized Law professor, and co-blogger at the single most influential Law blog - the Volokh conspiracy.

2. His highest cited academic paper (421 cites, which is a lot in law world) is titled "The fourth amendment and new technologies: constitutional myths and the case for caution", so this is literally his domain of expertise, so maybe you might want to acknowledge the possibility that he knows what he is talking about.

3. He actually changed his mind based on additional evidence that was presented to him in the form of counterarguments. Given how rarely this happens, anybody capable of doing this in a public forum automatically gets +10 Respect points from me.

4. He has a technical background, as timsally pointed out, including mechanical engineering degrees. Now if he has such trouble grappling with the subtleties of cryptography and security threat models, maybe that is also partially our fault as security practitioners. We should acknowledge that.

5. I am aware that this all sounds like an elaborate appeal to authority, but given the cavalier way people are criticizing the author (as opposed to his arguments), I thought these facts should be stated.

Re:Apple’s dangerous game, part 2 by GuiA on Monday September 22, 2014 @10:07AM (#8350577)
That's great. While I read his articles, I didn't bother to read the name of the author because the validity of a reasoning should be independent of who wrote it. Reading his original article just gave me a headache for the reasons cited in my first comment.

I will agree fully with you on 3), and partially on 5) (only partially, because on one hand I agree with the premise, but otoh if you're in a position of authority your job is precisely to understand despite potentially poor communication from other experts).

(I'm also not sure what my "accusations" are.)

Re:Apple’s dangerous game, part 2 by arjunnarayan on Monday September 22, 2014 @02:16PM (#8351719)
I apologize. I wasn't really replying to you, but also to many of the comments on this story that have been more insulting to Orin Kerr. E.g. "It is completely irresponsible of a man of his intelligence/qualifications to post something", "He still sounds like a government key escrow apologist,", "you should lose your fucking license to practice law.", "Sounds like an apologist and a shill for the entitlement mentality".

I disagree with your sentiment that we should weep for the future of our world governments. I think things are slowly changing around in the right direction, and a lot of that is thanks to people like Orin Kerr who are capable of changing their minds when presented with hard evidence.

Re:Apple’s dangerous game, part 2 by idlewords on Monday September 22, 2014 @07:25AM (#8350094)
The guy made a reasoned argument and changed his mind on an important point after reading counterarguments.

Seems like the kind of person we need more of. Not going to weep!

Re:Apple’s dangerous game, part 2 by Tloewald on Monday September 22, 2014 @08:08AM (#8350196)
He hasn't figured out that iCloud backups are also encrypted, so wait for part 3.
Re:Apple’s dangerous game, part 2 by daxelrod on Monday September 22, 2014 @10:22AM (#8350639)
Are full-device iCloud backups additionally encryped?

Apple possesses the key for most data synced with iCloud, or a huge number of iCloud features would not work. According to [1] Apple can still turn over iCloud data.

[1]: http://www.washingtonpost.com/business/technology/2014/09/17...

Re:Apple’s dangerous game, part 2 by Tloewald on Monday September 22, 2014 @01:46PM (#8351578)
Maybe I'm misreading or thinking wishfully:

"This means that your data is protected from unauthorized access both while it is being transmitted to your devices and when it is stored in the cloud."

And

"iCloud Keychain encryption keys are created on your devices, and Apple can't access those keys. Only encrypted keychain data passes through Apple's servers, and Apple can't access any of the key material that could be used to decrypt that data."

And finally:

"You can choose to disable keychain recovery, which means that iCloud Keychain is kept up to date across your approved devices, but the encrypted data is not stored with Apple and cannot be recovered if all of your devices are lost."

(The last is opt-in, but seems quite explicit.)

http://support.apple.com/kb/ht4865

Re:Apple’s dangerous game, part 2 by madeofpalk on Monday September 22, 2014 @11:14AM (#8350869)
You aren't suggested that Apple has access to files in full-device backups, are you?

iOS backups are/could essentially be encrypted zip archives (poor example, but you get the idea) - this doesn't require apple to have the key for it.

Is it possible to (en/de)crypt something using a password, if that password changes?

Re:Apple’s dangerous game, part 2 by timsally on Monday September 22, 2014 @08:54AM (#8350325)
Not every technical person is (or even can be) an expert in cryptography or goes into a technical field for their career. It's just not practical. This is why our legal system reaches conclusions collaboratively with experts in both the law and the relevant technical fields.

That said, he's got an MS in mechanical engineering from Stanford and a BS in mechanical/aerospace engineering from Princeton. If his technical background isn't sufficient to you, I'm not really sure what to do for you. It seems that you have mistaken him admitting that he doesn't know something as a sign that he is not technical.

Re:Apple’s dangerous game, part 2 by exstudent on Monday September 22, 2014 @09:18AM (#8350402)
His technical background is clearly insufficient in that he doesn't understand the BASIC technical problems in his argument. Yet, he feels he's qualified to authoritatively call for radical government access to our data in a mainstream media publication.

He's changed his position to "need more information to decide". Well DUH! how about getting that information before scaring up a call to backdoor all of our data?