Security, backdoors and control.

WttWColorEye_forBlogThe FBI may use different words to describe this tool, but make no mistake: Building a version of iOS that bypasses security in this way would undeniably create a backdoor. And while the government may argue that its use would be limited to this case, there is no way to guarantee such control. Apple letter to customers

Encryption is a way to keep private information private in the digital world. But there are government actors, particularly here in the US, that want access to our private data.
The NSA has been snooping our data for years. Backdoors have been snuck into router encryption code to make it easier to break.
Today at M3AAWG we had a keynote from Kim Zetter, talking about Stuxnet and how it spread well outside the control of the people who created it.
I commend Tim Cook for his stand against the US Government and his insistence on protecting the data of all iPhone users. The feds are strongly arguing the encryption breaking code would only be used for This One Phone. But can we really trust them with our data or believe they wouldn’t use this in another situation? Or as a way to access data that they can’t currently access through the NSA surveillance program?
It’s a little strange for me to be stating this. It feels weird. I grew up in a suburb about 10 miles outside of DC. My father worked as a civil servant for the DoD. My Friend’s dads were diplomats, senate-confirmed federal appointees and secret service agents. A CIA agent lived across the street and I regularly swam in their pool. Generals were regular visitors to our house. My first job out of high school was in a federal regulatory agency. Government wasn’t bad. It was, on the whole, a force for good. Even some of the dumb seeming things ($1000 hammers) weren’t fails, they were reasonable if you understood the context.
Government wasn’t the enemy and generally had a good reason for the things they did.
Now I’m not as sure as I was then. The government has done some things I don’t really understand. And even when I try and put them in the context of the environment I grew up I still don’t think it’s a good thing. Pervasive monitoring is bad and I don’t think our digital property should be any less secure than our physical property.
I understand and can even sympathize with why the FBI is asking for what they want. But I also support Tim Cook and his efforts to protect all iPhone users. Maybe the FBI would only use the code for this phone. But what about other governments? What about other players in the space? If Apple provides this for the US government, what’s to prevent other governments from getting their hands on it? If the RSA can be hacked and have their root keys stolen then we’re all vulnerable. Apple had one of the iPhone 4 prototypes stolen out of a bar.
If you leave a backdoor unlocked anyone can use it. Putting backdoors in code, sharing keys and creating software to allow one person to compromise security only makes all of us less secure. Stuxnet tells us that malicious software spreads further than we expect and once it exists it can easily escape any control.

Related Posts

Protecting customer data

There have been a number of reports recently about customer lists leaking out through ESPs. In one case, the ESP attributed the leak to an outside hack. In other cases, the ESPs and companies involved have kept the information very quiet and not told anyone that data was leaked. People do notice, though, when they use single use addresses or tagged addresses and know to whom each address was submitted. Data security is not something that can be glossed over and ignored.
Most of the cases I am aware of have actually been inside jobs. Data has been stolen either by employees or by subcontractors that had access to it and then sold to spammers. There are steps that companies can take to prevent leaks and identify the source when or if they do happen.

Read More

Random thoughts on reporting abuse

stop_atOn IRC today, someone mentioned an Ars Technica article discussing how a research team tried to contact Xfinity about a security flaw in their home security system.

Read More

Are you ready for DMARC?

secure_email_blogThe next step in email authentication is DMARC. I wrote a Brief DMARC primer a few years ago to help clear up some of the questions about DMARC and alignment. But I didn’t talk much about where DMARC was going. Part of the reason was I didn’t know where things were going and too much was unclear to even speculate.
We’re almost 2 years down the line from the security issues that prompted Yahoo to turn on p=reject in their DMARC record. This broke a lot of common uses of email. A lot of the damage created by this has been mitigated and efforts to fix it continue. There’s even an IETF draft looking at ways to transfer authentication through mailing lists and third parties.
For 2016, DMARC alignment is going to be a major factor in deliverability for bulk email, even in the absence of a published DMARC record.

Read More