Reply to post: It's actually even besides the point

FBI Director wants 'adult conversation' about backdooring encryption

Christian Berger

It's actually even besides the point

I mean we are talking about crypto here, and cryptography can protect your secret against eavesdropping under certain circumstances...

However that's not what the FBI claims to want, They claim to want to be able to extract data from telephones. Once you have physical access to that device, you are in a while different position, you can then extract every bit stored in Flash... and unless you have very special hardware, every bit in RAM. Of course you could encrypt that, but for that you'd need to enter a key. Of you only have a touchscreen, the best you can get is a 8 digit PIN... which is easy to brute-force.

Yes, people have had ideas like having a special chip which only releases the key when given the right PIN, and yes those are advertised to have a "wrong tries" counter, but keep in mind that you can erase individual Flash cells easily when uncapping the chip, or you can just read out the internal flash of such a chip with a bit more effort.

Even that is assuming that the rest of the software is flawless. Today we have mobile operating systems which seem like they were deliberately made more complicated to introduce new bugs. Even lock screens can often be bypassed by simple user interaction.

Of course solving those problems is feasible, just make your mobile device a terminal to a server that sits somewhere safe. That would really get the FBI into trouble.... and that's what the device companies won't sell you. So in a way the interests of the FBI and the actions of the device manufacturers already seem to overlap.

So essentially use ssh over Tor Hiden Services or mosh and authenticate via public key authentication, have your local key with a moderately strong password (of course a hardware keyboard helps) and have your sever remove that "authorized keys" entry once there has be no login for n days, and you would be moderately safe... if you could trust your operating system on your mobile device.

POST COMMENT House rules

Not a member of The Register? Create a new account here.

  • Enter your comment

  • Add an icon

Anonymous cowards cannot choose their icon