Hacker Newsnew | past | comments | ask | show | jobs | submitlogin

What if another agency already has an NSL in place requiring exactly the same (backdoor, weak crypto params, weak by design secure enclave) and they simply are under a gag order to talk about?


@jzdziarski: "NSA isn't about to divulge their capabilities by burning exploits on a case that, thanks to FBIs ego, is high profile."


NSLs can only ask for information, not force a company to build a product. That kind of request would have to come through legislation and apply to all US companies in a similar situation.


That's not really true; as evidence, I give you Room 641A: https://en.wikipedia.org/wiki/Room_641A

"Room 641A is a telecommunication interception facility operated by AT&T for the U.S. National Security Agency"

As long as you have a backdoor, and Apple does, shady government agencies can and do come knocking. We've got plenty of shady government agencies, and can never guarantee that we won't have more in the future.


That was most likely a backdoor deal between AT&T and the NSA. There was no legislation enacted. AT&T was not REQUIRED to install that room.


We still don't know what the deal was. Arguing the nature of what we know about NSLs is a bit pointless when things like 641A are happening.

Our interpretation of already unconstitutional NSLs guarantees nothing.


Yea NO. NSL's can't do that. At worst they will tell you to release and data that you have and your private keys. At best they will tell you to make sure you archive everything and don't permanently destroy records in case they are required in the future. They cannot force you to add backdoors or create a weak crypto , although they can indirectly suggest you to do that and its then on the company if they do so.




Guidelines | FAQ | Lists | API | Security | Legal | Apply to YC | Contact

Search: