Your Own Gravity Your Own Gravity     Categories     About     Feed    

The Road to Illegal Encryption

To continue thinking through where we are headed if the U.S. government gets its way on compelling Apple and other corporations to provide access to data on devices

Paul Rosenzweig at Lawfare, in “What If Feinstein-Burr Passes?”, takes this argument down a parallel road with respect to this draft legislation that has been thoroughly criticized by the tech industry:

If we can’t realistically stop the importation of encryption products, the only plausible implementation step left as a counter-move is to prohibit the possession of the non-conforming product. This might be done civilly (in the same rough manner as we prohibit the possession of devices and items that violate intellectual property laws) or it could be done criminally (as we do with drugs). So it seems to me that if we are serious about Feinstein-Burr and want to counter the determined encryptor we are going to have to move to a system of software regulation and prohibition – the ban can’t work any other way.

If you think this is only about the San Bernardino shooter’s phone, or a particular device in the possession of the New York City Police Department, you may be missing where things are headed if this legislation passes or if pending court orders go the government’s way. The end game for the U.S. government is encryption becoming illegal.

Making encryption illegal will have far worse consequences than letting terrorists carry on with encrypted communications – which they will easily do regardless of these legislative and other government actions currently pending. Banning or weakening encryption will end up leaving all of our sensitive data unprotected.

Meanwhile, some good stuff to read about the Burr-Feinstein crypto bill, by cybersecurity experts.

Encryption - An Inconvenient Truth

Great article by Rich Mogul, “How FBI vs. Apple could cripple corporate and government security,” that merely scratches the surface of this complex topic that so many try to make into a sound bite:

The President and the director of the FBI have portrayed this conflict as one between privacy absolutists and government compromise. The issue is that the technology itself forces us to make a binary decision. There are no known techniques for providing lawful access to encrypted communications and storage at scale. The only way to allow government access is to reduce the security of foundational technologies used by business and government agencies, not merely individual citizens. That is math, not politics.

If we go down the road where the government gets what they want in these cases – which is to compel manufacturers to be able to decrypt data on devices when requested – or if legislation is passed that requires this, we will end up with encryption becoming illegal. Or it will become de facto illegal, because corporations like Apple will only be able to provide access to this data if it is not encrypted effectively.

Open Sourcing Data Center Operating Systems

Cade Metz at Wired on the open sourcing of data center operating systems:

Stoppelman notes that Mesosphere developed an early lead in the new market, and Polvi says much the same thing. But Polvi also believes the market eventually will center on Kubernetes. His company offers an individual server operating system, CoreOS, that works with tools like Kubernetes, and he has worked closely with Google on the open source project. “I think things kinda converge on Kubernetes in due course,” Polvi says. “Kubernetes nailed the interface—the API—for how you talk to these distributed systems.”

Who knows how this all shakes out, but it looks like a significant new battle among the big tech companies. Interesting how Microsoft has been embracing more open source stuff recently, even Linux (which may be explained in part by the company’s investment in Mesosphere).

Cloud Services Security

Glenn Fleischman on Smile’s TextExpander and security:

Scown says Smile stores snippets at rest in unencrypted form on database servers operated by Compose.io, an IBM company. The company evaluated using solutions in which data is always encrypted except during the moments items are needed for syncing or updating, and found the other security elements—such as how passwords were restricted—were lacking in its evaluation.

Daring Fireball on TextExpander snippets stored on their servers:

This is my primary concern about TextExpander 6. I see some amount of risk, and no benefit, with storing my text snippets on Smile’s servers.

I don’t know if TextExpander snippets are a rich source of valuable data for hackers, though they certainly could be if users embed things like passwords or other sensitive information in them. But this brings up a larger issue which very few people think about, even in light of the recent FBI vs. Apple encryption battle, and that is knowing how your data is stored when you save it to one of these “cloud” services, such as Google Docs, Dropbox, One Drive, Box, et. al. I have sort of stressed about this for years, and have balked at signing up for some services because I felt I did not understand how they protected my data once it was out of my hands and on their servers.

If you haven’t thought this through before, consider a simple example: you have a product idea. You might be concerned about others finding out about it while you develop it (there are, of course, many startups in “stealth mode” just for that reason). So let’s say you put your thoughts down in a document and back it up to Dropbox (or other service – this is simply an example). Can an admin who works at Dropbox read your document? Or, in the course of Dropbox complying with some request from a law enforcement agency to hand over data, could someone whom you never anticipated read your document? Note that these services typically secure the connection between your device and the cloud, and therefore encrypt your data while in transit, but your data is often stored in an unencrypted format on their servers. It is not just hackers who may be able to read your stuff.

Now consider how a lot of people save their passwords in documents that they store using these services. It is a very short step from there to having your data compromised by just one nefarious employee.

This is very important stuff to think about if you are concerned with the security of your sensitive information. Not unrelated is that it is ultimately the key thing at stake in the FBI vs. Apple brouhaha.

The Problem With 3D Touch

Jason Snell and the trouble with 3D Touch:

This is, I realize, [o]ne of the reasons I stopped using 3D Touch so much. It seemed like so many places I attempted to use the gesture resulted in a whole lot of nothing. After a while, I gave up. 3D Touch needs to be pervasive. It needs to be a gesture that works all over the place, so that using it becomes second nature.

I completely agree. 3D Touch has a lot of promise but so far is implemented in a half-hearted way in almost every app I’ve tried. His comments about using the long-press gesture to trigger 3D Touch on devices that don’t have hardware support for it, so that the functionality can work everywhere and thereby entice developers to implement it more widely, makes a lot of sense.

In case you were not aware of all the ways you can currently use 3D Touch, see the iMore 3D Touch Guide. One other very useful capability for those who type a lot of text is using your keyboard as a trackpad with 3D Touch. I type a lot of notes on my iPhone and had forgotten all about this (too bad – it’s a very useful feature), which brings up another problem with features like this: lack of discoverability.

Killer iPad-Apple Pencil Feature

Dan Moren on the lack of handwriting recognition in iOS:

And yet even with the debut of the Apple Pencil, which would seem like a natural use to revive this technology, Apple hasn’t delved back into handwriting recognition. Part of that is no doubt because Steve Jobs famously lambasted stylus-based interfaces – though I have no doubt that if he were around today, he’d proclaim the Apple Pencil “the stylus done right.”

Handwriting recognition with the Apple Pencil would be a killer feature. I may buy an iPad Pro, but with this feature, I definitely would, and just for that.

Email Write Order

A more logical way to compose email messages from David Sparks at MacSparky. I first heard him mention this on his podcast some time ago, and I think about it every time I compose an email. I’ve made all the typical mistakes – hitting send before finishing, forgetting the attachment, the subject line, etc.

This might be a good way to lay out an email app screen that conforms to David’s approach:

Email Write Order 20160406.001

It follows the order of his workflow, with a summary section showing any issues with the message. At the bottom is an Action section with buttons for Cancel, Save Draft, Send Later (a nice feature in some email apps), and a giant SEND NOW button.

iPhone SE Review: Everything is Awful, Soon We Die

The Macalope on the inane Gizmodo iPhone SE review by Alex Cranz:

Instead of comparing “phone” sizes, how about comparing the size of the brass balls it takes for a publication that did nothing but nay-say Jobs when he was alive to now chastise Cook for rejecting his legacy. Uncomfortably long and sarcastic golf clap for that. Bra-vo.

Gotta love the Macalope.

Gizmodo’s click-bait article ostensibly about how Apple is out of ideas justifies it with observations like…

While I’m knocking the SE for being proof that Apple is bereft of good ideas, I can’t actually knock the phone’s performance or form factor.

The SE on the other hand, is beautifully practical. It simply disappears.

If you’ve been staring off into the distance singing “Someday my tiny phone will come” then you can stop. This is it. The best phone under 4 inches currently available.

A big whatever.