Security, backdoors and control.

WttWColorEye_forBlogThe FBI may use different words to describe this tool, but make no mistake: Building a version of iOS that bypasses security in this way would undeniably create a backdoor. And while the government may argue that its use would be limited to this case, there is no way to guarantee such control. Apple letter to customers

Encryption is a way to keep private information private in the digital world. But there are government actors, particularly here in the US, that want access to our private data.
The NSA has been snooping our data for years. Backdoors have been snuck into router encryption code to make it easier to break.
Today at M3AAWG we had a keynote from Kim Zetter, talking about Stuxnet and how it spread well outside the control of the people who created it.
I commend Tim Cook for his stand against the US Government and his insistence on protecting the data of all iPhone users. The feds are strongly arguing the encryption breaking code would only be used for This One Phone. But can we really trust them with our data or believe they wouldn’t use this in another situation? Or as a way to access data that they can’t currently access through the NSA surveillance program?
It’s a little strange for me to be stating this. It feels weird. I grew up in a suburb about 10 miles outside of DC. My father worked as a civil servant for the DoD. My Friend’s dads were diplomats, senate-confirmed federal appointees and secret service agents. A CIA agent lived across the street and I regularly swam in their pool. Generals were regular visitors to our house. My first job out of high school was in a federal regulatory agency. Government wasn’t bad. It was, on the whole, a force for good. Even some of the dumb seeming things ($1000 hammers) weren’t fails, they were reasonable if you understood the context.
Government wasn’t the enemy and generally had a good reason for the things they did.
Now I’m not as sure as I was then. The government has done some things I don’t really understand. And even when I try and put them in the context of the environment I grew up I still don’t think it’s a good thing. Pervasive monitoring is bad and I don’t think our digital property should be any less secure than our physical property.
I understand and can even sympathize with why the FBI is asking for what they want. But I also support Tim Cook and his efforts to protect all iPhone users. Maybe the FBI would only use the code for this phone. But what about other governments? What about other players in the space? If Apple provides this for the US government, what’s to prevent other governments from getting their hands on it? If the RSA can be hacked and have their root keys stolen then we’re all vulnerable. Apple had one of the iPhone 4 prototypes stolen out of a bar.
If you leave a backdoor unlocked anyone can use it. Putting backdoors in code, sharing keys and creating software to allow one person to compromise security only makes all of us less secure. Stuxnet tells us that malicious software spreads further than we expect and once it exists it can easily escape any control.

Related Posts

Marketers, we have a problem

And that problem is security.
Much of what marketing does is build profiles of customers by collecting huge amounts of data on every customer. That data collection is facilitated by compliant customers that provide all sorts of personal data just because they’re politely asked by a retail clerk.
There will always be people who comply with data requests, but I expect more customers to be wary of sharing information at the register.
I’m not the only one, a recent NY Times blog post from one of their security researchers: Stop asking me for my email address. She discusses how much information companies ask for and how complacently consumers hand it over without asking about security.

Read More

December 2015: The month in email

December2015_blogHappy 2016! We enjoyed a bit of a break over the holidays and hope you did too. Here’s our December wrap up – look for a year-end post later this week, as well as our predictions for the year ahead. I got a bit of a head start on those predictions in my post at the beginning of December on email security and other important issues that I think will dominate the email landscape in 2016.
DMARC will continue to be a big story in 2016, and we’re starting to see more emphasis on DMARC alignment as a significant component of delivery decisions. I wrote a bit more on delivery decisions and delivery improvement here.
December in the world of email is all about the holidays, and this year was no exception. We saw the usual mix of retailers creating thoughtful experiences (a nice unsubscribe workflow) and demonstrating not-so-great practices (purchased list fails). We took a deeper look at the impacts and hidden costs of list purchasing – as much as companies want to expand their reach, purchased lists rarely offer real ROI. And on the unsubscribe front, if you missed our discussion and update on unroll.me unsubs, you may want to take a look.
Steve wrote a detailed post looking at what happens when you click on a link, and how you can investigate the path of a clickthrough in a message, which is useful when you’re trying to prevent phishing, fraud, and other spam. In other malicious email news, the CRTC served its first ever warrant as part of an international botnet takedown.
In other industry news, some new information for both ESPs and recipients interested in feedback loops and a somewhat humorous look at the hot-button issues that divide our ranks in the world of email marketing. Please share any we may have missed, or any other topics you’d like us to address.

Read More

Random thoughts on reporting abuse

stop_atOn IRC today, someone mentioned an Ars Technica article discussing how a research team tried to contact Xfinity about a security flaw in their home security system.

Read More