No wonder the government is confused about what a backdoor is

found on Reddit

Up is down, left is right, front is back. I suppose it's all a matter of perspective, and if you come at something from the backdoor often enough you start to think it's the default way in and start calling it the front door.

Encrypting an encryption key

from here and here (image source)

Whether you lock or encrypt a key, you'll need a key to unlock or decrypt it, so how do you protect that secondary key? You either get into an infinite loop of keys and locks/encryption or you accept that a less secure key unlocks the thing you're ultimately trying to protect.

In the case above, however, you could just break the glass, which is exactly the kind of backdoor authorities would love to see in encryption, but which would make us all less secure, just as this key is less secure because of the glass.

Flunking Cryptography 101

from here and here

The revelation that Microsoft Office uses ECB (electronic codebook) mode for it's encryption (not just now but as far back as 2010) is stunning. If you've read a book on cryptography then you would know better than to use ECB mode. If you haven't read a book on cryptography then what the heck are you doing writing the crypto code in something as important as Microsoft Office? 

How do you put someone so green in such a position? Alternatively, if it wasn't a mistake, if it wasn't a matter of a lack of experience (because the failings of ECB were widely known long, long before the creation of Office 2010 - I knew about it in university in the 90s) then could this have actually been a kind of backdoor?

We take your security, seriously

from here and here

Surely there are better ways of providing support than implementing a backdoor account. At the very least, a support account shouldn't have fixed, known credentials.

This plan couldn't possibly backfire

from here and here

It's 2022 and apparently the European Union has learned nothing about mandating encryption backdoors. 

An advancement towards the grave, maybe

from here and here (image source)

Apple's CSAM (child sexual abuse material) scanning plans may now be paused, but paused isn't the same as stopped, and if they really think it's an advancement in privacy then it's important to recognize the distinction between paused and stopped.

In no world is adding surveillance where none previously existed an advancement in privacy, no matter how favourably it may compare to what others are doing. Furthermore, if your plan involves trying to work around the problem of encryption then you are once again not advancing privacy because, when it comes to privacy, encryption is not a problem that needs a work-around.

They still plan to go forward with this one way or another. They're just slowing down to consider how to take the bite out of the criticisms against it so that they can still pretend like they care about your privacy.

Or even an underside door

from here and here (image source)

Not only did someone install this monstrosity, someone put a padlock on it, as if that could stop anyone from simply going around or under.

Nobody gives in just once

from here

Apple turning their devices into a surveillance system and then saying "We'll only allow it to look for one kind of thing, trust us" has got to be one of the most tone deaf moves they've made in a loooong time. Of course they'll abandon that promise in the future, and most people already know this. Only the most gullible Apple fan boys would believe the promises they're making surrounding this.

The sun went down on the going dark problem

from here

I always knew the government had it in them to gather evidence of criminal activity in spite of encrypted communications. They just had to put in the work instead of asking the tech industry for an Easy Button. Now that they've shown they can sell their own backdoored phones to criminals all over the world, read tens of millions of encrypted messages, and make nearly a thousand arrests (with more coming), they better realize they can't leverage their perceived helplessness in negotiations with tech companies any longer. Everyone knows what they're capable of and arguably their approach is better than anything the tech industry can do because it's much more targeted.

Now that's a backdoor

found on Reddit

I wonder how the rest of this vulnerability disclosure story went. Was he locked up? Did future sewer workers just release information about secret tunnels into bank vaults to the general public? And if so, how did THAT turn out?

How can we trust you with backdoors if you don't trust yourselves?

from here

It's really revealing that the police want backdoors to use against other police, apparently oblivious to the fact that that would allow those other police to use the same backdoors against them (and a whole bunch of others). Clearly they aren't putting a lot of thought into this. All they know how to do is ask for more power.

How do you "accidentally" add hard-coded credentials?

from here and here

Believe me, I can imagine how this backdoor got added to the Zyxel firmware. In theory they may be developing the firmware with the built-in account for testing purposes and then they remove or disable that code in the final build that they intend for release. But if that's what they're doing then this mistake begs to happen over and over again.

Maybe they should make a product that's testable in it's final releasable form instead.

Keep them out of our online sexy time

from here and here

The details of this spying are pretty laughable. Imagine doing something naughty after the government made you install a certificate that allows them to view your encrypted web traffic. You'd have to be pretty dumb to get caught, but it would suck not having the freedom to do what you want (or possibly need) to do. I suspect it does more to keep people in line than it does to actually catch people - not unlike the way obvious surveillance cameras deter some crime.

The security claims were pulled out of their ass

from here

The lesson we should all learn from Zoom is that it's not really end-to-end encrypted if a middleman holds the keys. 

A backdoor for one is a backdoor for all

from here

Y'know what's better than telling the government what will happen to the backdoors they're asking for? Reminding them of what's already happened to the ones they had. 

Only America gets to have backdoors

from here

I may be dating myself here, but back in the day Oracle tried to market their software as "unbreakable". I don't think I need to tell you how that worked out for them. Now they're going to be looking for problems in someone else's code - good luck with that. Hopefully it works out better this time.

Of course the aim is to prevent Chinese backdoors, and this was all prompted by a government that keeps trying to add backdoors to things (they're obsessed with the back door, it seems). It all seems very self-serving, to be honest.

The secret is right under your butt

from here and here (image source)

I imagine there's probably a repeating pattern, but it's not immediately obvious to me so it's fun to imagine there's an actual hidden message in there.

It's the debate that never ends...

from here and here

... 'Cause it goes on and on my friends.

Backdoor legislation is back again. It's going to be disastrous and harm us all but they don't care and won't listen. They seem to think now, while the country is gripped in the throes of anti-police-brutality protests, is the right time to give law enforcement extra help at all of our expense. I wonder how that will work out for them when they're up for re-election.

Maybe they didn't notice

from here

Y'know, a good meme isn't just a funny picture or video on the Internet. Sometimes it's a different way of looking at things, of thinking about them, of framing them. I think the FBI's continued attempts to get backdoors in iPhones deserves something like that.

Cheap, Fast, or Secure... Pick Two

from here

So it appears that Zoom's "end-to-end" encryption only counts as end-to-end if you consider Zoom's servers themselves to be one of the ends. Specifically, according to their own blog, they have software running on their servers acting like legitimate communication endpoints so that they can send the unencrypted data to devices that don't support their end-to-end encryption. It's a backdoor dressed up as a compatibility feature. We have to take them at their word that this backdoor will never be used by misbehaving employees and that various governments will never or can never compel them to use it to reveal our communications.

They could have (and arguably should have) simply told customers they can't use the end-to-end encryption feature when participants are using devices that don't support it, but they chose to compromise the communication channel instead so that users could maintain a (now false) sense of security.