back to article Facebook Messenger backdoor demand, bail in Bitcoin, and lots more

It's time for another rapid roundup of computer security news beyond what we've already reported. US prosecutors want Facebook Messenger crypto cracked Uncle Sam is demanding Facebook alter its Messenger software so that American g-men can easily snoop on suspected criminals, it is claimed. The social network is said to be …

  1. frank ly Silver badge

    "... concerns that miscreants and hackers will find and exploit these Feds-only backdoors to spy on victims."

    No concerns that the Feds will misuse the backdoors to spy on victims?

    1. Ogi
      Facepalm

      > No concerns that the Feds will misuse the backdoors to spy on victims?

      That's not a bug, that's a feature! (in their eyes)

    2. A.P. Veening

      Re; Concerns

      "No concerns that the Feds will misuse the backdoors to spy on victims?"

      That isn't a concern, that is a given.

    3. Mark 85 Silver badge

      No just the bad guys and victims, but anyone including CongressCritters, administration officials...might as well get the goods on those who control the purse strings of their budget.

      Gotta' love their belief that a backdoor isn't crackable by miscreants. Or maybe the know that and just don't care?

    4. macjules Silver badge
      Paris Hilton

      Why don't the Feds just request President Trump to ask his controller Mr Putin if the Russian "Internet Research Agency" could please hack FBM for them?

    5. Michael Wojcik Silver badge

      No concerns that the Feds will misuse the backdoors to spy on victims?

      Covered by the article's original phrasing, I think. "Feds" and "miscreants" are not disjoint sets.

  2. Voyna i Mor Silver badge

    Reason for resistance

    Once it is public knowledge that Messenger is readable by the US Government, part of its reason for existence goes away and it hits the Facebook share price.

    At one end of the scale you have photocopiers controlled by KGB agents (mind you in some companies in this country they used to be controlled by MI5 cleared women). At the other end you have uncrackable encryption available to everybody, thus facilitating all kinds of crime.

    As I see it the problem is that nobody has really sat down and thought about where in the middle the optimum solution lies, and nobody ever will because of special interests and lobbying.

    1. Goobertee

      Re: Reason for resistance

      A third factor is that nobody has shown for sure (1) that uncrackable encryption that can be read only by the "good guys" and never by the "bad guys" actually exists or can be created, and (2) how we identify with 100% certainty which are the good guys and which are the bad guys so the bad guys can NEVER get in. .

      1. Anonymous Coward
        Anonymous Coward

        Re: Reason for resistance

        Even if we were to crack the technical issues, what happens when the 'good guys' become the 'bad guys'. or vice versa after a change in government (via election, coup or invasion)

        How do we even know if we are the good guys?

      2. Michael Wojcik Silver badge

        Re: Reason for resistance

        A third factor is that nobody has shown for sure (1) that uncrackable encryption that can be read only by the "good guys" and never by the "bad guys" actually exists or can be created

        "nobody has shown for sure"? It's a prima facie impossibility, unless and until you have provably-correct mechanical detection of intent.1,2 I'd say it's pretty clearly sure that you can't have "encryption that can be read only by the 'good guys'". No one who has any shred of a clue seriously believes that's possible.

        1And even that has failure modes which will be unacceptable to many users, such as a "good guy" unwittingly using a compromised system, or operating under instructions from a corrupt superior.

        2Also - and this ought to be obvious - since human judges can't agree on what constitutes good action, they're not going to agree on an algorithmic proxy for it. We're still debating the moral valences of actions that took place millennia ago. There are reasons these are unsettled questions; we have entire academic disciplines and huge bodies of literature dedicated to the meta-problem of why there's no universal ethics.

  3. raving angry loony

    Facebook privacy?

    Their messenger app is already an invasive piece of privacy destroying crap. The cops don't need to break the encryption, they just need to subpoena Facebook to release their records. They'll have more than enough info on a particular phone if they do that.

    1. Alistair Silver badge
      Coat

      Re: Facebook privacy?

      They'll have more than enough info on a particular phone if they do that

      Quite sure they can tap the endpoints (phones) with the assistance of the network provisioners (i.e. telco's) **SINCE THOSE LAWS ALREADY EXIST**, and could track the conversations before they were encrypted. The issue here is that ... well... finding these bodies on the street, or finding out what their real cell numbers are requires that the FBI, ICE, Border Patrol, Local Cops, CIA, NSA, and NASA all talk nice to one another and do this thing that is so ultra new, cutting edge and outrageously exotic called COOPERATING, instead of DICK WAVING.

  4. ThatOne Silver badge
    Facepalm

    Animoto

    > sensitive profile info including email addresses, dates of birth, gender, and geolocation were taken

    Could somebody be so kind to explain why a "video editing site" needs date of birth, gender and geolocation? All right, date of birth might be required to prove one is not a minor - although a simple yes/no question would be enough (you can lie just as easily for both). Now gender is definitely nothing of their concern, and so is geolocation of the user. (IMHO, but then I'm old school.)

    1. Alistair Silver badge
      Windows

      Re: Animoto

      @ThatOne:

      It *might* be possible that the location data is relevant to IP law, but who knows these days, since IP law seems to be better phrased as Disney's law.

    2. Michael Wojcik Silver badge

      Re: Animoto

      gender is definitely nothing of their concern

      Sure it is - it's demographic userbase information for marketing. "Looks like our users are 97% male. Target venues with predominantly male users for upgrade advertising, and female-predominant ones for ads aimed at new users."

      True, it's not a technical concern. But that doesn't mean there's no reason for the organization to solicit that information.

      You might not like it. I might not like it. We might both feel they could damn well do without it. But there's a reason for it.

  5. onefang Silver badge

    Twitch

    So let me get this straight, the only messages "leaked" are "strangers' private messages", but they are all "promotional and mass-mailed messages from Twitch's marketing partners". Riiiight. Something not quite adding up here, that story is leaving my spider sense all twitchy.

    "notify all users who had their messages accidentally shared, and give them a full copy of the messages at issue." Ah, the marketing partners will get a bucket load of their own adverts thrown back in their faces. So it's not all bad.

  6. williamsth

    They can force back doors as much as they like, but that’s not going to suddenly uninvent cryptography. Miscreants will just find new platforms or implement their own platforms using the same technology, whilst everyone else can be readily spied upon for no reason, but then that’s obviously their intention, I guess.

  7. Rockets

    Govt Shenanigans

    We've got end to end encryption now on messaging systems because various Governments proved that they couldn't help themselves by breaching the privacy of everyone to snoop on a few miscreants. If the Govt gets what they want who's to say that the determined crims or terrorists won't just fall back to older forms of encryption such as one time pads, stenography etc. American prison gangs seem to be able to communicate at will between inside & outside the jails using old fashioned ciphers & other techniques. Rather than SIGINT perhaps the governments invest more in HUMINT.

    1. earl grey Silver badge
      Headmaster

      Re: Govt Shenanigans

      "stenography"

      I don't think that word means what you think it means.

      1. Rockets

        Re: Govt Shenanigans

        Haha - oops. I did mean steganography not stenography. In my defence I do have brain damage to my language centre after I had a brain tumour removed which was the size of a lime.

  8. PaulR79

    "Android gets low-key security update"

    "Those with Pixel devices should already have the update – for everyone else, it will be up to your device vendor and carrier, where appropriate."

    For everyone else, just avoid using those features / doing whatever it is that's now exploited until you buy a new phone. I've used Android since release and unless / until Google makes it a requirement or make it so the base Android can be updated directly by them it will always be a problem. I like that this is the route they are kind of heading down but it's never going to be soon enough.

    1. Anonymous Coward
      Anonymous Coward

      Re: "Android gets low-key security update"

      This is exactly why myself and several ex techies i know of my generation have finally bowed down and bought iphones.

      The hardware generally has enough 'poke' for me for about 4 years so I need security patches delivered for that period, not just until the next handset is released

      1. Claptrap314 Bronze badge

        Re: "Android gets low-key security update"

        And why others have never purchased a "smart" phone for ourselves at all...

  9. StargateSg7 Bronze badge

    Well That's too too bad so sad, as I can make up an HTML5 web app that runs in ANY web browser while you are on ANY major social media site that gives FULLY ENCRYPTED Peer-to-peer SMS, multi-party text messaging ane even realtime audio and VIDEO communications which uses Triple-CAAST (768 bit), Lattice, Invariate AND other SHOR'S resistant anti-quantum encryption algorithms to give basically impenetrable digital communications to EVERYONE FOR ABSOLUTELY FREE !!!! And since I am NOT in the USA and no in no way bound to THEIR legal system, I can tell them to GO STUFF IT UP THEIR PFERD ARSES...Hmmm....I should have that finished within two weeks AND it will work on Windows, Android, Linux and MACOS/iOS!

    Since I've ALREADY designed and coded all the components and they are ready to go LIKE RIGHT NOW on all the world's major OS'es, I just need a decent user interface which will take less than two weeks to do !!!

    THERE ! I just stuffed your spy prods up your keester.. Go Suck and Egg !!!!!!!

  10. Anonymous Coward
    Anonymous Coward

    ms13 no need for spying

    Since all ms13 members are murders and rapist (initiation requirement) there is no need to spy on them, just exterminate. And let us keep our Pii

POST COMMENT House rules

Not a member of The Register? Create a new account here.

  • Enter your comment

  • Add an icon

Anonymous cowards cannot choose their icon

Biting the hand that feeds IT © 1998–2019