The media and its misunderstanding technology

[PaulCa]

Oh, and this isn’t sixties London or an episode of the Sweeney, the police don’t ‘fit’ people up any more.

The point of process and protection of the innocent and presumption of innocence say otherwise.

I understand the severity of the allegations and honestly I think you are correct. However the law does not work like that. You cannot say in one particular case it's allowed but in others it is not. Thus if we slacken the protections the police will start using the powers inproportionally. There are dozens of cases of this abuse of powers reported every year. As a random example, the film team from "ToonAtik" - A kids TV show were detained under the anti-terror laws for wielding a toy hair drier as a prop gun during a shoot.

Police are NOT fully educated in the law and the entry requirements are not that high at all (when compared to a judge or bar lawyer). We rely on judges to filter out the excess of cases they bring. There are also quite a few cases of the police fabricating or miss interupting evidence and of being evasive and invasive in their conduct. Finally if you have ever been on the wrong side of the police you will learn how they treat people and how eager they are to pin things on you, especially if it starts to look like they were in the wrong.

 

[TheVoice]

We rely on judges to filter out the excess of cases they bring.

In E&W it's the CPS who make a charging decision and ultimately decide if a case goes to court, not the police.

In this instance, the order to compel the suspect to provide his password was signed by a court, it wasn't simply the police demanding it.

 

[Energize]

It is stored in encrypted form and most encryption can be broken.

This is a common myth and demonstrates a lack of understanding of the basic principles of one-way hashes.

 

[jsmoke]

This is a common myth and demonstrates a lack of understanding of the basic principles of one-way hashes.

Through brute force?

 

[Destination]

Through brute force?

How does one go about brute forcing a password system which takes longer between each try to allow another retry?
As in the unlocking of a device.
Or how does one brute force a long key encryption? Please explain.

 

[jsmoke]

I meant you give the hash to the cops to crack.

 

[dowie]

I see the Daily Mail today reporting that Facebook should "hand over" the password to a Facebook account to the police.

First of all, doesn't this set a dangerous precedent?

Yes it does, especially if you're talking about literally handing over a password. The journalist has clearly messed up but even if talking about access to the account then there need to be some checks in place.

Second of all, how could Facebook do this? Facebook don't know the person's password, they do not store it. This is literally web security 101, NEVER store a password. What is most stunning is how the Mail don't seem to know this, when a five second Google would give you this information.

When our media doesn't even understand how technology works - including apparently how to use Google - how can they be trusted to act in our best interest?

Indeed they might not be able to - it depends how they've stored the passwords. They are however going to be able to access the account.

I assume this is the article?; http://www.dailymail.co.uk/news/art...holson-jailed-refusing-Facebook-password.html

Nah in that article the DM journalist refers simply to accessing the account and doesn't make the mistake the OP has highlighted, also that article is from the 31st of August whereas the OP on the 4th of Sept refers to an article "today". Might have been helpful if he'd included a link to the article he was actually referring to but I'm perfectly willing to take his word for it that a journalist has got this wrong.

Yeah, I'd agree with that - FB do have an large engineering office in London and their EU HQ. I find it pretty silly how they can operate a social media platform which may contain evidence relating to a murder, yet - any and all decisions relating to handing that evidence over, must go through a challenging and lengthy US DOJ application..

Interestingly, Nick Ferrari announced he's talking about this on LBC in the next hour,

I dunno, I can see situation where they might not want to give access via foreign courts/governments - plenty of countries with poor human rights records over there. Also flip it around, say you're a UK company with various legal obligations re: data protection, you don't just dish out customer data to some foreign authority. If the process if somewhat convoluted then perhaps there needs to be something done to speed things up - perhaps there can be some international agreement signed whereby some trusted foreign courts can make data access requests i.e. I don't see why say a court order in relation to a particularly serious offence such as a murder enquiry shouldn't be allowed from the likes of courts in the UK, EU, Aus/NZ/Canada, the US etc.. if some sort of mutual recognition were put in place.

I severely hope not. That would show a worrying lack of security.

I don't see why it would show that at all, they already fulfil these sorts of requests for access via US courts etc.. it doesn't imply that there is a lack of security. Its not like any random employee can simply access user data. Fort Knox can easily hand over gold if required to by the US govt, it doesn't imply that gold isn't stored securely.

Also, the way end-to-end encryption is reported on makes it seem like it's the bee's knees to keeping everything secure and private, but that's 100% NOT the case. As its name suggests it's only working on securing the communication between two parties - the thing to remember is that the two parties that are communication are two "Facebook Accounts". Not two "people".

Yep people do seem to get confused by end to end encryption, there was a thread on here not so long ago where one user seemed to think it was some magical catch all technology when it simply refers to the communication between point A and point B being encrypted but says nothing about the storage at either end. For example, am not up to date on WhatsApp, but at one point IIRC the backup of all your messages could be stored unencrypted in iCloud. I think they have now addressed this, but I'm sure someone on here in a previous thread didn't understand that this back up has nothing to do with the service itself utilising end to end encryption for the purposes of transmitting messages.

 

[Energize]

Through brute force?

Ignoring the fact that that is completely infeasible even with supercomputers, one way hashes tend to have collisions such that two preimages can produce the same output so you can never really know which is the real password.

This is not too dissimilar from a one time pad in that many (in this case all) encryption keys work but it's impossible to tell which is the "real" one.

 

[jsmoke]

Ignoring the fact that that is completely infeasible even with supercomputers, one way hashes tend to have collisions such that two preimages can produce the same output so you can never really know which is the real password.

This is not too dissimilar from a one time pad in that many (in this case all) encryption keys work but it's impossible to tell which is the "real" one.

I know all this stuff. Your just being arrogant as I said to give the hash to the cops assuming they may have support from GCHQ or whoever else with a super computer.

I made two errors.

1) The content in the databases is unlikely to be encrypted hence easy for fb to send content rather than passworf to cops

2) Fb will likely have super strength non standard encryption plus salt making it impractical to crack it.

However initially the topic was about sending the police the password which technically fb shouldn't even know, only the hash they would have.

So i said to send the police the hash with corresponding encryption method for them to try and crack.

They could always run a dictionary attack on it.

As for which is the real password well it would take all of 5sec to check.

 

[jpaul]

I meant you give the hash to the cops to crack.

if the accused was using the secure messaging facility then thats an AES256 bit key that has been disposed of, after the message keep time expired, so no way back.
Facebook and the like have to be careful they do not reveal if back-doors exist.

Albeit Terrorism act's permit prosecution based on evidence whose source they don't have to reveal afaik .. but would that apply to this

 

[Energize]

I know all this stuff. Your just being arrogant as I said to give the hash to the cops assuming they may have support from GCHQ or whoever else with a super computer.

Arrogant? It is completely unfeasible to try to break modern encryption with supercomputers. There is nothing arrogant about stating that.

And no, you can't check which is the real password, that's why it's called a collision. Ten passwords for example could produce the same hash, you could get into the Facebook account but you would have no way to mathematically deduce what the real password was. This is important to consider if you are trying to obtain a suspects original password in order to gain access to other websites/services he uses.

 

[TheVoice]

Your just being arrogant as I said to give the hash to the cops assuming they may have support from GCHQ or whoever else with a super computer.

They don't. They need Facebook to provide access or for the suspect to give his password.

 

[Tefal]

This may be a stupid question but if thwyre after thiet conversation history why don't they just access it from her side?

 

[Haggisman]

Is it just me or is it slightly ironic that in a thread complaining about spreading misinformation that the OP contains an error on the very subject (It isn't "never store a password", it's "never store a password in plain text") and that a lot of people are confusion the important difference between hashing and encryption?

What's even more ironic is that you're also getting it wrong, it's "never store a password in a recoverable format" I could transpose every letter in a password 1 place to the left (e.g. A=B, B=C etc.), it would no longer be plain text, but still easily recoverable /pedant

 

[jsmoke]

There will surely be a massive fb data breach one day, millions of accounts etc. So that people will be sifting through others' messages etc.

Could be interesting.

 

[Tefal]

There will surely be a massive fb data breach one day, millions of accounts etc. So that people will be sifting through others' messages etc.

Could be interesting.

I doubt it. I mean just think how long it would actually take to transfer account data.

 

[PaulCa]

Password hashes are crackable. You have to account for people using simple passwords.

Brute force can be pre-calculated and looked up in a database. So... you set an algorithm generating passwords and hashing them, then a month later you have a database containing several billion of them.

You enter the hash of the password and if it's one of the simplier ones you generated the look up takes on seconds.

Just google "password hash cracker" you'll be spoilt for choice.

Try your own password hash, you might be shocked if it's simple enough.

Note however this only really works for simple hashes. A lot of password systems use what is called "salted hashes". Works like this:

HASH_SALT="AB123123FE14423CCD242345F"
PASSWORD="Password123"
SALTED=PASSWORD | HASH_SALT // You can use ors, ands, nors or just concatenation.
HASHED_PASSWORD=md5_hash( SALTED )

 

[jsmoke]

I doubt it. I mean just think how long it would actually take to transfer account data.

I just mean messages, other stuff is generally public viewing anyway.

Messages will be around 100KB per person so times say a million is 100MB. Maybe up to 1GB.

 

[jsmoke]

Password hashes are crackable. You have to account for people using simple passwords.

Brute force can be pre-calculated and looked up in a database. So... you set an algorithm generating passwords and hashing them, then a month later you have a database containing several billion of them.

You enter the hash of the password and if it's one of the simplier ones you generated the look up takes on seconds.

Just google "password hash cracker" you'll be spoilt for choice.

Try your own password hash, you might be shocked if it's simple enough.

Note however this only really works for simple hashes. A lot of password systems use what is called "salted hashes". Works like this:

HASH_SALT="AB123123FE14423CCD242345F"
PASSWORD="Password123"
SALTED=PASSWORD | HASH_SALT // You can use ors, ands, nors or just concatenation.
HASHED_PASSWORD=md5_hash( SALTED )

Or just use online rainbow tables much faster.

Also can take a long time just to generate many billions or trillions of passwords and it also needs many terabytes of storage.

Anyway they would be salted and use many layers of encryption so unless you have a spare million years or so and a lot of money for the electricity bill then forget it.

 

[RoyMi6]

What's even more ironic is that you're also getting it wrong, it's "never store a password in a recoverable format" I could transpose every letter in a password 1 place to the left (e.g. A=B, B=C etc.), it would no longer be plain text, but still easily recoverable /pedant

Pedants are what keep everyone else safe! You are correct, I doff my hat to you sir!

Something I was thinking about the other day is that technically it's possible to create a social network where the host doesn't actually have access to any of the data...

If you designed a system entirely around E2EE that stored public and private keys on the users devices then (if implemented as intended) when you add a friend what you're actually doing is going through a key exchange that allows them to unlock your posts etc. TECHNICALLY the host won't have the built in ability to decrypt everything that it's serving up (without brute forcing it)

Leaves itself massively open to exploit in terms of illegal activity, but could be possible...