Hacker Newsnew | past | comments | ask | show | jobs | submitlogin

Changes in laws cannot provide access to data that was never gathered and stored in the first place.

Similarly, laws cannot force a company to divulge encrypted data if the company does not hold the encryption keys.

So as long as you trust the company, the country it's in is not relevant, at least for the situations outlined above.



> Changes in laws cannot provide access to data that was never gathered and stored in the first place.

Laws can and have been written that require companies to gather data.

> Similarly, laws cannot force a company to divulge encrypted data if the company does not hold the encryption keys.

Laws can and have been written that require companies to use weaker or broken encryption.


> Laws can and have been written that require companies to gather data.

Not just that. Laws can (and probably have been) written that require companies to gather data and to explicitly lie about it.


> to explicitly lie about it.

Maybe I'm dense or naive, but I don't think there's any precedent for that. A gag order is one thing (and there are certainly places for it), but forcing someone to lie would hopefully violate the First Amendment.


> Maybe I'm dense or naive, but I don't think there's any precedent for that.

It's well know about.

https://en.wikipedia.org/wiki/National_security_letter

https://www.eff.org/deeplinks/2014/04/warrant-canary-faq


It's strange that chainsaw10 is being downvoted for their comment. From the second link above, "Have courts upheld compelled false speech? No, and the cases on compelled speech have tended to rely on truth as a minimum requirement." That sounds more like there is not precedent to force people to tell explicit lies.


True, of course. But we would presumably know about these laws, in advance, and we would have the ability to make choices based on this knowledge.

Apple has thus far been steadfast in resisting this sort of activity and in advocating against any such laws.

So for me at least, this is behavior that is worthy of trust.


> But we would presumably know about these laws, in advance

Court rulings and legal authorisations to conduct surveilance can and have ... you guessed it ... been kept secret


Also true. But we know from the Snowden revelations and other sources that Apple has been backing up its promises. So we have at least some level of assurance that Apple is a good actor.


>Laws can and have been written that require companies to use weaker or broken encryption.

Source? Example? I don't know an example of this. (At least in the US)


https://en.wikipedia.org/wiki/40-bit_encryption was the most secure thing it was legal to export. The Netscape browser, in particular, had a lot of hoops you had to go through in order to get the 56 bit version meant for US audiences. Therefore, even most Americans with internet access at the time had the crippled international version.


I would also consider the NSA meddling with Bitlocker and RSA behind the curtain to be conceptually equivalent.

https://www.schneier.com/blog/archives/2015/03/can_the_nsa_b...

http://gizmodo.com/nsa-paid-security-firm-10-million-bribe-t...


That's saying that agencies can break TPM chips and get Bitlocker keys. Which is obviously true, as even a private individual has done so to a TPM.


Whether or not they hold the keys at present, Apple is in a position of power with regard to the iOS environment. In a technical sense it would be fairly straightforward for them to acquire the keys.

Trusting the company has nothing to do with it - they could be legally compelled to do so in a secret court, and gagged with a NSL to keep them from revealing such an order. Sadly that's the reality we now live in.


No, they can't... not without designing changes into their hardware to allow retrieving the keys from the secure enclave.

In theory Apple could modify iMessage to MITM the key distribution server and enable eavesdropping. The only way to protect against that is to provide in-person validation mechanisms so users can directly compare keys. I hope they add such a thing, not that 99.99999% of their users would ever use it.

As far as the US legal system goes you'd need positive law to enforce wiretapping requirements. Courts (as a general rule) can't issue orders to force Apple to write new code or modify their silicon design to support something the government wishes it could have. Given the way SCOTUS has been approaching cell phone privacy I'm not sure such a law would pass muster.


The reality is that they could always choose to do that and not tell you, no matter what they had promised.


As far as I know you have very little rights to begin with as a non-US citizen outside of the US.


Laws could, however, force the company to secretly push out an update that sends your keys to be held in escrow on government servers should the need arise to decrypt your stuff.




Consider applying for YC's Summer 2026 batch! Applications are open till May 4

Guidelines | FAQ | Lists | API | Security | Legal | Apply to YC | Contact

Search: