Hacker News new | past | comments | ask | show | jobs | submit login
Last Week Tonight with John Oliver: Encryption [video] (youtube.com)
331 points by XioNoX on March 14, 2016 | hide | past | favorite | 86 comments



Like everyone on this site, I've been following this story too closely to get any new info from this segment, so I couldn't tell if this will convince people. It was up to the always high standards of Last Week Tonight though.

I really hope the message got through to his audience. We need every single non-technical person in the world to understand this clearly if we have any hope of getting the US Government to back down.


A) Yes John Oliver is awesome

B) Holy Crap! A comedian is the best for reporting on issues that are actually important. What a sad state of journalism we have been for the last decade or so.


Unfortunately, the problem is that the media isn't any better than a comedian, not that the comedian is very good. Having been on both sides of some of John's issues, I have to say that he is a master of making you think you understand an issue, when in fact you are carefully sealed off from getting even a whiff of what the other side's points may be, with snark and mockery substituted instead. Many people criticize the mainstream media for the fake controversy approach where every issue has two sides no matter how silly, but John Oliver is even worse than that. It's fun, but that's all it is... it is not informative. Only fun.

If you think he's "really good" at covering the issues, I strongly suggest tuning your media consumption; you're not even getting one side of an issue so much as one spoon-fed preparation of one side of an issue. You're dangerously underexposed.

(And to be clear, I do think he is fun. I've watched a goodly number of his videos myself. I'm not saying I don't like his schtick... just that it is a schtick.)


Example: FCC Chairman Net Neutrality is a good example of his style. Yes he does show the other side and yes it maybe a case of straw-man argument, but for the most part.

Encryption - He shows the FBI public address on the issue and why they are concerned in terms of terrorist. Then shows the Congress and Trump. Points out the ability for the government to "penetrate" any bank, door, etc as needed through a court of law.

Then the issue is the "Pandora's Box" of setting president.

I would like you to show one where there isn't the other side getting their main points presented by John Oliver? Would you be willing to show an example of what shows only one side?


I decline to volunteer a list of the exact ways in which I disagree with the liberal orthodoxy. (Thread derail ho!) I'm sure you'll understand.

He carefully makes sure that any exposure to the "opposite side" is sandwiched with snark on both sides, and to make sure that none of the strong arguments are shown to you. You are not actually being exposed to the other side, just a soundbite carefully processed to remove any possibility that you might even be so much as intrigued, let alone convinced.

Be honest: When have you been "exposed" to one of these viewpoints and even experience a hint of "Hmmm, maybe I should dig into that position a bit more, I'm not sure John's right here."? All I'm asking for is a twitch. I bet you're too busy laughing for the thought to even cross your mind. (Again... be honest with me. Don't hypothesize about how maybe somebody else might have. Tell me about whether you followed up on a video's points.)

I'm taking a bit of risk putting this challenge out there, because a lot of people read these posts and of all those people, there almost has to be one person who actually can tell a story about how they followed up and came to a conclusion that disagreed with John. But I dunno... I've probably still got decent odds, and I'm quite sure there won't be a long stream of them below this concept.

And let me reemphasize my core point here, which is not that I really expect that much more from a comedian (you are laughing, because he is pretty funny, after all), but that the media doesn't do any better. John isn't doing anything particularly wrong. He ought to be the dessert part of your balanced news and media diet; it's not the dessert's fault that the rest of the meal is short on nutrients.


1) My point was what a bad place we are in when a Comedian does a better job covering a story. When I know the facts of an issue John Oliver has actually covered the issue MUCH better then News Media.

2) I think you turned this into something else completely :) Please don't be the facts don't matter everything is bias and then never care about what common ground facts people can hold on to. Example Obama going to SxSW for a "Entertainment" festival instead of going to Nancy Reagan's funeral. a) SxSW is also a major technology gathering (We all know that here) b) no other President went to a funeral of a first lady for decades and it was the job of the first lady.

> I decline to volunteer a list of the exact ways in which I disagree with the liberal orthodoxy.

Wait we are talking points of John Oliver not showing both sides. I am Pro-Life and I disagreed with him and he would with me also. Facts are different then conclusions. I never get mad at people for coming to a different conclusion if we both have access to the same facts. I am asking for an example where he doesn't show both sides like you were saying.

Also your tone is a "wee-bit" offensive. I use to be a Systems Librarian and to this day I check everyone's facts with them in person. My kids when they hear something take the phone and ask Google for the answer.

  I wasn't saying HE IS FUNNIES I said he covered the story better. It is the fact that no one else covered Net Neutrality in a balanced or informed way at all. The issue had zero traction till John Oliver did his piece. The reason why is he was informed and presented it in a way the general public could understand and they could come up to a conclusion of gee John is right or wrong for themselves.


You forgot to give an example to illustrate your point


I'm not sure how much of this is on John Oliver's show and how much of this is due to his followers, but the sentiment to pick on Trump because his last name used to be different when his father immigrated. Imagine if conservatives found that Sanders originally had a more ethnic sounding name and made fun of that... would that have been treated the same? I don't think so.


It was 100% because Trump told Jon Stewart that he should have been proud of his original last name and then years later denied he made fun of it and would have never done so.

Donald Trump's tweet - https://twitter.com/realDonaldTrump/status/32707672042545152...


>Having been on both sides of some of John's issues, I have to say that he is a master of making you think you understand an issue, when in fact you are carefully sealed off from getting even a whiff of what the other side's points may be, with snark and mockery substituted instead.

It is like the people who, when asked about why some thing should be, they respond "Because it is 2016!" And all their supporters laugh and agree and think the argument has been made. Both sides are really strongly set on talking past each other, and on some issues they are often far closer in opinion than they would ever be willing to admit (especially after all the extreme rhetoric was thrown around).

And my absolute favorite, when you make a careful comparison between two issues to show a comparable line of reasoning, a lot of people will just go "They aren't comparable." No discussion, no attempt to explain why they are different, and if you can manage to get them to keep going, you are going to be swimming in a flood of logical fallacies.


Interesting format. First time I've watched him. This is a pet topic, so I wanted to watch. But I stopped about half-way through.

If you need a joke every 10 seconds or so -- otherwise you lose attention -- I guess it's okay. Seemed to cover this topic well enough. But if you need that amount of humor, if I were you I might want to up my game a bit.

The problem with entertainment disguising itself as useful information is bias. At the end of the day, it doesn't really matter to most people what the guy is saying. His criteria for a successful broadcast is something that emotionally moves folks and that he can make entertain people the maximum amount. The viewer's criteria is to laugh and feel like they now understand some complex subject.

Whether or not the information is biased or not never enters the picture between the two parties. In fact, the more complexity that's introduced, the less likely the material is to be entertaining. Likewise, the more you're laughing, the less you're probably learning. But it doesn't matter because everybody's having a good time. Reminds me of talk radio in the early 90s (except the politics are all different, of course)


You should watch the entire segment because he "plot twists" a little past half way.

And the jokes are just part of the Last Week Tonight formula. This is information disguising itself as entertainment, not the other way around. Oliver also did a segment recently about special tax districts that was quite informative, as another example of the LWT formula for you to sample.

You get a lot more information from a LWT piece than from traditional news; the comedy bit might even just be to avoid being sued for satirizing living people (maybe "comedians" can get away with more than "journalists").


My point is still the same take away all the jokes and look at only that facts. John Oliver does a better job at breaking down stories into parts that tell the story better.

John Oliver is entertainment but the News facts are presented better then mainline news.

My case in point: New Neutrality. He singlehandedly turned the whole issue into something people a) could understand b) then decided if it was something they should care about. For YEARS tech community went no where then John Oliver immediately made it into an issue most people understood and changed FCC and Net Neutrality overnight,


Is there a particularly egregious example of one-sidedness you can point to?


Comedy is very effective, and I have been a fan of Juice Rap News for a long time, they are really good at breaking things down, explain things with references and asking the right questions.

My favorite is this: https://www.youtube.com/watch?v=o66FUc61MvU


Thanks for that. It's very well done and the message is spot on!


Meh I used to think so, then I saw the lengthy rebuttal that a guy did regarding the Trump episode he did. John Oliver unfortunately can't be trusted in some regards - https://www.youtube.com/watch?v=Jf3vW0e_Wgc


Is there a transcript somewhere or a 5 minute version? I would like to have a counterpoint to the Drumpf piece but don't have 80 minutes to spend.


A counterpoint to the Drumpf piece, Bill Clinton is not a Clinton, he changed his name from his biological father's Blythe.


It's basically 80 minutes of agonising "Yeah, well, you know, that's just, like, your opinion, man."


Do you honestly think non-technical people from outside the US are going to make a difference in this debate? I can't imagine a demographic with less influence over the situation.


That "non-technical" person from "outside the US" has done a better job of explaining Edward Snowden to the masses than most news networks. His target demographic is Millennials, and he's very popular.

Yeah - This carries some weight.


OP said "We need every single non-technical person in the world to understand this clearly." You are talking about one non-technical person, from outside the US, who reads, writes and speaks English fluently, lives in NYC with his American wife and has an above average income because of the wildly popular television show on HBO that he hosts. John Oliver is hardly representative of the other billions of non-technical people from outside of the US.

  > Yeah - This carries some weight. 
A February poll by Reuters has 46% of Americans supporting Apple, the number jumped to 64% for people 18-39 years of age and a more recent WSJ/NBC poll of registered voters puts the number at 47%. What percentage of John Oliver's audience do you think changed their opinion after seeing the show and now support Apple? Or do you consider comedic reinforcement of a previously held belief is "carrying some weight"?


The host is British, but Last Week Tonight is an American television show.


I hope so. It has worldwide implications. There would be negative impacts for their business(es) globally if they nerf encryption.


If it can be shown that it will eat into profits of US companies (because people will switch en masse to non-US providers, e.g. telegram in Brasil) then it's a pretty big difference non-technical people from outside the US can make.


I hoped he would have touched on one more important and oft overlooked point:

Encryption is not a secret. It's accessible to criminals, and criminals don't give a shit about "backdoor" laws.

In fact, I'd venture to guess that there is great encryption software already available on jail broken iPhones.


Well what we have seen in actual practice is in France and other terror attacks that they used no encryption so far. http://www.bloombergview.com/articles/2015-11-18/a-back-door...

What we have also seen in regards to just use of technology is the reign of default. I I doubt that criminals would go for an unlocked iPhone for security reasons for a few reason but one being that is beyond them.


Considering that ISIS has a website[1] protected by TOR, I'm pretty sure they could figure out how to jail break an iPhone, which takes about 10 minutes and a YouTube tutorial.

I apologize, if I'm wrong, but I can't help but feel like you're being disingenuous.

1. http://motherboard.vice.com/read/isis-now-has-a-propaganda-s...


Though there is a tor website is does it actually get visited by people? Seems like Twitter, Facebook, YouTube and Telegram has been more successful for them.


ISIS is known to use encryption in their communications.


I specifically spoke about the attacks in Paris which was originally blamed on Snowden and encryption but actually they didn't use encrypted communication.


Do they? Do you have evidence to back that up?

The bits I've read suggest that they don't - or at least not widely.

Eg: https://www.schneier.com/blog/archives/2015/11/paris_terrori...



There's only one mention of ISIS affiliated chat channels on Telegram, not that it's actually been used by actual terrorists.

The rest of the speculation in that article was called out and refuted by the link I supplied.


He did touch on this point. He said that no matter what the outcome if this case is, real encryption is still just an app away. He then listed several 3rd party encryption apps.


Ah, good catch. I hadn't noticed that. I miss words all the time when listening to British people speak.


He brings this up around 13:30, when he mentions Telegram has 100 million downloads, and that if the government forced them to weaken their encryption, other apps with pop up 5 minutes later.


What a shame that Signal is not mentioned as encryption app.


Open Whisper is based in the US so Signal isn't different from Apple in a way that was interesting for the story.


If someone shows up with a phone, Open Whisper Systems can't read the messages stored on it if they don't have the passphrase. The messages are encrypted at rest, so they can't create an update that would circumvent it. The only option would be brute-forcing the passphrase. In that way, it's fundamentally different from Apple.


Sure, but the segment that mentioned other encryption apps was talking about what would happen under a US government mandate. Open Whisper Systems would have to comply, move or cease operating (Just like Apple).

Apple also improved the latest iPhones, the OS replace bypass at question here will no longer work. So Signal has an advantage over older iPhones, but not all of them.


Telegram is good at marketing and Signal/OWS is good at encryption. Not too surprising.


I know, right? I actually got excited for a second thinking he'd name drop that.


He used phrasing like "widely thought by experts to be impossible" (13m2s) a few times through this piece. Which cryptographers and cryptography experts think, in 2016, that a crypto system could be created that is, baring bugs, completely secure right up until the point where you don't want it to be? He showed clips of legislators asking for magic crypto unicorns (10m). Is this some kind of 4 out of 5 cryptographers think it's an "impossibility", and do we really think that that remaining one is actually an expert?

Or is this just an attempt at "fair and balanced" reporting, implying that, while they couldn't find any "experts" to take the opposite side, there must be some out there. John Oliver doesn't usually do that though.


I think what he meant with those words was that experts think it's impossible to create such a backdoor and keep it 100% safe from being leaked or exploited by bad actors. Which I think we all here can agree with.


Well Apple has signing keys right? The signing keys are a backdoor, and we've mostly mastered "don't leak your secret keys."

Now for a backdoor that you're sharing with a bunch of people...


But they would be asked to share this back door with the thousands of law enforcement organizations, as well as other countries. If they had to do the same with their signing keys, those wouldn't be secure either.


If you sound overly certain when people disagree with you they won't take you seriously.


Pretty much explained why Donald Trump is so popular at the moment.


Glib dismissals like this are just one of his sources of power.


I'm not sure I completely understand your comment. Do you mean that instead of "widely thought by experts to be impossible", he should have said "all experts believe it to be impossible"?


It doesn't sound likely to be possible, but has it been proven so (in the rigorous mathematical sense)?


>"widely thought by experts to be impossible" (13m2s) a few times through this piece. Which cryptographers and cryptography experts think, in 2016, [...]"

You take a John Oliver quote, and it contains the current year? Come on.


Awesome summary of the issue. All it takes is 1 disgruntled/bribed/blackmailed employee, and everyone could be compromised. Not worth the risk.


Depending on how it's done if the signing key is delivered to the USG yes, if Apple only delivers on-demand software updates then the security remains pretty much the same - anyone within apple who has access to the current signing key / authority to push software updates to apple devices.

Handing out the signing key to the USG will probably be quite disastrous as they more likely than not offload it to any 3rd party in the private sector which will offer to make them the next best phone scrapping kit or spyware.

If Apple is compelled and goes trough the software route then it's will be bombarded by 1000's of requests to unlock phones, and worse in the future to potentially install "wiretaps" on phones of suspects not in custody who haven't been charged with anything yet which will be quite a costly operation for Apple.


In the house meeting the security expert said this pretty well. As soon as the process becomes routine its going to be in a huge amount of danger.


That one I don't really buy sorry, wiretaps have been around for ages and while they have been misused by law enforcement I haven't heard about too many cases in which criminals actually exploit them.

While cyber criminals are sophisticated it's just not going to be worth the effort for them, most large cyber crimes were pretty low tech.

Foreign intelligence agencies is another deal, but then again they could just as easily penetrate Apple now.

So while there will be some technical risk its really not substantial, the privacy implications however are going to be very severe.


You attack the weakest aspect of a system and with traditional phones that was not the interface to the state.

Apple having a well such a key now is problematic but it is necessary. As long as apple only signs individuel versions that is hardcoded to one perticular phone, the danger is not that large. These keys are protected with lots of effort and access to it is limited.

If apple is forced to unlock hundreds of phones they will not sign a version for each phone individually, the will have a version that runs on all phones. This software is way more problematic then the key itself.

This is by the way exactly what the securty expert said in front of the house:

https://judiciary.house.gov/hearing/the-encryption-tightrope...


Apple doesn't and as far as I can tell cannot sign a version for an individual phone a signed binary by apple that removes the security settings for a phone lock/wipe will be valid for any other apple phone as long as you can trigger an update which you can using iTunes you should be able to deploy it on any device you want.

There are no individual singing keys for phones that would be unmanageable there are probably a handful (or even a single one) singing keys that apple has which are valid on their devices and that's it.


That is wrong. The phones have hardware ids and those can be checked in code. They can sign a binary blob that runs on one phone only.


No its not, phones have hardware ID's that are used to generate the encryption key (on phones with a secure enclave, this isn't even one) I have seen no evidence that there is any specific per phone signing of apple software.


As opposed to the current situation with Apple's signing key?


One disgruntled/bribed/blackmailed employee with access. Without knowing how many that is and what measures are in place to stop those people it isn't possible to quantify the risk.

Note that I'm not defending the idea of encryption backdoors. I still believe they are a bad idea, period. I'm just getting annoyed that the pro-encryption crowd here and on other tech sites is engaging in the same kind of out-of-touch hyperbole that the anti-encryption crowd is.


Okay, while I am in full agreement that no back door is warranted why does Apple get a pass of their actions with regards to China? The rumor mill claims it means possibly handing over source code used to drive devices. If true, how would they not do the same for US officials?

I certainly don't believe they should write the code request by the government but at the same time are they going to keep that stance in all markets?


There is a big difference between handing over source code and pushing signed patches to a device. A key principle in modern Cryptography is that if your algorithm has to stay secret in order to remain secure then it is inherently insecure. The same could be said of source code. Handing over the source code to China should not effect the security of the platform, otherwise it is inherently insecure. Handing over signing keys however is completely different.


Apple showed the Chinese its source code so they could verify that it had not been back doored (per Snowden's accusations). Since this did not entail revealing their signing keys, it's a completely irrelevant comparison (in fact, it's exculpatory).


Would it be possible to build devices that could be unlocked a fixed number of times across all units (say 1,000 times). Devices could be heavily hardware encrypted, but unlockable with an encryption key, a portion of which comes from a publicly monitored blockchain/distributed ledger, that when used reduces the number of future uses.

This way, the government could be granted access for extreme cases, but without the potential for abuse or mass surveillance. Once there were 1,000 check-ins, not more keys could be generated.

Thoughts?


It's irrelevant, since the goal of FBI now is to make a precedent in being able to demand the changes in hardware or software based on the "All Writs Act" which should otherwise be the wrong act to allow them to effectively introduce infinite "Clipper chip" equivalents the way they haven't succeeded through the regular legislation procedures up to now.

Up to now such changes had to pass through the Congress, the laws had to be voted to solve such issues. This time they just quoted the Act which really just says they "may issue all writs necessary or appropriate." (check: https://en.wikipedia.org/wiki/All_Writs_Act ) Almost like citing the Catch 22.

It sounds too trivial but it's fundamentally dangerous in the powers they obtain if their current interpretation is accepted: the state doesn't have to make laws, the government can just write anything whenever it likes and say it's covered by "All Writs."

In the older cases when Apple cooperated Apple didn't have to change anything, neither their future hardware for retail nor the software of the hardware they produce for retail and the cases when nothing has to be changed but just the accessible data copied can be understood to be actually covered with the specific law, CALEA.

And don't forget how weak the argument of the FBI really is, the phone in question was a business phone of the terrorist, who actually intentionally destroyed his private phone before being chased. For this one he didn't care. Apple gave FBI the backup of the business phone, and was able to give them even the current state of it, but the government changed the backup password themselves. And the FBI can actually without Apple copy the data from the SSD disk of the phone and restore it any time to allow them more password tries. But they really want to make the precedent. Because they don't want that Apple produces the next phone on which FBI can't have more access.


Is it really technically feasible for the FBI to do a bit by bit copy of the SSD? Is there not some hardware restriction?

This seems highly relevant...


It is feasible but not purely with software, the SSD chip has to be desoldered from the circuit board, the socket inserted in the board and then the copying can be done as many times as needed and the combinations tried. There are companies that do exactly such kind of intervention.

https://www.aclu.org/blog/free-future/one-fbis-major-claims-...


Not on the 5, apparently. My understanding is that it isn't the SSD but rather the flash on which the encryption key derived from user input is stored (the part you unlock with code and is wiped after 10 tries).


I don't agree. There were more texts claiming it can be done, they just have to try the combinations on the same circuit board, because one of the parts of the key is the part of the hardware, but the copying of encrypted data and then restoring from such backup can be done outside of the board, nothing is against that. Here's how Chinese trivially remove and replace the "solid state disk" chip.

http://9to5mac.com/2016/02/03/iphone-flash-storage-upgrade-s...

And the article that describes the process:

https://www.aclu.org/blog/free-future/one-fbis-major-claims-...

Yes it's just a chip that has to be copied, it's not a disk as we understand it in notebooks in a sense "a bunch of chips connected via SATA or M2" it's lower level but the principle is the same.


No, you can't do this in a way that's as strong as conventional encryption. It would be too easy to present your system with an older view of the "ledger" to compel it to reveal expired/locked information. If your system were to mutate some encrypted internal state to keep track of the read count, this could be worked around via backups.

The only way your system could work is if it relied on some sort of TPM, which is essentially security by obscurity.


Doesn't the blockchain offer some solution to that problem?


No. The blockchain is only a consensus through a network.

Anyone can make a tiny isolated network and create a fork that will look real to the target (here, the iPhone).

This is remotely related to the CAP Theorem [1]. Namely, you expect a blockchain not to fulfill the consistency requirement.

[1] https://en.wikipedia.org/wiki/CAP_theorem


So there is an effort estimate to ADD what the authorities need?

Does this indicate the crypto is already broken?

What's hindering the "intelligence community" from doing it on their own on case by case basis?

Did they already do this?

Does Apple win disproportionately marketing wise by staging it self as the sound and secure provider?


The FBI is asking for firmware that disables its anti-brute-force delays and auto-wipe feature. The estimate Apple gave is for creating that firmware and signing it with their key. They're not breaking the crypto, but merely making an brute-force attack more viable (by reducing the delay to ~80ms, which is how long the hash algorithm takes per passcode).

The intelligence community would need access to Apple's firmware signing key in order to do this themselves. (IIRC, in their latest court filing, the FBI actually mentioned this would work for them if Apple is unwilling to implement the firmware changes.)


Thanks for clarifying this.


There's widespread speculation that this is a test case.

I.e one big high visibility case where there is general support that the government should have access to a Terrorist's data.

Once Apple has been forced to write this one version of the software, the legal precedent is there to force Apple (and every other company building software and devices) to do it again for all the other devices that any law enforcement agency has on hand, for scenarios that might not have as much support.


I listen to the hole house commity about this issue. The FBI says it has "talked to anyone who would talk to them". The security expert is on record stating that she beliefes the NSA had the capability to break the 5C but did not want to share it with the FBI. She recommended the FBI build such capabity itself instead of threaten the security of everybody.


any chance of a non-geoblocked link?


https://m.facebook.com/story.php?story_fbid=858905877571756&...

Supprisingly their Facebook video isn't...



Interesting; I can see the video in The Netherlands. I wonder which specific regions they are blocking and why.


Video spam. Late night show bullshit.




Guidelines | FAQ | Lists | API | Security | Legal | Apply to YC | Contact

Search: