At EFF we’ve long noted that you cannot build a backdoor that only lets in good guys and not bad guys. Over the weekend, we saw another example of this.
Every backdoor is a keyhole, and every keyhole is an access point. Once you give the govt access you have to assume hostile third parties have access, because they do.
Doing good cryptography is hard, and a lot of work. Designing a good key escrow system or other back door is more cryptographic work, so more chances to get it wrong, and more chances for the corporate overlords to demand corners be cut for cost savings.
Even if the software has meticulously perfect cryptography, the government definitely won’t. The feds will:
give away keys to other feds, or local cops, for bad faith reasons.
give away keys to other cops for good faith reasons, though the other cops are not authorized. This increases the attack surface.
misuse keys themselves for bad faith reasons, like spying on their ex-girlfriend.
have poor security from the start, and get their keys stolen by hackers, both foreign and domestic.
Every backdoor is a keyhole, and every keyhole is an access point. Once you give the govt access you have to assume hostile third parties have access, because they do.
Doing good cryptography is hard, and a lot of work. Designing a good key escrow system or other back door is more cryptographic work, so more chances to get it wrong, and more chances for the corporate overlords to demand corners be cut for cost savings.
Even if the software has meticulously perfect cryptography, the government definitely won’t. The feds will: