Home » Posts tagged "fbi"

VPN 保留連線記錄幫助 FBI 抓犯人

這應該是這幾天鬧得蠻大的事情:「PureVPN Logs Helped FBI Net Alleged Cyberstalker」。

起因在於 PureVPN 的廣告寫著他們不會記錄:

但在證詞裡卻提到 PureVPN 有記錄:

“Significantly, PureVPN was able to determine that their service was accessed by the same customer from two originating IP addresses: the RCN IP address from the home Lin was living in at the time, and the software company where Lin was employed at the time,” the agent’s affidavit reads.

然後回頭看 PureVPN 的 Privacy 條款發現他們在條款裡面寫著他們會記錄連線資訊:

Our servers automatically record the time at which you connect to any of our servers. From here on forward, we do not keep any records of anything that could associate any specific activity to a specific user. The time when a successful connection is made with our servers is counted as a ‘connection’ and the total bandwidth used during this connection is called ‘bandwidth’. Connection and bandwidth are kept in record to maintain the quality of our service. This helps us understand the flow of traffic to specific servers so we could optimize them better.

然後被告 Ryan S. Lin 就幹剿了:

“There is no such thing as a VPN that doesn’t keep logs,” Lin said. “If they can limit your connections or track bandwidth usage, they keep logs.”

以後挑 VPN 還得仔細看條款裡面留 log 的部份啊...

Apple 打算把 iCloud 加密用的 Key 放到用戶端

在經過最近 FBIApple 的戰鬥中 (FBI–Apple encryption dispute),Apple 正規劃把 iCloud 加密所使用的 key 放到用戶端裝置上,而非放在伺服器端:「Apple to Hand iCloud Encryption Key Management to Account Holders」:

In effect, Apple is following the lead of secure cloud services such as SpiderOak which has been offering what it calls “Zero Knowledge” cloud storage. By that, SpiderOak retains no information about whatever is stored in its cloud service, nor the means of gaining access to it.

也就是加解密都放在 client 端處理,server 端只是 storage。

這類型最大的問題是 server 端沒辦法運用資料,但 iCloud 的確可以放掉這些功能 (搜尋之類的),純粹當 storage 使用,藉以讓使用者自己裝置保護。

而蘋果在使用者的裝置上把類似於 HSM 的系統做的頗強大... 不知道 Android 有沒有機會也跟進。(雖然我自己是用 Apple 家的東西...)

Amazon Fire 會把加密系統弄回來

FBIApple 的戰爭開打後,愈來愈多安全與隱私問題被重新拿出來檢驗,而 Amazon 也決定將 2015 年拔掉的加密功能搬回 Fire OS 裡:「Amazon Reverses Course, Encryption Returning for Fire Devices」:

Amazon.com Inc. will restore encryption as a security option on its tablets and other devices that use the Fire operating system, following a customer backlash driven by increased sensitivity about data protection as Apple Inc. grapples with the FBI over access to a terrorist’s iPhone.


Amazon reversed course late Friday night, saying in an e-mail that it would restore encryption as an option on Fire devices with a software update “this spring,“ without being more specific.



紐約時報報導 National Society of High School Scholars 問了一萬八千名美國年輕人 (15~29 歲) 理想的職業,也不少出乎意料的結果跑出來:「The New Dream Jobs」。

常見的網路公司在上面,但讓紐約時報感到意外的,FBICIANSA 也在上面:

When the National Society of High School Scholars asked 18,000 Americans, ages 15 to 29, to rank their ideal future employers, the results were curious. To nobody’s surprise, Google, Apple and Facebook appeared high on the list, but so did the Central Intelligence Agency, the Federal Bureau of Investigation and the National Security Agency.


聯邦政府僱用 CMU 的人研究攻擊 Tor

先前 Tor Project 有提到外面報導 FBI 在 2014 年時僱用 CMU 的人研究 Tor 的弱點並且加以攻擊:「Did the FBI Pay a University to Attack Tor Users?」。

這的確是錯的,因為不是 FBI,而是 DoD (美國國防部) 僱用的 (瞬間噴出茶來):「Judge confirms what many suspected: Feds hired CMU to break Tor」。Tor Project 的反應在「Statement from the Tor Project re: the Court's February 23 Order in U.S. v. Farrell」這邊。

A federal judge in Washington has now confirmed what has been strongly suspected: that Carnegie Mellon University (CMU) researchers at its Software Engineering Institute were hired by the federal government to do research into breaking Tor in 2014.


FBI 的搜索「創意」被美國法院否決

Zite 上看到「FBI can’t cut Internet and pose as cable guy to search property, judge says」這篇文章,講 FBI 的「創意」被法院給否決。

搜索的手段是這樣發生的。FBI 的人先把網路給剪斷,然後偽裝成修復工人進去搜索:

The Las Vegas court frowned on the FBI's ruse of disconnecting Internet access to $25,000-per-night villas at Caesar's Palace Hotel and Casino. FBI agents posed as the cable guy and secretly searched the premises.


The government claimed the search was legal because the suspects invited the agents into the room to fix the Internet.


Permitting the government to create the need for the occupant to invite a third party into his or her home would effectively allow the government to conduct warrantless searches of the vast majority of residents and hotel rooms in America,