[Cryptography] About those fingerprints ...

[Jerry Leichter]

On Sep 11, 2013, at 1:44 PM, Tim Dierks <tim at dierks.org> wrote:
> When it comes to litigation or actual examination, it's been demonstrated again and again that people can hide behind their own definitions of terms that you thought were self-evident. For example, the NSA's definition of "target", "collect", etc., which fly in the fact of common understanding, and exploit the loopholes in English discourse. People can lie to you without actually uttering a demonstrable falsehood or exposing themselves to liability, unless you have the ability to cross-example the assertions.
I wouldn't take it quite that far.  Government agencies always claim broader leeway than is granted to private actors - and even for NSA and friends, exactly how the courts will react to that language parsing isn't clear.  Even their pet FISA court, we now know from declassified documents, has angrily rejected some of this game playing - a second report of this is in today's New York Times.  Not that it did much good in terms of changing behavior.  And Congress, of course, can interpret stuff as it likes.

The standard for civil lawsuits and even more so for regulatory actions is quite a bit lower.  If Apple says "no fingerprint information leaves the phone", it's going to be interpreted that way.  Another article in today's Times reports that Google has had its argument that WiFi is "radio" hence not subject to wiretap laws soundly rejected by an appeals court.

> I don't have a precise cite for the Apple claim...
http://www.youtube.com/watch?v=TJkmc8-eyvE, starting at about 2:20, is one statement.  I won't try to transcribe it here, but short of a technical paper, it's about a strong and direct a statement as you're going to get.  People have a queasy feeling about fingerprint recognition.  If Apple wants to get them to use it, they have to reassure them.  It's a basic result of game theory that the only way you can get people to believe you is to put yourself in harm's way if you lie.

> ...[I]s the data indirectly accessible?
What counts as indirect access?  In one sense, the answer to this question is yes:  You can use your fingerprint to authorize purchases - at least from the iTunes/App store.  It's completely unclear - and Apple really should explain - how the authentication flows work.  Since they promise to keep your fingerprint information on the phone, they can't be sending it off to their store servers.  On the other hand, if it's a simple "go ahead and authorize a charge for user U" message, what's to prevent someone from faking such a message?  (In other words:  If the decision is made on the phone, how do you authenticate the phone?)

> ...Unless you can cross-examine the assertions with some kind of penalty for dissembling, you can't be sure that an assertion means what you think or hope it means, regardless of how straightforward and direct it sounds.
Courts are not nearly as willing to let those before them hide behind complicated and unusual word constructions as you think - especially not when dealing with consumers.  It is, in fact, a standard rule of contract law that any ambiguity is to be interpreted contrary to the interests of the drafter.

None of this is specific to Apple.  Commerce depends on trust, enforced ultimately by courts of law.  The ability to govern depends on the consent of the governed - yes, even in dictatorships; they survive as long as enough of the population grudgingly accedes, and get toppled when they lose too much of the consent.  And consent ultimately also requires trust.

The games the intelligence community have been playing are extremely corrosive to that trust, which is why they are so dangerous.  But we have to get beyond that and not see attackers behind every door.  The guys who need to be stopped run the NSA and friends, not Apple or Facebook or Google - or even the Telco's.

                                                        -- Jerry