What It's Like When The FBI Asks You To Backdoor Your Software...

Found this posted on Reddit this morning and thought I'd share...

At a recent RSA Security Conference, Nico Sell was on stage announcing that her company—Wickr—was making drastic changes to ensure its users' security. She said that the company would switch from RSA encryption to elliptic curve encryption, and that the service wouldn't have a backdoor for anyone.

As she left the stage, before she'd even had a chance to take her microphone off, a man approached her and introduced himself as an agent with the Federal Bureau of Investigation. He then proceeded to "casually" ask if she'd be willing to install a backdoor into Wickr that would allow the FBI to retrieve information.

What it's Like...

Gotta give her props for asking questions and not backing down and her reasons for not allowing a "backdoor" into the program.

reply to post by lovebeck


Forgive me for being skeptical but how do we know her statement isn't simply a publicity stunt? Is there any evidence that what she claims occurred actually occurred?

It sounds great, but her business is selling security. If there is evidence that the conversation occurred well I would feel more secure using that software.

reply to post by lovebeck


Maybe its my natural suspicion here, but I can't help but immediately think that this is just a PR thing to draw attention to her company. Maybe stage scenario so that people will be more likely to believe what she said about refusing to implement 'backdoors' into her program.

That was my knee-jerk reaction, because it seems to me that an actual FBI agent would have the common sense to not approach this subject in a public location while the woman has on a microphone. Just seems fake to me.

That said, if the woman's claims are true, then I think it is really great that she is taking her company in the right direction by refusing to allow willy nilly access to consumer info.

To me this all smells about the same as it did about two weeks ago.

Apple denounced the US Gov't as being hackers and purveyors of malware.

Yeah, so AWESOME of them to ONLY NOW come forward and announce this. What about when they willingly complied with the Gov't request in the first place? Where was their willingness to publicly point a finger then?


IMHO....if you use a computer...or software...guess what. Someone created it. That someone is nowhere near as altruistic as you'd like to believe.

an FBI agent i doubt would introduce themselves as such at an event like that and you'd want to see a badge etc not just some schmuck in a suit saying that they're from the FBI, plus if they want in they just get a tame judge to do the signing and whammo it'll be quicker to leave a permanent back door than respond to the incessant number of signed orders from a judge with a rubber stamp and perhaps have a monthly drop off of the orders along with a judgement that says you can't discuss it

reply to post by MojaveBurning

That was my knee-jerk reaction, because it seems to me that an actual FBI agent would have the common sense to not approach this subject in a public location while the woman has on a microphone. Just seems fake to me.

10-15 years ago, I would have agreed entirely with you and laughed at a story like this for the stupidity it would have been.

Now? We have SS Agents creating international incidents over $40 call girls. We have LEO's assigned to the first lady's detail...talking about killing them both. (a couple years ago)...and the FBI has played hell on retention of experienced agents to serve as a decent core for them to build new agents from.

If they have crap to train with because the older guys all hit the doors for retirement? They'll get crap agents from the process ...and that was one crappy agent if he was FBI.

From the article...A few paragraphs down:

This encounter, and the agent's casual demeanor, is apparently business as usual as intelligence and law enforcement agencies seek to gain greater access into protected communication systems. Since her encounter with the agent at RSA, Sell says it's a story she's heard again and again. "It sounds like that's how they do it now," she told SecurityWatch. "Always casual, testing, because most people would say yes."

She's not the first person to be approached in this manner...You have to think about the type of people they're approaching. Makes sense that they're going to go in with a casual type demeanor.

I'm surprised by some of the responses seeing this as a PR stunt and not something that actually happened. Where were you the last year or so?

I have no problem believing she was approached by an FBI agent. They probably have an incentive program for getting companies to "sign up" for the backdoor program.

The other possibility is that it was not an agent at all, but rather an undercover reporter trying to generate a story.

Either way... good for her!

I can completely believe this. They are very blatant, and most go along with it.

The worst part about it though is that while it might not have been their intention, the NSA has essentially declared war on our technology industry. After learning about things like finding exploits and keeping them hidden, putting in hardware backdoors, software backdoors, and so on... who is going to trust US technology? We have a government agency that's spending billions per year to either create vulnerabilities in our gadgets or find already existing ones.

While it wouldn't surprise me if the FBI did ask if she'd consider leaving a backdoor in her software, something about this story doesn't seem right.

Maybe from my perspective, if I were an FBI agent and wanted to make sure that there was a backdoor left in the software, I wouldn't have met in a public forum - I would've requested a "private meeting" or coffee date. By meeting in an open forum like that, just the fact that the FBI was there risks the company - I mean, if I knew that the FBI had backdoors in my software, and many of my clients knew this, wouldn't it put less faith in the product, knowing that the FBI could just waltz in and snoop around?

It's a good selling point: "Yeah, the FBI wanted me to leave a backdoor in, and I told them to shove it...", which makes this story sound like a PR stunt (Note to self: To sell more software, tell everyone that I put an "NSA blocker" in the app).

-fossilera

lovebeck
Found this posted on Reddit this morning and thought I'd share...

At a recent RSA Security Conference, Nico Sell was on stage announcing that her company—Wickr—was making drastic changes to ensure its users' security. She said that the company would switch from RSA encryption to elliptic curve encryption, and that the service wouldn't have a backdoor for anyone.

As she left the stage, before she'd even had a chance to take her microphone off, a man approached her and introduced himself as an agent with the Federal Bureau of Investigation. He then proceeded to "casually" ask if she'd be willing to install a backdoor into Wickr that would allow the FBI to retrieve information.

At a recent RSA Security Conference, Nico Sell was on stage announcing that her company—Wickr—was making drastic changes to ensure its users' security. She said that the company would switch from RSA encryption to elliptic curve encryption, and that the service wouldn't have a backdoor for anyone.

As she left the stage, before she'd even had a chance to take her microphone off, a man approached her and introduced himself as an agent with the Federal Bureau of Investigation. He then proceeded to "casually" ask if she'd be willing to install a backdoor into Wickr that would allow the FBI to retrieve information.

I quoted the OP because something very obvious stands out. I'll re-quote:

the company would switch from RSA encryption to elliptic curve encryption

In case people weren't paying close attention recently, the PRNG (Pseudo-Random Number Generator) inside Elliptic-Curve algorithm (more specifically, Dual EC DRBG), is the version that HAS been back-doored by the NSA!

RSA, as far as anyone is aware, is SECURE.

If she said exactly what the OP wrote, then I scream BS breaking records for amplitude. Far from increasing security, they would be back-dooring themselves (knowingly or not).

A bit more digging, and it seems the source of that particular quote was Max Eddy of pcmag.com. It seems everyone else is quoting him.