I compile my SSH and IPSec stuff from source. How exactly are they going to keep me from commenting out the access hooks before I compile, or replacing them with code that fakes the hooks? Eg., if they require the actual key to be included encrypted with their master key, I just change the code to encrypt a random number and put it there instead of the real key. Simply put, the only way these laws can actually work is if the government takes over total control of the endpoint hardware and software and prohibits people from running their own programs, and that's not going to be feasible.

[ reply ]

Link to this comment: http://www.securityfocus.com/comments/columns/261/27997#27997