Ring Says New Encryption Limits What It Can Give Police (theverge.com)
- Reference: 0185231013
- News link: https://it.slashdot.org/story/26/08/27/2014225/ring-says-new-encryption-limits-what-it-can-give-police
- Source link: https://www.theverge.com/tech/984838/ring-take-encryption-throw-away-the-key-law-enforcement
> Ring says TAKE uses unique, rotating encryption keys for your footage, stored in a secure enclave and accessible only under strict conditions -- based on the features you enable on your account. Currently, footage captured by Ring cameras is encrypted in transit to the cloud and at rest, and then decrypted for Ring to process for those smart features. With TAKE, the encryption keys change for every five minutes of footage. Ring stores copies of those keys to decrypt the footage, but throws away each copy within 24 hours, "leaving you with the keys and full control of your videos," according to Ring.
>
> TAKE was developed using Messaging Layer Security, an open standard from the Internet Engineering Task Force, according to Ring. The company says it is "inspired by the privacy principles of E2EE (end-to-end encryption)," which Ring offers on some of its cameras. However, the two systems work differently. With E2EE, Ring never has the keys and can't process your video for cloud-based features. Both options are available on newer cameras that encrypt on-device, and you can switch between the two. Older cameras encrypt at cloud ingress and only support TAKE.
>
> According to a [3]white paper the company published today, Ring's copy of those keys is managed inside an AWS Nitro Enclave, to which Ring's access is restricted by "access controls, cryptography, and hardware isolation." The company claims there is no persistent storage and no way for a Ring employee to access it. The stored keys can only be unlocked by the enclave through cryptographic attestation that proves it's running the exact software image Ring approved. The enclave releases a temporary key when an enabled service requests it.
When asked about what happens if Ring is subpoenaed by law enforcement, a spokesperson for the company said: "Where TAKE is enabled, Ring will only be able to provide non-video information (such as basic subscriber information) and encrypted video files in response to the valid legal process. We have updated our Law Enforcement Guidelines to reflect this change."
[1] https://www.aboutamazon.com/news/devices/ring-take-encryption
[2] https://www.theverge.com/tech/984838/ring-take-encryption-throw-away-the-key-law-enforcement
[3] https://assets.aboutamazon.com/e8/64/d5c572c74f11b5e55bcb93b63bd8/ring-ae-e2ee-whitepaper-august-26-2026.pdf
Translation: They want more money for the data (Score:2)
Now that "Ring" is known to collect surveillance data on such a massive scale, they probably just want to invent some "reasons" why future buyers of that data will have to pay a higher price... like "because somebody has to copy the keys to the customer before they are deleted on Ring's servers".
"Permanently Deletes After 24 Hr" (Score:2)
Still plenty of time to utilize in a manhunt for diss^H^H^H^H escaped convicts.
Re: (Score:2)
How often does that happen? Meanwhile stranger-initiated outdoor or home-invasion rapes and street murders are happening at tens of thousands annually most of them going unsolved and barely mentioned in the police blotter let alone news (which 99% of people dont watch anyway).
Reference: [1]https://bjs.ojp.gov/library/pu... [ojp.gov]
[1] https://bjs.ojp.gov/library/publications/victimization-during-household-burglary
Re: (Score:2)
> How often does that happen?
How often do political dissidents disappear? Something tells me they don't make records for that public, unlike all the crimes they like to blame "illegals" for (ignoring the majority of arrests for these crimes are [1]of Caucasians [fbi.gov]).
[1] https://ucr.fbi.gov/crime-in-the-u.s/2019/crime-in-the-u.s.-2019/topic-pages/tables/table-43
Almost like you own it (Score:2)
Wow, a couple more changes like this and RING uses will have almost as much rights as people that do not connect their hardware to other company's businesses.
We throw away the keys, honest! (Score:2)
Sure you do. Just like the USPS deletes their scans for routing instead of sending them to the feds
Seems reasonable (Score:2)
Companies should, in general, avoid keeping any user data one second longer than they legitimately need it. Data should be viewed as a liability more than an asset, and every company that achieves significant scale with user data soon realizes this, though some take longer than others to learn the lesson.
The reason it's a liability is because it exposes the company to an endless stream of warrants and subpoenas, and contrary to popular belief, the government does not pay for that data. In some cases the
The benefits of the surveillance state (Score:2)
Surveillance protects us all. It is a keystone in keeping our nation safe and free. Think about how you never have a package stolen off your porch anymore. And how our bicycles are totally safe in San Francisco, no need to double lock and remove the seat anymore. And let us not forget that mass surveillance prevents terrible crimes like [1]summary executions out at sea [pbs.org]. And even prevented a pedophile and adjudicated rapist from being elected President. GOD BLESS THE USA!
[1] https://www.pbs.org/newshour/world/all-the-u-s-military-strikes-against-alleged-drug-boats
It does, does it? (Score:2)
Seems their new encryption only limits what they can give law enforcement, until they are motivated to do otherwise.
It's not like they can't push an update to the device to have it dump it's encryption key back to the mothership.
If you don't want other people looking at it, get it off the cloud. Period.
Interesting.... (Score:2)
> Ring is rolling out a new default encryption system
Interesting: Amazon-owned Ring is able to have new 'default' enabled (read: auto opt-in - the hard path) in an existing product/feature.
Extra interesting: Also Amazon-owned Twitch [1]somehow cannot figure out automatic opt-out [slashdot.org] (read: leaving it 'off' by doing nothing - the easy path -, and only enabling it when users turn it on - the harder path) on existing product service.
[1] https://games.slashdot.org/story/26/08/13/1853232/amazon-will-train-on-twitch-streamers-content-by-default-unless-they-opt-out
But... (Score:2)
They still have the keys.