Hacker Timesnew | past | comments | ask | show | jobs | submit | crypto_throwa's commentslogin

Without open source, end to end encryption is useless. It's not hard to hide a piece of code that defeats the encryption in closed source code.


iMessage is end to end encrypted. Although Apple says it secure and the courts and FBI seem to not be able to get it in, it is still closed source.


I can't tell if I'm being paranoid or just realistic, when I suspect that FBI/Apple fights over decrypting/unlocking iPhones or iMessage are just part of Apple's security theater.

If I were Evil-Tim-Cook, I'd have a deal with the FBI (and other agencies) where I'd hand over some user's data, in return for them keeping that secret and occasionally very publicly taking Apple to court demanding they expose a specific user and intentionally losing - to bolster Apple's privacy reputation.


> If I were Evil-Tim-Cook, I'd have a deal with the FBI (and other agencies) where I'd hand over some user's data, in return for them keeping that secret and occasionally very publicly taking Apple to court demanding they expose a specific user and intentionally losing - to bolster Apple's privacy reputation.

The FBI wants its investigations to go to court and lead to convictions. Any evidence gained in this way would be exposed as coming form Apple; notwithstanding parallel construction:

* https://en.wikipedia.org/wiki/Parallel_construction

As for other agencies, I'm sure many have exploits to attack these devices and get spyware on them, and so may not need Apple's assistance.


I imagine if you have the information parallel construction becomes trivial.


The killers app for ai.


It's possible for it to be a facade, but also real.

Apple is a part of PRISM so there's approximately a 100% chance that anything you send to Apple via message, cloud, or whatever else, gets sent onto the NSA and consequently any agency that wants it. But the entire mass data collection they are doing is probably unconstitutional and thus illegal. But anytime it gets challenged in courts it gets thrown out on a lack of standing - nobody can prove it was used against them, so they don't have the legal standing to sue.

And the reason this is, is because its usage is never acknowledged in court. Instead there is parallel construction. [1] For instance imagine the NSA finds out somebody is e.g. muling some drugs. They tip off the police and then the police find the car in question and create some reason to pull it over - perhaps it was 'driving recklessly.' They coincidentally find the cache of drugs after doing a search of the car because the driver was 'behaving erratically', and then this 'coincidence' is how the evidence is introduced into court.

----

So getting back to Apple they probably want to have their cake and eat it too. By giving the NSA et al all they want behind the scenes they maintain those positive relations (and compensatory $$$ from the government), but then by genuinely fighting its normalization (which would allow it to be directly introduced) in court, they implicitly lie to their users that they're keeping their data protected. So it's this sort of strange thing where it's a facade, but simultaneously also real.

[1] - https://en.wikipedia.org/wiki/Parallel_construction


> the entire mass data collection they are doing is probably unconstitutional and thus illegal. But anytime it gets challenged in courts it gets thrown out on a lack of standing

It's kind of wild that this is the part of the deep state MAGA just forgot about.


Maybe. I think they'd have a hard time keeping that under wraps—governments aren't typically very careful (and the FBI is about as careful as a bull in a china shop) about not showing their hand when it comes to charging people. If you're strict about keeping certain info on certain channels, smart observers would notice if someone were snooping.

For instance, if someone shared something incriminating in a group chat and got arrested, and that info was only shared in the group chat, they'd have to silence everyone in that group chat to ensure that the channel still seemed secure. I don't think at least our government is that competent or careful.

But also, people wayyyy overhype how much apple tries to come off as privacy-forward. They sell ads and don't even allow you to deny apps access to the internet, and for the most part their phone security seems more focused on denying you control over your own phone rather than denying a third party access to it. I think they just don't want the hassle of complying with warrants. Stuff like pegasus would only be so easy to sell if you couldn't lean on the company to gain access, and I think it'd be difficult for hundreds of countries to conspire to obscure legal pressure. Finally Apple generally has little to gain from reading your data, unlike other tech giants with perverse incentives.

Of course this is all speculation, but I do trust imessages much more than I trust anything coming out of meta, and most of what comes out of google.


> someone shared something incriminating in a group chat and got arrested, and that info was only shared in the group chat

“Only” is doing an incredible amount of work there.

Unless you concoct something incriminating solely for the purpose of testing this, the something incriminating being discussed in group chat previously happened in the real world. Ripples of information were created there and can be found (parallel construction).


Right, but parallel construction only works if opsec fails. Good luck with repeating that feat forever. You clearly have far more faith in the FBI than I do. Now repeat this feat for every dumbass in intelligence in every country.


My position doesn’t require a lot of faith in the FBI.

If they fail in parallel construction, they always have the option to continue. For the vast majority of cases where opsec isn't 100% foolproof, we hear about them. For the few cases where it was foolproof, we just don't hear about them.


It requires faith that they prioritize keeping such abilities a secret rather than prosecuting, and again, I do not share this faith.


> For instance, if someone shared something incriminating in a group chat and got arrested, and that info was only shared in the group chat, they'd have to silence everyone in that group chat to ensure that the channel still seemed secure.

Corrupt investigators can use parallel construction to pretend that the key breakthrough in the case was actually something legal.


See the sibling comment. The odds of nobody noticing still don't make any sense.


PRISM went undetected for a long, long time and it's essentially a wiretapping of the entire internet.

Clearly, you are underestimating the intelligence and capabilities of the US government. They have a lot of money. Like... A lot of money.


What do you think I based this analysis on?


Wouldn’t it be easier to just not do that and have the same thing happen, but for real?


iMessage backups in the cloud are subject to warrants. Even if you don't use iCloud backups, can you be sure everyone you communicate with also abstains?


Aren’t those encrypted with a key that lives on your device only?


Only if you enable Advanced Data Protection, but in that case, yes, absolutely


how would you restore if you lost your device?


Backups with Advanced Data Protection also enroll:

* Recovery Keys

* Recovery Contact (someone who holds your recovery key in key escrow)


right, the ability to recover implies keys exist outside the device. even if they gossip keys to other devices you control, there are lots of people with only a single apple device.


Just don't back it up to iCloud!


Not able to get into it legally or without consequence, it is not infallible.


It is actually quite difficult.


Curious, is there a poc somewhere demonstrating an attack like this ?


Sure:

  plain_msg = decrypt(encrypted_msg)
  send_to_nsa(plain_msg)


If you look at who supports this theory, it's all ego-driven software engineers who believe they can solve physics from first principles, ignoring hundreds of years of evidence that these laws do apply.

Highly recommend reading this book for how these sci-fi theories are being used to promote eugenics, climate destruction, and pseudoscience: https://www.amazon.com/More-Everything-Forever-Overlords-Hum...


As soon as the article mentioned Ray Kurzweil, I knew there was no scientific basis for the claim.


I'm in a chat with one of the engineers on DOGE (young college dropout), and they're trying to recruit more young college dropouts to work on DOGE.

I would characterize some in this group as believing they're smarter than everyone else or anything that's been done before, so yes I think it's pure hubris.

There are a lot of bright people in the chat working on very important things, but they're not the ones joining DOGE.


Here's one situation where it is very different.

Say I get paid 100 BTC for doing a job worth $100/BTC at the time or $10000. Now, say BTC drops to $1/BTC. I owe income tax on the $10000. Let's say I owe $2000 (20%) in taxes. However, I only have $100 now. My effective tax rate is 2000%.

This does allow for a small deduction of capital gains each year. However you can only deduct $3000 a year in capital gains. In a larger scenario, this would take decades to fully receive your total deduction.


> Here's one situation where it is very different.

Good god, no it is not different.

When the internet bubble collapsed in 2000, it literally bankrupted some people who had been compensated with stock options because of taxes. Exercising the options not only had resulted in greater income, but it caused AMT to kick in.

Moreover, some of the exercised options yielded stock that was still in lock-up due to IPO agreements. (People were anxious to start the long-term capital gains clock.) Shares plummeted even before they could be sold to pay off the taxes due.

The moral of the story is: Make sure to set aside money (liquid, USD) for taxes if you get hit with a sudden windfall. (edit addition, JumpCrisscross comment below has it right.)

Here's a couple of links to that history:

https://www.chicagotribune.com/sns-tech-taxes-story.html

https://www.mercurynews.com/2008/11/10/rescue-bill-offers-re...


> When the internet bubble collapsed in 2000, it literally bankrupted people who had been compensated with stock options

Best practice is to sell stock sufficient to pay for taxes when exercising options. (Same for workers subject to U.S. taxation being paid in a foreign currency.)


Alternatively, you can sell a covered collar that protects your downside enough to know that you'll have the cash on hand come tax time. This limits your upside somewhat, but usually less than selling the stock outright. Mark Cuban famously used this strategy to protect his Broadcast.com payout under lock-out.

https://www.acceleratedfi.com/real-world-options-example-how...

(Check the details of your contracts with an attorney and financial advisor; I've heard that some lock-outs now explicitly forbid trading in derivatives of the stock to prevent doing what Cuban did. With financial engineering being as advanced as it is, though, it's always possible to create a "synthetic" derivative that is nearly guaranteed to have the same value as a particular options strategy without mentioning the particular asset involved.)


Trading options against employer's stock may be forbidden by insider trading policy. It was in my previous job (along with shorting, and only trading during trading windows). Can't say I disagree with such policies.

Other than that yeah, get a collar or just straight up buy some puts. Or like others recommended - sell some % instantly and put in high grade bonds, or a savings account. Forgetting taxes is a big mistake.


Isn't the whole point of the story that they weren't allowed to sell when they exercised their options?


> Isn't the whole point of the story that they weren't allowed to sell when they exercised their options?

The story most applicable to cryptocurrencies is the one where the stock was publicly traded [1]. Those exercisers chose not to sell.

(With respect to ISOs for private stock, yes, it's different. Best practice is not to exercise until you have a plan for paying taxes. This could be lining up a loan or a secondary sale, or only exercising what you can pay for.)

[1] https://www.chicagotribune.com/sns-tech-taxes-story.html


I chose NOT to exercise options and let them simply expire because they will illiquid and I didn't expect the company to every be worth anything. (It turns out that was wrong!)

This is why I was annoyed when Congress bailed out these dot-com specu-vesters. They knew the risks, or should have. I chose not to exercise because of the tax consequences. They were no secret. Anyone buying stock options should know what they are and how they're taxed.


This is not different.

Coincidentally, I was the engineer at Zenpayroll (now Gusto) who was working on enabling employees to be paid in crypto back in 2013/2014. We never got to the implementation phase because of precisely this scenario. Bitcoin is so volatile that it's a very scary way to be paid. The downside risk (you can't pay rent because bitcoin did something weird that week) is really really bad for users and most people don't understand those or the tax implications. So we scrapped the feature.[0]

A parallel would be stock options issued by companies. Let's say you get 100 stock options with a strike price of $1/per share. You wait a year to exercise and by that point the common stock is valued at $2.50 per share. If you exercise, you still pay $100 for the 100 shares but you owe taxes on the $150 gain, even though you might think that your compensation was always $100.

If you acquire an asset at one price and sell it at another, you owe taxes on the difference. If you acquire an asset for less than it's worth, you owe taxes on that.

[0]: this is one reason why I will never understand people defending btc as "a store of value". That's a terrible store of value!


What about setting up partial compensation on a sliding scale? If my rent+bills+other fixed expenses is X% of my income, I could just take as much as cash as will pay for that and take out the rest of the 1-X% in crypto

That said, unless there are tax implications of paying/getting paid in BTC that cause you to e.g. not realize gains, it's really no different than just paying the employee in all cash and letting them purchase as much crypto as they want with it.


Not a bad idea.

There were other issues as well that contributed to the decision, namely:

- Legality: there are specific regulations around how employees can be paid. These stem, historically, from companies paying employees in coupons only redeemable at other company stores (think: railroad workers paid in coupons for the general store owned by the railroad.

- Reversibility: What happens if the payroll needs to be reversed? With bitcoin you can't. This is important for cases of fraud (e.g. stolen credentials), user error (e.g. mistyping hours worked), or bugs on our end.

- Anti-money laundering: We needed to be reasonably sure you weren't laundering money. In case you were, having a bank account makes tracing the money much easier. Coin tumblers and the like make obfuscation and cleaning dirty money trivial.

- User adoption and education: How many people really want this feature versus others in the pipeline? If we ship it, what load does this put on our support team to handle calls about bitcoin? About losing their private key?

These are a subset. There are many concerns. I hear you about employees taking that money and buying it anyway, but we did have additional concerns to think about. We weren't against crypto, but it wasn't a good fit for our platform, userbase, size, priorities, etc.


How is this different from just converting 1-x% of your pay schedule into bitcoins yourself?

I'm not sure the option to be paid in numerous currencies concurrently is a big feature for payroll.


What if you get paid in meat, $100k worth of meat, but then you spoil all of them so they're now worth $0. It's not government's problem if your currency is volatile. You can find a job that doesn't pay you in BTC.


Great response, really clear and simple


The problem there is that meat doesn't come in dollars; it comes in kilograms.

If you are paid in meat, you get something like 100 kg of pre-formed frozen ground beef patties. That doesn't have a dollar value unless you can find a buyer for it. Which is pretty easy to do if it's a commodity.

So let's try a more broken example. You get paid in sandstone triangular prisms machined to be 31 mm on the two longer sides, 19 mm on the short side, and 9mm in height. These then have a square(-ish) hole drilled in them, slightly off center, and then the sides are grooved, and the faces engraved. These triangles are called fubaar.

Fubaar have no fixed exchange rate with the dollar. For a job, you are paid 1000 fubaar. The value of a fubaar is very stable. One has been able to purchase the traditional formal attire of Barbazia for exactly 5 fubaar, for over 800 years. But you can't buy much with them on the international market except quuxfruit--which bruises easily, and smells like durian crossed with feet after four days.

At the end of the year, I could report that I earned 1000 fubaar since last year, and mail about 250 of them to the treasury. It's not my problem if the government can't convert them to dollars. They can go buy quuxfruit with it. But the treasury won't take anything but dollars. My only recourse is to say the fubaar represent $0 in income, because they really are essentially worth $0, having no inherent value.

The problem is that the gov't is levying taxes in dollars on income that is not dollars, and exporting the inconvenience of conversion to those least able to get a good conversion rate. Congress has the enumerated power to regulate the value of foreign coin. Why not use it? The Treasury also has the ability to accept foreign coin. For a good length of US history, much commerce was conducted in Spanish silver dollars, not US-minted coin. Those were acceptable for payment of taxes.


Whether the unit of measure is kg or bits or unicorns doesn't make a difference since the value at the time of the transaction is what is taxed.

Also your example is very convoluted, and with all due respect, I can't tell if it's satire or not.


I'm fairly sure it's not satire. Some people just think that way.


I think I follow what you're saying, you think the IRS should accept BTC as the tax payment, so it is at least always correlated to the asset you earned/lost.

While I agree, it's kind of backwards to ask for this now, after the IRS is finally making their moves/intentions clear. I know a majority of the crypto crowd was quietly hoping the IRS wouldn't keep track of the absurd money people were making, so this just feels like a reckoning.


If there is no inherent conversion rate then how does the government define how much you owe?


That's just it. They require you to say how much it was worth when you got it.

But they really have no way to know whether you are lying. As a result, people lie about the value of traded goods, or art, or land properties, or unlisted financial instruments, to reduce the amount of income tax they purportedly owe. This is a major tax-evasion (not avoiding) and/or money-laundering loophole employed by the rich, especially when employing art and real estate, which may be justifiably non-comparable to similar goods due to uniqueness.

A law-obeying person would liquidate enough of the subjective-value goods to pay income tax at the maximum withholding rate at the time of receipt, and send that amount to the IRS at the end of the quarter, then claiming a refund from that amount with their return at the end of the year.

A practical, law-breaking person would just keep their mouth shut about it, and allow the IRS to claim it was income that had value, and only pay taxes on it (or dispute the amount demanded) if the IRS actually demanded an amount.

The enforcement on Bitcoin-holders is not to raise revenue in any meaningful sense. It is to discourage use of cryptocurrencies as a means of tax evasion--probably because middle-class people could make use of it. With respect to the means employed by the rich to evade and avoid taxes, an equivalent effort would likely return 1000 times greater rewards.


I agree with you, but "My effective tax rate is 2000%" is a huge stretch. No, you got taxed 20% when you generated the income. Just because the place-you-keep-your-money blew up doesn't increase your "effective" tax rate or any other. It's a you problem if your mattress-full-of-cash burns down, or your bank goes out of business, or whatever -- you were taxed at the time you generated the income, and if you didn't set the money aside at the time, that's not the government's problem. You can't really say they're increasing your tax rate.


And easily mitigated by converting the amount you owe in tax at the time your are paid. I don't see how this would be different than getting paid in any other currency.

The problem in your scenario is not really to do with tax, it's that one has effectively expended $10,000 worth of effort for $100.

If someone was worried about this, they shouldn't be accepting BTC as payment, or they should convert it to fiat currency immediately upon receipt.


Agreed, its analogous to being paid $10k and immediately buying BTC.


This situation is treated the same as the following:

Say I get paid $10,000 for doing a job, and buy bitcoin at $100/BTC. Now, say BTC drops to $1/BTC. I owe income tax on the $10000. Let's say I owe $2000 (20%) in taxes. However, I only have $100 now.

The smart way to handle that would be to deduct approximate income taxes "immediately" and convert to USD. This scenario is part of why income taxes are deducted per-paycheck instead of just once at the end of the year.


This is why you shouldn't accept payment in any currency other than the one you pay your taxes with. It's effectively investing 100% of your income in a single asset.


True.

But you could also say that you shouldn't accept payment as the entity that will pay taxes. That's what Apple, for example, does for non-US revenue. And what Mirimir does, in a small way.


Oh yeah, for sure. If you can prove that all of your income was earned by a shell company in Ireland, you should definitely do that. :)


It's not different at all. Copying from my other comment:

When my RSU stocks vest, I pay (regular income) taxes on the vested amount. It's treated as if my company gave me the money to buy these stocks I now have. Later when I sell them, I'll pay capital gains tax on the gain/loss.

What you describe is exactly this, with stocks instead of BTC. If my employer gives me any stocks, I have to pay income tax on the value of the stock calculated on the day I received it.

Now I know stocks are volatile. If I decide not to sell them immediately (at essentially 0% capital gains tax), I am deciding to take the risk in price fluctuations.

BTW, if your BTC drops to $100 value in under a year, simply sell them and claim the loss. It will typically be taxed at the same rate as your income, and you'll effectively only pay income tax on $100.


How is this different from any other sort of security that drops in value? You make a conscious decision to hold a volatile security. You could have just as well sold it and put it into An index fund.


>My effective tax rate is 2000%.

Sounds like a pretty good reason not to get paid in Bitcoin, no? How is the ridiculous volatilty the government's problem?


But that's no different than if you got paid in a foreign currency, or shares of stock.


It's the exact same as if you'd be paid in a foreign currency right before it depreciates signifcantly.


Yes, my WAG is that I would be studying tax law in relation to forex investing before claiming crypto is somehow different....


>Here's one situation where it is very different.

It's not.


This is the risk of dealing with crypto, it is not different and the same as anything else. Volatility doesn't change the taxation premise.


Guidelines | FAQ | Lists | API | Security | Legal | Apply to YC | Contact

Search: