That description could mean that the client would be open-source for verification, but the server would refuse to communicate with any but official binaries -- I doubt that this was your intent, but if so, I'll be happy to write a full-page rant explaining why this is bad, without resorting to RMS-style moral arguments. (Starring Ken's back-door, of course.)

Tell the user to move it off the tablet. It's a private key, to deal with the possibility of the tablet being compromised, so you really don't want a copy of it sitting in the tablet...

Originally Posted by briand

IANAL, but...

If the tablet is in possession of the criminal when the unauthorized network access takes place (which, it can be shown, only took place because the criminal was in possession of the tablet as a direct result of a prior, connected criminal act), then it is the criminal (not the actual, true owner of the tablet) that would be liable for any criminal or civil penalties arising out of the unauthorized use (be it automatic or otherwise) of the (open or otherwise) wireless network with the tablet.

...in other words, even if the 'recovery script/program' does initiate what might, in some states, be considered an illegal network access attempt, the law will have been broken by the person in possession (albeit, criminally so) of the tablet at the time.

short answer: great! that's one more charge to levy against the miscreant when he is apprehended. bring it on!

I doubt that would hold up. Think of a bomb in a taxi. The taxi driver is driving the vehicle and does not know of the bombs existence. But the bad guy has a remote and sets the bomb off after the driver parks and exits the taxi. The person initiating the illegal action is at fault, even if you change the analogy to a car thief instead of a cabby.

Originally Posted by Benson

OK, so long as you're not involved with the maemo tool-chain, I suppose that works. And I won't bother with the rant, since you clearly understand the issues. I still don't see a real need for it, though, because I can't come up with any scenario where an attacker gains by modifying the daemon.

WRT Joe's snooping ways, if it's open source (and I'm completely in favor of that), he can just rip the camera-snapping and non-light-flashing bits out and make it redirect to local storage, or (if he's on a week-long business trip and doesn't have an SD) upload with mail, sftp, or whatever -- he doesn't really gain anything by using a hacked daemon with the server.

Supposing you go with the hash, there are ways different binaries would be generated (e.g. 770 vs. N8x0, linked against different libraries for different OSes), so you'd need a table of trusted hashes. And I build on the tablet, so my binaries might be different. I'm not prepared to be that untrusting, if various others are compiling and matching your binary, but I just don't like the idea, especially when I (perhaps for want of imagination) can't see any bad scenario it helps avoid...

(BTW, wasn't SHA-1 broken a couple years back? Something like 2^60-something instead of 2^80 for a collision, if my memory serves well. Not sure if that result gains anything for matching an existing hash, and it's still not much of an issue if it's 2^130 for matching , but it might not be the best choice.)

Originally Posted by Benson

Broken in the cryptographic sense; we found some faster way of generating collisions than brute-force. Obviously, if I'm hashing several KB into a 160-bit number, a collision with any particular result will occur one in 2^160 times by blind luck. If I'm just looking for two things with the same hash (not matching a given one), I'll only need around 2^80 tries. Any method that actually gives you collisions faster than random guessing is considered "broken"; although it's not yet feasible to crack it, it's not as secure as a simple bit-count would suggest. I don't think it's an issue here, though. (And I'm no cryptographer either; I know just about enough to read blogs by people who understand the journals and try to put it in lay terms.)

And by the way, thanks for taking the initiative on this project; I think it's going to be very useful, and my hat's off to you for coming up with ideas and working on it, while the rest of us are just spouting off ideas. (It's come up a couple times before, I even half-jotted some pseudo-code for some scripts to accomplish it, but nobody really dug in seriously like you're doing.)