Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Petition UK government to not ban encryption

petition.parliament.uk

Post reply on HN
Print view View original

41–50 of 113 posts

Re: Petition UK government to not ban encryption

#41

Post by burke »

navait wrote: post #20
untog wrote: post #16

Urgh. This should be better phrased. From the BoingBoing article: David Cameron says there should be no "means of communication" which "we cannot read" It's very specific to communication, and reading between the lines, messaging, as opposed to something like HTTP communication between a bank and a customer. Don't get me wrong, it's still incredibly stupid, but the government will be able to reply to this petition wi…

Apparently our politicians should understand infosec to demand policy, but the people don't have to understand their goverment to demand policy.

One would hope that the legislating body would be held to a higher standard.

Re: Petition UK government to not ban encryption

#43

Post by LunaSea »

Joeboy wrote: post #40
LunaSea wrote: post #30

Earlier quoted context omitted.

How can you have a situation where the HTTPS used to secure communication between two peers is different than the HTTPS used between a bank and one of it's clients ? This just shows serious misinformation on your part.

The number of people that can implement secure communications without relying on third parties is close enough to zero that they basically don't count. ISIS recruitment would plummet to zero if people had to get TLS working before joining.

I don't think that you understand that the TLS technology used for online banking (which would still be legal) is the very same technology that lets you create a secure communication channel with other users.

Re: Petition UK government to not ban encryption

#44

Post by onion2k »

arianvanp wrote: post #4

Honestly. I'd like to see them try to ban it. They'll see their entire internet economy crash and hell will break loose. People getting pissed why they can't login to gmail or facebook or paypal or do any online shopping. It's such an entirely ridiculous idea that i can't even describe it in words. Okay to be honest I haven't really read into the material. but is their actual plan to "ban" encryption? Or do they want…

They'll see their entire internet economy crash and hell will break loose.

The point is that the government want to ban encryption that they can't can't view. That essentially means you'll only be able to run an encrypted service if you're happy to hand over the unencrypted data to the government. It might also mean that end-to-end encrypted services are blocked by ISPs. But the average internet user will still see the little padlock in their browser, so they'll believe it's all still fine, and will carry on as normal.

What the government really seems to fail to understand[1] is the principle that if they can view the decrypted information then so can the bad guys.

[1] Or, I suspect, they do understand but they arrogantly believe they're better at security.

Re: Petition UK government to not ban encryption

#45

Post by IlPeach »

spuz wrote: post #21

The government's story has been "we need a way to access people's data so we can catch pedophiles, drug dealers and terrorists" and it seems there is a widely held belief that in order to do this, they would need to either ban encryption or weaken it sufficiently to make it effectively useless. However, as far as I can tell, backdoors into your phone or your desktop PC already exist. All the government has to do is c…

Or simply start instilling the idea into ignorant people's minds that crypto is bad and just keep repeating that until it becomes a "truth", or gain votes or leverage on the right occasion when needed with "we told you so".

Re: Petition UK government to not ban encryption

#47

Post by agd »

onion2k wrote: post #35
agd wrote: post #33

Cameron is not really trying to ban encryption (or even ban end to end encryption apps). This is misdirection in the run up to new surveillance legislation. The real issue is 'bulk collection'. The UK government is trying to frame the debate such that the concept of mass surveillance is not challenged.

Bulk collection is rendered entirely pointless by end-to-end encryption because the government would just end up with vast amounts of data they can't read. I would say the UK government is trying to ban encryption, and for exactly that reason - they want mass surveillance that is 'useful' (for the government's definition of useful, which is not the same as mine or yours).

The GCHQ geeks are not stupid, they know banning end-to-end encryption is not really feasible.

Yes, increased usage of it will harm "bulk collection" but not too much. Your whatsapp might be end-to-end encrypted, but companies such as facebook and google aren't going to change too much because it would harm their business models.

Re: Petition UK government to not ban encryption

#48

Post by w0000t »

smcl wrote: post #32
chrisdew wrote: post #13

Earlier quoted context omitted.

> I expect the language to be broad and the enforcement narrow. That's the worst kind of law - you can be locked up at a prosecutors whim. In the UK, it's already illegal not to disclose the key to an encrypted file.

Is there any scheme which permits a data to be encrypted such that there are two passwords\keys which can decrypt it - one which unlocks the real data and the other to some dummy\innocuous stuff?

Storing the different information in the same place is impossible. You could use stenography but then anyone with access to the program/source will immediately discover the deceit.

You can use what hiq is suggesting, https://news.ycombinator.com/item?id=10097533, but that is a different method.

Re: Petition UK government to not ban encryption

#49

Post by zorked »

dr_zoidberg wrote: post #23
chrisdew wrote: post #13

Earlier quoted context omitted.

> I expect the language to be broad and the enforcement narrow. That's the worst kind of law - you can be locked up at a prosecutors whim. In the UK, it's already illegal not to disclose the key to an encrypted file.

It's fun, in Argentina we've had a case were a criminal releasing the key nullified the evidence, because the criminal's lawyer argued that (under Argentinian law): * He was forced ("tortured" was the word used) to disclose the key by the police. * You can't accuse yourself or direct relatives, and disclosing an encryption key that resulted in incriminating evidence was argued to be a form of "self incrimination". *…

The rule against self-incrimination is a very important part of Roman law - the government can't force you to do anything that would lead to your conviction.

That's why the Brazilian police has a hard drive that is known to have tons of incriminating evidence against a number of bankers but they can't do anything about it because, well, TrueCrypt.

It sounds ridiculous that the discovery of a body would be nullified because the evidence leading to it was nullified but this is important because it forces the prosecution to comply with the law. It helps avoid the violation of a fundamental right.

I don't necessarily find that Roman Law is superior to Common Law but all of the silliness about people being forced to type passwords could be avoided with this very reasonable provision. Common Law allows you to incriminate yourself by forcing you to prove your innocence by assuming guilt unless you can prove your innocence via decryption - let's hope we can all remember all of passwords!

Re: Petition UK government to not ban encryption

#50

Post by hiq »

smcl wrote: post #32
chrisdew wrote: post #13

Earlier quoted context omitted.

> I expect the language to be broad and the enforcement narrow. That's the worst kind of law - you can be locked up at a prosecutors whim. In the UK, it's already illegal not to disclose the key to an encrypted file.

Is there any scheme which permits a data to be encrypted such that there are two passwords\keys which can decrypt it - one which unlocks the real data and the other to some dummy\innocuous stuff?

Indeed there is, it is called plausible deniability [1]. With Truecrypt, you can nest a hidden volume within another volume, so you can decrypt the latter and it will only show innocuous files, while another password (using other parts of the volume) would provide other (incriminating) files.

I wonder what is in a judge's mind when the encrypted evidence turns out to be kitten pictures and the defendant claims that he does not have any other password to provide.

[1]: https://en.wikipedia.org/wiki/Plausible_deniability#Use_in_c...

edit: clarification

Post reply on HN