Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

New German law would force ISPs to allow secret service to install trojans

privateinternetaccess.com

Post reply on HN
Print view View original

71–80 of 245 posts

Re: New German law would force ISPs to allow secret service to install trojans

#71

Post by luckylion »

jrockway wrote: post #61
luckylion wrote: post #42

Earlier quoted context omitted.

Possibly, but it's much harder to intercept and mitm specific traffic at that level. On the ISP-side, that's different: they can with high certainty say that some traffic is coming from/to a specific suspect, much like a phone surveillance. This might also apply to individual service, e.g. an email provider.

I think you can collect a lot of good data for law enforcement purposes by tapping datacenter networks. Remember the NSA's "SSL added and removed here :-)" slide? Raise your hand if you use TLS between your database server and your web frontend. Keep your hand up if you rotated that certificate in the last month. Keep your hand up if you know whether your database's certificate has been tampered with. (i.e. do you ch…

Yeah, but Germany's intelligence services aren't the NSA, neither regarding technical ability, nor regarding the lack of mission constraints. I'm sure they'd love to get their hands on DE-CIX as a whole, but they won't unless somebody with a US passport sits in on the meeting - and if they have that person, they don't need German laws.

I believe that these changes target ISPs and providers like mailbox.org, posteo etc, that have been "privacy first" and not too friendly. These laws aren't for wholesale data intake, they are more like phone surveillance with the added bonus that they (the ISPs and service providers) will be not only required to let them listen in, but to also allow them to inject trojans into the traffic that is being transported. These are very closely related to our laws for mailing services that contain similar things (the wording is very similar as well). They're not for the intelligence services to just walk in and say "Hi, we'll take everything, please", they still require a court order and target specific individuals.

Re: New German law would force ISPs to allow secret service to install trojans

#72

Post by golem14 »

corty wrote: post #38
netsharc wrote: post #5

"will" isn't the exact translation of the headline, the idea is written in an upcoming law that will be discussed (or rubber-stamped?) next Wednesday...

Probably rubber-stamped. But you are right, my translation is confusing. I'm very sorry.

Given the recent series of atrocious child porn scandals in Germany, I think this has a good chance of passing.

Re: New German law would force ISPs to allow secret service to install trojans

#73

Post by devalgo »

worldofmatthew wrote: post #17

My guess is that Germany will lose its web hosts as no one will trust to host anything in that country if this passes.

Snowden uncovered astonishing breaches of Trust in the US, has there been a major loss of Hosts here?

Re: New German law would force ISPs to allow secret service to install trojans

#74

Post by brobdingnagians »

devalgo wrote: post #73
worldofmatthew wrote: post #17

My guess is that Germany will lose its web hosts as no one will trust to host anything in that country if this passes.

Snowden uncovered astonishing breaches of Trust in the US, has there been a major loss of Hosts here?

I accept the principle; I wish people would take more action, but I for one am American and I have shifted most of my hosting out of the US because of it. I probably don't have much worth spying on, but on principle I oppose any form of blanket surveillance.

Re: New German law would force ISPs to allow secret service to install trojans

#75

Post by squarefoot »

Sound strange to me that they need a law for this, unless it is intended as leverage to coerce ISPs into collaboration. Secret service agencies do exist for the purpose of doing nasty things governments cannot afford to put their names on, or even be associated with; this would include spying on own citizens. In other words they'd do what they have already done for decades, but this time since it involves ISPs, ie a third party whose collaboration and silence are necessary, it is possible that the regulation includes also some kind of gag order preventing ISPs to tell their users they're under surveillance.

Re: New German law would force ISPs to allow secret service to install trojans

#77

Post by MaxBarraclough »

wmf wrote: post #31
LockAndLol wrote: post #23

Is it possible to modify HTTPS traffic? Wouldn't they have to replace the CA certs on the target machine first before being able to modify that traffic?

They just have to hijack one existing CA that's within their jurisdiction and force it to issue MITM certs. Key pinning or certificate transparency may mitigate this. Or the MITM box could use some kind of HTTP downgrade attack and not worry about certificates at all.

If the 'certificate transparency' initiative takes off, this could be easily detected.

https://transparencyreport.google.com/https/certificates

Re: New German law would force ISPs to allow secret service to install trojans

#78

Post by est31 »

cpach wrote: post #14
1cvmask wrote: post #2

The German surveillance state is very capable and often understated. They even “ran” Crypto AG with the NSA for decades and even profited from it. https://en.wikipedia.org/wiki/Crypto_AG

TIL. Didn’t know Germany was involved in that.

It's funny as the Germans had different priorities from the US. The US mainly wanted to use it to extract information, while the Germans also wanted to increase profits so that they have funds outside of parliamentary control and supervision. So they looked more at the business side of things.

Re: New German law would force ISPs to allow secret service to install trojans

#79

Post by Barrin92 »

phnofive wrote: post #65
Barrin92 wrote: post #58

Earlier quoted context omitted.

>Pretty shocking in a state that has such strict privacy laws. Not sure how the two can come from the same mouth, and even be in public view. Because they're not necessarily contradictory. This doesn't just give secret services a blank cheque to spy on everyone, it just provides intelligence agencies with a tool. I'm German and I don't object in principle to the fact that intelligence, under supervision of the govern…

They can wiretap, sure, but they can’t practically compel you to give up your book cipher.

Sure, but a police operation surely could attempt to swap the book cipher out for a compromised one, no?

I think the idea that communication ought to be categorically out of reach of intelligence is very novel. I don't think it was even conceivable decades ago that, with legal justification, intelligence could not hack or be completely locked out of the communication of some network. For criminals who are savy enough, tech has made it much harder, not easier for the government to do their job.

I think there is also a very paradoxical side-effect. A harmstrung government may resort to outsourcing its intelligence work. I read a story about private firms in the US collecting license plate information and selling it back to the police. Clearview AI is certainly another example. If the agencies are limited, there is a real chance of both ineffective policing and a huge unregulated surveillance grey market. I would rather equip the government with enough capacity, but strong legal checks.

Re: New German law would force ISPs to allow secret service to install trojans

#80

Post by alcoholic_byte »

lazaroclapp wrote: post #57
opqpo wrote: post #48

What does "trojans at ISPs" even mean? TLS works end-to-end and ISPs can do absolutely nothing to see the plaintext. It's unless the CAs at users-side are manually replaced with fake ones nothing can be done. I've never used Windows since I was a kid but I am sure this is pretty much impossible on Linux for example since adding CAs require root privilege.

Presumably, Germany would have little trouble compelling at least one root CA to sign any TLS certificates they wanted. Just a cursory search shows that Google Chrome, on Linux, trusts, e.g. > CN = D-TRUST Root CA 3 2013 > O = D-Trust GmbH > C = DE There is certificate transparency and pinning and so on, and they would be caught (probably, maybe) if they abused this carelessly and at scale, but in practice, for a sma…

Well. That is the reason for Certificate Pinning. And these days there is no excuse to not enable it server-side. Helped me detect some MITM-Interceptions. Not that the content was malicious (OpenDNS just rerouted my requests to a "This site is blocked page", but the certificate was signed by Cisco, and thus valid. Certificate Pinning still picked it up. Little hint: It was an Archlinux-site.).
Post reply on HN