Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

German court forces mail provider Tutanota to insert a backdoor

heise.de

Post reply on HN
Print view View original

41–50 of 103 posts

Re: German court forces mail provider Tutanota to insert a backdoor

#41

Post by [deleted] »

throwaway2245 wrote: post #32
giancarlostoro wrote: post #2

Encryption is the only thing that forces law enforcement to use warrants, without it it's just a wild wild west of privacy abuse. I do hope we see more services crop up, and new methods for people to encrypt email outside of specific services, maybe better plugins for Thunderbird or something, hell I'd easily pay for such a plugin if someone else can communicate back and forth with me through it and it is encrypted.…

We generally accept that warrants are a reasonable solution when it comes to the state entering private property without permission for law enforcement purposes. This also seems like a reasonable solution for encryption. The state here is not making or trying to make encryption illegal; and it is open about the fact that court authorisation is required to enforce a backdoor.

[deleted]

Re: German court forces mail provider Tutanota to insert a backdoor

#44

Post by RickS »

pferde wrote: post #43

I wonder if publicizing this was a good idea. Now whoever was blackmailing can simply stop, or will find other means. It's like setting up a trap for smugglers or whoever and hanging a big blinking "TRAP HERE" sign on it.

Perhaps that's the intent, similar to a warrant canary. It's fortunate that they're even allowed to talk about being forced to comply.

Re: German court forces mail provider Tutanota to insert a backdoor

#45

Post by gruez »

bgorman wrote: post #12

I was planning to migrate to Tutanota, I guess I will not be doing so after all

Realistically speaking, is there jurisdiction where this isn't a threat? Most governments allow for wiretaps (basically what this "backdoor" is) when there's a warrant, so I'm not sure what the alternative is. Not even self-hosting works because they can seize your server/ip/domain name and install a backdoor there.

Re: German court forces mail provider Tutanota to insert a backdoor

#46

Post by floatingatoll »

bhaak wrote: post #10
floatingatoll wrote: post #4

A relevant machine-translated paragraph appears to indicate that they are only required to implement monitoring of a single mailbox: > This is about a blackmail that had been sent to an automotive supplier from a Tutanota mailbox. Tutanota is now forced to program a function by the end of the year that allows the State Criminal Police Office of North Rhine-Westphalia to monitor this mailbox. Lacking the ability to re…

No, you got that right. It's about a single mailbox and only for new mails. As they can't decrypt old mails themselves without a backdoor. Still, once they have this function, all it takes is a court order to start collecting for other mailboxes. Tutanota will take this to the next higher court but as it says in the article, they have to start implementing the backdoor right away.

There's a clear distinction between "We are mandated by the court to maintain plaintext for all accounts for all time" and "We are mandated by the court to have the capability to maintain plaintext for one account when ordered so by subpoena-or-equivalent". This is the latter.

Arguments can be had about the relevance of that distinction, but relevant or not, the distinction does exist. Thanks for clarifying!

(I'm not participating in the "Is this distinction relevant?" discussion today, sorry, just trying to understand what was passed. See other threads for pro/con arguments.)

Re: German court forces mail provider Tutanota to insert a backdoor

#47

Post by beezle »

uallo wrote: post #18
sneeze-slayer wrote: post #11

From my understanding of the article (non-native), it seems like it is only one specific mailbox that is to be monitored > "Tutanota sieht sich nun gezwungen, bis Jahresende eine Funktion zu programmieren...dieses Postfach zu überwachen." and that nothing else will change for the other users > "Für die anderen Nutzer soll sich dadurch nichts ändern, ihre Mails sollen weiter standardmäßig verschlüsselt werden" As othe…

German native here. Your translation is mostly correct. The court seems to have forced Tutanota to store new incoming non-encrypted emails in plaintext for a specific mailbox that was used to blackmail an automotive supplier. But the article is not entirely clear on whether that is for that specific mailbox only. At one point, the article mentions that storing emails in plain text could be used on "specific mailboxes…

>The court seems to have forced Tutanota to store new incoming non-encrypted emails in plaintext

This makes sense as AFAIK Tutanota messages between users are encrypted on the client side, not the server side. I guess they could try to backdoor that too but I'd think someone would be able to sniff that in the network traffic?

Re: German court forces mail provider Tutanota to insert a backdoor

#48

Post by PopeDotNinja »

leipert wrote: post #37
PopeDotNinja wrote: post #35

Earlier quoted context omitted.

I wonder how a company that uses 100% open source software would comply with an order like this. def decrypt_email?(email) do email in surveilance_order_emails() end

You mean so that they do not leak the affected email address?

I mean if your code is open source, and you get an order to insert a backdoor of some kind, how can you put the backdoor in the open source code without violating a nondisclosure clause in the government’s order?

Re: German court forces mail provider Tutanota to insert a backdoor

#49

Post by colejohnson66 »

PopeDotNinja wrote: post #48
leipert wrote: post #37

Earlier quoted context omitted.

You mean so that they do not leak the affected email address?

I mean if your code is open source, and you get an order to insert a backdoor of some kind, how can you put the backdoor in the open source code without violating a nondisclosure clause in the government’s order?

Unless you can prove your running copy is the same as the provided code (which is pretty hard for server software), you can always keep a private forked copy with the backdoor and run that

Re: German court forces mail provider Tutanota to insert a backdoor

#50

Post by upofadown »

giancarlostoro wrote: post #2

Encryption is the only thing that forces law enforcement to use warrants, without it it's just a wild wild west of privacy abuse. I do hope we see more services crop up, and new methods for people to encrypt email outside of specific services, maybe better plugins for Thunderbird or something, hell I'd easily pay for such a plugin if someone else can communicate back and forth with me through it and it is encrypted.…

I doubt that Thunderbird would want to go back to a plugin for PGP. They just moved that support into the program with S/MIME.
Post reply on HN