Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

German court forces mail provider Tutanota to insert a backdoor

heise.de

Post reply on HN
Print view View original

51–60 of 103 posts

Re: German court forces mail provider Tutanota to insert a backdoor

#51

Post by girvo »

throwaway2245 wrote: post #32
giancarlostoro wrote: post #2

Encryption is the only thing that forces law enforcement to use warrants, without it it's just a wild wild west of privacy abuse. I do hope we see more services crop up, and new methods for people to encrypt email outside of specific services, maybe better plugins for Thunderbird or something, hell I'd easily pay for such a plugin if someone else can communicate back and forth with me through it and it is encrypted.…

We generally accept that warrants are a reasonable solution when it comes to the state entering private property without permission for law enforcement purposes. This also seems like a reasonable solution for encryption. The state here is not making or trying to make encryption illegal; and it is open about the fact that court authorisation is required to enforce a backdoor.

The reason that breaks down is that a backdoor to achieve this isn’t for that one case, it’s for everyone on the service (or easily made to be). It’s like getting permission to break every lock from a particular manufacturer, rather than permission to enter one particular home.

I know in this particular case they’ve said it’s for a singular mailbox. I’m curious how they achieve it.

Re: German court forces mail provider Tutanota to insert a backdoor

#52

Post by isv »

PopeDotNinja wrote: post #35
BlackLotus89 wrote: post #20

Earlier quoted context omitted.

Yeah german here you are correct. > Tutanota will Beschwerde gegen den Beschluss einlegen, diese hat jedoch keine aufschiebende Wirkung Tutanota wants to appeal in court against this, but is forced to comply (right now). > "Tutanota sieht sich nun gezwungen, bis Jahresende eine Funktion zu programmieren...dieses Postfach zu überwachen." Tutanota sees no other possibility than to program a function (until the end of t…

I wonder how a company that uses 100% open source software would comply with an order like this. def decrypt_email?(email) do email in surveilance_order_emails() end

They will do what reddit did, keep "sensitive" additions to your system closed, and if you are not distributing it, you are not required to publish it. Just watch out for AGPL.

Re: German court forces mail provider Tutanota to insert a backdoor

#53

Post by girvo »

rglullis wrote: post #26
stunt wrote: post #6

I worked in the telecom industry, and knowing how much surveillance related regulations was there, I can't believe true e2e encryption is a thing on the internet. I'm surprised how so many people in tech believe that a messaging application like WhatsApp is allowed to have real e2e encryption. It's impossible for regulators to ignore a platform with substantial traffic.

You are right, and yet I always asked myself if all the regulations ever made sense. Those that really want to coordinate any kind of illicit activity, do they use Whatsapp thinking it is secure, or would they be smart enough to set up their own infrastructure? How many threats were stopped due to police/Three-Letter-Agencies being able to tap into the largest services vs going to the deep web and infiltrating/invest…

My thing is that it doesn’t seem to make me safer. So I give up my privacy without (what seems to me) much benefit. I don’t like the trade-off...

Are organised dangerous criminals really using and relying on platforms for this stuff?

Re: German court forces mail provider Tutanota to insert a backdoor

#55

Post by usr1106 »

j_jochem wrote: post #15
pb77 wrote: post #5

I almost got Tutanota, I went with runbox. It is based off Norway, hopefully this ruling will not applicable for other email companies with EU.

Fun fact: Norway is not a member of the EU.

They aren't, but they are in the EEA (European Economic Area). So in trade they mostly follow EU rules without participating in the political process.

I don't how much of the lawful interception stuff is governed by EU directives. Even less whether that would affect EEA countries.

Re: German court forces mail provider Tutanota to insert a backdoor

#56

Post by [deleted] »

md- wrote: post #28

german here: Tutanota is a german email provider which encrypts incoming email after those were received. The court ordered tutanota to provide incoming emails to a single email account to law enforcement. This is "lawful interception" as you know it, as "service-side encryption" is useless against lawful interception laws. - md

[deleted]

Re: German court forces mail provider Tutanota to insert a backdoor

#57

Post by cookiengineer »

j_jochem wrote: post #15
pb77 wrote: post #5

I almost got Tutanota, I went with runbox. It is based off Norway, hopefully this ruling will not applicable for other email companies with EU.

Fun fact: Norway is not a member of the EU.

> Fun fact: Norway is not a member of the EU.

Which I think is a shame. Sweden and Norway together would have a net positive influence on modernizing law across the EU.

(I'm saying that as a German)

Re: German court forces mail provider Tutanota to insert a backdoor

#59

Post by alltakendamned »

cookiengineer wrote: post #57
j_jochem wrote: post #15

Earlier quoted context omitted.

Fun fact: Norway is not a member of the EU.

> Fun fact: Norway is not a member of the EU. Which I think is a shame. Sweden and Norway together would have a net positive influence on modernizing law across the EU. (I'm saying that as a German)

Sweden already is part of the EU.

Re: German court forces mail provider Tutanota to insert a backdoor

#60

Post by PeterisP »

PopeDotNinja wrote: post #48
leipert wrote: post #37

Earlier quoted context omitted.

You mean so that they do not leak the affected email address?

I mean if your code is open source, and you get an order to insert a backdoor of some kind, how can you put the backdoor in the open source code without violating a nondisclosure clause in the government’s order?

Law overrides contract, so if distributing those changes is prohibited, then not distributing those changes to code is not a violation of the open source licence, the relevant clauses of the licence contract can not be legally binding.

So you'd just [be required to] keep a non-open fork of that code even if the license (e.g. AGPL) would prohibit that.

Post reply on HN