I almost got Tutanota, I went with runbox. It is based off Norway, hopefully this ruling will not applicable for other email companies with EU.
Good luck with that https://theintercept.com/2018/03/01/norway-nsa-victory-garde...
German court forces mail provider Tutanota to insert a backdoor
71–80 of 103 posts
Re: German court forces mail provider Tutanota to insert a backdoor
#72Earlier quoted context omitted.
You are right, and yet I always asked myself if all the regulations ever made sense. Those that really want to coordinate any kind of illicit activity, do they use Whatsapp thinking it is secure, or would they be smart enough to set up their own infrastructure? How many threats were stopped due to police/Three-Letter-Agencies being able to tap into the largest services vs going to the deep web and infiltrating/invest…
My thing is that it doesn’t seem to make me safer. So I give up my privacy without (what seems to me) much benefit. I don’t like the trade-off... Are organised dangerous criminals really using and relying on platforms for this stuff?
Re: German court forces mail provider Tutanota to insert a backdoor
#73Clickbait verging on the fake news - they took piece of information completely out of the context and baked a "sensation". No, Tutanova does NOT install "backdoor" be it a court order or not. Government or else can only read contents of non-encrypted mails and only metadata of the encrypted mails, it has been so ever since and this is the way the email works.
Clarification in plain English here https://www.reddit.com/r/tutanota/comments/k3sfs5/in_englisc...
Re: German court forces mail provider Tutanota to insert a backdoor
#74Earlier quoted context omitted.
We generally accept that warrants are a reasonable solution when it comes to the state entering private property without permission for law enforcement purposes. This also seems like a reasonable solution for encryption. The state here is not making or trying to make encryption illegal; and it is open about the fact that court authorisation is required to enforce a backdoor.
The reason that breaks down is that a backdoor to achieve this isn’t for that one case, it’s for everyone on the service (or easily made to be). It’s like getting permission to break every lock from a particular manufacturer, rather than permission to enter one particular home. I know in this particular case they’ve said it’s for a singular mailbox. I’m curious how they achieve it.
This is the same as the TSA lock in newly made luggage. In order for Americans to have their luggage inspected, the Europeans have to have a backdoor into their luggage.
Fortunately in Europe you can add a layer of security on top of that by adding new locks.
Re: German court forces mail provider Tutanota to insert a backdoor
#75Earlier quoted context omitted.
We generally accept that warrants are a reasonable solution when it comes to the state entering private property without permission for law enforcement purposes. This also seems like a reasonable solution for encryption. The state here is not making or trying to make encryption illegal; and it is open about the fact that court authorisation is required to enforce a backdoor.
The reason that breaks down is that a backdoor to achieve this isn’t for that one case, it’s for everyone on the service (or easily made to be). It’s like getting permission to break every lock from a particular manufacturer, rather than permission to enter one particular home. I know in this particular case they’ve said it’s for a singular mailbox. I’m curious how they achieve it.
This sounds more like the analogy breaking down than illustrating a meaningful difference in scenarios. The police already /can/ break a lock from just about any manufacturer. They just break the door down and enter regardless of the phenomenal quality of the lock itself.
Re: German court forces mail provider Tutanota to insert a backdoor
#76I worked in the telecom industry, and knowing how much surveillance related regulations was there, I can't believe true e2e encryption is a thing on the internet. I'm surprised how so many people in tech believe that a messaging application like WhatsApp is allowed to have real e2e encryption. It's impossible for regulators to ignore a platform with substantial traffic.
This kind of encryption makes the difference between targeted surveillance and mass surveillance.
In Germany mass surveillance is not accepted as easily as it is in many other countries.
Re: German court forces mail provider Tutanota to insert a backdoor
#77Earlier quoted context omitted.
You mean so that they do not leak the affected email address?
I mean if your code is open source, and you get an order to insert a backdoor of some kind, how can you put the backdoor in the open source code without violating a nondisclosure clause in the government’s order?
This is sever-side code, so you handle this email address the same way you handle other secrets, like your database password: put them in configuration instead of hardcoding them.
With end-to-end encryption, where encryption happens in an open source client, this conflict would be more interesting.
Re: German court forces mail provider Tutanota to insert a backdoor
#78The article says criminal police had a problem with an extortion email. If the victim is willing to collaborate what's the problem with getting the plaintext?
Anyway, I wonder how it's going to be implemented for the case where encryption is done on the client side with open-source tools (not sure if that's the case for Tutanota).
Re: German court forces mail provider Tutanota to insert a backdoor
#79Be aware that the local courts decisions is not in line with the decisions done by other German courts.
It's likely that the courts decisions will be overruled or even be found to be unconstitutional.
Re: German court forces mail provider Tutanota to insert a backdoor
#80From my understanding of the article (non-native), it seems like it is only one specific mailbox that is to be monitored > "Tutanota sieht sich nun gezwungen, bis Jahresende eine Funktion zu programmieren...dieses Postfach zu überwachen." and that nothing else will change for the other users > "Für die anderen Nutzer soll sich dadurch nichts ändern, ihre Mails sollen weiter standardmäßig verschlüsselt werden" As othe…
Yes furthermore it's a decision of a local court which is not in line with decisions of other courts in similar cases.
So it's likely to be overruled but until then the courts decision is valid, hopefully it gets overruled before the charges are deployed.