Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

ProtonMail, Tutanota urging EU to reconsider encryption rules

cyberscoop.com

Post reply on HN
Print view View original

21–30 of 85 posts

Re: ProtonMail, Tutanota urging EU to reconsider encryption rules

#21

Post by bem94 »

bayindirh wrote: post #5
christophilus wrote: post #2

It really is amazing to me that anyone thinks it's reasonable policy to ban end-to-end encryption. For the sake of national security, I would want to strengthen the security of digital data, not weaken it.

As far as I understood, the problem stems from the Crypto AG era. Governments are addicted to be able to listen to communications of everyone and don't want to lose their toys. Also, EU is far more advanced in terms of invisible security so, they don't want to lose the tools which enable them to do it. We need to re-think security and people are lazy about it because, it's hard. Edit: My English gets a hit when I'm l…

What is meant by "invisible security"?

Re: ProtonMail, Tutanota urging EU to reconsider encryption rules

#22

Post by [deleted] »

Aeolun wrote: post #19
vbezhenar wrote: post #14

Earlier quoted context omitted.

Yes, it is possible. You have to encrypt session key with government public key and include that encrypted data with your session. Government can decrypt that data with their private key. I think that's a pretty reasonable scheme as long as government private key managed by a competent organization (e.g. NSA). HSM makes it impossible to easily extract private key and military guard and other physical security measure…

Yeah, and that part is the pipe dream. You really need to compromise it only once to have access to everything. It’s unreasonable to believe only the government will have access.

[deleted]

Re: ProtonMail, Tutanota urging EU to reconsider encryption rules

#23

Post by admash »

thower234324 wrote: post #9

Isn't "encrypted mail" an oxymoron ?

Mail is transferred using SMTP, which may or may not be encrypted via TLS or similar. What protonmail et al. are likely referring to is the zero-knowledge encrypted storage and retrieval of received mail on their servers by their customers.

Re: ProtonMail, Tutanota urging EU to reconsider encryption rules

#24

Post by secondraft »

christophilus wrote: post #2

It really is amazing to me that anyone thinks it's reasonable policy to ban end-to-end encryption. For the sake of national security, I would want to strengthen the security of digital data, not weaken it.

You claim that somebody thinks it is reasonable policy to ban e2ee. Who is that exactly?

Consider this section from the resolution:

  Striking a right balance
  
  The principle of security through encryption and security despite encryption must be upheld in its entirety. The European Union continues to support strong encryption. Encryption is an anchor of confidence in digitalisation and in protection of fundamental rights and should be promoted and developed.
  
  Protecting the privacy and security of communications through encryption and at the same time upholding the possibility for competent authorities in the area of security and criminal justice to lawfully access relevant data for legitimate, clearly defined purposes in fighting serious and/or organized crimes and terrorism, including in the digital world, and upholding the rule of law, are extremely important. Any actions taken have to balance these interests carefully against the principles of necessity, proportionality and subsidiarity.
See https://data.consilium.europa.eu/doc/document/ST-13084-2020-...

Re: ProtonMail, Tutanota urging EU to reconsider encryption rules

#25

Post by chokeartist »

koonsolo wrote: post #16
christophilus wrote: post #2

It really is amazing to me that anyone thinks it's reasonable policy to ban end-to-end encryption. For the sake of national security, I would want to strengthen the security of digital data, not weaken it.

It's a trade-off. Of course I want to preserve my privacy. But I get it that law enforcement wants to be able to look into communications. Let's say they find a terrorist (I'm close to Brussels, so not a hypothetical scenario here). Best case you want to see which phones they have, and look into all their communication to get an idea about their contacts etc. It's a very hard problem, and I'm not sure which one I wou…

You're overthinking terrorism investigations. They don't need to be able to defeat crypto. They just need to be able to threaten Muhammad or whomever with 20 years in the clink. Everyone rolls under that pressure. No one is "hard".

Re: ProtonMail, Tutanota urging EU to reconsider encryption rules

#26

Post by autoditype »

secondraft wrote: post #24
christophilus wrote: post #2

It really is amazing to me that anyone thinks it's reasonable policy to ban end-to-end encryption. For the sake of national security, I would want to strengthen the security of digital data, not weaken it.

You claim that somebody thinks it is reasonable policy to ban e2ee. Who is that exactly? Consider this section from the resolution: Striking a right balance The principle of security through encryption and security despite encryption must be upheld in its entirety. The European Union continues to support strong encryption. Encryption is an anchor of confidence in digitalisation and in protection of fundamental rights…

No the person you're responding to, but the OP article gives the impression.

Either way I don't understand how the text you pasted intends to "strike the balance" when e2ee is present. Either they're talking about backdoors or they're in fantasyland

Re: ProtonMail, Tutanota urging EU to reconsider encryption rules

#27

Post by koonsolo »

koonsolo wrote: post #16
christophilus wrote: post #2

It really is amazing to me that anyone thinks it's reasonable policy to ban end-to-end encryption. For the sake of national security, I would want to strengthen the security of digital data, not weaken it.

It's a trade-off. Of course I want to preserve my privacy. But I get it that law enforcement wants to be able to look into communications. Let's say they find a terrorist (I'm close to Brussels, so not a hypothetical scenario here). Best case you want to see which phones they have, and look into all their communication to get an idea about their contacts etc. It's a very hard problem, and I'm not sure which one I wou…

Oof, a lot of downvotes. Can you please explain why it's not a tradeoff, or what else I said wrong?

Re: ProtonMail, Tutanota urging EU to reconsider encryption rules

#28

Post by numpad0 »

bem94 wrote: post #21
bayindirh wrote: post #5

Earlier quoted context omitted.

As far as I understood, the problem stems from the Crypto AG era. Governments are addicted to be able to listen to communications of everyone and don't want to lose their toys. Also, EU is far more advanced in terms of invisible security so, they don't want to lose the tools which enable them to do it. We need to re-think security and people are lazy about it because, it's hard. Edit: My English gets a hit when I'm l…

What is meant by "invisible security"?

Perhaps security as in national security, and invisible as opposed to clear military presence? IOW, espionage?

Re: ProtonMail, Tutanota urging EU to reconsider encryption rules

#29

Post by amelius »

Aeolun wrote: post #19
vbezhenar wrote: post #14

Earlier quoted context omitted.

Yes, it is possible. You have to encrypt session key with government public key and include that encrypted data with your session. Government can decrypt that data with their private key. I think that's a pretty reasonable scheme as long as government private key managed by a competent organization (e.g. NSA). HSM makes it impossible to easily extract private key and military guard and other physical security measure…

Yeah, and that part is the pipe dream. You really need to compromise it only once to have access to everything. It’s unreasonable to believe only the government will have access.

You implement it by putting the key inside a box, and letting that box perform the decryption. No other services/ports allowed. (Except you have to have a way to get the public key out, and allow the box to generate a private key which means it needs entropy). You can pot the box in epoxy for additional security.

Re: ProtonMail, Tutanota urging EU to reconsider encryption rules

#30

Post by tzs »

vbezhenar wrote: post #14
amelius wrote: post #6

Earlier quoted context omitted.

Can't we have E2EE+G? (end-to-end encryption, plus government can see everything) Not saying this is a good idea, though.

Yes, it is possible. You have to encrypt session key with government public key and include that encrypted data with your session. Government can decrypt that data with their private key. I think that's a pretty reasonable scheme as long as government private key managed by a competent organization (e.g. NSA). HSM makes it impossible to easily extract private key and military guard and other physical security measure…

You could put a check on the government misusing their private key by having the government key distributed among several parties using a secret sharing system such as Shamir's that requires several parties to agree in order to use the government key.

Include privacy or civil rights civilian organizations among the shareholders, such as the ACLU, so that there is an outside check.

If you choose a sufficient and diverse enough set of shareholders, you can reduce the chances that someone could compromise or coerce enough of them to gain access to the government key to less than 1 in N, where N is arbitrarily large. Chose N so that this is less likely than simply brute forcing the key.

Post reply on HN