Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

ProtonMail, Tutanota urging EU to reconsider encryption rules

cyberscoop.com

Post reply on HN
Print view View original

31–40 of 85 posts

Re: ProtonMail, Tutanota urging EU to reconsider encryption rules

#31

Post by extrememota »

secondraft wrote: post #24
christophilus wrote: post #2

It really is amazing to me that anyone thinks it's reasonable policy to ban end-to-end encryption. For the sake of national security, I would want to strengthen the security of digital data, not weaken it.

You claim that somebody thinks it is reasonable policy to ban e2ee. Who is that exactly? Consider this section from the resolution: Striking a right balance The principle of security through encryption and security despite encryption must be upheld in its entirety. The European Union continues to support strong encryption. Encryption is an anchor of confidence in digitalisation and in protection of fundamental rights…

From the same document. I do not see how this is technically possible.

> Technical solutions for gaining access to encrypted data must comply withthe principles of legality, transparency, necessity and proportionalityincluding protection of personal data by design and by default.

Re: ProtonMail, Tutanota urging EU to reconsider encryption rules

#32

Post by kemonocode »

koonsolo wrote: post #27
koonsolo wrote: post #16

Earlier quoted context omitted.

It's a trade-off. Of course I want to preserve my privacy. But I get it that law enforcement wants to be able to look into communications. Let's say they find a terrorist (I'm close to Brussels, so not a hypothetical scenario here). Best case you want to see which phones they have, and look into all their communication to get an idea about their contacts etc. It's a very hard problem, and I'm not sure which one I wou…

Oof, a lot of downvotes. Can you please explain why it's not a tradeoff, or what else I said wrong?

People are probably considering what you said an appeal to emotion, "Think of the terrorists!" being up there with "Think of the children!" in terms of excuses for misguided policies. Governments already have plenty of tools to track down and deal with terrorists if so they wished: a distressingly amount of planning and radicalization is done over clear text in social media, and even in E2EE there's a wealth of necessarily unencrypted metadata you can make use of.

Re: ProtonMail, Tutanota urging EU to reconsider encryption rules

#33

Post by furi »

Aeolun wrote: post #17

> But the proposals are the digital equivalent of giving law enforcement a key to every citizens’ home To be fair, it’s more like giving law enforcement the key to everyones heavily fortified unobtanium bunker. There’s no way they can possibly get in if the owner doesn’t let them.

I think the intended image there is that they can come and go without announcing themselves, which is what's being proposed.

They can still access your E2E encrypted messages under existing laws by bringing a warrant to your door and asking you to hand over your phone, then:

A: finding it unlocked. B: hacking it. C: using normal police techniques to convince you to hand over the passphrase. D: using a key disclosure law to compel you to hand over the passphrase.

What they want to do instead is take the warrant to Facebook/Signal/etc. and get them to hand the messages over without needing to interact with you at all.

Re: ProtonMail, Tutanota urging EU to reconsider encryption rules

#34

Post by ceilingcorner »

koonsolo wrote: post #16
christophilus wrote: post #2

It really is amazing to me that anyone thinks it's reasonable policy to ban end-to-end encryption. For the sake of national security, I would want to strengthen the security of digital data, not weaken it.

It's a trade-off. Of course I want to preserve my privacy. But I get it that law enforcement wants to be able to look into communications. Let's say they find a terrorist (I'm close to Brussels, so not a hypothetical scenario here). Best case you want to see which phones they have, and look into all their communication to get an idea about their contacts etc. It's a very hard problem, and I'm not sure which one I wou…

Or perhaps you figure out why terrorism exists and work towards preventing it, instead of spying on your population and violating their rights “just in case”?

Re: ProtonMail, Tutanota urging EU to reconsider encryption rules

#35

Post by extrememota »

amelius wrote: post #20
christophilus wrote: post #13

Earlier quoted context omitted.

If you allow the +G, you allow hackers. It's as simple as that. If you want security, you can't have backdoors.

What is wrong with the method which vbezhenar suggested? (sibling comment of yours)

Considering how all master keys of most popular measures have been hacked, its natural to assume that government keys will be hacked and leacked too.

Re: ProtonMail, Tutanota urging EU to reconsider encryption rules

#36

Post by tehwebguy »

amelius wrote: post #29
Aeolun wrote: post #19

Earlier quoted context omitted.

Yeah, and that part is the pipe dream. You really need to compromise it only once to have access to everything. It’s unreasonable to believe only the government will have access.

You implement it by putting the key inside a box, and letting that box perform the decryption. No other services/ports allowed. (Except you have to have a way to get the public key out, and allow the box to generate a private key which means it needs entropy). You can pot the box in epoxy for additional security.

Nothing that you, tzs and vbezhenar are describing is different from “end to end encryption, but with a backdoor that could be leaked”

Re: ProtonMail, Tutanota urging EU to reconsider encryption rules

#37

Post by coldtea »

secondraft wrote: post #24
christophilus wrote: post #2

It really is amazing to me that anyone thinks it's reasonable policy to ban end-to-end encryption. For the sake of national security, I would want to strengthen the security of digital data, not weaken it.

You claim that somebody thinks it is reasonable policy to ban e2ee. Who is that exactly? Consider this section from the resolution: Striking a right balance The principle of security through encryption and security despite encryption must be upheld in its entirety. The European Union continues to support strong encryption. Encryption is an anchor of confidence in digitalisation and in protection of fundamental rights…

>Who is that exactly?

Whoever wrote: "at the same time upholding the possibility for competent authorities in the area of security and criminal justice to lawfully access relevant data for legitimate, clearly defined purposes in fighting serious and/or organized crimes and terrorism, including in the digital world, and upholding the rule of law, are extremely important".

Either said person doesn't understand end-to-end encryption, or they don't want end-to-end encryption but mere encryption, with keys shared here and there...

Re: ProtonMail, Tutanota urging EU to reconsider encryption rules

#38

Post by coldtea »

koonsolo wrote: post #16
christophilus wrote: post #2

It really is amazing to me that anyone thinks it's reasonable policy to ban end-to-end encryption. For the sake of national security, I would want to strengthen the security of digital data, not weaken it.

It's a trade-off. Of course I want to preserve my privacy. But I get it that law enforcement wants to be able to look into communications. Let's say they find a terrorist (I'm close to Brussels, so not a hypothetical scenario here). Best case you want to see which phones they have, and look into all their communication to get an idea about their contacts etc. It's a very hard problem, and I'm not sure which one I wou…

>But I get it that law enforcement wants to be able to look into communications.

Why?

Re: ProtonMail, Tutanota urging EU to reconsider encryption rules

#39

Post by numpad0 »

amelius wrote: post #20
christophilus wrote: post #13

Earlier quoted context omitted.

If you allow the +G, you allow hackers. It's as simple as that. If you want security, you can't have backdoors.

What is wrong with the method which vbezhenar suggested? (sibling comment of yours)

Backdoor algorithms and operators cannot be reasonably trusted to not disclose the key or data.

Re: ProtonMail, Tutanota urging EU to reconsider encryption rules

#40

Post by danarmak »

tzs wrote: post #30
vbezhenar wrote: post #14

Earlier quoted context omitted.

Yes, it is possible. You have to encrypt session key with government public key and include that encrypted data with your session. Government can decrypt that data with their private key. I think that's a pretty reasonable scheme as long as government private key managed by a competent organization (e.g. NSA). HSM makes it impossible to easily extract private key and military guard and other physical security measure…

You could put a check on the government misusing their private key by having the government key distributed among several parties using a secret sharing system such as Shamir's that requires several parties to agree in order to use the government key. Include privacy or civil rights civilian organizations among the shareholders, such as the ACLU, so that there is an outside check. If you choose a sufficient and diver…

Even assuming purely good intentions, the government would want to use the key very often (hundreds or thousands of concurrent investigations) and in many large unrelated organizations (eg police + FBI + NSA + CIA + DOD + ...). It would be impractical to authorize each individual use, let alone authorize it by several parties each time.

Instead we'd see 'ongoing' authorizations on the level of an investigation, a person or team, or a whole sub-organization (modulo clearance / position in that organization). And so you'd have copies of the complete key going around.

Post reply on HN