ProtonMail, Tutanota urging EU to reconsider encryption rules

Most operating systems already have a "front door" keys in the form of automatic updates certificates. Android, windows, ios, even apt get, all base their security around certificates which, if stolen, can by design lead to running code.

All the objections to end to end encryption + government access fail to mention that we already have an implicit trust in corporate certificates in the security of nearly all devices, and yet that front door was never used by hackers like everyone suggests government backdoors would be used.

The problem with E2E+G is not technical, it is political. It can be done in a way that it would only be practical for the government to use it rarely (E.g., [1]) and only for cases where there is a broad consensus that it is being used Constitutionally (or whatever is equivalent outside the US).

But getting Congress (or whatever is equivalent outside the US) to pass an E2E+G law that allows it to be done in such a way seems unlikely. They will go for a way that allows broad use.

[1] You could make it a per-device key, generated on the device itself. The device makes the Shamir secret sharing shares, encrypts them with the public keys of the shareholders, and periodically includes those includes those in the chat metadata.

To decrypt a chat, the government needs to record it, get the encrypted shares out of the chat metadata, get each shareholder to use that shareholder's private key to decrypt their share and then contribute that share for recovery of the actual chat key for that chat.

If they want to decrypt a chat from another device, they'd have to do that all over again for that device.

> ...resolution on security through encryption and security despite encryption

People in government, be it in the EU or elsewhere, have a different idea of what privacy means and a citizen having privacy from state powers is antithetical to it. EU mopes believe their own marketing material regarding privacy, which is why the above phrase can be found in a Council publication, along with the always present "competent law enforcement". Nevermind that when it comes our privacy, a competent law enforcement officer is as much a mythical being as is an "ordinary citizen" who has nothing to fear or hide.

The Council is tasked with "setting" the agenda for the EU. The latest one is from last summer and the first item in it reads "protecting citizens and freedoms". That is exactly how I would imagine someone working at the Council to think of the act of stripping their "fellow" citizens of their privacy, while convinced that they're the good guy. There is no privacy without encryption today. As soon as you mandate that someone with special powers has to have the ability to force their way in and read the thoughts I exchange then you'll have killed privacy. It doesn't matter who that person is, it doesn't matter how you justified it and it doesn't matter what the consequences of privacy are.

We don't yet know what the "regulatory framework" (kill me please) will look like but whatever it is I don't think it's far fetched to expect things like running a Tor relay to get you in trouble, running an IRC server over TLS will be lots of fun too, and so on and so on. How long till you're required to have a license to run nc -l 1234? I'm sure it will be a decade or two but eventually that's where we'll be.

> With or without EU's snooping what is more likely to happen is that people will migrate to messaging systems that the EU

historic legislation and these plans suggest that there will be 2 forms of encryption: 1) Legal 2) Illegal.

it doesn't matter if some niche technologies exist if people are unable to access them. even if they could they would not feel strongly enough to "break the law".

This push has been noticeable only to specialists in the field (and the push is also unevenly distributed) but been ongoing in all 9-eye countries.

France implemented snooping charter in 2015 by changing their constitution (using Charlie Hebdo[1] as excuse), the UK is on par with the US and needs no introduction, Australia has the AAbill[1] criminalizing employees if they do not act as moles in companies, Germany has its Bundestrojaner etc etc ... Australia is especially interesting as it is a tiny population and used as a test-bed for more salty US propaganda and to see what can be learned (in terms of messaging) before applied to a wider basis (e.g. one that is later always rolled out to the rest of the countries in the pact)

All of them are driven by US interests and pressure (anyone wanting to become a member of the many eyes is well advised to implement SIGINT technologies and laws to facilitate Western espionage on their citizens.

Public outcry won't matter, nobody cares because why would a sane person not working in Tech even think about topics like encryption - when this is all just to "catch the bad guys" and "only bad guys have something to hide anyway".

[1] https://www.reuters.com/article/us-france-surveillance/frenc...

[2] https://en.wikipedia.org/wiki/Mass_surveillance_in_Australia

What do you think of these counter examples?

The automatic upgrades channel issue is close to the very heart of, for example, popular browser extensions becoming malicious.

Another attack from the past was the system certificate store compromise by Lenovo on workstations and laptops sold to its own customers, allowing for decryption of any HTTPS traffic from the customer. [1]

Another high profile attack that everyone will know about is the SolarWinds compromise of its software updates. [2]

[1] https://us-cert.cisa.gov/ncas/alerts/TA15-051A

[2] https://www.bleepingcomputer.com/news/security/new-sunspot-m...