Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

If David Cameron bans secure encryption he can't intercept

blog.mythic-beasts.com

Post reply on HN
Print view View original

41–50 of 104 posts

Re: If David Cameron bans secure encryption he can't intercept

#41

Post by c0g »

visarga wrote: post #32
c0g wrote: post #24

Except Cameron wants to backdoor end-to-end encryption like iMessage/Whatsapp, rather than mess with something like SSL. With SSL they can just get a warrant (or you know, don't get a warrant) and look at the server, where everything is in plain text. One possible way to backdoor it might be mandate that companies keep copies of the encrypted messages, tagged with a device ID. Then to decrypt you need to get the pers…

What about apps that keep the encryption keys in the user phones and can't decrypt the contents of messages? Do they intend to ban those apps?

That was my second paragraph - and to be clear, they don't want to ban it, they want to backdoor it.

My idea was that rather than ban it outright and make it like most other internet traffic (decrypted on a server), they could mandate some kind of cacheing of the _encrypted_ data on the server. Then, once they'd lawfully executed a warrant to grab the suspects phone, they can decrypt at their leisure. Apps using per-message keys will probably be a no-no.

Myself - I live in the UK - I hope Apple, Google and Facebook all say a big "fuck you" and cut this country off from their services, but I have a feeling the 'compromise' is going to be something like the paragraph above.

Re: If David Cameron bans secure encryption he can't intercept

#42

Post by giancarlostoro »

Why do we still have politicians trying to pass laws in technology if they don't understand it at all? Really we need to change how laws affecting technology are approved or something. It's always the same thing, some politician is passing some law affecting technology in what seems like the most absurd approach.

Re: If David Cameron bans secure encryption he can't intercept

#43

Post by nly »

danpalmer wrote: post #11

As far as I remember (and I may be wrong), the specific quote from David Cameron was about banning encryption that can't be backdoored, so that the government can look at things if they need to. Obviously I'm completely against that, because once there's a backdoor, it's all too easy to collect by default, instead of only when "needed". With this clarification though, lots of this tech would still work. Most things b…

A government CA wouldn't give them anything they want, let alone anything they don't already have. Even if we're naive enough to assume GCHQ don't already have the private keys of half a dozen root CAs, owning a CA just doesn't enable cheap, post-facto, mass surveillance.

Re: If David Cameron bans secure encryption he can't intercept

#44

Post by swombat »

c0g wrote: post #24

Except Cameron wants to backdoor end-to-end encryption like iMessage/Whatsapp, rather than mess with something like SSL. With SSL they can just get a warrant (or you know, don't get a warrant) and look at the server, where everything is in plain text. One possible way to backdoor it might be mandate that companies keep copies of the encrypted messages, tagged with a device ID. Then to decrypt you need to get the pers…

I would be very surprised if Apple and Facebook (and Google, with GMail, GTalk, Hangouts, etc) didn't use this golden opportunity to swing their weight about and assert who's really in charge of technology around here, by simply wholesale blocking use of all their communication tools in the UK to comply with the law.

I have a feeling that if they did this, the uproar would be sufficient to have the law reversed by emergency measures.

If they were followed, as they may well be, by a whole host of other essential internet services (Google Search, Wikipedia, Github, etc etc etc) just switching off simultaneously in the UK on the day the law comes into force, that might be sufficient to ensure this sort of dumb shit is never done again. The cost of billions of pounds of lost productivity would probably ensure that.

Re: If David Cameron bans secure encryption he can't intercept

#45

Post by ackalker »

One-time pad encryption, implemented correctly, cannot be broken or backdoored. There is the matter of key exchange of course, but that is as old as the use of covert communications itself. Anyone who cares enough about their communication remaining secret will find a way of exchanging keys for which any attempt at interception by a government entity is entirely impractical.

Re: If David Cameron bans secure encryption he can't intercept

#46

Post by joesmo »

giancarlostoro wrote: post #42

Why do we still have politicians trying to pass laws in technology if they don't understand it at all? Really we need to change how laws affecting technology are approved or something. It's always the same thing, some politician is passing some law affecting technology in what seems like the most absurd approach.

I agree, but if it hasn't happened for women's issues, it won't happen for technology either. From the point of view of those in charge, it makes sense to have politicians be as dumb as possible. That reduces the chances of any moral conflicts or other unpleasant issues that might arise to stop the idiocy they're about to commit.

Re: If David Cameron bans secure encryption he can't intercept

#47

Post by c0g »

swombat wrote: post #44
c0g wrote: post #24

Except Cameron wants to backdoor end-to-end encryption like iMessage/Whatsapp, rather than mess with something like SSL. With SSL they can just get a warrant (or you know, don't get a warrant) and look at the server, where everything is in plain text. One possible way to backdoor it might be mandate that companies keep copies of the encrypted messages, tagged with a device ID. Then to decrypt you need to get the pers…

I would be very surprised if Apple and Facebook (and Google, with GMail, GTalk, Hangouts, etc) didn't use this golden opportunity to swing their weight about and assert who's really in charge of technology around here, by simply wholesale blocking use of all their communication tools in the UK to comply with the law. I have a feeling that if they did this, the uproar would be sufficient to have the law reversed by em…

Honestly, I hope they do. Bets on who's first to use the words "democracy", "sovereignty" and "American"?

Re: If David Cameron bans secure encryption he can't intercept

#48

Post by ianamartin »

giancarlostoro wrote: post #42

Why do we still have politicians trying to pass laws in technology if they don't understand it at all? Really we need to change how laws affecting technology are approved or something. It's always the same thing, some politician is passing some law affecting technology in what seems like the most absurd approach.

Why do we have politicians passing laws about anything?

Re: If David Cameron bans secure encryption he can't intercept

#49

Post by mariuolo »

Luc wrote: post #28
chao- wrote: post #17

Earlier quoted context omitted.

Who are the security services employed by? I certainly wouldn't call them private industry! Did you mean to say it's not elected government officials? Just curious, because I definitely consider a country's intelligence apparatus to be completely and wholly part of its "government", and would be surprised to find someone who didn't.

'The government' refers to something different in the US than in (most of?) Europe. My American friends were mightily amused and amazed when Belgium spent >500 days without government a couple of years ago, but of course they were interpreting the word in a much more encompassing way than it is done in Belgium. 'The goverment' is really just a couple of dozen people (with perhaps a couple of dozen assistants each).

Gouvernement/regering translate to administration or cabinet or whatever each country designates its executive branch.

Re: If David Cameron bans secure encryption he can't intercept

#50

Post by cesarb »

c0g wrote: post #24

Except Cameron wants to backdoor end-to-end encryption like iMessage/Whatsapp, rather than mess with something like SSL. With SSL they can just get a warrant (or you know, don't get a warrant) and look at the server, where everything is in plain text. One possible way to backdoor it might be mandate that companies keep copies of the encrypted messages, tagged with a device ID. Then to decrypt you need to get the pers…

> One possible way to backdoor it might be mandate that companies keep copies of the encrypted messages, tagged with a device ID. Then to decrypt you need to get the person's phone, which is a clearer analogy to getting a warrant to search someone's house to look for things they have stashed.

That doesn't work if the message has been encrypted on transit with an one-time key, which is discarded after the message has been received. The Axolotl system (used by TextSecure/Signal and AFAIK the new encryption on WhatsApp) does that. Once the message has been received (and thus the corresponding key discarded), any copy of the encrypted message becomes useless.

The current tendency in protocol design is to use ephemeral keys (usually through some Diffie-Hellman variant) whenever possible, since it's more secure.

> With SSL they can just get a warrant (or you know, don't get a warrant) and look at the server, where everything is in plain text.

That doesn't work if the server is outside their jurisdiction.

Post reply on HN