Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

The EU is set to declare war on encryption

tech.newstatesman.com

Post reply on HN
Print view View original

151–160 of 167 posts

Re: The EU is set to declare war on encryption

#151

Post by rocqua »

noodlesoups wrote: post #78
rocqua wrote: post #70

Earlier quoted context omitted.

Encryption is actually incredibly hard. This is why it took whatsapp and other apps centrally doing it, and coordinating it between devices, to make end-to-end encryption commonly used.

Using established methods is not difficult, though making a good crypto to begin with absolutely is.

The difficulty is using the established methods to build out a whole system that is workable in realistic conditions.

A system that handle sending messages when one party is off-line. A system that doesn't require up-front key agreement between all parties. A system that handles moving devices somewhat gracefully. A system that gives decent guarantees on the identity of your counter party, without being very onerous.

Making a system that meets the above requirements and others I missed, and that remains as usable as if the encryption weren't there is hard.

Re: The EU is set to declare war on encryption

#152

Post by rocqua »

upofadown wrote: post #114
rocqua wrote: post #80

Earlier quoted context omitted.

Really? How? If you want to enable communication where both parties don't need to be online at the same time, and with easy setup of a trusted system, you will need something very much like the signal protocol. That requires setting up a pretty complicated central service. Moreover, you are going to need to do quite some updating on the end-points of the e2e encrypted communications? Setting up this kind of operation…

>If you want to enable communication where both parties don't need to be online at the same time, and with easy setup of a trusted system, you will need something very much like the signal protocol. PGP and S/MIME would like a word. Note that PGP is used routinely on the darknets for pasting orders into a web form. There are several detailed howtos available.

PGP and S/MIME are widely considered as insufficient.

Certainly, they existed for a long time, and yet it did not seem to impede police investigations. Whilst I don't think the current complaints aren't exaggerated I do believe police when they say "Because of whatsapp, we are hitting cases where we would normally send a warrant, but now we can't". This wasn't the case before with PGP, and with decent reasons. (PGP is not very user friendly)

Re: The EU is set to declare war on encryption

#153

Post by rocqua »

retox wrote: post #146
rocqua wrote: post #88

Earlier quoted context omitted.

Note, the police does not have the key to my front door. And yet, the police can get into my house if they need to. In the world of locks and doors, there is almost nothing I can feasibly do to totally make it impossible for the police to get into my house if I want to keep them out. Encryption is different. Making encryption that is nigh impossible to break is almost trivial these days. And the police has no recours…

Let's say that it's possible to create a lock and doors for your house that are impossible to defeat. The security forces would instead find another way into your property; the window, the chimney, blowing a hole in the wall, etc. If the security forces don't have a master key for E2E encryption they should instead find another way to find evidence of a crime if they suspect one has taken place. The analogy does fall…

Honestly, if the police get into my house because of another way, I think that counts as 'defeating my lock'. Indeed, the fact that police can blow a hole in my wall is part of why I say they can defeat the lock.

Change the analogy to a safe. No matter how good the safe, if police want, they can read the contents of the documents in my safe. The same can not be said for contents of encrypted documents.

Now, it might be possible for the police to persecute someone without access to those documents. Certainly, I am not arguing 'the police need this access because they used to have it'. All I am arguing is that encryption came with a meaningful change in what law enforcement can and cannot access without cooperation.

Claiming that we don't even need to consider the question because nothing meaningful changed is wrong. I don't believe we need to make that claim to argue against banning e2e encryption though.

Re: The EU is set to declare war on encryption

#154

Post by upofadown »

rocqua wrote: post #152
upofadown wrote: post #114

Earlier quoted context omitted.

>If you want to enable communication where both parties don't need to be online at the same time, and with easy setup of a trusted system, you will need something very much like the signal protocol. PGP and S/MIME would like a word. Note that PGP is used routinely on the darknets for pasting orders into a web form. There are several detailed howtos available.

PGP and S/MIME are widely considered as insufficient. Certainly, they existed for a long time, and yet it did not seem to impede police investigations. Whilst I don't think the current complaints aren't exaggerated I do believe police when they say "Because of whatsapp, we are hitting cases where we would normally send a warrant, but now we can't". This wasn't the case before with PGP, and with decent reasons. (PGP i…

>PGP and S/MIME are widely considered as insufficient.

I am pretty sure that the darknet users would use something better if it was available. In what ways is it insufficient?

Re: The EU is set to declare war on encryption

#155

Post by dahfizz »

LatteLazy wrote: post #150
dahfizz wrote: post #142

Earlier quoted context omitted.

You can find examples where certain US states or EU states have more freedom in a certain area, but the USA has a much more absolutist view towards human rights than the EU does in general. In the EU, rights are subservient to "the greater good" (as defined by those in power). Some examples: Germany will arrest you for using "symbols of unconstitutional organization". This includes the Communist Hammer + Sickle[1] Fr…

The same exact limits apply in the USA. Freedom of speech is no more absolute there than in the EU exactly because no one wants people "shouting fire in a crowded theatre". Similarly, in the USA you can be fired for wearing a hijab just as rapidly. The USA has some (not all) rights well protected against government action, but your employer has vastly more right to restrict your activities. Recent rulings even allow…

> Freedom of speech is no more absolute there than in the EU exactly because no one wants people "shouting fire in a crowded theatre".

In the US, only direct incitements to violence and mayhem are not protected (like your example). In the EU they take this much further to outright ban all speech deemed hateful. That's not the same restriction.

> Similarly, in the USA you can be fired for wearing a hijab just as rapidly.

Absolutely false. That kind of discrimination is against the law here[1]. I'm sure it still happens, but the wronged party has the ability to fight discrimination in court. In Europe, the opposite is true. The employer has a legal right to ban Hijabs and religious dress.

> Recent rulings even allow employers to compel religion or ban lgbt etc

Can you explain this more? Any info I find says the opposite[2].

> This is the weakness of the US system: it protects a small number of limited rights very strongly, but only a small number and only against govetent interference. The EU has a much broader approach to rights in both these dimensions.

This comes back to a fundamental disagreement about what rights are. For the Bill-of-Rights type rights, Americans do have much more robust protections than Europeans, and not just from governmental interference. There is better religious / racial employee protections, you have a greater ability to defend yourself against people violating your property rights, etc.

For fluffier rights, like "the right to respect" or "the right to free $governmentService", you are better off in Europe. But they do not protect these rights to the same degree as American Bill-of-Right rights. For example, in every German citizen has the right to healthcare, but they have a compulsory insurance scheme to pay for it. They call that a 'right', but its something different than in the American definition.

[1]https://www.eeoc.gov/fact-sheet/questions-and-answers-about-...

[2] https://abcnews.go.com/Politics/supreme-court-makes-historic...

Re: The EU is set to declare war on encryption

#156

Post by megous »

orev wrote: post #140
megous wrote: post #73

Earlier quoted context omitted.

Not true. E-commerce did just fine even without TLS in the past. Also most of the e-commerce features don't really need encryption, but authenticity. That can be achieved with just asymmetric crypto and signing, but payloads can be in the open. Encryption is only needed for privacy.

There was no e-commerce before SSL. That was a huge thing and one of the main driving factors for all e-commerce sites to get certificates, display all those “trust” badges, etc. Most people buying things online would prefer to keep their credit card information private.

Almost no e-commerce solutions handled credit cards. That was done by bank payment gateways.

Anyway, most people didn't use credit cards either (and still don't), preferring wire transfers, because they felt they had more control over those (instead of giving someone info they could use to take money from the card at any time, they'd initiate and control the transfer themselves - push vs pull approach).

Times changed since then, but there was little financial risk to buyers from e-commerce not being encrypted at the time.

You seem to be assuming some US situation, where using credit cards online and handing card details to actual e-commerce websites was/is maybe more common.

But this article you're commenting under is about EU and I'm providing an experience from one of the EU member countries. So US situation is not relevant.

Re: The EU is set to declare war on encryption

#157

Post by zingplex »

scoutt wrote: post #98
zingplex wrote: post #20

Earlier quoted context omitted.

“Four Horsemen of the Infocalypse”: terrorists, pedophiles, drug dealers, and money launderers.

In the eyes of the state, there is a much, much worse category: tax cheaters. Saul from Breaking Bad explains it very well here: https://www.youtube.com/watch?v=ez6xH-su2xI

The state knows that backdooring encryption wouldn't help with any of this stuff, they just role it out as propaganda tool.

Re: The EU is set to declare war on encryption

#158

Post by rendall »

ColanR wrote: post #131
rendall wrote: post #102

Earlier quoted context omitted.

Except they are breaking the law, but are too powerful to be brought to heel, largely because of lots and lots of money and powerful, shady friends. https://www.icij.org/investigations/fincen-files/global-bank... The Mexican drug cartels could not fit cash through the teller stations quickly enough, so HSBC had special teller boxes so that it was far more efficient. https://uk.reuters.com/article/uk-hsbc-probe/hsbc-b…

> U.S. agencies responsible for enforcing money laundering laws rarely prosecute megabanks that break the law, and the actions authorities do take barely ripple the flood of plundered money that washes through the international financial system. From your first link. It sounds like the law enforcers need to do better at enforcing the law. If they can't enforce it against the banks, how can we expect the banks to enfo…

"It sounds like the law enforcers need to do better at enforcing the law"

While true, it's a non-sequitur.

OP made the point that banks serve criminals and asked then who are the "real crooks". You asked if bankers can serve everyone neutrally rather than be expected to exercise "personal morality". Which is a fair question in my opinion

Questions of individual moral duty aside, however, banks are not merely neutral when the law forbids them from specific activity and they decide to do it anyway.

Now your goalpost appears to be that banks should be able to do whatever they want if law enforcement cannot do anything about it, which is a very strange stance, to be honest

Re: The EU is set to declare war on encryption

#159

Post by BrandoElFollito »

dahfizz wrote: post #101
LatteLazy wrote: post #86

Earlier quoted context omitted.

In fairness, its don't much better at human rights than any of its predecessors or competitors...

That's pretty subjective. The right to free speech and to defend yourself + your property is severely diminished in the EU. The EU and US definitions of "human rights" are pretty different.

Free speech is very strong in Europe and deep rooted in the culture. You can say whatever you want, much more than in the US (we do not loose our mind when someone says tits or black - this is also free speech, not only amendments in the context of gov related speech). Charlie Hebdo paid a heavy price for this freedom (and while I do not like their style at all, I am deeply thankful to them).

As for the property this is a disaster. A squatter breaks in your house, stays 48 hours and it is basically theirs. This is the case where I am really pro gun because this is delayed robbery. I think that some blood will be poured and only then our useless politicians may get off their ivory tower to do something then (in France we are close)

Re: The EU is set to declare war on encryption

#160

Post by tatersolid »

nerdkid93 wrote: post #109
noodlesoups wrote: post #55

Earlier quoted context omitted.

The saying is twisted, because it already assumes privacy is a privilege, which it is not. It's a basic right, written to the constitution

It is? I did a quick search through the Constitution [0] and Bill of Rights [1] and found no mention of the word "privacy." [0] https://www.archives.gov/founding-docs/constitution-transcri... [1] https://www.archives.gov/founding-docs/bill-of-rights-transc...

> Amendment IV

> The right of the people to be secure in their persons, houses, papers, and effects, against unreasonable searches and seizures, shall not be violated, and no Warrants shall issue, but upon probable cause, supported by Oath or affirmation, and particularly describing the place to be searched, and the persons or things to be seized.

Post reply on HN