Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Comment on the UK Gov Proposal to Ban “Bespoke” “Sophisticated” Encrypted Phones

cyberlaw.stanford.edu

Post reply on HN
Print view View original

21–30 of 30 posts

Re: Comment on the UK Gov Proposal to Ban “Bespoke” “Sophisticated” Encrypted Phones

#21

Post by dane-pgp »

flangola7 wrote: post #3
dane-pgp wrote: post #2

There are some good arguments in here, but I think it misses the broader picture. Clearly someone at GCHQ has told the UK government that if they want to ban secure apps like Signal, they first need to get the apps taken out of the app stores, then they need to mandate that phone OSes don't allow side-loading, then finally they need to ban "bespoke" phones, i.e. ones that allow general purpose computing. Not only Sta…

Wonder how they expect this to mesh with the new EU law mandating, among other things, open app ecosystems. Will Britons just import their phones from France?

Presumably mobile networks will be required to only grant internet service to phones that were bought in the UK (or that have been registered with a foreign network for more than N months).

I'm not sure how easy it is for networks to filter by IMEI (and presumably there would have to be a database for recording which IMEIs were sold with UK-compliant OSes) but eventually there would be a system which covered all access to the internet, not just from phones.

This means broadband ISPs doing a Remote Attestation check before routing any other packets from your device. A proof of concept for this has been implemented for some online games already.[0]

[0] https://arstechnica.com/gaming/2021/09/riot-games-anti-cheat...

Re: Comment on the UK Gov Proposal to Ban “Bespoke” “Sophisticated” Encrypted Phones

#22

Post by bbg2401 »

CommanderData wrote: post #14
flangola7 wrote: post #3

Earlier quoted context omitted.

Wonder how they expect this to mesh with the new EU law mandating, among other things, open app ecosystems. Will Britons just import their phones from France?

[flagged]

Speak for yourself.

Re: Comment on the UK Gov Proposal to Ban “Bespoke” “Sophisticated” Encrypted Phones

#23

Post by flangola7 »

dane-pgp wrote: post #21
flangola7 wrote: post #3

Earlier quoted context omitted.

Wonder how they expect this to mesh with the new EU law mandating, among other things, open app ecosystems. Will Britons just import their phones from France?

Presumably mobile networks will be required to only grant internet service to phones that were bought in the UK (or that have been registered with a foreign network for more than N months). I'm not sure how easy it is for networks to filter by IMEI (and presumably there would have to be a database for recording which IMEIs were sold with UK-compliant OSes) but eventually there would be a system which covered all acce…

Even with attestation you could just daisy chain and use the attesting device as a proxy. Not to mentioned the billion of internet enabled devices that would never support it

Re: Comment on the UK Gov Proposal to Ban “Bespoke” “Sophisticated” Encrypted Phones

#24

Post by giobox »

lozenge wrote: post #13
giobox wrote: post #8

Earlier quoted context omitted.

Sure, but its not that hard or expensive to hop a ferry/train/plane trip to France or Ireland and buy an unlocked phone, as one example. Any laws the UK passes have to account for the geographical realities of its location. Just because the UK is no longer in the EU doesn't mean its not affected by many of its decisions, given the enormous volume of trade that will continue to occur between them.

What happens when you get stopped and searched in the UK (probable cause isn't a factor here) and they find a "special encryption" phone?

I hate to break the bad news, but people break laws all the time, including in the UK. People will just manage the risk exactly like any other law they choose to ignore.

Criminals still carry blades as weapons in the UK, despite it being a strict liability crime and at risk of stop and search.

Re: Comment on the UK Gov Proposal to Ban “Bespoke” “Sophisticated” Encrypted Phones

#25

Post by giobox »

blibble wrote: post #18
giobox wrote: post #11

Earlier quoted context omitted.

And the Channel between England and France is a mere 20 miles at its narrowest point, Ireland is 12 (the UK's nearest EU neighbors). You can argue it down to zero miles for Ireland if you start your journey in Northern Ireland. The sun absolutely does set on what little is left of the "British Empire" in the 21st century.

> The sun absolutely does set on what little is left of the "British Empire" in the 21st century. I suggest you look at the locations of the British Overseas Territories

The famous phrase was as much about the relative geo-political strength of the empire in the 18th and 19th centuries as much as it has to do with actually being able to see a sunset... but feel free to take it literally if you like.

Re: Comment on the UK Gov Proposal to Ban “Bespoke” “Sophisticated” Encrypted Phones

#26

Post by blibble »

giobox wrote: post #25
blibble wrote: post #18

Earlier quoted context omitted.

> The sun absolutely does set on what little is left of the "British Empire" in the 21st century. I suggest you look at the locations of the British Overseas Territories

The famous phrase was as much about the relative geo-political strength of the empire in the 18th and 19th centuries as much as it has to do with actually being able to see a sunset... but feel free to take it literally if you like.

this subthread is literally about geography

Re: Comment on the UK Gov Proposal to Ban “Bespoke” “Sophisticated” Encrypted Phones

#27

Post by giobox »

blibble wrote: post #26
giobox wrote: post #25

Earlier quoted context omitted.

The famous phrase was as much about the relative geo-political strength of the empire in the 18th and 19th centuries as much as it has to do with actually being able to see a sunset... but feel free to take it literally if you like.

this subthread is literally about geography

Its literally about the quote widely used to generally describe the nature of 19th century British power, but ok!

> The sun never sets...

> https://www.phrases.org.uk/meanings/the-empire-on-which-the-...

Re: Comment on the UK Gov Proposal to Ban “Bespoke” “Sophisticated” Encrypted Phones

#28

Post by dane-pgp »

flangola7 wrote: post #23
dane-pgp wrote: post #21

Earlier quoted context omitted.

Presumably mobile networks will be required to only grant internet service to phones that were bought in the UK (or that have been registered with a foreign network for more than N months). I'm not sure how easy it is for networks to filter by IMEI (and presumably there would have to be a database for recording which IMEIs were sold with UK-compliant OSes) but eventually there would be a system which covered all acce…

Even with attestation you could just daisy chain and use the attesting device as a proxy. Not to mentioned the billion of internet enabled devices that would never support it

> Even with attestation you could just daisy chain and use the attesting device as a proxy.

But you'd need the attested device to run the proxy server software, which would obviously not be allowed in the app store, and would be blocked by the gatekeeper daemon or the OS-level firewall. Well, proxy software would be allowed, but it would have to perform its own attestation checks on the devices it proxies for.

> Not to mentioned the billion of internet enabled devices that would never support it

The billion internet enabled devices would be allowed onto a special "safe" segment of the internet, which companies could apply to add their static IPs to. So your internet connected fridge could still phone home, but the manufacturer would take liability for any data that a rooted fridge managed to send out to the internet.

There might still be millions of old devices that don't support TPMs and don't have manufacturers willing to apply to have their IPs whitelisted, but the government will say that kicking these insecure unpatched devices off their internet would be a huge win for cybersecurity. Making people buy a whole load of new devices would probably also give a temporary boost to the economy too.

Re: Comment on the UK Gov Proposal to Ban “Bespoke” “Sophisticated” Encrypted Phones

#29

Post by flangola7 »

dane-pgp wrote: post #28
flangola7 wrote: post #23

Earlier quoted context omitted.

Even with attestation you could just daisy chain and use the attesting device as a proxy. Not to mentioned the billion of internet enabled devices that would never support it

> Even with attestation you could just daisy chain and use the attesting device as a proxy. But you'd need the attested device to run the proxy server software, which would obviously not be allowed in the app store, and would be blocked by the gatekeeper daemon or the OS-level firewall. Well, proxy software would be allowed, but it would have to perform its own attestation checks on the devices it proxies for. > Not…

I think you're missing the point. Attestation is just key signing and verification with more bells and whistles and overhead. DRM tries and fails for the same reason: you have to give the user both the key and the content. There has been 30 years of attempts to somehow obfuscate and keep them apart, all without success.

An attacker with physical access and unbounded time cannot be defeated.

Re: Comment on the UK Gov Proposal to Ban “Bespoke” “Sophisticated” Encrypted Phones

#30

Post by dane-pgp »

flangola7 wrote: post #29
dane-pgp wrote: post #28

Earlier quoted context omitted.

> Even with attestation you could just daisy chain and use the attesting device as a proxy. But you'd need the attested device to run the proxy server software, which would obviously not be allowed in the app store, and would be blocked by the gatekeeper daemon or the OS-level firewall. Well, proxy software would be allowed, but it would have to perform its own attestation checks on the devices it proxies for. > Not…

I think you're missing the point. Attestation is just key signing and verification with more bells and whistles and overhead. DRM tries and fails for the same reason: you have to give the user both the key and the content. There has been 30 years of attempts to somehow obfuscate and keep them apart, all without success. An attacker with physical access and unbounded time cannot be defeated.

The reason why DRM has failed in the past is that it only takes one person to crack the DRM on their own device, and then they have an unencumbered digital file which can be copied and distributed freely.

Applying DRM to kernels and applications rather than to media files is completely different. If someone wants to have an E2E encrypted conversation, not only do they have to have jailbroken their own device by extracting the secret keys from inside its processor (using an electron microscope, perhaps) but their conversation partner has to have done the same to their own device.

Even if a few brave and well-resourced journalists/lawyers/activists managed to do this among themselves, they would quickly be exposed by traffic analysis, allowing the government to simultaneously arrest all of them and use their devices as evidence.

Post reply on HN