Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Independent review of UK national security law warns of overreach

techradar.com

Post reply on HN
Print view View original

201–210 of 299 posts

Re: Independent review of UK national security law warns of overreach

#201

Post by IshKebab »

fennecfoxy wrote: post #190

I know this is about UK (where I am a foreigner living for almost a decade). But why are pretty much all governments universally inept? It's not only the UK but US gov has also pushed for this and plenty of other stupendously stupid ideas or decisions - and plenty of other governments (well, all of them) besides. It leads me to believe that our species is incapable of leading itself, that we are incapable of choosing…

What makes you think this is ineptitude? They know exactly what they're doing.

The mistake HN commenters make is thinking "But TLS is encryption too! They can't ban Signal without also banning TLS!". They absolutely can if they want to.

Re: Independent review of UK national security law warns of overreach

#202

Post by rightbyte »

drumhead wrote: post #37
N_Lens wrote: post #9

I wonder how the public in the UK feels about their country quickly devolving into an oversurveilled state.

It's always been like this. From the official secrets act where they could jail you just for revealing the date of the office Christmas party to D notices suppressing newspapers from publish stories the government thought were to sensitive. MI5 and MI6 acting totally without accountability, with the government not even acknowledging their existence. If anything, things have started to get more transparent now, with a…

> But the default position of the UK government has always been secrecy and the right to do what they want to protect the country.

Usually those types are the prime threat to the country.

Re: Independent review of UK national security law warns of overreach

#203

Post by MangoToupe »

jandrewrogers wrote: post #160
MangoToupe wrote: post #79

Earlier quoted context omitted.

This is an convictable crime in the US. Inciting violence is emphatically not protected speech.

This is definitely not a crime in the US per the US Supreme Court. Several additional conditions not in evidence are required for speech of this type to fall outside of First Amendment protections.

https://www.law.cornell.edu/uscode/text/18/373

> Several additional conditions not in evidence are required for speech of this type to fall outside of First Amendment protections.

Perhaps your point would be clearer if you indicated what specific conditions you believe are missing. Maybe the tweeter had no followers? Idk, I can only vaguely guess at what you're referring to.

Re: Independent review of UK national security law warns of overreach

#204

Post by n4r9 »

miroljub wrote: post #42
mosura wrote: post #25

Earlier quoted context omitted.

> This has got to stop. If you want to stop criminals, then focus on their illegal activites, not the streets they walk on. That would be against everything european governments stand for.

I don't understand why you got heavily downvoted. Yes, there are governments that are worse than European, but the decline of European government is the fastest. You may be surprised that the UK is the world leader in the number of people arrested because of internet posts. And that Germany, which is still way behind the UK, has more people arrested for the same reason than Russia, China, North Korea, Iran, Belarus,…

> You may be surprised that the UK is the world leader in the number of people arrested because of internet posts

This is untrue, as I've previously pointed out here [0] and here [1].

[0] https://news.ycombinator.com/item?id=41488099

[1] https://news.ycombinator.com/item?id=45412989

Re: Independent review of UK national security law warns of overreach

#205

Post by kelnos »

flowerthoughts wrote: post #17

> He warns that developers of apps like Signal and WhatsApp could technically fall within the legal definition of "hostile activity" simply because their technology "make[s] it more difficult for UK security and intelligence agencies to monitor communications. Sounds like Let's Encrypt would also fall under that. This has got to stop. If you want to stop criminals, then focus on their illegal activites, not the stree…

> I see the dangers, and I see why governments think they are doing this to protect the people.

That's what they say, but that's a smokescreen. They do it because they believe it helps them consolidate and keep power.

Re: Independent review of UK national security law warns of overreach

#206

Post by tialaramex »

sgtrx wrote: post #156
nisegami wrote: post #36

Earlier quoted context omitted.

>Btw. The https communication comparison does not hold, there is always a third party that can read what you say. E2E chats are effectively communication where evidence is instantly destroyed. If I use a third party CA this is correct. But what third party can read communications over HTTPS between a client and a server I control with a self signed SSL cert?

This isn't correct with 3rd party CA's with modern TLS either. TLSv1.2 has Perfect Forward Secrecy with DHE and ECDHE key exchanges and in TLSv1.3 PFS is mandatory. A compromised root CA or even leaf certificate these days protects you from a man-in-the-middle and not a whole lot else - the certificate private key is never used for session key derivation and the keys themselves are ephemeral and never sent over the w…

Even if you don't have Forward Secrecy, like you decided to use RSA KEX which is a terrible non-default idea even in 2015 let alone today (this feature isn't even present in TLS 1.3 deliberately, lobbying to keep doing this failed), your private key is still needed so a third party CA can't imitate you.

The CAs have never been supposed to know your private key. For a long time now it's straight up forbidden on pain of removal from trust stores for the CAs to learn somebody else's private keys.

For the example of Let's Encrypt your client probably picks a private key and stores it where your web server can use it, but it never sends this key to anybody else. In fact if you care you can even have the key chosen by the web server and literally never send that key to the Let's Encrypt client at all, the client picks up a "Certificate Signing Request" and it goes OK, I see you want a certificate for some key you know but I don't, that's cool I will go ask Let's Encrypt to issue a certificate for that and let you know.

Re: Independent review of UK national security law warns of overreach

#207

Post by immibis »

miroljub wrote: post #121
dbdr wrote: post #107

Earlier quoted context omitted.

One example is: "I think it’s time for the British to gang together, hit the streets and start the slaughter."

Congratulations. You found one. What about the other 11999?

Why don't you share them, since you seem to know them well?

Re: Independent review of UK national security law warns of overreach

#209

Post by bilekas »

pona-a wrote: post #147
bilekas wrote: post #94

Earlier quoted context omitted.

No need really, your ISP are not going to go to bat for your privacy.

Do you understand what transit encryption is? The point of TLS is the ISP can't inspect the traffic. They can of course refuse to carry all encrypted traffic, but 1) stenography exists, so have fun writing DPI filters to detect suspicious noise in the note velocities of MIDI data; 2) turns out the free market didn't adopt HTTPS just to hide drug dealers -- I don't know if you heard, but there's this itty bitty thing…

I know very well and I absolutely am not advocating for removing TLS. I am only saying that there is no need for them to remove it as IsP's can already access your traffic if needed through a lawful intercept. These are part of ISP certification. You're very naive if you believe there is no way for the ISP to view your traffic just because you're over an Https connection.

The ISP has "Intercept Access Points" withing their infra that will just clone you're data. Without you knowing. This is a feature. Turned on with a warrant always I'm sure.

Making my point of your ISP not being there to defend your privacy. It's not their mandate. Their mandate is to provide an internet service to you, and a mechanism to intercept to law enforcement.

Nobody is talking about passing around plain text over the wire here.

Post reply on HN