Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

New German law would force ISPs to allow secret service to install trojans

privateinternetaccess.com

Post reply on HN
Print view View original

211–220 of 245 posts

Re: New German law would force ISPs to allow secret service to install trojans

#211

Post by brummm »

Youden wrote: post #33
brummm wrote: post #13

Earlier quoted context omitted.

Actually it translated to "have to", not "should" (which would more properly be "sollten").

I'm learning German at a fairly low level so I ask this from the perspective of wanting to learn, not as a challenge. Wouldn't "have to" be "müssen"? In what cases would you use "sollen" to have a similar meaning? And "sollten" is either Präteritum or Konjunctive II, which as I understand it would both mean "should have", though in different senses. Why is that a more proper translation of "should"?

Sollten is indeed Konjunktiv.

Re: New German law would force ISPs to allow secret service to install trojans

#212

Post by MauranKilom »

rbecker wrote: post #138
MauranKilom wrote: post #118

Earlier quoted context omitted.

What does this have to do with "internet freedom" (whatever that means)? Statements that would get you prosecuted when shouted in the streets have that same effect when posted online. Surprised Pikachu face?

By that logic, China is doing excellent on internet freedom, since whatever is banned online, is also mostly illegal in the streets too.

No, that's not "by that logic". The entire point is that internet freedom is about things that are conceptually impossible to do on the streets. Like using a VPN or having net neutrality. It's not about whether you get to do things on the internet that are otherwise forbidden.

Re: New German law would force ISPs to allow secret service to install trojans

#214

Post by raxxorrax »

metachris wrote: post #210
raxxorrax wrote: post #204

Earlier quoted context omitted.

I wonder how they would break TLS though. Your ISP cannot just break that up. Maybe degrade your connection to http, but without local access to your machine, it would be quite difficult to inject something in a data stream that is encrypted. Easier to do it through app stores of any kind.

Browsers and operating systems include a list of root certificates which includes those of various governments. Pretty much any government can thus issue valid HTTPS certificates for any domain to MITM traffic.

True, that would be possible. Time to ban the German one in my opinion for breaking the chain of trust.

Re: New German law would force ISPs to allow secret service to install trojans

#215

Post by baybal2 »

wmf wrote: post #31
LockAndLol wrote: post #23

Is it possible to modify HTTPS traffic? Wouldn't they have to replace the CA certs on the target machine first before being able to modify that traffic?

They just have to hijack one existing CA that's within their jurisdiction and force it to issue MITM certs. Key pinning or certificate transparency may mitigate this. Or the MITM box could use some kind of HTTP downgrade attack and not worry about certificates at all.

Certificate transparency would not work against targeted MITM attack

Re: New German law would force ISPs to allow secret service to install trojans

#217

Post by rocqua »

metachris wrote: post #210
raxxorrax wrote: post #204

Earlier quoted context omitted.

I wonder how they would break TLS though. Your ISP cannot just break that up. Maybe degrade your connection to http, but without local access to your machine, it would be quite difficult to inject something in a data stream that is encrypted. Easier to do it through app stores of any kind.

Browsers and operating systems include a list of root certificates which includes those of various governments. Pretty much any government can thus issue valid HTTPS certificates for any domain to MITM traffic.

Certificate transparency should mean that those wrongly-signed certificates make it out into the world though, right?

I am not quite sure how mandatory CT is at the moment though.

Re: New German law would force ISPs to allow secret service to install trojans

#218

Post by rocqua »

raxxorrax wrote: post #204
mindfulhack wrote: post #126

To not even be sure whether a website you visit, or a file you download is actually what its creator says it is, is like picking up an orange but the government secretly replaces it with an apple that contains almost no vitamin C in it at all. You have the right to seek out and eat an orange for your immune system and survival, and no government should have the right to interfere with that, at any time. This law is a…

I wonder how they would break TLS though. Your ISP cannot just break that up. Maybe degrade your connection to http, but without local access to your machine, it would be quite difficult to inject something in a data stream that is encrypted. Easier to do it through app stores of any kind.

Besides, for any malicious interference with updates you will be breaking code-signing on those updates.

Re: New German law would force ISPs to allow secret service to install trojans

#219

Post by teddyh »

kazagistar wrote: post #203
teddyh wrote: post #202

Earlier quoted context omitted.

Analogies can’t convince anyone who is not already sympathetic – anyone wanting to oppose your point would only poke holes in and argue about the analogy itself; making analogies does not help when arguing. Analogies only help when explaining something to someone who genuinely wants to understand it.

All argumentation is generally for the sake of the neutral interested third party, not the firm opponent.

In what theoretical dimension do you find these “neutral interested third party” people? In my experience, every discussion is a result of (at least) two people with both an opposing view and and, more crucially, an interest to argue the point. The very prerequisite of a debate is an interest in arguing a specific point of view, which most often precludes any participant being a neutral third party.

Of course, you could always argue “for the gallery”, i.e. not try to persuade your opponent, but to merely use the debate as a platform to reach an audience. But this is not persuasion; this is rhetoric. Analogies can be used as rhetorical tools. But analogies won’t persuade your opponent.

Therefore, if you’re arguing with someone else one-on-one, and there is no one else to win over by rhetorical tricks, you should avoid using analogies, since analogies aren’t persuasive.

Re: New German law would force ISPs to allow secret service to install trojans

#220

Post by rocqua »

dannyw wrote: post #139
sloshnmosh wrote: post #122

Earlier quoted context omitted.

That is a good question. Looking at some of Citizen Lab’s excellent reporting on FinFisher shows that victims were redirected to regular unencrypted http downloads when the malware was installed. One of the examples given was when a user tried to download Avast antivirus from a well-known software hosting site and the download was done over http. There are several security sites that have downloadable packet captures…

Browsers should phase out and block executable downloads from HTTP sources in 12 months.

They should not.

They should maybe give bigger warnings, but lets not break all of the old web just to protect a few more people against themselves.

Post reply on HN