Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

France threatens GrapheneOS with arrests / server seizure for refusing backdoors

mamot.fr

Post reply on HN
Print view View original

271–280 of 399 posts

Re: France threatens GrapheneOS with arrests / server seizure for refusing backdoors

#271

Post by StopDisinfo910 »

whimsicalism wrote: post #243
johnwayne666 wrote: post #202

HN title: "France threatens GrapheneOS with arrests / server seizure for refusing backdoors" LQDN: "Dans ces articles, la cheffe de la section cybercriminalité du parquet de Paris – à l'origine de l'arrestation de Pavel Durov – menace également les développeurs·es de GrapheneOs. Interviewée, elle prévient qu'elle ne s'« empêchera pas de poursuivre les éditeurs, si des liens sont découverts avec une organisation crimi…

What is cooperation? How are they supposed to unlock the phone? Unless you're saying 'compelled to use their private keys to publish an update' or something along those lines, in which case I would say the original headline is correct.

There is no law allowing the police to do that in France so that can’t be what cooperation means.

In the case of Telegram, it was about providing meta data when subpoenaed and moderating the unencrypted part of the application.

There is little reason to believe it is about anything else here.

Edit: Happy to hear what the people downvoting actually disagree about as usual. At the moment I have read a ton of mud thrown of France here - including someone from GrapheneOS implying they won’t hire from France unless someone relocate which must one of the most hilarious take I have ever read coming from someone from North America - with very little actually substantial shared, which, to be fair, seems to be becoming the norm here.

Re: France threatens GrapheneOS with arrests / server seizure for refusing backdoors

#272

Post by throw-qqqqq »

greenavocado wrote: post #250

Americans do not understand the fact that their own government rates the top four intelligence threats as French, Israeli, Chinese, and Russian.

Where do you get that ‘fact’? Can you elaborate?

According to all the Annual Threat Assessment reports from the office of the Director of National Intelligence[1], the top four threats are

1. China

2. Russia

3. Iran

4. North Korea

[1]: https://www.intelligence.gov/annual-threat-assessment

Re: France threatens GrapheneOS with arrests / server seizure for refusing backdoors

#273

Post by rini17 »

mason_mpls wrote: post #247
dagi3d wrote: post #110

so, they are basically confirming Android and Apple have their backdoors as no arrests or seizures on that matter have taken place

Does this apply to other Linux Distros?

I don't think they are highly concerned with people installing their own OS on desktop machines, that's still a fringe group. And most of us are using smartphones too. Also there are likely other trivial exploits like CUPS which was preinstalled and enabled by default on desktop linuxes.

Re: France threatens GrapheneOS with arrests / server seizure for refusing backdoors

#274

Post by threethirtytwo »

lucideer wrote: post #251
threethirtytwo wrote: post #146

Earlier quoted context omitted.

Logistically, when you combine private citizenship with government you get corruption problems because incentives are so misaligned. In fact private citizenship combined with government is the origin of corruption. Think about it, as a government official your incentive should be to preserve order, fairness and honor. As a private citizen your goal is to optimize the amount of money you make via business or employmen…

> As a private citizen your goal is to optimize the amount of money you make Ok. I'm interested in why you think this is the goal of citizens (but not of government). To be clear: I don't believe this should be the goal of government. I don't really understand why this should be the goal of citizens. I've emphasised the term "should" here, which is a somewhat odd moral term in general, but if we're applying a "should…

This is the definition of capitalism. The system is set up this way. Of course as a human you're not completely embodied by the system and you clearly have beliefs and philosophies different from the "system".

But you cannot deny that you as an individual are HEAVILY influenced by the system can culture you live in. Status is equated to those who have the most money. Regardless of yourself as an individual, in aggregate this is how people behave and a good basic universal model that predicts behavior. But additionally outside of culture, the logistical reality of the society we live in is that money is the basis of survival. All of our morals and philosophies are thrown out the window the minute when we are poor or if we have no money and we do need money to buy food to eat. So money and business is not only a status thing but it forms the basis of survival as well.

This is not about your beliefs or morality. This is about the practical reality. In addition to this, capitalism so far is the the only known effective system to create modern economies of scale. We tried to make things fair, ideal and utopian with communism, but, practically speaking, we haven't seen it work.

Re: France threatens GrapheneOS with arrests / server seizure for refusing backdoors

#275

Post by JumpCrisscross »

MSFT_Edging wrote: post #238
JumpCrisscross wrote: post #192

Earlier quoted context omitted.

> devices should have government-mandated backdoors if and only if you are a public servant This would be an intelligence bonanza. Better: mandatory, encrypted logging. Officials maintain the keys. When they leave office or are subpoenaed, they have the means to grant access. (If they can send and read their messages, they have the keys.) This is how NARA in the U.S. is supposed to work.

> This would be an intelligence bonanza. And ideally an illustration to those in power why backdoors are never a good thing. They won't care if it's not happening to them. But if their devices are suddenly incredibly insecure due to their backdoors, they might just rethink the concept entirely.

> if their devices are suddenly incredibly insecure due to their backdoors, they might just rethink the concept entirely

A hypothesis I would have bought until seeing our current White House's opsec.

Re: France threatens GrapheneOS with arrests / server seizure for refusing backdoors

#276

Post by lazide »

SirMaster wrote: post #236
lazide wrote: post #177

Earlier quoted context omitted.

Why would politicians and cops want to be held (actually) to a higher standard?

Who says they would? The point is the people would vote to have them held to this higher standard. They represent the people's will. They shouldnt get to choose other than their personal vote, the people choose. If they don't agree with what the people choose then they can leave politics.

Sure, and how is that working out right now?

Re: France threatens GrapheneOS with arrests / server seizure for refusing backdoors

#277

Post by [deleted] »

clhodapp wrote: post #211
JumpCrisscross wrote: post #192

Earlier quoted context omitted.

> devices should have government-mandated backdoors if and only if you are a public servant This would be an intelligence bonanza. Better: mandatory, encrypted logging. Officials maintain the keys. When they leave office or are subpoenaed, they have the means to grant access. (If they can send and read their messages, they have the keys.) This is how NARA in the U.S. is supposed to work.

It's even more of an intelligence bonanza when it's done to the private citizens! That's the point of trying to do it!

[deleted]

Re: France threatens GrapheneOS with arrests / server seizure for refusing backdoors

#278

Post by forgetfulness »

aeurielesn wrote: post #117
notaustinpowers wrote: post #100

Earlier quoted context omitted.

Backdoors exist for everyone or they exist for no one, this technology isn't one that has room for a gray area to debate. If it can be deployed to public servant devices, it can be deployed to your device.

Not according to Chat Control at least where politicians are exempting themselves from State surveillance.

Great way to fight the allegations that EU politicians are corrupt and unaccountable, there

Re: France threatens GrapheneOS with arrests / server seizure for refusing backdoors

#279

Post by strcat »

foxyv wrote: post #240
miohtama wrote: post #230

Earlier quoted context omitted.

And how do you hack a single phone without a backdoor in every phone?

You use the signing keys for GrapheneOS to push an update to a single user.

That doesn't offer a way to bypass disk encryption for data protected by the per-profile lock method. GrapheneOS cannot bypass the brute force protection implemented by the secure element. Google cannot bypass the brute force protection either because they designed the Titan M2 to require the Owner user successfully unlocks in order to update it. Weaver + insider attack protection for the secure element are among our hardware security requirements (see https://grapheneos.org/faq#future-devices for a list) which are being implemented by an OEM we're working with to provide a Pixel alternative. Weaver has a table of user authentication tokens mapped to random tokens used as part of the final key derivation. The authentication token is made with a hash of the initial key derived from scrypt, then the final key derivation in TrustZone combines both with hardware-bound key derivation to get the key derivation key. Weaver implements very aggressive time-based throttling. We have the original delays documented at https://grapheneos.org/faq#encryption but it ramps up faster now.

Aside from that, people can use a strong diceware passphrase on GrapheneOS due to us massively raising the character limit from 16 to 128. This is far more usable on GrapheneOS because people can combine it with fingerprint+PIN secondary unlock instead of fingerprint-only secondary unlock. 5 attempts are allowed for fingerprint unlock and the 2nd factor PIN being entered incorrectly counts towards that so even a random 4 digit one works well. That's convenient to use with the passphrase only having to be entered 48h after the last successful passphrase unlock and after reboot.

We also won't do it and cannot be forced to do it under Canadian laws. France's laws are going to be as relevant to us as North Korean laws once we've finished replaced our OVH servers in Beauharnois, Canada with a Canadian provider. France could currently force OVH to mess with our static website or mail server but we haven't done anything illegal so it would be outrageous and a diplomatic incident due to violating Canadian sovereignty during a time period when foreign server hosting companies being subject to foreign law is already in a recent news cycle. We're not waiting around for them to hijack our website though.

Post reply on HN