Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

The UK Is Trying to Stop Facebook's End-to-End Encryption

wired.com

Post reply on HN
Print view View original

51–60 of 60 posts

Re: The UK Is Trying to Stop Facebook's End-to-End Encryption

#51

Post by thro1 »

asddubs wrote: post #7
CraigJPerry wrote: post #4

>> One industry source who has spoken with government figures is skeptical that such a radical scenario will come to pass And yet the Investigatory Powers Act[1] passed into law in the UK and has never been repealed. We haven't seen a headline like "local ambulance chief spied on my wife's porn browsing habits" so far but I do wonder if there have been any abuses by now? [1] That's the law which allows people like yo…

i assume in days of https, most of the history they would be able to obtain are only domain names, not specific URLs, right?

What about specific lengths of the documents, linked from pages which may be known or be easy to guess (earlier visited, front page or known size)?

Re: The UK Is Trying to Stop Facebook's End-to-End Encryption

#52

Post by Talanes »

azalemeth wrote: post #28
intricatedetail wrote: post #20

Earlier quoted context omitted.

This all only works in theory. In reality police in the UK is mostly useless if you tried to report a crime. They won't touch anything unless it gets them PR points or you present all evidence, track the perpetrators and so on and still they may drop it because the judge wouldn't give them time so why bother. It's a problem that media don't talk about.

This is true with with minor crime. It's not true at all of violent crime, or serious cases; if you're knocked down by a drunk driver, the police absolutely are very good to you and do -- eventually -- get there. Minor theft? Expect less. Copyright infringement? Hope you are a big player, otherwise piss off...

Mike Birbiglia has a whole one man show centered around being ordered to pay damages on the drunk driver who hit him - due to a sloppily written police report.

Re: The UK Is Trying to Stop Facebook's End-to-End Encryption

#53

Post by rimliu »

agurk wrote: post #26
Lev1a wrote: post #14

It's always either "Think of the children!" or "X will only be used to investigate the most serious of crimes like terrorism, rape and murder" which shortly afterwards is then (quietly) forgotten about when something like browsing history etc. can be downloaded by basically anyone in government(s). Maybe there is a restriction snort where such an action requires a warrant but considering that "judges" and "courts" fo…

> In German there is a nice idiom for that kind of thought pattern: "Nach mir die Sintflut" Interestingly this is originally a French saying by Louis XV, Après moi, le déluge [0]. From wiki: > It is generally regarded as a nihilistic expression of indifference to whatever happens after one is gone, though it may also express a more literal forecasting of ruination. Its meaning is translated by Brewer in the forms "Wh…

We have the same idiom in Lithuanian, literal translation from the French: "Po mūsų nors ir tvanas".

Re: The UK Is Trying to Stop Facebook's End-to-End Encryption

#54

Post by BrandoElFollito »

I am not a lawyer so sorry if this is obvious, buy how can a country been the use of software that is made in another one?

I read country X is trying to ban Y, and every time I just wonder: how?

I can download something off GitHub (except if the ban is in the US), or a copy somewhere else.

Ideally, developers wild set a multi country repository with a canary and be done.

Re: The UK Is Trying to Stop Facebook's End-to-End Encryption

#55

Post by max1984_2 »

varispeed wrote: post #46
max1984_2 wrote: post #42

Earlier quoted context omitted.

I don't want to be "blackpilled" about it. But there is literally nothing that can be done about it. None of the politicians in the UK seem to care about freedom of speech, right to privacy or anything else that is classically liberal. Everyone in the UK either supports it or is resigned to it. Also almost nobody in the IT industry seems to care about it either (I've worked at quite a few places as a consultant).

There is nothing that you can do about it, so people are just apathetic. Only way to change something is by voting, but there is no party that would have a chance of winning that would support freedom of speech. People literally think that if you have nothing to hide, then you have nothing to worry about. When I tried to move some of my friends to Signal and told them that someone can read our messages, they just sai…

Getting people to move from something like Whatsapp to Signal is almost impossible. I have no intention of even living in the UK in the next few years to probably one of the overseas territories again (they are starting to tax the hell out of the things I make a living on).

Re: The UK Is Trying to Stop Facebook's End-to-End Encryption

#56

Post by max1984_2 »

varispeed wrote: post #40
archsurface wrote: post #34

Earlier quoted context omitted.

Vote libertarian. Governments will do what they can to make their jobs easier, to show off success. I know left leaning people are going to dislike that, but it's a double edged sword - if you want eg a national health system, you're going to end up with the government telling you to eat your five vegetables each day.

With private healthcare system, the difference will be that private company will be telling you to eat 5 vegs a day, then they will require that you take a photo each time you eat a veg and so on and if you don't you'll be left with nowhere to go for help. No thank you. I get that national health service is mostly rubbish, but it's better than nothing and if you are poor, it's your only chance and you can always have…

If health care was properly private (not pseudo private) it would be really cheap. I had private health care in Spain / Gibraltar and it was relatively quite cheap.

The NHS is a massive money sink that always requires more money to keep on operating. I've heard the chant of "Save the NHS" since I was a child. As someone who parents are Labour voters (my ancestors used to work in the mines) even they are starting to think it might not be worth it.

Re: The UK Is Trying to Stop Facebook's End-to-End Encryption

#57

Post by LinuxBender »

tialaramex wrote: post #35
BiteCode_dev wrote: post #13

Earlier quoted context omitted.

Except if you have a root certificate, then you can MITM you heart away. Which govs probably have.

A root CA certificate doesn't allow you to "MITM you heart away". Its purpose, as would be clear if you think about what the CA does with it, is to sign other certificates for keys which in turn are used to sign certificates that identify machines. So first of all this hypothetical government would have to issue itself certificates for any sites it was interested in intercepting, and intercept the traffic to impose a…

I think they meant unrestricted signing certificate. A few CA's have been caught providing this to external entities and have been pulled from trust stores. The cynical side of me assumes the behavior just moves to another shell company. For those curious how to mitigate or at least identify when this is occurring, you could trust transparency reports, or if you don't trust those, then log certificate fingerprints of the sites you visit.

  for domain in $(cat ./mydomains.txt); do echo -en "${domain} "; openssl s_client -servername "${domain}" -connect "${domain}":443 /dev/null | openssl x509 -fingerprint -noout -in /dev/stdin; done|sort -k2 -t"=" | awk {'print $NF "\t" $1'} | column -t

  Fingerprint=4C:B1:F9:42:9A:58:CB:E2:7F:92:27:A9:41:5B:15:8B:01:3B:D1:64  ycombinator.com
  Fingerprint=98:70:50:FF:B9:05:CA:D3:A7:9A:85:96:C2:12:0D:B9:7C:03:A1:65  news.ycombinator.com
It's probably also worth logging the creation/expiration dates too, given that certs expire so much quicker these days. If you wanted to make this information even more useful, have people all around the world run this and feed it into a distributed database and log the ISP the test was run from so that you can see if a particular ISP has been compromised. That is how some folks I know in Africa found out their ISP was using BlueCoat proxies and that the certs were being installed as part of their ISP's required package downloads.

Re: The UK Is Trying to Stop Facebook's End-to-End Encryption

#58

Post by pydry »

varispeed wrote: post #46
max1984_2 wrote: post #42

Earlier quoted context omitted.

I don't want to be "blackpilled" about it. But there is literally nothing that can be done about it. None of the politicians in the UK seem to care about freedom of speech, right to privacy or anything else that is classically liberal. Everyone in the UK either supports it or is resigned to it. Also almost nobody in the IT industry seems to care about it either (I've worked at quite a few places as a consultant).

There is nothing that you can do about it, so people are just apathetic. Only way to change something is by voting, but there is no party that would have a chance of winning that would support freedom of speech. People literally think that if you have nothing to hide, then you have nothing to worry about. When I tried to move some of my friends to Signal and told them that someone can read our messages, they just sai…

>Only way to change something is by voting

Any party with a chance of winning gets coopted.

The only real way to change is to participate in internal party politics machinery, and be prepared to play dirty, because they certainly will.

Re: The UK Is Trying to Stop Facebook's End-to-End Encryption

#59

Post by max1984_2 »

varispeed wrote: post #46
max1984_2 wrote: post #42

Earlier quoted context omitted.

I don't want to be "blackpilled" about it. But there is literally nothing that can be done about it. None of the politicians in the UK seem to care about freedom of speech, right to privacy or anything else that is classically liberal. Everyone in the UK either supports it or is resigned to it. Also almost nobody in the IT industry seems to care about it either (I've worked at quite a few places as a consultant).

There is nothing that you can do about it, so people are just apathetic. Only way to change something is by voting, but there is no party that would have a chance of winning that would support freedom of speech. People literally think that if you have nothing to hide, then you have nothing to worry about. When I tried to move some of my friends to Signal and told them that someone can read our messages, they just sai…

> There is nothing that you can do about it, so people are just apathetic.

Just to expand on this. It is just recognising the state of current situation. A lot of people in the UK support the state in some form or another and if the state tells you encryption is for terrorists or criminals then as far as they are concerned it it is for terrorists and criminals. Almost everyone in IT *might* grumble about it but that is as far as it goes.

People outside of that view point are seen as eccentric, crazy or "conspiracy theorists" even after you point to real abuses of the current snooping from GCGQ (e.g. people spying on their former spouses) that has rock solid evidence.

There is no political will in any mainstream party, even the non-mainstream ones don't care. The citizenry is apathetic, the professionals in the industry that work here are apathetic. In fact the very opposite exists, people seem to love it when the politicians do tyrannical things. There is also no real difference in the mainstream parties. I haven't voted in years because there is nobody to vote for who is worth a damn.

I am so fed up of fellow citizens. I am moving once the COVID situation is resolved as mentioned in another comment.

Re: The UK Is Trying to Stop Facebook's End-to-End Encryption

#60

Post by tialaramex »

LinuxBender wrote: post #57
tialaramex wrote: post #35

Earlier quoted context omitted.

A root CA certificate doesn't allow you to "MITM you heart away". Its purpose, as would be clear if you think about what the CA does with it, is to sign other certificates for keys which in turn are used to sign certificates that identify machines. So first of all this hypothetical government would have to issue itself certificates for any sites it was interested in intercepting, and intercept the traffic to impose a…

I think they meant unrestricted signing certificate. A few CA's have been caught providing this to external entities and have been pulled from trust stores. The cynical side of me assumes the behavior just moves to another shell company. For those curious how to mitigate or at least identify when this is occurring, you could trust transparency reports, or if you don't trust those, then log certificate fingerprints of…

This seems like an over-complicated non-solution. If your browser is trusting some other root, you can see that information in the browser. For example if I click the padlock for this site, and pick More Information / View Certificate, sure enough this is a certificate issued from DigiCert.

But also, it's basically game over if you agree to run arbitrary software other people pick, so that's where the real problem is for the African case you describe.

Post reply on HN