Hacker News Reader

Comment by aneutron | Hacker News Reader

It feels weird to read stuff like this, really.

What they want is to be able to wiretap people, without them knowing. Because if encryption is what's bothering them, you can get a warrant, seize the phone and/or computer, and make the owner unlock it / give you the keys, by law.

It is perfectly logical and lawful. However, if unwarranted (in the sense of without a warrant) wiretapping is involved, then yes, encryption "hinders the law enforcement". Except it doesn't. Because as mentioned earlier, just get a warrant, and make the owner unlock / give you the key, by law.

It doesn't hinder the law enforcement, it hinders the intelligence agencies work and makes it less invisible. And I kind of think that's a good thing too.

View on HN

Following up on your point, NYT really swings-and-misses here. (I suppose they could also be engaging in gaslighting or dog-whistling ...)

> Ordinary Americans — including President Trump’s former lawyer, Michael D. Cohen — are also increasingly using encrypted apps to conduct delicate conversations to prevent monitoring by the government or others.

"Ordinary Americans" are not only using "encrypted apps" to conduct "delicate conversations." People, regardless of jurisdiction, are using these applications because they expect that their private conversations are and will remain private -- especially in a world where digital interactions are replacing/will continue to replace face-to-face interactions.

If I have a conversation with someone over coffee at my kitchen table, I wouldn't (necessarily) consider that conversation to be "delicate." Regardless, I wouldn't want any person or government entity to be able to listen in -- surveillance inhibits freedom of expression and the results are often without context.

> […] make the owner unlock / give you the key, by law.

That only works if you can threaten to put the owner into jail for not complying. If you're trying to spy on communication between two people outside your jurisdiction, you're out of luck.

(that doesn't mean I support the US governments attempt to undermine secure communication)

Refusing to provide your passwords is itself a crime in the UK, not to mention obstructing an investigation and god knows what else they decide to stick you with for trying to have some privacy. I believe the idea is to threaten you with more jail time than you would receive for the crime you possibly committed.

Luckily with modern key agreement protocols the user never knew the decryption keys at all. Encryption of data at rest is another matter. We need better duress mechanisms there, and in order for those to be effective we need a big cleanup of how many applications store user data.

That makes no sense to me. There must be some mechanism for accessing messages. Whatever that is, it's those credentials that you'll need to produce. Or rot in jail indeterminately.

The term for the concept is forward secrecy, or often "perfect forward secrecy". It seems like magic to me, too, and I'll probably be reviewing the basics tonight. I couldn't begin to tell you how the trick is accomplished.

Somehow, an attacker can have your whole conversation log (encrypted), including the key exchange, and be unable to retrieve the key used, even if he has the credentials you used at the time the key was generated.

The real crux of the question may be, "How does Diffie-Hellman work?" (Well known key exchange method.)

Yes, I understand PFS, ratcheting and all that. But you're talking about stuff captured off the wire. And yes, that can be protected with PFS. Even OpenVPN does that. But I thought that we were talking about devices and stuff stored on them. Even if all transport had PFS, devices and encrypted files all have passphrases and/or secret keys.

I've been curious about one aspect every time I've seen this law mentioned.

Theoretically, let's say you use VeraCrypt or something similar to create a password-protected volume inside a big .mp4 file using steganographic techniques. A second secret password is set, which can decrypt another hidden volume which contains the actual sensitive data.

You give out the password for the first volume under duress.

Would that be enough to satisfy the law? If so, isn't it undermined?

https://en.wikipedia.org/wiki/Rubberhose_(file_system)

They all know about VeraCrypt, and passwords for hidden stuff.

Yes, but the point I'm getting at is whether someone could hypothetically still be outside the law if they gave access via the first password, but the interrogators suspected (but could not prove) that a second volume existed.

They don't need to prove anything. They just imprison until you reveal the password for the hidden volume. And if there's really no hidden volume, then you're SOL.

Max tariff in the UK is 2 years, or 5 in Terrorism cases. Does anybody have any actual insight on this specific UK law, rather than guesses?

Once again, this is in context of UK law. So speculation about rubber hoses in dungeons isn't particularly relevant (luckily).

> […] a crime in the UK

I don't think somebody living outside of UK cares. The threat only wors if that person lives in UK jurisdiction. Not everybody does.

It seems to work in the US. There's a man in Philadelphia, who's been jailed for years. He's charged with contempt of court. because he claims to have forgotten the FDE key for his macOS box. Which investigators believe is loaded with child porn. And so he periodically sees the judge, who extends his sentence for contempt. There's apparently no limit under current US law.

Well, a lot of people live in EU jurisdiction. And at least until March 2019, a UK warrant can cause you to be arrested by any EU police if one of the crimes covered by the warrant is also illegal in the country where you're arrested.

How can they prove that you know the password? What would the consequences be if you legitimately forgot or didn't know the password?

Very likely, you just stay in jail until you remember. Or whatever the maximum is, if there is a maximum.

It comes down to whether a judge believes you or not.

Tacking on to wereHamster's comment, encryption also irrevocably hinders investigators if the suspect is dead and the investigators are attempting to discover any potential co-conspirators.

>And I kind of think that's a good thing too.

Not just a good thing but isn't it really the point of the whole exercise?

Reply on news.ycombinator.com