Hacker News Reader

Comment by Cthulhu_ | Hacker News Reader

It pretty much is, section 12 of the Universal Declaration of Human Rights states:

> No one shall be subjected to arbitrary interference with his privacy, family, home or correspondence, nor to attacks upon his honour and reputation. Everyone has the right to the protection of the law against such interference or attacks.

I mean wearing my programmer goggles it doesn't state privacy AND correspondence but OR, but still. Not having your personal conversations get intercepted is not too much to ask for, is it?

I mean I get it, if they have a reasonable suspicion they CAN intercept your communications (listening devices, intercepting the phone conversations), but this is not a right they can claim on anyone, and they shouldn't be able to force companies to allow them to listen in. Not arbitrarily anyway (see: Snowden revelations, where it was proven that the NSA just hoovers up anything and retroactively checks if there's anything wrong in there)

View on HN

The problem is that you can’t leave any room for interpretation, because governments generally interpret things as liberally as they can in their favor, to the brink of absurdity.

In other words, “encryption” needs to be listed there as a right, to remove any room for interpretation. Or explicitly listed as an example of a more general right, like the right to private speech (or whatever you want to call it).

The EU ministers do want us to have a right to encryption. They just want to be able to decrypt it.

Considering governments have about the same capacity to store data securely as a twelve-year-old, those decryption keys basically open up the door for everyone who is willing to put the effort into retrieving them.

And considering the retrieval would certainly be breaking at least a few laws, the people who are going to pull it off are going to be

- nation states

- APTs

- large criminal organizations

- large corporations (corporate espionage)

So you arguably defeat the entire purpose of having encrypted data streams. Sure, the barrier of going and "stealing the keys" is still there, but given the track record large governments have at not leaking data, it is safe to say there would be little barrier aside from legal ramifications if caught.

Like TSA luggage keys.... there's no way those would leak online, and no way anybody would be able to download them from https://www.thingiverse.com/thing:1687424 and 3d-print them... no way something like that'd happen!

Luckily, you can't 3D print an encryption key that would be useful in any way. Although, now I wish the guy from Lavabits had handed in his SSL cert as 3D printed letters and numbers like a puzzle.

3D printing is one of the more useful ways to securely backup up encryption key’s. Just ensure the only place they exist is inside an object and not only are they durable, but tamper resistant as someone can’t just photocopy the key.

Could you elaborate on that? I couldn't find anything from a few Google searches.

3D printers can make solid objects with internal structures.

It’s the same basic idea as an envelope, as in you need to open it to see what’s inside. However, opening it up inherently breaks the object so if you have it unbroken then it’s obvious that nobody has done so. XRay’s being an obvious risk.

That would be a 2D print.

You’re 3D printing inside the object so people can’t just copy the number. Think envelope.

> Luckily, you can't 3D print an encryption key that would be useful in any way.

That's true, you have to rely on Sony executives to tweet them out instead. https://m.slashdot.org/story/147470

You can tattoo an encrypyion algorithm. Someone did that a long time ago with RSA: http://www.geekytattoos.com/illegal-tattoos-rsa-tattoos/

There are many, many ways to print (escrowed) keys with a 3d printer... from punched cards, to "engraved" letters, to chains of 3d numbers, etc.

No you can just print a QR code of it on a 2D printer :P

That is not encrypted then.

Should we say that no building is really locked, since the fire department is alway able to force entry?

We are not talking about human habitats that are supposed to be transitable by design. We are talking about lockers within this habitat, that remain secure even if the house is burning, because you don't want thieves who arrive before the firedepartment to have access to your guns. It's a civil obligation.

"really locked" is using a wholy misused modifier. Neither are we talking about royal priviliges, nor the distinction to virtualized fantasy. The necessary capability of encryptian is effectivity. The effectivity of regular locks is indeed a matter of concern in the security industry to begin with, as lock picking sessions at Defcon make clear. But, if the fireman's axe shreds the frontdoor, at least there will be no denying that you have been literally hacked.

Scale and viability. Your fire department can't break force entry without notifying others in the area or do it to every building in the city.

Now digitally, that's not true. You can keep collecting data without anyone knowing at an unprecedented scale.

They think it is.

Well, if everything is working as planned - it is encrypted in a way, that the economy and the people are protected against criminals, but everything is still in control of the government. That is the plan. And it makes sense, from their point of view. But their point of view usually comes from law schools and not technical universities.

You might be confusing hashed with encrypted.

Not just governments. Anyone, really.

> I mean wearing my programmer goggles it doesn't state privacy AND correspondence but OR, but still.

But still what? The logic is perfectly correct; ~(a | b) = (~a & ~b)

They key word is 'arbitrary'.

The courts may not view the police, with a warrant, wanting to see your texts because they believe you're doing something illegal as a form of 'arbitrary' interference.

This new proposal sounds nutty to me, but I think that our various constitutions provide for the possibility of government access to private stuff given legitimacy, proportionality etc.

That's what I believe they're thinking too. Except with encryption that's not one of the options, unfortunately.

It continues " There shall be no interference by a public authority with the exercise of this right except such as is in accordance with the law" [to ensure everyone's safety].

E2e encryption that is "safe from courts" isn't protected.

It isn't "safe from courts" because courts can allow them to bug your house and hack your phone using the unlock code their bug recorded you entering.

They can't do that to the entire public at once because it's not economical, but that's the point.

Not sure I follow. The struggle politicians are in isn't to eavesdrop on everyone. The fact that this is possible is an unwelcome side effect. The struggle is to not lose the same ability (targeted eavesdropping after court orders) when people switch to e2e from phone calls.

If cell phones had e2e encryptoions so the normal court-order landline eavesdropping disappeared from law enforcements' toolboxes - there is zero chance they would ever have been allowed in the hands of the public.

> The struggle is to not lose the same ability (targeted eavesdropping after court orders) when people switch to e2e from phone calls.

But they haven't. They can physically install a listening device at the location in the warrant and thereby record any conversations you make from there. That gives them the same capability they historically had with landlines.

Yes. So for a static location that's feasible. But the status quo is they can also tap old school mobile voice calls and text messages.

Which they can do, too. Just break into an Android phone (easy enough to do remotely). Bug home, bug the car, bug shoes, now you have phone calls from an iPhone. (You can pick up electrical interference from phone calls on an iPhone, due to the hearing aid induction loop.)

For every phone, you can just slip an antenna under the case (or in the phone's body) and pick up the LCD switching interference – faint though it may be – and figure out what's on the screen from there. Or, you know, CCTV.

Encryption-for-the-masses merely protects from mass surveillance; anyone protecting themselves from targeted surveillance isn't going to suffer from an encryption ban.

I don't see any good middle ground between "authorities can never eavesdrop on inviduals' comms even with a warrant" and "authorities can do mass surveillance". It's a very difficult dilemma. I (as you do) prefer the former if I have to choose. I understand why it's not a very wasy pill to swallow though. Hopefully techniques for targeted eavesdropping (like those you mention) will improve as e2e gets more widespread. The easy of eavesdropping on mobile comms has probably been too comfortable for too long.

The status quo today is that various encrypted messaging apps exist without any apparent backdoors. This has been the case for several years already. The status quo from not long before that was that mobile phones and text messages didn't exist at all.

Yes. Perhaps the endgame here is that when "old school" voice/text shrinks, so does that avenue for eavesdropping, and once it's almost zero, then allowing any e2e doesn't mean a loss of ability anyway.

Also, so long as metadata is available from cell towers, you can still use the most useful piece of data: that someone's phone was at a crime scene, even if the communication itself was encrypted. That will always be the case (unfortunately also in authoritarian regimes).

“The struggle politicians are in isn't to eavesdrop on everyone.”

Counterpoint: yes it is.

that's the short story.

The long story is that encrypted files alone are no use to anyone, so the courts have no more right to it than anyone else. The decrypted text is a different matter. It's supposed to be protected. So you are saying, eventually, if I may interpret it that way, that speech which is protected from the authorities including the courts is not in fact protected from the courts.

Oh, ok, that's not even illogic, just paradox.

Problematicly, if you consider the abstract danger of a key cypher pair a threat, the same goes for the legislatator court partnership. The courts aren't a threat as long as there's no legislation that opens them up to it. So, clearly, the legislation is key to the infringement. This means that legislation has to act in accordance with legislation, which is as difficult to understand for regular joe as function pointer semantics in C++. So it appears to say, simply, that legislation has to act...

That's you and me. Actually though, the law is accordingly a huge tower of abstraction. The moment you try to dereference "the law" it blows up into your face, a group of skilled experts has to drop into debugging mode and, eventually, has to decide if they want to have their access limited even in debugging mode. Well, the system was designed for the hypervisor kernel to access all areas, this seems to be a problem of the virtual OS handling the capabilities for userspace incorrectly.

Bug closed: won't fix.

If only the Declaration was legally binding...

Well, the ECHR is (for all EU members), and has a similar clause:

> Everyone has the right to respect for his private and family life, his home and his correspondence.

unfortunately it also has exemptions for anything a government could reasonably use as justification to restrict this right:

> There shall be no interference by a public authority with the exercise of this right except such as is in accordance with the law and is necessary in a democratic society in the interests of national security, public safety or the economic well-being of the country, for the prevention of disorder or crime, for the protection of health or morals, or for the protection of the rights and freedoms of others.

If government can strip it at will and I think it is formulated as such, the right doesn't exist and it isn't more than nice window dressing.

> interference with [...] correspondence

Imagine that some unnamed corrupt government treats your telegram messages as correspondence, but not encryption keys. It then orders Telegram to release said keys (pinky promising not to do anything nefarious with them) because they aren't considered correspondence.

When they have a court warrant, it's not arbitrary. I think some rights were given to the people to combat government tyranny (right to bear arms for example), but combating government tyranny is just not feasible anymore, due to a set of factors, like our inability to organize behind a common cause. Anyway, the choice here is reserving our ability to overthrow an unjust system, or giving the government the rights to catch those who might want to unjustly overthrow it.

The court warrant sounds like it's a good idea, and don't most other things work that way too? Actually End-to-end encryption isn't that different.

It so happens that there's no point in taking out a warrant against the man-in-the-middle, because he has no access to begin with.

You'll have to get a warrant against one of the ends.

What these proposals would end up doing is to force people to weaken protocols and start spying as a man-in-the-middle, just so that they can be targeted by a warrant.

This is just a little bit silly, I feel; and doesn't really help anyone. I don't think that authorities realize that that is what they're asking for. Usually when it gets explained to them, sooner or later they relent. And then a few years later someone replaces them, and it happens all over again.

I don't see any proposal to "weaken protocols." Why would the government try to mandate the use of provably unsound end-to-end encryption, weakening security for everyone, when it could just order Apple and Google to spy on the user's end, which they control?

Sorry, but this is nonsense. Possessing cryptography does not imply the boogeyman will, as a consequence, gain the ability to overthrow the system. On the other hand, there's very concrete evidence governments are the boogeymen.

>giving the government the rights to catch those who might want to unjustly overthrow it.

So how decides when an attempt is just? Did the British think the American revolutionaries were just in declaring independence?

It is might makes right essentially - if treason doth prospor none dare call it treason. If there is absolutely no hope of any effort to revert it succeeding it is just.

Reply on news.ycombinator.com