The UK Is Trying to Stop Facebook's End-to-End Encryption
wired.com
wired.com
Maybe there is a restriction snort where such an action requires a warrant but considering that "judges" and "courts" for that (like that infamous US secret court, seriously WTAF) are basically rubber-stamping enthusiasts, it's not actually a restriction and just compromises end user privacy and (online) information security.
"Backdooring E2E encryption"/"Private key escrow" are some other examples of unrealistic and ultimately harmful things called for by technologically inept, old people who inexplicably have been granted the power to devise laws that will most likely only show their full effects years or decades down the line when most of those legislators are either already dead or don't have to worry about the consequences of such legislation anyway ("I don't even use a computer, what do I care? The internet is just full of criminals anyway." quote from my 80-something grandmother). In German there is a nice idiom for that kind of thought pattern: "Nach mir die Sintflut" (something like "After me, the flood/deluge" from what I could find). At the same time these old people and their accomplices - indoctrinated middle-aged people - try to stem the flow of young people into politics if their ideologies do not align with the elderly agenda by e.g. accusing them of trying to oppose the protection of children or something equally effective in the mass media (via the excuses mentioned above).
It's all just so fucked up...
Interestingly this is originally a French saying by Louis XV, Après moi, le déluge [0]. From wiki:
> It is generally regarded as a nihilistic expression of indifference to whatever happens after one is gone, though it may also express a more literal forecasting of ruination. Its meaning is translated by Brewer in the forms "When I am dead the deluge may come for aught I care", and "Ruin, if you like, when we are dead and gone."
It looks like the German translation of the same idiom was popularised by Marx [1].
[0] https://en.wikipedia.org/wiki/Apr%C3%A8s_moi,_le_d%C3%A9luge
TIL.
And yet the Investigatory Powers Act[1] passed into law in the UK and has never been repealed.
We haven't seen a headline like "local ambulance chief spied on my wife's porn browsing habits" so far but I do wonder if there have been any abuses by now?
[1] That's the law which allows people like your local fire chief or food standards agency to download a copy of your browsing history without a warrant. From the legislation itself, here are the surprisingly large list of people:
https://www.legislation.gov.uk/ukpga/2016/25/schedule/4/enac...
Getting a warrant in the UK is not some huge effort, in the worst cases it can take just under 1 month but regularly can be under 35 minutes.
In the way DoH is being used in practice, it alllows third parties to collect histories of DNS lookups for myriad users, separated by individual program. In other words, the third party can tell which program was used by a given user to initiate any given DNS lookup. The program often reveals identifying information about the device on which it is installed. Other parties collect user data pertaining to IP address and device.
Device fingerprinting, i.e., associating a given user with a given device, is in widespread use purportedly "as a security measure" by "tech" companies like Facebook. Can we be sure the data collected is also not being used for other purposes.1
Combine the DNS program+IP fingerprint with, e.g., a web browser+IP fingerprint and now we can potentially identify a user from DNS lookups.
Now consider that Facebook prefixes all external URLs posted to Facebook pages (including external URLs posted in messages) so that any clicks on these URLs are captured, and the HTTP requests to non-Facebook sites are redirected via Facebook servers, again as a purported "security measure". Can we be sure the data collected is not also being used for other purposes.1 Thus Facebook has a history for each user of the URLs in Facebook pages/messages that the user clicks/follows.
The problem with DoH in practice is that it is being used almost exclusivelt to provide third party DNS. When we use third party DNS we give anyone (e.g., a "tech" company, a government, etc.) the potential opportunity to obtain from the third party (e.g., through subpoena, acquiring assets through merger, undisclosed data breach, etc.) complete DNS lookup histories for users' individual programs. There is no need to do this because there is no technical need to use third party DNS. And, of course, DoH does not have to be used only by third party DNS providers, so DoH itself is not the problem.
1. If I recall correctly, Facebook in the past has been caught lying about collecting telephone numbers "only" as a security measure.
Right now they get a good idea which sites are visited (because of Server Name Indication) by web browsers, and they get some portion of email (sent in the clear) plus a small fraction of web traffic (HTTP-only) and numerous older unencrypted protocols.
In particular they also get most of DNS. DPRIVE work (DNS over TLS, DNS over HTTPS, and eventually DNS over QUIC) reduces that considerably. Future DPRIVE work also includes oblivious transfer (you ask say Google to do a DNS lookup on your behalf, they learn who you are and which DNS server was asked but not what you asked it, the DNS server learns what was asked but not who you are, you get your answer).
Or of course, if you're particularly worried, you use Tor and everything on the snoops' screens dissolves into noise.
So first of all this hypothetical government would have to issue itself certificates for any sites it was interested in intercepting, and intercept the traffic to impose a MITM. It has to do this live or it won't work. Every time it does this, it provides the other participant a smoking gun, which is to say evidence - in the form of these bogus certificates.
But wait, if you run Chrome, Safari or similar browsers, these certificates just won't work. To be functional the government has to obtain proof they were logged for everybody to see - in the Certificate Transparency system. Without that the user just gets an error telling them the certificate isn't logged and can't be trusted.
If they were logged, we all get to see them. Do you see them? No, because this isn't actually a thing. It's a paranoid fantasy.
for domain in $(cat ./mydomains.txt); do echo -en "${domain} "; openssl s_client -servername "${domain}" -connect "${domain}":443 < /dev/null 2>/dev/null | openssl x509 -fingerprint -noout -in /dev/stdin; done|sort -k2 -t"=" | awk {'print $NF "\t" $1'} | column -t
Fingerprint=4C:B1:F9:42:9A:58:CB:E2:7F:92:27:A9:41:5B:15:8B:01:3B:D1:64 ycombinator.com
Fingerprint=98:70:50:FF:B9:05:CA:D3:A7:9A:85:96:C2:12:0D:B9:7C:03:A1:65 news.ycombinator.com
But also, it's basically game over if you agree to run arbitrary software other people pick, so that's where the real problem is for the African case you describe.
It's literally a crime done right in front of the police, with official records and signatures for you to be prosecuted.
The Justice system has all sorts of power. A cop can arrest you, right now, for no reason at all - which is totally against the law, but he could do it, you'd have to file a redress and hopefully they'd be charged.
So the issue isn't really about encryption, it's about the integrity of our systems.
We'll get 10x further by improving processes than otherwise.
Technology can help, but it's secondary.
How does the party know they have been wronged? Are they notified that someone has been given access to their browsing history?
Like, stricter regulation of mathematics?
1. There being a service provider that is a legal entity. 2. The service provider providing the client software. 3. The service provider gatekeeping to the social network that makes the system useful. 4. Consumers not generally being able or willing to interfere with their client end software to add E2E on top of what the service provider does, even if that is technically feasible.
Under these conditions, mandating backdoors through regulation is perfectly feasible, regardless of mathematics.
Maybe one day we'll see true P2P software that users actually control, with no central entity that the government can coerce, actually being used by the mass market. Until then, it's not defying mathematics at all to mandate backdoors.
But as it stands, private houses are warrant-proof places where anything can happen.
> yet houses are still sold without built-in surveillance cameras, that would let law enforcement look at the recording of what you were doing (with a warrant, of course!)
yet, but it could come. I can imagine offline AI detector that spies on you 24/7 in your house and only sends footage when it detects something illegal so the police wouldn't do the monitoring. I could see plenty of people being ok with that specially if it's advertised as a good way to proof your innocence.
No. Thanks.
I already considered this in my predicate: 4. Consumers not generally being able or willing to interfere with their client end software to add E2E on top of what the service provider does, even if that is technically feasible.
https://www.theregister.com/1999/01/15/france_to_end_severe_...
(Sarcastic? Who knows?)
Implying that any system which looks to casual users e2e encrypted now isn't, like the web. Are they ready to open that can of worms?
The NHS is a massive money sink that always requires more money to keep on operating. I've heard the chant of "Save the NHS" since I was a child. As someone who parents are Labour voters (my ancestors used to work in the mines) even they are starting to think it might not be worth it.
Any party with a chance of winning gets coopted.
The only real way to change is to participate in internal party politics machinery, and be prepared to play dirty, because they certainly will.
Just to expand on this. It is just recognising the state of current situation. A lot of people in the UK support the state in some form or another and if the state tells you encryption is for terrorists or criminals then as far as they are concerned it it is for terrorists and criminals. Almost everyone in IT *might* grumble about it but that is as far as it goes.
People outside of that view point are seen as eccentric, crazy or "conspiracy theorists" even after you point to real abuses of the current snooping from GCGQ (e.g. people spying on their former spouses) that has rock solid evidence.
There is no political will in any mainstream party, even the non-mainstream ones don't care. The citizenry is apathetic, the professionals in the industry that work here are apathetic. In fact the very opposite exists, people seem to love it when the politicians do tyrannical things. There is also no real difference in the mainstream parties. I haven't voted in years because there is nobody to vote for who is worth a damn.
I am so fed up of fellow citizens. I am moving once the COVID situation is resolved as mentioned in another comment.
I read country X is trying to ban Y, and every time I just wonder: how?
I can download something off GitHub (except if the ban is in the US), or a copy somewhere else.
Ideally, developers wild set a multi country repository with a canary and be done.