Hacker News Reader

Comment by flangola7 | Hacker News Reader

Wonder how they expect this to mesh with the new EU law mandating, among other things, open app ecosystems.

Will Britons just import their phones from France?

Presumably mobile networks will be required to only grant internet service to phones that were bought in the UK (or that have been registered with a foreign network for more than N months).

I'm not sure how easy it is for networks to filter by IMEI (and presumably there would have to be a database for recording which IMEIs were sold with UK-compliant OSes) but eventually there would be a system which covered all access to the internet, not just from phones.

This means broadband ISPs doing a Remote Attestation check before routing any other packets from your device. A proof of concept for this has been implemented for some online games already.[0]

[0] https://arstechnica.com/gaming/2021/09/riot-games-anti-cheat...

Even with attestation you could just daisy chain and use the attesting device as a proxy. Not to mentioned the billion of internet enabled devices that would never support it

> Even with attestation you could just daisy chain and use the attesting device as a proxy.

But you'd need the attested device to run the proxy server software, which would obviously not be allowed in the app store, and would be blocked by the gatekeeper daemon or the OS-level firewall. Well, proxy software would be allowed, but it would have to perform its own attestation checks on the devices it proxies for.

> Not to mentioned the billion of internet enabled devices that would never support it

The billion internet enabled devices would be allowed onto a special "safe" segment of the internet, which companies could apply to add their static IPs to. So your internet connected fridge could still phone home, but the manufacturer would take liability for any data that a rooted fridge managed to send out to the internet.

There might still be millions of old devices that don't support TPMs and don't have manufacturers willing to apply to have their IPs whitelisted, but the government will say that kicking these insecure unpatched devices off their internet would be a huge win for cybersecurity. Making people buy a whole load of new devices would probably also give a temporary boost to the economy too.

I think you're missing the point. Attestation is just key signing and verification with more bells and whistles and overhead. DRM tries and fails for the same reason: you have to give the user both the key and the content. There has been 30 years of attempts to somehow obfuscate and keep them apart, all without success.

An attacker with physical access and unbounded time cannot be defeated.

The reason why DRM has failed in the past is that it only takes one person to crack the DRM on their own device, and then they have an unencumbered digital file which can be copied and distributed freely.

Applying DRM to kernels and applications rather than to media files is completely different. If someone wants to have an E2E encrypted conversation, not only do they have to have jailbroken their own device by extracting the secret keys from inside its processor (using an electron microscope, perhaps) but their conversation partner has to have done the same to their own device.

Even if a few brave and well-resourced journalists/lawyers/activists managed to do this among themselves, they would quickly be exposed by traffic analysis, allowing the government to simultaneously arrest all of them and use their devices as evidence.

UK is not a part of the EU so it wouldn’t have to mesh at all unless I’m missing something?

Sure, but its not that hard or expensive to hop a ferry/train/plane trip to France or Ireland and buy an unlocked phone, as one example. Any laws the UK passes have to account for the geographical realities of its location.

Just because the UK is no longer in the EU doesn't mean its not affected by many of its decisions, given the enormous volume of trade that will continue to occur between them.

>Any laws the UK passes have to account for the geographical realities of its location.

The sun never sets.....

And the Channel between England and France is a mere 20 miles at its narrowest point, Ireland is 12 (the UK's nearest EU neighbors). You can argue it down to zero miles for Ireland if you start your journey in Northern Ireland.

The sun absolutely does set on what little is left of the "British Empire" in the 21st century.

> The sun absolutely does set on what little is left of the "British Empire" in the 21st century.

I suggest you look at the locations of the British Overseas Territories

The famous phrase was as much about the relative geo-political strength of the empire in the 18th and 19th centuries as much as it has to do with actually being able to see a sunset... but feel free to take it literally if you like.

this subthread is literally about geography

Its literally about the quote widely used to generally describe the nature of 19th century British power, but ok!

> The sun never sets...

> https://www.phrases.org.uk/meanings/the-empire-on-which-the-...

What happens when you get stopped and searched in the UK (probable cause isn't a factor here) and they find a "special encryption" phone?

I hate to break the bad news, but people break laws all the time, including in the UK. People will just manage the risk exactly like any other law they choose to ignore.

Criminals still carry blades as weapons in the UK, despite it being a strict liability crime and at risk of stop and search.

Some EU laws apply in Northern Ireland - I don’t know about laws in this area specifically. If a phone is legal in the EU, the UK may be required under the Northern Ireland Protocol (and the new “Windsor Framework”) to allow it in Northern Ireland. If they have to make a phone legal in Northern Ireland, it will be very hard to ban it in England, Scotland and Wales

Reply on news.ycombinator.com