Hacker News Reader

Comment by palata | Hacker News Reader

Just like for other big challenges like biodiversity and climate change, it feels like it often boils down to the politicians just not understanding enough to take rational decisions. Of course they can't all have a PhD in cryptography, but they should also not have no clue at all.

Over an over again, politicians are asking for backdoors. To me it just proves that they don't understand the very basic of how encryption works.

Especially these days in Europe, it seems completely insane: it is already a problem that most companies use US services, given that the US have become hostile to Europe. The sane way to go is to try to get better privacy for European companies/people, not worse. Adding backdoors just makes it easier for adversaries to access private data.

View on HN

> To me it just proves that they don't understand the very basic of how encryption works.

Hanlon’s razor isn’t always true, sometimes it really is malice. Considering EU ministers want to exempt themselves from Chat Control, that suggests to me they do understand enough of the basics.

https://european-pirateparty.eu/chatcontrol-eu-ministers-wan...

I love the combination of them naming this evil bill "Child Sexual Abuse Regulation Proposal" to make it sound like an obviously good idea, and them asking to be exempt from it. So are you implying you are abusing children?

Especially considering that governments such as the UK (I know they left the EU but I'm more familiar with them than the current EU members) have a pretty grim history of exactly that.

Using their own bullshit excuses against them, that might actually cause their heads to explode. Of course the rebuttal will be something something national security yadda yadda.

yes, they are obviously to be considered child abusers. thats what I will publicly call ANYONE that supports their own exemption. they are pedos and child abusers, and should them campaigning for their exemption should count as admission of guilt

It’s far more often malice than stupidity, when talking about overreach of power. I absolutely hate Hanlon’s Razor, it’s how we got here.

> it feels like it often boils down to the politicians just not understanding enough to take rational decisions.

That's a very gullible take and kind of apologetic for the politicians. If you are implementing a backdoor to crypto-systems, you probably know exactly what you are doing.

That, and this has been re-surfacing time and again under different pretenses make this a deliberate attack on freedom of expression. The politicians know exactly what they are doing.

I'm sure some of them do but encryption is pretty unusual as a lock that police can't break. If a judge orders a search of your house and the incriminating evidence is in a safe they will break it open if you refuse to open it for them. Governments aren't exactly happy that for digital assets there's ready made mass-market systems where the response to any search warrant will be to pound sand.

When law enforcement tells you that they're being hindered by the fact that even unsophisticated criminals have E2EE messaging and that's their biggest source of evidence (pulling text records) then asking for back doors starts to sound reasonable. It isn't of course because it defeats the whole point but it doesn't have to be a crusade against speech or whatever.

> Governments aren't exactly happy that for digital assets there's ready made mass-market systems where the response to any search warrant will be to pound sand.

Which is to say they understand the situation perfectly and are acting with a firm intellectual grasp of what is going on.

The issue isn't that they don't understand encryption, it is that they reject citizens having any sort of power to resist the state. Which is cool and all, authoritarianism is always with us to some extent. But at its core they see this from the viewpoint that the state is fundamentally in control and sometimes it grants people the privilege of privacy because it doesn't think what they are saying is important and therefore they can be humoured. They'll pretend technical ignorance if it gets the liberals off their backs, but the only people they are fooling are the credulous.

> it is that they reject citizens having any sort of power to resist the state

But by doing that, they make it easier for adversaries to spy on their own citizen, which is a national security issue.

That's why it sounds like ignorance to me: I understand that they really want a backdoor just for themselves "because they are the good guys" and "for national security", but they don't understand that if they have a backdoor, then their adversaries will eventually have it, too.

It isn't even that complex an idea, you laid it out in 1 sentence. "If they have a backdoor, then their adversaries will eventually have it, too". They understand that just fine. If anything, you're the one who doesn't understand although I'd not push the point because the rules around political debate are weird and you might be humouring them.

The people in government have a hierarchy of threats. Social challenges from within their own nation always higher than those from foreign countries. Most politicians are perfectly happy to sacrifice national security to be able to see what their citizens are saying, they just won't articulate it in plain language because it sounds bad.

We can tell this because they're signing off on narratives around being "the good guys". Anyone pushing that sort of narrative spin isn't a good guy. That isn't how law enforcement works in practice and anyone in high political power knows it if they have even a shred of intellectual honesty; they've seen how the sausage is made and are well aware that the real world is all various shades of what happens when a family breaks down and siblings start fighting with each other.

The issue is that something like this will not affect the criminals, they can just use something with encryption.

Listening to the debates in the lower chamber (Assemblée Nationale) and the arguments of those arguing in favor of backdoors clearly show they do not have a clue how any of this works. They are not clever players doing double-bluffs. They are ignorant stooges.

First, the constituents on the chamber are supposed to vote along the party lines. Yes, they do not understand what is going on but that does not obviate their responsibility. Negligence can be criminal. I am specifically talking about the people pushing this (as in planning, writing, orchestrating its ascent to become law and then enforcing).

Why do they need to understand how encryption works ? They’re mostly interested in the goal ( a lock that can be broken by law enforcement, and allow wiretapping), and will tell you that these things are already possible in the physical world today.

In other words they’re fine with intruding upon citizens privacy - this doesn’t require any understanding of encryption I think ( and if encryption prevents that, their answer would be ‘ban encryption’)

This is incorrect. They will quite often claim that it is possible to do without breaking encryption, as required for banking and such. They do believe it is possible to have a backdoor that will _only_ be accessible to the government. Completely ignorant of how quickly that backdoor will be found by hostile state actors.

Well, hostile state actors can ( and do!) already wiretap lots of things in the physical world, in theory wiretapping / surveillance is only possible for governments etc. And the NSA semi-successfully inserted a backdoor through carefully chosen elliptic curves a few years ago ( DUAL_EC_DRBG ) by convincing folks to use a weak PRNG.

I’d say that the problem isn’t so much related to encryption, but to the fact that anything digital can be industrialized very quickly, and that the ‘if it goes wrong’ scenario can go really wrong if ( and when) your backdoor falls into the wrong hands.

From a lawmaker’s perspective, it’s just a different kind of risk, which they may or may not be assessing properly. In some ways I see it as closer to people misunderstanding how easy and how bad it is to lose large amounts of data : it’s not related to the inner workings of computers , but rather to the leverage that computers provide. The same is true with weak crypto : everything is great until suddenly everything is in the clear all at the same time, and read by people you don’t want.

The article clearly states that it was pushed by the Interior Ministry. Those in there know exactly what they are doing.

On the other hand, the interior minister himself has no clue, as well as all the politicians in the assemblée. This is where the double-bluff is from. (granted, I think Darmanain was an exception)

We have to remember that, while the minister changes with the government and thus is by definition a politician (seriously, look at some of our ministries, they go from education to health taking a trip by ecology with a pit stop in finance), the ministries themselves are made of people that mostly stay in place and are not affected by government changes. Those are the ones making the calls. And those precisely know what they're doing (thing DGSI and DGSE).

> Those are the ones making the calls.

No, the career specialists in the ministries are the ones writing the reports and developing options. Ministers, in France and other democracies, bring their own staffs of experts. Those will work out a recommendation. The minister -- or more broadly speaking the politician -- makes the call.

And frankly, I don't know of another way. Nobody can be an expert on all the things that come up in a single ministry, let alone the parliament.

On paper. But it is easier to get influenced by intelligent "Subject Matter Experts" and they usually know how to nudge the public representatives their way.

This is a known and accepted flaw of rotating leadership in democracies.

The question is who is feeding them that information.

No, it is theatre. They are masters of their craft. They are pushing an agenda to convince the public. They pose as ignorant and relatable, so that the ignorant and relatable keep voting for them.

That is a very cynical take.

This is the line of Russian propaganda. But don't try to explain by malice if it can be perfectly explained by incompetence.

Unbelievable. What does Russian propaganda of all damn things has to do with this? Especially considering that the power takeover in Russia happened much in the same way - people assumed the politicians are dumb and naive, which I'm telling you as someone who tried to resist that takeover. Yes, your politicians - all politicians, regardless of the country - would have been happy to have more power over you and need to be kept in check. They are never naive, only you can be naive by assuming that. If you forget this for a second, you're done. This is not some kind of controversial issue all of a sudden, that's basic democracy.

> What does Russian propaganda of all damn things has to do with this?

They welcome Europeans thinking their government is out to get them

> Especially considering that the power takeover in Russia happened much in the same way - people assumed the politicians are dumb and naive

People in Russia did the opposite of that. People in Russia were conditioned by decades of violent dictatorship and were either afraid to make a noise or actively wanted the strongman fascist rule. And the guy in power is actual ex KGB. There's a difference

> your politicians

Putin?

> need to be kept in check.

Keeping in check != assuming the worst. Assuming the worst from everybody is how no one would get anything done. e2ee, like any tech not bad or good inherently helps both goodies and baddies. Not turning blind eye on this is important first step. Even if your gov doesn't get a backdoor now they will keep at it until they find a way because voters who are not extremist libertarian techbros want them to. Your way out is to help them find a good enough way witg a compromise.

> People in Russia did the opposite of that. People in Russia were conditioned by decades of violent dictatorship and were either afraid to make a noise or actively wanted the strongman fascist rule. And the guy in power is actual ex KGB. There's a difference

I'm sorry if I'm blunt or rude but you have zero idea what you're talking about, and judging by this answer you're unlikely to even attempt to find out. It saddens me that people who have actual chance to avoid neo-feudalism learn nothing from the experience of my own country (Russia), because hey that's Eastasia and we've always been at war with Eastasia so it can be discarded, "we" are not like that, surely "we" are not "them" and can do better, it can never happen here. Well, good luck! You'll need it.

What you quoted is reality. People who care are in those two categories with rare exceptions. If you are actually russian like me you'd know that 95% of people are in two of the above groups I described. Literally everybody you ask either voted for Putin or did not vote (if we pretend elections were real)

And you I guess have no objection to my main point. e2ee helps crime as much as good guys, maybe more because it helps scale crime. And non stupid government would see that. If what a democratic government is doing to fix this looks like censorship, then it does not mean the government is bad. There is other context. A good democratic government can be instructed by competent experts make better tradeoffs. You cannot expect politicians to be competent experts.

It saddens me that every now and then even well intentioned(?) fellow russians act like every government is like that. You're not the only one. The legacy and history of how people came to power is completely different. Yes it's hard to believe but there are governments who are different.

If you want to see how actual surveillance would look, check out russia. Chinese firewall tech, TSPU boxes at every ISP, making VPN illegal etc. Unlike EU there is historical context and evidence in which it is clear that the government is not doing this to fight crime.

TSPU is just the consequence of a failed attempt to bring it under control, which happened much much earlier (no point in getting into detail here). And yes you're right, I actually have no objections to proportional response and keeping trust where it's possible, you can't get things done without it. Just keep in mind that "it cannot happen here" attitude is dangerous and you're always one step from what you've thought is impossible. Opposing to E2EE strikes me as similar to unified IDs in some European countries that are proud of safety and convenience it brings, dismissing the reality that they are now one regime change from the total control. (not even the unlikely change, considering that certain EU countries historically lean "right", for simplicity).

Sure. But also remember there is also a balance between hostile distrust for all things government does and getting things done. They cannot happen at the same time.

And remember authoritative governments don't care about trust and they get things done while west is squabbling.

To say gov does it to spy is not constructive. What can you do? If they are against you you lose, they hold all the power. This reminds me of attitude of most people in Russia. But to say government does it because it doesn't know is constructive. Because it (and the public) can be educated. There are democratic processes for this.

What I don't understand is this:

Whether they are gullible, corrupt, or simply pieces of shit and sociopaths... Why are they allowed to keep their job? And how can we fix democracy to make sure that they are held accountable?

Let's be clear about one thing: Hanlon's razor is bullshit. Globally, only about ~30% of humans think that "people are generally trustworthy". Even fewer think that "strangers can be trusted". So it fucking IS malice, and people are not trusting because they know that it is malice. In fairness you can look at nord-european countries for some counter-examples, but 30% is a good approximation.

I don't even care if politicians are stupid or malicious. They're probably both anyway because they're human. But what I care about is that they don't fuck with my hard earned civil liberties. So much blood was shed to get where we are... have we learned nothing at all?

These aren't dumb people. They know exactly what they're asking for. Privacy and security of the public's data is not a priority to them, surveillance and power is. Politicians would much prefer all communication in plaintext, to hell with individual freedoms and privacy, especially European politicians that don't come from the same traditions of freedom as the anglophone countries.

What politician do you expect to openly confess the above in public. These are world-leading politicians, i.e., professional athletes of lying and obfuscation.

I sort of agree with them. I want all privacy abolished for politicians. Think about it, if we live stream them in the shower we might get some much needed young people to take the job. Let them keep the ad revenue. Only fans suggests it should be the best paid job out there and the workers are all about public approval.

no more naughty business!

That is not how it works. Politicians will vote for special measures for themselves, but citizens need to have their data easily presentable for inspection by government agencies. Think of the children/terrorists.

> These aren't dumb people.

Yes, they absolutely are. I agree with the rest of your comment, they aren't interested in privacy or security, want generalized surveillance, and are world-class liars.

But they are also pretty dumb and extremely ignorant of anything technical.

>especially European politicians that don't come from the same traditions of freedom as the anglophone countries.

Have you been reading English-language news? Attempts at limiting privacy and advancing surveillance have been nonstop in the anglophone world over the past decades. What may even have been the first attempt at having a backdoor mandate was American: https://en.wikipedia.org/wiki/Clipper_chip

The UK and Australia are ahead of countries like France in restricting freedom, so this sounds like a poor attempt to avoid complimenting the US specifically.

What freedoms are you referring to wrt Australia?

https://www.bbc.co.uk/news/world-australia-46463029

https://www.theregister.com/2021/09/14/identify_and_disrupt_...

"These aren't dumb people."

they are, most tech worker didn't know how cryptography works under the hood and yet you expect politician to know it??? nah its just intelligence agency make a request to parlement of some shit

Are you actually trying to say that understanding cryptography is a prerequisite for intelligence?

In the context of a discussion where the two propositions are "they take bad decisions because they don't understand" or "they take those decisions by malice", I think the parent is trying to say "they most probably don't understand cryptography, given that most tech workers don't either and those politicians are less into tech than tech workers".

You mean UKUSA? Echelon? Patriot Act? SSL and encryption 'bans' making the vendors get OpenSSL from the Canadian OpenBSD?

OpenSSL = OpenSSL Software Foundation Inc / OpenSSL Software Services Inc (In the US)

OpenSSH = OpenBSD (In Canada).

OpenBSD does maintain a fork of OpenSSL, called LibreSSL.

OpenBSD had a SSL stack too, not bound to US licenses and restrictions on exporting.

Before the LibreSSL fork? I did not know that. They've shipped OpenSSL for as long as I can remember, and then forked it, in 2014.

How long ago was that?

OpenSSL built on Canada was fine. Get NetBSD from US mirrors and you got a TLS-challenged OS until the 00's when the restriction exports on tech 'as weapons' were nonsense.

No dumb perhaps, but very very short sighted and it pretty clear how other decisions can be so very wrong, once you hear them get quizzed on encryption.

"We should have a backdoor for law enforcement", okay but what if that abused by some regime that doesn't like Jews, Muslims, Christians, homosexuals, communists, authors, journalists... you? Obviously THOSE people shouldn't have access to a backdoor. Okay, but if you do it EU wide then Hungary will have access to it. Okay, only Western European nations should have access. What if AFD wins in Germany or Groupe Rassemblement National in France? Okay, in THAT case the backdoor access should be revoked. Who decides that?

It's very clear that politicians want backdoors in encryption, but only under a very specific set of circumstances. Those circumstances are almost completely tied to their own parliamentary seats. If questioned long enough, most of them will see it issue, they probably won't admit it though.

So no, not dumb, just incredibly short sighted on almost irreversible decisions that can and will hurt the wrong people.

I would like to know what the public opinion on these issues is before blaming politician's ignorance, considering that to them the relevant knowledge is knowledge of what voters will support or tolerate. The impossible promise of backdoors that France can enter but no other country, organized criminal syndicate or petty government-employed stalker can find is only one impossible promise among the many we can hear from the world's parliaments. In fact, the impossible promise is something of a stereotypical tactic.

French want less criminals and immigrants in the street. Whatever it takes.

I'm french, i have not heard any people, work, street, even television or internet speak about that.

The sad truth is that it wouldn't even solve the issue, criminals will always be able to use encrypted communications. there are open source software that can't be tampered with, software that doesn't use a single server where backdoor can be put, or they could even simply encrypt their text message. i could do that from my mac terminal and Bruno Retailleau isn't going to put a backdoor in my mac terminal...

> French want less criminals and immigrants in the street. Whatever it takes.

What about using the probability that a specific race or religion will commit crimes then target those people with aggressive tactics.

As for the public they could make those people feel unwelcomed through constant harassment in the hopes they leave the country.

Thus reducing the crime rate by any means.

----

I checked the murder rate and it's been on a downward trajectory for the last 30 years

https://www.macrotrends.net/global-metrics/countries/fra/fra...

I haven't check other stats but what if your views on crime are being manipulated by people who have agenda that normally wouldn't be possible if the true reason was revealed?

In France, like a lot of other countries, they are blaming everything on the immigrants.

Crime? Immigrants are doing it. Retirement age? Immigrants are spending the money.

These things are not backed up by data, but just like the US, or Nazi Germany, nobody cares, simply easier to choose an easy "solution" and blame immigrants.

Immigrants commit a bit less crimes than the locals in France.

Yes, but inmate population is mostly immigrant descendants (for various reasons, poverty and been unable to work are the main ones).

The morally lazy racist explanation is helped by the famous logical fallacy that if most criminals are of foreign origin, it must be because most foreigners are criminals.

> In 2019, 82% of the people implicated by the police and the gendarmerie declared themselves French and 18% foreigners, while they represent 93% and 7% of the population in France respectively.

https://www.insee.fr/fr/statistiques/5763585?sommaire=576363...

> I haven't check other stats but what if your views on crime are being manipulated by people who have agenda that normally wouldn't be possible if the true reason was revealed?

That is a known fact. Criminality rate drops but french people are feeling more and more insecure.

There is a media oligarchy in France (by billionaires) that pushes anything but left ideas (the left want an exit tax and a wealth tax, the last one is the Zucman tax). The idea that immigrants are criminals is easy to spread as the prison population is clearly different than the mean population of France (for various reasons). They are pushing it so hard that the population is feeling insecure even if the criminality rate drops.

Source about media oligarchy by billionaires: https://upload.wikimedia.org/wikipedia/commons/thumb/a/a6/M%...

> I haven't check other stats but what if your views on crime are being manipulated by people who have agenda that normally wouldn't be possible if the true reason was revealed?

Actually, you're right about murders, but you're wrong overall i'd say. Organized crime is on the rise since 2004? Maybe a bit before.

Politicians "reformed" the police, removed our "proximity police" which were basically social workers with physical and weapon training, who also were a great point of contact for future informants as it built a lot of trust in some cities (mostly western and northern France: it didn't work as well in the south and in Paris, but it worked truly great were i lived and their removal killed a lot of initiatives. My bet is that the failure in Marseille and Paris killed the initiative which worked great in small to medium cities).

And then circa 2008 they added another police reform that basically pushed police towards targeting petty criminals. Petty criminals turned to organized crime "en masse", and nowaday you have basically 3 crime families who run most of the crime in France. They reached Paris around 2011-2014, divided it cleanly around 2017 (i've heard multiple people talking about a missile launcher sighted in the 93 around 2015-2016 when i lived there, in at least 2 different location) and now politicians act surprised.

Can you provide some stats?

Moi aussi je suis francais.

> French want less criminals and immigrants in the street. Whatever it takes.

Maybe it's because I spent most of my time in big cities hanging out with relatively well-educated, often left-leaning, relatively young people, but I'm not getting that vibe at all.

Yes, you do have pathological cases of badly integrated immigrant communities - for example the quartiers Nord de Marseille, and yes, I've known more working class people who have to endure abuse from anti-social immigrant drug dealers to express some pretty far right views, but I'm not sure that reflects the majority of the French population. I don't watch the news much, but when I do I don't see anything about issues with integration, mostly stuff about Ukraine and Trump.

You could , and should, make the point about criminals and drug dealing affecting "normal citizens" without using imprecise and often wrong terms like immigrants.

Yes. Many people feel unsafe, are affected by crime, or feel they are. Yes, people are afraid. Whether they are, statistically actually more unsafe, or not (most often aren't) matters little. If people have a problem with criminal behaviour or abuse, they have a problem with criminal behaviour or abuse. Regardless of where that comes from. Being beaten up by three Moroccans hurts just as much as being beaten up by three Frenchies whose great grandparents were also born in Marseille.

It honestly doesn't help. First and foremost because many people will now dismiss the problems you may adress, simply because they are drowned in what appears racism, or at least ignorance.

The thing is, the criminals do tend, and when I say "tend to" I mean "as far as I can tell, always are, although obviously just because I've not seen a counter example doesn't mean one doesn't exist" always be from similar ethnic groups.

You've heard of the Italian Mafia? A criminal organization where ethnicity was literally a criteria for admission? Or, while not criminal, Jewish diamond merchants? Having a specific ethnic group specialize in a certain type of commercial activity isn't new.

When that activity is trafficking drugs from Morocco, against the wishes of the local state, it's not surprising that the organization is largely composed of people who happen to share a common language, culture and ethnicity with Morroco.

And if you're wondering why Morocco, well that's where all the hashish is grown.

You've possibly been to "Chinatown" in a large city (say NYC). Now remplace east Asian immigration with North Africa immigration, replace the stereotypical restaurants and dry cleaners with drug dealing, and you have north Marseille.

This unfortunate fact actually drives a lot of the racism. If you ignore it because it sounds racist well... The problem will remain, refusing to accept that there currently is an ethnic group that dominates illegal drug trafficking in a certain place, due to ties with the source of the drug doesn't make it any less true.

Similarly, of you're smuggling cocaine into the US, speaking Spanish is a really good trait to have. Because the country that produces most of the cocaine speaks that language.

How does naming the ethnicity of a group of criminals help in solving or preventing the crimes the commit?

If there's a clear, proven answer to that, one that works obviously better than other methods to solve or prevent it, then by all means: name this parameter.

In all other cases, it helps nothing. If anything, its counterproductive.

Let me give an example: a significant portion of Dutch heavy criminals, in the niche of harddrug trafficking were raised in poverty (relatively, its still the netherlands), in tough neighborhoods, by parents/families that often fall partly outside of the established social constructs.

If you look carefully, non of these parameters are "of certain ethnicity", but the enthnic group underlies many of these parameters. A populist politician, or racist, would say "they are all Marroccan". Which, except for the absolutists "all" is true, even. But it doesn't help one bit in preventing this crime, catching the criminals or preventing new kids to become the next generation.

What helps is finding the traits that do lead to them turning criminal; many of these traits may stem from their ethnic background. Mind you: these traits are by no means excuses, merely traits that allow a clearer and more effective treatment of the societal illness that these criminals are.

(Source: my ex treated a.o. criminals at a TBS. Where phyches "dissect" these people in order to treat them so that some might some day return to society)

> French want less criminals and immigrants in the street. Whatever it takes.

If that were true, France would have a vastly different immigration policy. It would even have an explicit, drastic, and targeted emigration policy.

Since when the general population are the decision makers? /s

Well, half /s anyways. Working class don't want them because "they're taking our jobs". Middle class don't want them because "blah blah security". Upper class want them because that's cheap labour. And as it happens, the upper class is the class in power.

Most french don't care. But this still creates tensions, even between immigrants, say for like housing. As we say in french, it's a "bourbier".

In the end, it's the same situation as in any other country where immigration has taken over the frontline of the political debate.

Open source software can definitely be tampered with if the maintainers aren't vigilant enough. Look at what happened with XZ/LZMA debacle a few months ago. Yeah it didn't make it into most distros but still...

And the sad reality, the maintainers for most useful OSS projects are essentially paid employees of a company. Which can be easily enticed/forced by governments.

And then there's the hardware manufacturers. Even the most hardened software running atop compromised hardware becomes worthless.

> to them the relevant knowledge is knowledge of what voters will support or tolerate

That's relevant knowledge. It's not the relevant knowledge. Another piece of relevant knowledge is facts about complex things like political science, cryptography, etc. Since politicians actually need to decide and implement things, as a side gig to being popular, lack of the proper knowledge to do so is a shortcoming.

> I would like to know what the public opinion on these issues is

Not big sample sizes, but I regularly ask and interview people from all sides of life, and to a simple question like "Do you think the police should spy on you if that catches criminals?" the answer is always a resounding "no". Especially young people. They just way "No way. We're not criminals". They "arguments" may be choppy, muddy waters, but I don't think peoples feelings about being spied on is much of a mystery.

Here in Sweden the answer from the general public often is "yes, I am honest and have nothing to hide".

Unlike French media, Swedish media does not have a well-developed tradition of confronting those in power and/or demanding accountability.

I often get frustrated by how easily interviewees dodge direct questions by answering something completely different, and get a "thank you" from the journalist in return, instead of a follow-up question.

That sounds like the US in the postwar era, under Eisenhower. It broke down quickly, as the journalists were not slow to catch on when the leaders abused that trust.

It's not just our media, it's our culture.

We have a looong and storied tradition of not liking the government, starting with our first revolution in 1789, continuing in 1830 and 1848, and further reinforced by the Nazi occupation during WW2. When I went to England, I heard the joke "where are all the French people? Oh right, probably on strike again".

I feel like some people would probably go out and protest if the government went so far as to suggest that maybe regular tooth brushing might be a good idea, just out of principle.

Yeah we don't do that here. Our culture was Pirate Bay and nation-wide torrenting until the government said it was stealing and people stopped because we are Honest Citizens.

No revolutions, unless explicitly permitted by the government.

Actually makes me a bit worried given the recent geopolitical development in the world.

One problem is that public opinion is also often at odds with facts. It's not hard to find a sequence of "Do you want X or Y" type questions that will send many people into a circle of intransitive preferences.

I think it is a valid point: politicians try to please their voters, and the voters don't know anything about how encryption works.

If you tell your voters: "I will force those tech people to develop encryption that can be accessed by the good guys but not by the bad guys", the average voter will say "yeah, that sounds reasonable".

I am frustrated that the politicians don't understand that they are making it worse for everybody, but that's probably a consequence of their voters not understanding it either. That's always the problem with complicated issues (e.g. climate change or covid). Voters typically vote without having a basic understanding of the topic.

> Just like for other big challenges like biodiversity and climate change, it feels like it often boils down to the politicians just not understanding enough to take rational decisions. Of course they can't all have a PhD in cryptography, but they should also not have no clue at all.

They would argue about the damages drugs do.

I think they know what they are doing. Digital privacy has no lobby outside of EEF. We donate more than $10k to them annually.

The "war" on drugs is what brings all of the violence and crime associated with drugs, not the drugs themselves. But it finances the police industrial complex and so many people would lose out (or be forced to focus on actual crimes rather than people consensually trading plants or chemicals) that it will never happen.

The pharmaceutical industry has a pretty big lobby, so does big tobacco, and don't even get me started on the alcohol industry.

If one of them finds a way to patent drugs that are currently illegal or otherwise profit from it, legalization will happen.

Honestly, in many places, legalization has already happened, look at the coffee shops in the Netherlands and the dispensaries in North America.

The police industrial complex might be attached to their cash cow, but everyone else in the capitalist system wants to get rich too, and I suspect in the long run that'll win out.

Also, much as how after a few thousand years of civilization people eventually wised up to human sacrifice wasn't actually a good idea and was not in any way required to make the sun come up, maybe at some point in the future we'll realize that harsh criminal penalties don't actually solve the drug problem.

France has some of the strictest laws against cannabis use in Europe, and also some of the highest rates of consumption, or at least it did last time I checked.

> The "war" on drugs is what brings all of the violence and crime associated with drugs, not the drugs themselves.

Some of it, certainly, but I doubt it's all. Violence committed by druggies trying to scrape up enough for their next hit would still happen.

Also, violence caused by a sociopath's giving a desperate addict $50 in exchange for the addict's shooting one of the sociopath's enemies would still happen.

Also, addicts stealing from their moms would still happen, which is regrettable even if it is not violence.

The syringes thrown away on lawns and playgrounds probably also won't disappear just because the drugs get cheaper.

I wonder how much crime is done by people trying to get another hit of alcohol or cigarettes. They are pretty addictive, but I haven’t heard of this becoming a problem with legal drugs for whatever reason.

Do you not see that you're contradicting yourself?

If drugs were not prohibited, they would not cost so much as to cause "scraping up enough".

How come I can buy 50 liters of isopropanol (99.(9) whatever, dehydrated, better than medical eth) for like 20 euro, but no luck for ethanol. Even while ethanol is that much cheaper to produce?

    > Violence committed by druggies trying to scrape up enough for their next hit would still happen.

Portugal (mostly) decriminalised possession and use of all illegal drugs in 2001. (Ref: https://en.wikipedia.org/wiki/Drug_policy_of_Portugal) This should be an ideal country for study. Do you know if violence from drug users declined after this change in Portugal?

How much violence do you see from people trying to scrape up enough to get the next drink or cigarette?

It's almost none, because those things don't cost enough to ruin a person's life. Even for most of the serious addicts.

Hmm...

The "war on drugs" probably brings violence associated with drugs, but drugs in general bring harm (when someone becomes an addict or dies because of an overdose, it does harm to the relatives). Nobody would care about drugs if it didn't.

>> given that the US have become hostile to Europe

I'd like to comfort you that this is not true for the majority of Americans. We are having a hard time wrapping our heads around what our new government is doing.

It kinda doesn’t matter; Individuals aren’t making foreign policy decisions day-by-day, Republicans leaders are. Until we effect change in our government, we are hostile to most of our allies.

It matters to me, as a person who travels frequently, that people in the countries I visit don't believe that Americans writ large voted for the foreign policy we see being enacted. Even among the ones who voted for Trump, there seems to be a lot of shock at the aggressive posture toward our allies. I think it's important to convey that a majority of Americans are not on board with this 180 degree turn in our position toward Europe.

But yes... individuals don't make foreign policy, and we are subject to the whims of our polity. That's exactly what I'm asking the parent poster to take into account.

It matters to me too. However, it still doesn’t negate the fact that we are hostile.

There is always good news and bad news in the world. Our judicial branch is (so far) working to reverse illegal moves by the executive branch. People are protesting across the US and across the world. Our allies are currently putting pressure on us that is reversible.

The bad news is that our country is losing trust every day. We voted this person into office twice. We are deporting people for voiced opposition to the regime. There are now travel warnings to the US from multiple countries. Ironically, it’s now harder to leave the US. MAGA is trying to spread into other countries given the foothold it has gained here.

There isn’t a lot of comfort to give when the guy who holds the nations nuclear codes is questionably coherent and actively hostile.

>Even among the ones who voted for Trump, there seems to be a lot of shock at the aggressive posture toward our allies.

Source?

> we are hostile to most of our allies

One bad news (for everybody) is that I believe a lot of citizen of those "allied" countries don't see the US as allies anymore. The US are now seen as this unstable "partner" that threatens becoming an enemy (e.g. by invading those ex-allies militarily) and may well become an enemy.

And the feeling is getting worse everyday.

Yeah, it's good to mention. Still I believe that from the outside, in practice it doesn't matter much: if Trump gives the order to invade an ex-ally, who is to know if the US would do it or not? To the outside it is a risk, and a country making that kind of threats probably does not count as an "ally".

I am not here de defend politicians, but...

The title says "France rejects backdoor mandate" but TFA makes it clear that France is not a hive-mind:

- The rejection was by the French National Assembly (think parliament/congres) - Ths happened despite pressure from the internal ministry (the government)

I find it interesting that it is often a similar story at the EU level where the European Parliament puts a stop to the worst impulses of the European Commission.

> it is already a problem that most companies use US services, given that the US have become hostile to Europe.

Risking a potential flame war here but I think it’s important to cool down hysterical rhetoric whenever it’s pushed.

The US has not become hostile to Europe, and it’s quite silly to say this in contrast to, say, a certain country next door that is currently invading a European country.

The US is in the midst of a many decades “pivot to Asia.” This is not hostility, but growing indifference.

> This is not hostility, but growing indifference.

Among others, the US is threatening to invade and annex ex-allies using militarily force. This is the definition of "hostility", and again this is only one example.

> given that the US have become hostile to Europe

That’s more than a bit of an overstatement. One faction in the US government has started being less loyal to Europe. Most Americans consider Europe to still be our closest allies and friends.

Furthermore the US businesses are not stupid and have shown they will stand up to government pressure around data sovereignty. Anything less will drive both US and global customers back to on-prem infrastructure.

https://www.reuters.com/article/legal/microsoft-sues-us-gove...

> Most Americans consider Europe to still be our closest allies and friends.

The feeling isn't mutual.

> Furthermore the US businesses are not stupid and have shown they will stand up to government pressure around data sovereignty.

Only until it threatens their livelihood and family. Don't be naive. The majority of both Democrat and Republican members of the Senate and Congress, and many judges and other people in high positions in the government are afraid of the repercussions of crossing Trump. The US is screwed.

> Most Americans consider Europe to still be our closest allies and friends.

Maybe, yes. Do you know how many Europeans now consider that the US are not allies anymore? And how many take the threats of invading them seriously? Allies don't threaten to invade.

> Furthermore the US businesses are not stupid

The oligarchs of BigTech have clearly bent the knee. It would be irrational to trust them.

Your government has threatened military invasion of Denmark.

> To me it just proves that they don't understand the very basic of how encryption works.

No?

You can have encryption with “secure” backdoors. (In the sense that only an entity with the backdoor key could use it.)

For example, let’s say you were going to symmetrically encrypt some data with a certain private key.

You can add the key to the data, asymmetrically encrypted with the public backdoor key.

(You can improve on this with a salt to retain public anonymity.)

As a theoretical matter, cryptography can do this. As a practical matter…that’s a separate question of human structures and behaviors. But you don’t need cryptography to understand that.

The problem is, that many of the politicians in high positions are corrupt, bought by companies, and/or only went into politics, because they couldn't get a productive job. There are politicians, who never in their life had a proper job, were born wealthy and never had to work like someone in a productive proper job has to.

There may be exceptions, of course, but over and over again, when one checks the background of politicians in high positions, one finds out, that they simply inherited a lot, and never worked in the field they are making decisions about, nor actually in any other field. They "just became politicians". And even then they misuse funds, cars for private trips, first class tickets on means of transportation, let themselves be bought by lobbies, have prospect of some corporate board later, have even more side income than they are being already paid for their badly done job as a politician, and so on and on. Many one could outright call despicable.

The problem is, that we let them do it. Going into politics is such a clusterf' that no normal person even wants to do it any longer. It only attracts those kinds of person we see there. Others are sidelined or never join politics in the first place. Then we also don't vote/kick/protest them out of office the moment we hear about their crimes.

With things like this I think of the bill that tried to change the value of pi:

https://en.wikipedia.org/wiki/Indiana_pi_bill

It seems to me the bill tried to charge royalties on maths and that a result would have been state sanctioned calculations would contradict the value of pi.

The Wikipedia article notes that the redefining of pi was specifically not an aim of the bill, pi not being mentioned in it.

Every good idea needs powerful PR. How about we start rallying around the term "software equivalent of cancer" which Tim Cook coined to describe encryption backdoor.

Speech matters. "Software cancer bill" sure sounds less appealing than "catch terrorists bill".

Nobody has to understand the details about why encryption backdoor is impossible to implement without breaking the encryption. It is too hard of a topic. I only understand it vaguely. Does it matter? You don't need phd in silicon design to know that chips are important.

>To me it just proves that they don't understand the very basic of how encryption works.

Chats being encrypted between multiple participants is a normal use case of cryptography. Giving limited government access can be part of a cryptoscheme and doesn't mean that encryption has to be disabled.

"the US have become hostile to Europe."

1. I don't believe that anything changed in recent months/years other than the US repeating the statement that maybe EU should take care of its own defense. Not exactly a new sign of "becoming hostile" IMO.

2. If this would even be true then they have always been hostile to Europe and only just recently started becoming honest and open about it (but again, I dont see any sign of actual change). Five eyes, NSA, etc is not exactly new and have super obviously been used and are still being used by the US to do economic and political espionage on Europe for at least decades. The leaked news of NSA spying on German chancellor Angela Merkel's phone is like 10+ years ago by now?

My opinion is that every EU company that uses Onedrive, Teams, Outlook, Google etc (99 percent of them is my guess) are basically paying to give away their trade secrets to their US competitors. "but the terms of the contract say..." yeah right...

Its just become harder to stick European heads in the sand.

Is government agencies to. In the UK the NHS uses AWS, courts use Teams.... IT security is just ignored - its only recently that it occurred to the govt to remove Chinese cameras from sensitive sites.

European militaries are heavily dependent on the US too and have a lot of equipment that is reliant on US supplies or can only be used in line with agreements with the US.

Plus apparently there are things that only USA can currently do, awacs radar support and other recon I think

I believe there are several non-US awacs systems out there, although the American ones are probably the most common.

They have alienated their allies for sure and this time it seems different and it seems that it will have a lasting impact. Including for tech companies.

> Not exactly a new sign of "becoming hostile" IMO.

It feels like you missed the hostile actions. There are many, but let's just mention the fact that the US repeatedly threatened to invade militarily.

> To me it just proves that they don't understand the very basic of how encryption works.

Even if you don't have the encryption keys you can read messages by breaking into a phone and taking screenshots, for example.

If you've broken into the phone/app, you've got access to the key...

But it's only useful if you understand how encryption works.

> Of course they can't all have a PhD in cryptography

We could be seeing the effect of France's top notch level of mathematical attainment in how their politicians are behaving.

Education lifts all boats.

On the other hand, people can believe experts without being experts. Perhaps the French parliamentarians just listen better.

Not trying to debate club you here, but it could also be that higher educational attainment creates parliamentarians that can listen.

Another thought, in a highly educated populace, the path length between any person and someone highly skilled would be much shorter. Everyone would know someone who knows someone who is an expert in a subject. So it would be much easier for someone to seek and get assistance.

The adversary is often the person wanting the backdoor.

> but they should also not have no clue at all.

they usually talk to experts in those areas. Who those experts are can vary quite a lot though.

They know, they just don’t care. And they have learned if they just ignore problems, then most times they’ll get away with it. Like for example all their responsibilities to stop an ongoing genocide, or to combat apartheid

But think of the children

The children are not benefited by Putin and Kim Jong-Un being able to read their messages.

The US have not become hostile. So far it has made two demands of Europe, and both of them are reasonable:

1. Europe should not rely entirely on the US for its defense (stated by Trump numerous times).

2. Europe should stop its mad self-destruction and descent into totalitarianism (stated by Vance on several occasions).

Were they incorrect? Were they unreasonable? Sometimes you need a friend to tell you a harsh truth. Hearing that truth does not make that friend into an enemy; quite the contrary.

And tariffs are the the act of a friend too? Let's not be silly. Trump's is America first: the upshot of which is everyone else can be a subordinate or a rival. Europe is wisely choosing not to subordinate itself to the US quite so much. It'll be interesting to see if it becomes a real rival.

1. And made it clear by threatening to take land from a European country by force.

2. That's funny coming from a person who is building a totalitarian system. He was supporting parties that would make a similar development in Europe possible.

It is anecdotal but during Covid and the crypto boom I was chatting with someone living in France. He told me he was happy to have a few crypto since he has been using one of those exchange to buy illegal drugs.

Basically he told me that over there people just go on websites to order drugs, pay with crypto from a centralized crypto exchange and then have it delivered in they physical mailbox. And this is not the Silk road thing this is local business, shipped by the national postal service from an address in France from France.

I also read an article once saying drug stores on the internet and social media are very common over there.

My conclusion was that, selling most drugs had become de facto decriminalized in France.

Strangely France is also by far the country where I have been systematically harassed by the police and customs (at the frontier and within the country). They are very aggressive and it is to the point that I now avoid that country as much as possible.

Your comment only makes sense if you agree with either premise behind (1) or (2).

I bet the vast majority of Europeans across all swaths of the political and socioeconomic strata would tell you that (1) Europe DOES NOT rely entirely on the US for its defense and (2) that Europe is NOT on a mad self destructive descent into totalitarianism.

In fact, as an American, id say (2) sounds vastly more applicable to the the USA under the current Republican administration.

Further, they'd also tell you to stop taking your talking points from those two bozos. It destroys your credibility by using them as any kind of reliable source of factual information.

> I bet the vast majority of Europeans across all swaths of the political and socioeconomic strata would tell you that (1) Europe DOES NOT rely entirely on the US for its defense and (2) that Europe is NOT on a mad self destructive descent into totalitarianism.

And you'd loose that bet. Your opinions might be shared in your leftist bubble but definitely not across the whole population.

> Europe should stop its mad self-destruction and descent into totalitarianism (stated by Vance on several occasions).

If your source is Vance, I would suggest you question it.

Most of the world is currently looking and worrying at the US becoming an oligarchy. Who is talking about "Europe descending into totalitarianism"? The sentence does not even make much sense, as Europe is not a country. I'm not even sure if Vance is aware of it.

When you genuinely think that everybody else is wrong and you are right, maybe it's time to take a step back.

What politicians want (and what they think average people want) is very different from what HN users want.

Politicians: a backdoor that can be used by the police for investigating crimes, but not by criminals themselves.

HN users: no backdoor at all, especially not a backdoor that can be used by the police.

also politicians want a backdoor especially for tracking treason / spying possibilities, which in a way comes under police investigating crimes but is more national security apparatus protecting the state.

Which makes no sense, because if you have a backdoor, it opens the way for adversaries to access your data. You don't improve your national security by weakening its encryption.

I strongly disagree.

Politicians: technology that strengthens the power of the state, against crime, but also militarily, for spying on enemies both foreign and domestic.

Citizens: defensive architecture that prevents the state from preventing free speech.

This is especially relevant in the era of AI, where the cost of mass surveillance is virtually zero, and is incredibly powerful at sentiment analysis and summarization. Free speech is threatened when any statement can and will be used against you.

> they should also not have no clue at all. Over an over again, politicians are asking for backdoors. To me it just proves that they don't understand the very basic of how encryption works.

Unless you're claiming that it's literally impossible to construct a cipher with multiple decryption keys, I don't see how you're implying that asking for a backdoor "proves they don't understand the very basics of how encryption works".

Their stance differs from yours due to their values being different from yours, not due to inferior literacy.

It is impossible to construct a cypher with just one key, such that the good guys (spanning several allied nations, dozens of government agencies, perhaps even local police) can use the key, but bad guys (spanning several opposing nations, dozens of intelligence agencies, thousands of hacker groups, tens of thousands of individual cyber-criminals around the world) cannot. We are talking about every single person who can buy a copy of a piece of paper carried out of HQ being able to read all of your personal and professional correspondence: no doubt a possibility.

You're missing my point completely.

These folks very well understand that bad people can steal keys. Stolen keys have been a thing since antiquity. It's not rocket science they don't understand. Every single key in history has had a risk of theft and this is no exception.

The truth is a lot of them understand this just like you. But unlike you, they are willing to accept this risk. You aren't. That's fine. You have a value disagreement -- you don't think the risk is worth it, and they think it is. Which is why you make arguments about the merits of the issue, instead of attacking the other side on their basic literacy. Just because you disagree on values that doesn't mean the other side is stupid or illiterate about the basics.

This isn't about politeness either, it's actively counterproductive to your own cause: insulting people and showing that you lack a basic understanding of their position is a sure-fire way to make sure they dig their heels in and continue to oppose you regardless of the merits of the situation. i.e. it's a grest strategy for losing in the end.

I don't believe that France is actually willing to accept that every opposing intelligence agency will obtain the key...

Maybe they don't think it's as likely as you think. Or maybe they think the time horizon is long enough that it is worth it. Whatever it is, I assure you they are not too stupid to realize this is a possibility. They just differ on either the degree of the risk, or on the value they get in return. In which case, logic dictates that if you believe the actual risk is higher than they would tolerate, to find a way to convince them of that.

That's a matter of facts rather than values. The "impossible promise" is that a private company can keep a kilobyte of data out of the hands of every spy agency on Earth for any length of time.

Why does this concern apply to the French intelligence agency but not, say, the code signing certificate for Whatsapp?

On one level it does apply to certificates.

On another level, pushing a compromised update to every phone in Europe (to gain access equivalent to having a copy of the backdoor) would be noticed by the publisher, and the binary difference would quickly be found by security researchers.

And yet the immense majority of the population accept & use messaging platforms operated by "not France" where the operator would be able to obtain everyone's key with a couple clicks. (Yes, this includes Apple's).

That makes sense because it has been brought about as a consequence of consumer preference. It wouldn't make sense for it to have been required by the government.

Unfortunately, last time I heard, consumers actually dictate what the government cares about.

I think they think when that happens they'll change it. Or they'll change it on a schedule... "Just use HTTPS" is good enough for every website and web app on the planet (including ones that handle more messages than the entire country of France) but not a state intelligence agency can't keep their TLS keys secret?

"Just use HTTPS" sends French messages directly to NSA, insofar as those platforms are concerned. In that case there's not even a copy of any encryption key...

France is giving everything they receive to the NSA anyway, so there's not much difference.

This is spot on.

They're not concerned about their own security. They believe that they will have access to tools that will make them safe, but that "those people" will be deterred, and it is acceptable to give up some basic safety for many to catch "the bad people."

And, historically, they weren't necessarily wrong. The problem is more that all of the tradeoffs and probabilities from history have been thrown at the window, because it is now trivially easy to phish the majority of a population and getting a master key gives you access to hundreds of millions of individuals that you can reach from around the globe rather than a couple dozen that you can get to in person from a particular apartment complex.

Understanding encryption is not the problem. Understanding scale is the problem.

> It is impossible to construct a cypher with just one key […]

Technical nit:

I (mis?)remember reading in a cryptography book (by Schneier?) that the NSA has at least one algorithm where the decryption key is different than the encryption key, but my search-fu finds no references to it online. The application would be for devices in 'hostile territory' where there was a risk of capture of the unit and so you didn't want the other side to be able to alter data/firmware since the cipher that is available is decrypt only.

However, see perhaps:

* https://crypto.stanford.edu/~dabo/abstracts/traitors.html

* https://crypto.stackexchange.com/questions/39397/one-encrypt...

Also, see n-of-m algorithms:

* https://en.wikipedia.org/wiki/Shamir%27s_secret_sharing

the problem with backdoored encryption isn't making a cypher with multiple decryption keys. It's keeping secret that's worth billions of dollars and shared among 10s of thousands of people. The difference between backdoored encryption and no encryption is whether the backdoor is known to the public.

There is a coherent set of values that lead to saying "no encryption", but not one for "only backdoored encryption".

> There is a coherent set of values that lead to saying "no encryption", but not one for "only backdoored encryption".

While I oppose building backdoors, I don't really agree with this claim. There's nothing incoherent about developing a threat model.

I think some threat models, like one that doesn't include hackers, are not coherent relative to reality.

A threat model can include hackers while not taking every action that could prevent every conceivable attack from a hacker.

Your government isn't the only one out there. If your government can have a backdoor, so can every other government. If the US, EU, Russia, and China all have backdoors to everything, who are you keeping it secret from?

The powers that can't pay? If the US, EU, Russia, China all have nukes to everything...

Could it be possible to make a cryptosystem where messages can be decrypted either with the recipient key, or by sequentially applying say, 100 different backdoor keys, such that the different backdoor keys could be stored on different machines without ever being present on the same machine?

If you increase the number of backdoor keys needed to decrypt by enough, and have these keys be stored only on hardware that is meant to make it infeasible to extract the key from it, and if these machines are distributed among a sufficiently large and varied group, maybe that could work as reasonable oversight to prevent the backdoor from being used outside of select cases?

Edit: to be clear, I don’t want this. Just trying to map out what positions could reasonably be held / what options there are.

I upvoted because I don't think you should be censored, but I kindly disagree :-).

To me (and I think that's the position of cryptography-aware people), requesting a backdoor is a risk so high that it makes absolutely no sense.

Of course, they understand that if an adversary gets access to the backdoor, then it's game over. And of course, they believe that it's possible to prevent the adversary from accessing the backdoor. But that's my whole point: their believing this means that they don't understand the problem.

Reply on news.ycombinator.com