4 ms·

Yes. Incredibly, the German minister of the interior has recently announced his intention to force messengers like WhatsApp, Signal, etc. to decrypt messages w

by FabHK 7y ago

Yes. Incredibly, the German minister of the interior has recently announced his intention to force messengers like WhatsApp, Signal, etc. to decrypt messages when required by warrant. Of course, they'll be able to control the backdoor better than the NSA, right. Right? Only source in English I found quickly: https://www.bleepingcomputer.com/news/security/german-minister-wants-secure-messengers-to-decrypt-chats/ https://www.bleepingcomputer.com/news/security/german-minist...

walterbell 7y ago
Only the laws of physics and open-source E2E encryption stand in the way of that proposal. The messaging companies could drop service to Germany. People could use a VPN to access messengers.
- Barrin92 7y ago
  the cost of complying with the German legal requirements is probably much lower than losing 80 million, very wealthy users. And also regardless of what one's opinion about the law is, I'd be sceptical about the idea of a company arbitrarily cancelling service provision to an entire nation because they disagree with a domestic law.
  - walterbell 7y ago
    How would a company enforce the behavior of open-source client applications on millions of endpoints? If they can't comply with the law, they would be forced to stop service.
    - Barrin92 7y ago
      I don't think they could, these backdoor requests pretty much only apply to companies that have control over the client and server and can break the encryption if they want to. (after all anybody could theoretically already encrypt messages beforehand anyway) I assume whatsapp could provide an api and an open source client but then again they've got a strong commercial incentive to keep it walled in. And anyway, how many users would really switch to a third party client only for encryption? I figure these laws will be relatively effective in practise.
      - walterbell 7y ago
        There has been a shift in public awareness of surveillance, within the last decade. The adoption of Signal (whose messaging protocol has influenced Whatsapp) shows that some users, including high-value targets, have moved to 3rd-party open-source clients. If the goal is mass surveillance, then it would be enough to backdoor Whatsapp. But if the goal is to target a semi-competent adversary who can use a search engine, such a law would be entirely non-effective. There are existing laws for targeting of data from specific endpoints, e.g. via iCloud, Google. Some of these laws span multiple countries. They cover data from many apps, not just messaging.
XMPPwocky 7y ago
This is critically different. Part of the issue with intelligence agencies using exploits is that using an exploit often means sending it to somebody untrusted (often the target of the attack!) c2 servers and machines used to deliver exploits are necessarily connected to the internet, and often are from low-tier commercial hosting services- c2.tao.nsa.gov is a bit too easy to attribute, as it turns out. An IM backdoor could rely on a key kept in an HSM, across an airgapped network allowing only encrypted messages in one direction and decryptions in the other. Assuming the airgapped side only needs to decrypt something like a LEAF, communication over something like serial means almost zero attack surface would be exposed to anything reachable from the internet. So, yes, you probably can control an IM backdoor significantly better than the NSA can control their offensive tools. Will the government manage that? Ehhhhhhh. There are much better arguments against an IM backdoor. Saying "the government can't keep it secure" is especially problematic because if that's perceived as the anti-backdoor argument and the government comes up with a secure way to implement a backdoor...well, then, why not do it?
- beagle3 7y ago
  Theoretically possible, yes. But Snowden and the Shadow Brokers indicate that it is practically much harder.
  - XMPPwocky 7y ago
    Again, the Shadow Brokers stuff is "a staging server was compromised", which just isn't that related to the problem of securing an IM backdoor. Snowden leaked information he had access to, but measures like storing the key in an HSM (and not allowing it to be extracted) largely mitigate that threat.
    - beagle3 7y ago
      Do you have somewhere I can read on the Shadow Brokers' compromised staging server? I was under the impression that actual source code was released (implying a much deeper break) but seems I was wrong, as no article I could find through Google mentions a source code leak -- but none mention a staging server either.

by FabHK 7y ago

walterbell 7y ago

Only the laws of physics and open-source E2E encryption stand in the way of that proposal. The messaging companies could drop service to Germany. People could use a VPN to access messengers.

Barrin92 7y ago
the cost of complying with the German legal requirements is probably much lower than losing 80 million, very wealthy users. And also regardless of what one's opinion about the law is, I'd be sceptical about the idea of a company arbitrarily cancelling service provision to an entire nation because they disagree with a domestic law.
- walterbell 7y ago
  How would a company enforce the behavior of open-source client applications on millions of endpoints? If they can't comply with the law, they would be forced to stop service.
  - Barrin92 7y ago
    I don't think they could, these backdoor requests pretty much only apply to companies that have control over the client and server and can break the encryption if they want to. (after all anybody could theoretically already encrypt messages beforehand anyway) I assume whatsapp could provide an api and an open source client but then again they've got a strong commercial incentive to keep it walled in. And anyway, how many users would really switch to a third party client only for encryption? I figure these laws will be relatively effective in practise.
    - walterbell 7y ago
      There has been a shift in public awareness of surveillance, within the last decade. The adoption of Signal (whose messaging protocol has influenced Whatsapp) shows that some users, including high-value targets, have moved to 3rd-party open-source clients. If the goal is mass surveillance, then it would be enough to backdoor Whatsapp. But if the goal is to target a semi-competent adversary who can use a search engine, such a law would be entirely non-effective. There are existing laws for targeting of data from specific endpoints, e.g. via iCloud, Google. Some of these laws span multiple countries. They cover data from many apps, not just messaging.

XMPPwocky 7y ago

This is critically different. Part of the issue with intelligence agencies using exploits is that using an exploit often means sending it to somebody untrusted (often the target of the attack!) c2 servers and machines used to deliver exploits are necessarily connected to the internet, and often are from low-tier commercial hosting services- c2.tao.nsa.gov is a bit too easy to attribute, as it turns out. An IM backdoor could rely on a key kept in an HSM, across an airgapped network allowing only encrypted messages in one direction and decryptions in the other. Assuming the airgapped side only needs to decrypt something like a LEAF, communication over something like serial means almost zero attack surface would be exposed to anything reachable from the internet. So, yes, you probably can control an IM backdoor significantly better than the NSA can control their offensive tools. Will the government manage that? Ehhhhhhh. There are much better arguments against an IM backdoor. Saying "the government can't keep it secure" is especially problematic because if that's perceived as the anti-backdoor argument and the government comes up with a secure way to implement a backdoor...well, then, why not do it?

beagle3 7y ago
Theoretically possible, yes. But Snowden and the Shadow Brokers indicate that it is practically much harder.
- XMPPwocky 7y ago
  Again, the Shadow Brokers stuff is "a staging server was compromised", which just isn't that related to the problem of securing an IM backdoor. Snowden leaked information he had access to, but measures like storing the key in an HSM (and not allowing it to be extracted) largely mitigate that threat.
  - beagle3 7y ago
    Do you have somewhere I can read on the Shadow Brokers' compromised staging server? I was under the impression that actual source code was released (implying a much deeper break) but seems I was wrong, as no article I could find through Google mentions a source code leak -- but none mention a staging server either.