4 ms·

Gonna be unfortunate when they find out they've made HTTPS illegal indirectly by banning encryption! It really is amazing to see how often one part of the gove

Gonna be unfortunate when they find out they've made HTTPS illegal indirectly by banning encryption! It really is amazing to see how often one part of the government will actively sabotage the goals of other agencies.

wesley_snipes 6y ago
Remember it's always one standard for the spooks and one standard for the unwashed plebs. They keep you safe so you should be grateful.
LinuxBender 6y ago
I don't believe they are making encryption illegal. Rather, they would likely require any org doing TLS for them to provide lawful intercept, logging, audit and compliance. If a government org is managing their own network stack, then requiring TLS would be a non issue as they can provide their audit orgs with all the data they want, as they likely do today. From all the bills I have read, there is nothing that makes encryption illegal. They want the ability to access data from the servers after it has been decrypted. This includes a way to intercept what users perceive to be end-to-end encryption. The only problem I have run into with various government orgs is the lack of knowledge around implementing intermediate certificates. They will often try to talk people into installing their certs rather than installing intermediate certs correctly. I always point them to testssl.sh [1] [1] - https://github.com/drwetter/testssl.sh https://github.com/drwetter/testssl.sh
- cryptoz 6y ago
  I am having trouble parsing your comment. What do you mean by, > I don't believe they are making encryption illegal....They want the ability to access data from the servers after it has been decrypted. This includes a way to intercept what users perceive to be end-to-end encryption. This is contradictory, no? The data is not encrypted between 2 users if a 3rd user can read it. It sounds like every bill you read makes encryption illegal, by your own explanation of the bill? I just don't understand what you mean here. Maybe it's my personal understanding of 'encryption'? If Alice encrypts a message to Bob, and also gives the keys to Eve, but doesn't tell Bob that Eve has the keys, then I do not personally consider that message encrypted at all. Do you? What about the bills? A message encrypted with a key held by a potential attacker is not an encrypted message any more.
  - LinuxBender 6y ago
    Perhaps this is a terminology issue. Encryption being illegal implies to me that if someone uses encryption, they are violating a law and will be penalized. Providing lawful intercept (backdoors) does not preclude the use of encryption; but rather, renders it non existent for those with the lawful intercept access. Where this gets really sketchy is if companies give users the perception that they have end-to-end encryption, but also have a way to intercept that traffic. So I think we are in effect saying the same thing, but I am just saying that encryption is not illegal, just rendered non existent for specific parties. This is actually already in place today in many of the big centralized service providers. I believe these proposed laws are just a way to officiate this so that companies are protected and less likely to resist requests for information for fear of legal repercussion.
    - wizzwizz4 6y ago
      > but rather, renders it non existent for those with the lawful intercept access And for plenty of people who don't have the lawful intercept access. This downgrades encryption from "encrypts stuff" to "obfuscates stuff"; while technically incorrect, it's probably better to describe this as "no longer encryption" because it's clearer to non-techies.
      - LinuxBender 6y ago
        No, encryption still encrypts stuff. There is no obfuscation being suggested in these bills. Rather, some groups will have the ability to see data without encryption, as they do today, but with easier access and less red tape and less having to do inside deals and people looking the other way or depending on NSL's. Please don't get me wrong, I am not in support of these bills. I think it is risky to incorrectly describe what is happening, especially for non technical people. I believe the right way to describe this to non technical people would be: "Today, some people can see your traffic even if it is encrypted. If one of these bills (there are a few versions) are approved, then more groups will be able to see your data, easier and quicker." If you want to get people more interested in speaking up, then the best lessons learned would be from the interview between John Oliver and Edward Snowden. John interviewed many people on the street about the NSA having access to all your phone data. Nobody cared until he clarified and said, "So you would be ok with government employees looking at your significant others nude pics / sexting pics". At that point, most of the people interviewed said they would be furious.
- rezonant 6y ago
  What? No, GP is talking about EARN IT et al which would mandate backdoors in encryption tech
  - klyrs 6y ago
    If the government holds the private keys, don't they have that backdoor access to their own https traffic?
    - rezonant 6y ago
      Who watches the watchers?
  - president 6y ago
    Where again does EARN IT [1] mention anything about mandating backdoors in encryption tech? [1] https://www.congress.gov/bill/116th-congress/senate-bill/3398/text https://www.congress.gov/bill/116th-congress/senate-bill/339...
president 6y ago
After observing the mountains of opposition to EARN IT on large tech sites like Reddit and HN, I am starting to believe the "banning encryption" meme was started by tech companies to cripple the bill even though the word "encryption" isn't mentioned anywhere in the bill text. Guessing they are not liking the fact that the bill would force sites to be liable for illegal user-submitted content on their websites: "(3) MATTERS ADDRESSED.—The matters addressed by the recommended best practices developed and submitted by the Commission under paragraph (1) shall include— (A) preventing, identifying, disrupting, and reporting child sexual exploitation; (B) coordinating with non-profit organizations and other providers of interactive computer services to preserve, remove from view, and report child sexual exploitation; (C) retaining child sexual exploitation content and related user identification and location data; (D) receiving and triaging reports of child sexual exploitation by users of interactive computer services, including self-reporting; (E) implementing a standard rating and categorization system to identify the type and severity of child sexual abuse material; (F) training and supporting content moderators who review child sexual exploitation content for the purposes of preventing and disrupting online child sexual exploitation; (G) preparing and issuing transparency reports, including disclosures in terms of service, relating to identifying, categorizing, and reporting child sexual exploitation and efforts to prevent and disrupt online child sexual exploitation; (H) coordinating with voluntary initiatives offered among and to providers of interactive computer services relating to identifying, categorizing, and reporting child sexual exploitation; (I) employing age rating and age gating systems to reduce child sexual exploitation; (J) offering parental control products that enable customers to limit the types of websites, social media platforms, and internet content that are accessible to children; and (K) contractual and operational practices to ensure third parties, contractors, and affiliates comply with the best practices."
- thephyber 6y ago
  From the EFF (a civil liberties organization, not a tech company) coverage: > We’ve explained how the EARN IT Act could be used to drastically undermine encryption. Although the bill doesn’t use the word “encryption” in its text, it gives government officials like Attorney General William Barr the power to compel online service providers to break encryption or be exposed to potentially crushing legal liability. > The bill also violates the Constitution’s protections for free speech and privacy. As Congress considers the EARN IT Act—which would require online platforms to comply with to-be-determined “best practices” in order to preserve certain protections from criminal and civil liability for user-generated content under Section 230 (47 U.S.C. § 230)—it’s important to highlight the bill’s First and Fourth Amendment problems. [1] https://www.eff.org/deeplinks/2020/03/earn-it-act-violates-constitution https://www.eff.org/deeplinks/2020/03/earn-it-act-violates-c...

wesley_snipes 6y ago

Remember it's always one standard for the spooks and one standard for the unwashed plebs. They keep you safe so you should be grateful.

LinuxBender 6y ago

I don't believe they are making encryption illegal. Rather, they would likely require any org doing TLS for them to provide lawful intercept, logging, audit and compliance. If a government org is managing their own network stack, then requiring TLS would be a non issue as they can provide their audit orgs with all the data they want, as they likely do today. From all the bills I have read, there is nothing that makes encryption illegal. They want the ability to access data from the servers after it has been decrypted. This includes a way to intercept what users perceive to be end-to-end encryption. The only problem I have run into with various government orgs is the lack of knowledge around implementing intermediate certificates. They will often try to talk people into installing their certs rather than installing intermediate certs correctly. I always point them to testssl.sh [1] [1] - https://github.com/drwetter/testssl.sh https://github.com/drwetter/testssl.sh

cryptoz 6y ago
I am having trouble parsing your comment. What do you mean by, > I don't believe they are making encryption illegal....They want the ability to access data from the servers after it has been decrypted. This includes a way to intercept what users perceive to be end-to-end encryption. This is contradictory, no? The data is not encrypted between 2 users if a 3rd user can read it. It sounds like every bill you read makes encryption illegal, by your own explanation of the bill? I just don't understand what you mean here. Maybe it's my personal understanding of 'encryption'? If Alice encrypts a message to Bob, and also gives the keys to Eve, but doesn't tell Bob that Eve has the keys, then I do not personally consider that message encrypted at all. Do you? What about the bills? A message encrypted with a key held by a potential attacker is not an encrypted message any more.
- LinuxBender 6y ago
  Perhaps this is a terminology issue. Encryption being illegal implies to me that if someone uses encryption, they are violating a law and will be penalized. Providing lawful intercept (backdoors) does not preclude the use of encryption; but rather, renders it non existent for those with the lawful intercept access. Where this gets really sketchy is if companies give users the perception that they have end-to-end encryption, but also have a way to intercept that traffic. So I think we are in effect saying the same thing, but I am just saying that encryption is not illegal, just rendered non existent for specific parties. This is actually already in place today in many of the big centralized service providers. I believe these proposed laws are just a way to officiate this so that companies are protected and less likely to resist requests for information for fear of legal repercussion.
  - wizzwizz4 6y ago
    > but rather, renders it non existent for those with the lawful intercept access And for plenty of people who don't have the lawful intercept access. This downgrades encryption from "encrypts stuff" to "obfuscates stuff"; while technically incorrect, it's probably better to describe this as "no longer encryption" because it's clearer to non-techies.
    - LinuxBender 6y ago
      No, encryption still encrypts stuff. There is no obfuscation being suggested in these bills. Rather, some groups will have the ability to see data without encryption, as they do today, but with easier access and less red tape and less having to do inside deals and people looking the other way or depending on NSL's. Please don't get me wrong, I am not in support of these bills. I think it is risky to incorrectly describe what is happening, especially for non technical people. I believe the right way to describe this to non technical people would be: "Today, some people can see your traffic even if it is encrypted. If one of these bills (there are a few versions) are approved, then more groups will be able to see your data, easier and quicker." If you want to get people more interested in speaking up, then the best lessons learned would be from the interview between John Oliver and Edward Snowden. John interviewed many people on the street about the NSA having access to all your phone data. Nobody cared until he clarified and said, "So you would be ok with government employees looking at your significant others nude pics / sexting pics". At that point, most of the people interviewed said they would be furious.
rezonant 6y ago
What? No, GP is talking about EARN IT et al which would mandate backdoors in encryption tech
- klyrs 6y ago
  If the government holds the private keys, don't they have that backdoor access to their own https traffic?
  - rezonant 6y ago
    Who watches the watchers?
- president 6y ago
  Where again does EARN IT [1] mention anything about mandating backdoors in encryption tech? [1] https://www.congress.gov/bill/116th-congress/senate-bill/3398/text https://www.congress.gov/bill/116th-congress/senate-bill/339...

president 6y ago

After observing the mountains of opposition to EARN IT on large tech sites like Reddit and HN, I am starting to believe the "banning encryption" meme was started by tech companies to cripple the bill even though the word "encryption" isn't mentioned anywhere in the bill text. Guessing they are not liking the fact that the bill would force sites to be liable for illegal user-submitted content on their websites: "(3) MATTERS ADDRESSED.—The matters addressed by the recommended best practices developed and submitted by the Commission under paragraph (1) shall include— (A) preventing, identifying, disrupting, and reporting child sexual exploitation; (B) coordinating with non-profit organizations and other providers of interactive computer services to preserve, remove from view, and report child sexual exploitation; (C) retaining child sexual exploitation content and related user identification and location data; (D) receiving and triaging reports of child sexual exploitation by users of interactive computer services, including self-reporting; (E) implementing a standard rating and categorization system to identify the type and severity of child sexual abuse material; (F) training and supporting content moderators who review child sexual exploitation content for the purposes of preventing and disrupting online child sexual exploitation; (G) preparing and issuing transparency reports, including disclosures in terms of service, relating to identifying, categorizing, and reporting child sexual exploitation and efforts to prevent and disrupt online child sexual exploitation; (H) coordinating with voluntary initiatives offered among and to providers of interactive computer services relating to identifying, categorizing, and reporting child sexual exploitation; (I) employing age rating and age gating systems to reduce child sexual exploitation; (J) offering parental control products that enable customers to limit the types of websites, social media platforms, and internet content that are accessible to children; and (K) contractual and operational practices to ensure third parties, contractors, and affiliates comply with the best practices."

thephyber 6y ago
From the EFF (a civil liberties organization, not a tech company) coverage: > We’ve explained how the EARN IT Act could be used to drastically undermine encryption. Although the bill doesn’t use the word “encryption” in its text, it gives government officials like Attorney General William Barr the power to compel online service providers to break encryption or be exposed to potentially crushing legal liability. > The bill also violates the Constitution’s protections for free speech and privacy. As Congress considers the EARN IT Act—which would require online platforms to comply with to-be-determined “best practices” in order to preserve certain protections from criminal and civil liability for user-generated content under Section 230 (47 U.S.C. § 230)—it’s important to highlight the bill’s First and Fourth Amendment problems. [1] https://www.eff.org/deeplinks/2020/03/earn-it-act-violates-constitution https://www.eff.org/deeplinks/2020/03/earn-it-act-violates-c...