7 ms·
Bundeskabinett approves draft law allowing trojans on phones to monitor WhatsApp
- deleted 6y ago[deleted]
- reissbaker 6y agoThis doesn't seem like it "allows" a backdoor; it seems like it requires one. (IANAL, etc etc.) So much for the EU's vaunted privacy rights...
- mqus 6y agoAfaict this article is not at all about backdoors(things whatsapp/facebook has to provide) but about device surveillance, putting itself between e2e and humans
- golem14 6y agoTja: “Rules for thee but not for me”
- Semaphor 6y agoIt would be bad, if the HN title wasn’t complete clickbait that had nothing to do with the article it links to… edit: I would appreciate an explanation how my comment about an article talking about trojan horses on the victims' computer with a title about backdoors is wrong instead of mindless downvotes.
- Aerroon 6y ago>So much for the EU's vaunted privacy rights... Do people really have such an impression? In 2006 the EU passed a directive that obligated all ISPs to effectively save your browsing history.[0] They had to keep this for a minimum of 6 months. It took until 2014 for the directive to be found to be invalid. It worked until then though. And that's on the EU level. My expectations are even lower when it comes to individual member states, particularly Germany. [0] https://en.wikipedia.org/wiki/Data_Retention_Directive https://en.wikipedia.org/wiki/Data_Retention_Directive
- nelaboras 6y agoBut the data collection comes with safeguards to accesing the data. You need a court order to request it. This is not state ordered mass surveillance but rather gives police a right to monitor when they have a court order.
- ncmncm 6y agoSecret court orders. We have already seen where that naturally goes. Each abuse makes the next easier.
- reissbaker 6y agoIf e2e encryption is backdoored, there are no safeguards. If a court can read the data, then any "encryption" is privacy theater: either the key has been leaked and stored on government-controlled servers (which means an adversary who got access to the government-controlled servers could read your data without your knowledge too), or the e2e encryption is entirely fake and there's a plaintext copy stored somewhere that, similarly, adversaries could access. If the government can read all of your data, a hacker can too — which in today's age, also includes foreign (or even domestic!) government surveillance programs. Backdoored encryption isn't real encryption. It's theater.
- nelaboras 6y agoNo it gives the authorities the right to tap phones by e.g using 0 days.
- pjmlp 6y agoContrary to American beliefs that three letter security agencies are some angels that follow the law, most of us with our long term experience with dictatorships across the continent, are more than aware that even with democracy, the information services of each state are quite flexible in their interpretation of what is allowed or not.
- est31 6y agoNote that this is not about backdoor requirements or abilities, but about QuellenTKÜ (english: source telecommunications surveillance), which involves getting a trojan onto end devices, either through hacking, like using a bought 0-day, or by breaking into houses of suspects. It already exists as a part of law enforcement in various German states. The proposed regulation is to allow this for a bunch of additional federal agencies as well. A backdoor requirement like Australia has it would be the service vendor having to write their apps in a way that the apps can decrypt content on remote command. That goes much farther than expensively and riskily hacking the devices of suspects. Link to the passed draft (German): https://www.bmi.bund.de/SharedDocs/downloads/DE/gesetzestexte/gesetzesentwuerfe/entwurf-anpassung-verfassungsschutzrecht-bverfschg-madg-g10.pdf?__blob=publicationFile&v=1 https://www.bmi.bund.de/SharedDocs/downloads/DE/gesetzestext...
- StavrosK 6y agoSo this is something like planting a microphone into your house so they can hear your conversations (with a warrant)? That doesn't really sound too bad, it's targeted and you have to go through the proper channels to get authorization.
- DavidSJ 6y agoI think you’re being sarcastic but I’m actually not sure.
- StavrosK 6y agoI am not, do you consider legal wiretaps bad?
- DavidSJ 6y agoNot generally, but there shouldn’t be government microphones preemptively planted in everyone’s home, Stasi style, just waiting for a warrant either. It’s one thing to have the ability to wiretap selectively and with some cost which makes it prohibitive to do on a massive scale; it’s another thing to require vendors and service providers to deliberately sabotage their customers’ products for them. I mean there’s just potential for rampant abuse here. What of the right of political dissidents or other persecuted minorities to communicate safely? What of the possibility that this could be used to target a politician’s political adversaries (the way we see frequent mention of today)? There’s a whole history of abuse here, in the US and across the world, and there’s no need to facilitate the potential for such abuse on a scale we’ve never seen before.
- Barrin92 6y ago>Die Nachrichtendienste sollten in digitalen Bereich dieselben Möglichkeiten bekommen, die sie im analogen bereits haben translated: "Intelligence agencies ought to have the same capacities in the digital sphere that they have in the analog world." Going to be an unpopular opinion here but i agree with this. I don't think there is any precedent for impenetrable private communication legally or culturally. Capacity to say, tap a phone or surveil communication has existed, of course with a warrant and strict legal checks. People who want to argue against this need to make a case why legal or cultural standards should adopt to a technology, rather than arguing from technological capacity backwards.
- LurkersWillLurk 6y agoBecause the laws of physics trump the laws of the sovereign? I agree with the position that law enforcement should be able to attempt to access communications with a judicial warrant. I do not agree with a government mandate to use flawed encryption that would allow anyone to read my communications. It's questionable whether that would even accomplish their stated goals, and personally I doubt it.
- deleted 6y ago[deleted]
- dane-pgp 6y ago> I don't think there is any precedent for impenetrable private communication legally or culturally. What about discussions between conspirators in the privacy of their own home? Should the government be allowed to mandate that telescreens be installed in everyone's homes, with the promise that they would only listen in when they have a secret warrant to do so?
- Barrin92 6y agoisn't that already the status quo? Most governments I'm aware of have the right to engage in surveillance of individual homes, albeit with strong requirements. But all guarantees you have right now that no intelligence is bugging your home is the promise (and legal protection) that they don't do it arbitrarily.
- philips 6y agoWhat does this mean for Signal?
- walrus01 6y agoif the authorities gain physical access to your devices while you're not at home and pwn them with a keystroke logger that phones home + automated screenshot tool, all bets are off.
- sildur 6y agoWho would leave their mobile phone at home?
- abdullahkhalids 6y agoSomeone having an alternate phone for their secret activities.
- jimbob45 6y agoI’ve heard that systems like these are more about promoting state-sponsored industrial sabotage than realistically assisting in crime prevention. In this case though, it seems like Germany is trying to act as the “city on a hill” for the rest of the EU member states to model afterwards.
- ptman 6y agoThis might actually be good. It seems to be an alternative way to enable law enforcement instead of breaking encryption. EDRi has a document outlining solutions for law enforcement without breaking encryption: https://edri.org/files/encryption/workarounds_edriposition_20170912.pdf https://edri.org/files/encryption/workarounds_edriposition_2...
- dheera 6y agoThere's always the $5 wrench for law enforcement, I suppose ...
- tsjq 6y agoGenuinely curious. How is this different from China mandating visibility into all of their citizens' internet data ?
- dang 6y agoA couple problems with this submission: (1) articles on HN need to be in English. We have deep respect for the German language and for other languages, but HN is an English-language site; (2) we've gotten complaints about this title being misleading and/or completely wrong. I've edited the title now in an attempt to be more accurate. (Submitted title was "Germany's Bundeskabinett approves draft law allowing WhatsApp/Messenger backdoor".) If there's a more accurate and neutral title we can change it again.
- Cantbekhan 6y agoI'm sorry ... I could not find any English language article on any reliable/reputable media reporting on this matter after searching extensively. Therefore I decided it was best to submit this reputable AFP one in German that could be translated easily using Google translate or whatever. I thought it was quite important to report on it despite the absence of English media coverage. I apologize for the title being wrong in this case but some other German media press articles have used the word backdoor instead of Trojan. I should have used the word Trojan instead of Backdoor in relation to this particular article and apologize for the mistake. But I'm not really sure which is worse to be honest... and I also suppose they don't want the suspects aware of the Trojan being on their phone. Which leaves many wondering if they don't mean that they want the Trojans at tech companies instead (which then would become backdoors).
- dang 6y agoIt's quite ok - obviously your intentions were fine. I appreciate the explanation.