5 ms·

My german isn't that good, but from what I understand and from the translation below, the source seems a bit conspiratorial. I completely agree with the concer

My german isn't that good, but from what I understand and from the translation below, the source seems a bit conspiratorial. I completely agree with the concerns raised elsewhere in this thread, but I'm not sure I see the clear link to recent events in Vienna etc claimed here. Here[0] is an earlier document from 21 october which the article seems to take some screenshots from, so it seems that this has been coming either way. I wonder how this effects countries like Switzerland and the UK? [0] https://www.statewatch.org/media/1434/eu-council-draft-declaration-against-encryption-12143-20.pdf https://www.statewatch.org/media/1434/eu-council-draft-decla...

kenniskrag 6y ago
Switzerland is not part of the european union but has to follow some rules to have access to their market. If Whatsapp breaks E2E it will possibly affect multiple countries.
- dogma1138 6y ago
  If WhatsApp breaks E2E in Europe every other country will jump on the bandwagon.
  - GekkePrutser 6y ago
    WhatsApp is hardly safe from prying eyes anyway. Sure, there's always-on E2E encryption that is really well designed. However, WhatsApp constantly prompts every user to back up to the cloud, which is much less well secured. Thus, it's pretty trivial for the authorities to get to it there, I'm sure they can get into iCloud and Google Drive if they want to. It only takes one person in the conversation to have this option switched on. I think this is why WhatsApp doesn't get so much flak from the authorities for having good E2E encryption.
    - hated 6y ago
      Which is to say WhatsApp is perfectly secure as long as the hostile actor cannot access the WhatsApp backups. Only nation state actors might be able to do that.
      - HideousKojima 6y ago
        >Only nation state actors might be able to do that. Nah, all it takes is a good spear phishing campaign like the iCloud celebrity nudes leak a few years ago
      - freshhawk 6y ago
        Isn't it more like "literally any LEO or pseudo-LEO in a 'friendly' country" at this point based on what we know at this point? I think the threat model here is less about a hostile actor subverting the backups than the extreme ease of access to all data on those systems that is given to law enforcement?
      - mr_woozy 6y ago
        or until LEO or State Security compels / sidepushes a trojan app update via play store update. It's as trivial as that. Or just tap the baseband chip via the provider.
      - GekkePrutser 6y ago
        Yes but as a user you don't control this. That's the problem. Anyone you're talking to can activate cloud backups and there is no way to know.
    - kenniskrag 6y ago
      Whatsapp was just an example. There are other messengers out there and also the Email with SMIME and PGP is possibly affected.
    - dogma1138 6y ago
      Those are unrelated issues which also switch the burden to your cloud storage service provider in this case Google or Apple. This isn’t part of the threat model we are discussing here.
dang 6y ago
Thanks—we've changed the URL from https://fm4.orf.at/stories/3008930/ https://fm4.orf.at/stories/3008930/. Submissions to HN need to be in English—we have great respect for other languages, including German, but HN is an English language site. Happily in this case, following the site guideline that calls for original sources solves this problem as well. (I've taken the title from the new URL, btw, which uses the rather strong preposition "against"—I suppose this is a matter of interpretation since the document itself seems to fall over itself insisting on the opposite.)
- Daniel_sk 6y ago
  The German article is more on point and it goes into more details about the background and also the probable solution with "Exceptional Access" architecture. The official EU draft documents always use a very careful language to not create too much suspicion. Only one or two sentences actually tell the truth: "Possible solutions may need the support of service providers in a transparent and lawful manner, as well as improving the technical and tactical skills which the law enforcement and judicial authorities need to face the challenges of digitisation at a global scale." I hope some English articles will appear soon. Exceptional Access document: https://www.politico.eu/wp-content/uploads/2020/09/SKM_C45820090717470-1_new.pdf https://www.politico.eu/wp-content/uploads/2020/09/SKM_C4582... Rev. 1 of the original document, dated November 6: https://files.orf.at/vietnam2/files/fm4/202045/783284_fh_st12143-re01en20_783284.pdf https://files.orf.at/vietnam2/files/fm4/202045/783284_fh_st1...
  - dang 6y ago
    I'm certainly open to changing the URL from what is probably an obscurantist press release to a more accurate and neutral source. But it would need to be in English. Sorry—I realize that's frustrating to anyone who reads both languages, but most HN readers can't. https://hn.algolia.com/?dateRange=all&page=0&prefix=true&sort=byDate&type=comment&query=corporate%20press%20release%20by:dang https://hn.algolia.com/?dateRange=all&page=0&prefix=true&sor...
    - hammock 6y ago
Daniel_sk 6y ago
There is a new revision dated November 6. Changes are highlighted with bold text: https://files.orf.at/vietnam2/files/fm4/202045/783284_fh_st12143-re01en20_783284.pdf https://files.orf.at/vietnam2/files/fm4/202045/783284_fh_st1...

kenniskrag 6y ago

Switzerland is not part of the european union but has to follow some rules to have access to their market. If Whatsapp breaks E2E it will possibly affect multiple countries.

dogma1138 6y ago
If WhatsApp breaks E2E in Europe every other country will jump on the bandwagon.
- GekkePrutser 6y ago
  WhatsApp is hardly safe from prying eyes anyway. Sure, there's always-on E2E encryption that is really well designed. However, WhatsApp constantly prompts every user to back up to the cloud, which is much less well secured. Thus, it's pretty trivial for the authorities to get to it there, I'm sure they can get into iCloud and Google Drive if they want to. It only takes one person in the conversation to have this option switched on. I think this is why WhatsApp doesn't get so much flak from the authorities for having good E2E encryption.
  - hated 6y ago
    Which is to say WhatsApp is perfectly secure as long as the hostile actor cannot access the WhatsApp backups. Only nation state actors might be able to do that.
    - HideousKojima 6y ago
      >Only nation state actors might be able to do that. Nah, all it takes is a good spear phishing campaign like the iCloud celebrity nudes leak a few years ago
    - freshhawk 6y ago
      Isn't it more like "literally any LEO or pseudo-LEO in a 'friendly' country" at this point based on what we know at this point? I think the threat model here is less about a hostile actor subverting the backups than the extreme ease of access to all data on those systems that is given to law enforcement?
    - mr_woozy 6y ago
      or until LEO or State Security compels / sidepushes a trojan app update via play store update. It's as trivial as that. Or just tap the baseband chip via the provider.
    - GekkePrutser 6y ago
      Yes but as a user you don't control this. That's the problem. Anyone you're talking to can activate cloud backups and there is no way to know.
  - kenniskrag 6y ago
    Whatsapp was just an example. There are other messengers out there and also the Email with SMIME and PGP is possibly affected.
  - dogma1138 6y ago
    Those are unrelated issues which also switch the burden to your cloud storage service provider in this case Google or Apple. This isn’t part of the threat model we are discussing here.

dang 6y ago

Thanks—we've changed the URL from https://fm4.orf.at/stories/3008930/ https://fm4.orf.at/stories/3008930/. Submissions to HN need to be in English—we have great respect for other languages, including German, but HN is an English language site. Happily in this case, following the site guideline that calls for original sources solves this problem as well. (I've taken the title from the new URL, btw, which uses the rather strong preposition "against"—I suppose this is a matter of interpretation since the document itself seems to fall over itself insisting on the opposite.)

Daniel_sk 6y ago
The German article is more on point and it goes into more details about the background and also the probable solution with "Exceptional Access" architecture. The official EU draft documents always use a very careful language to not create too much suspicion. Only one or two sentences actually tell the truth: "Possible solutions may need the support of service providers in a transparent and lawful manner, as well as improving the technical and tactical skills which the law enforcement and judicial authorities need to face the challenges of digitisation at a global scale." I hope some English articles will appear soon. Exceptional Access document: https://www.politico.eu/wp-content/uploads/2020/09/SKM_C45820090717470-1_new.pdf https://www.politico.eu/wp-content/uploads/2020/09/SKM_C4582... Rev. 1 of the original document, dated November 6: https://files.orf.at/vietnam2/files/fm4/202045/783284_fh_st12143-re01en20_783284.pdf https://files.orf.at/vietnam2/files/fm4/202045/783284_fh_st1...
- dang 6y ago
  I'm certainly open to changing the URL from what is probably an obscurantist press release to a more accurate and neutral source. But it would need to be in English. Sorry—I realize that's frustrating to anyone who reads both languages, but most HN readers can't. https://hn.algolia.com/?dateRange=all&page=0&prefix=true&sort=byDate&type=comment&query=corporate%20press%20release%20by:dang https://hn.algolia.com/?dateRange=all&page=0&prefix=true&sor...
  - hammock 6y ago

Daniel_sk 6y ago

There is a new revision dated November 6. Changes are highlighted with bold text: https://files.orf.at/vietnam2/files/fm4/202045/783284_fh_st12143-re01en20_783284.pdf https://files.orf.at/vietnam2/files/fm4/202045/783284_fh_st1...