10 ms·

The UK Is Trying to Stop Facebook's End-to-End Encryption

136 points by gunwithdots 6y ago

readflaggedcomm 6y ago
>“end-to-end encryption poses an unacceptable risk to user safety and society. It would prevent any access to messaging content and severely erode tech companies’ ability to tackle the most serious illegal content on their own platforms, including child abuse and terrorism.” Implying that any system which looks to casual users e2e encrypted now isn't, like the web. Are they ready to open that can of worms?
oytis 6y ago
"... and asking for stricter regulation of the technology" Like, stricter regulation of mathematics?
- rlpb 6y ago
  Right now, mass consumer use of technology for communication is predicated by: 1. There being a service provider that is a legal entity. 2. The service provider providing the client software. 3. The service provider gatekeeping to the social network that makes the system useful. 4. Consumers not generally being able or willing to interfere with their client end software to add E2E on top of what the service provider does, even if that is technically feasible. Under these conditions, mandating backdoors through regulation is perfectly feasible, regardless of mathematics. Maybe one day we'll see true P2P software that users actually control, with no central entity that the government can coerce, actually being used by the mass market. Until then, it's not defying mathematics at all to mandate backdoors.
  - oytis 6y ago
    I would argue connecting child abusers is a pretty niche market.
    - MikeUt 6y ago
      And enabling child abusers is even more niche, yet houses are still sold without built-in surveillance cameras, that would let law enforcement look at the recording of what you were doing (with a warrant, of course!) But as it stands, private houses are warrant-proof places where anything can happen.
      - patrickaljord 6y ago
        https://www.wired.com/2011/05/warrantless-house-search/ https://www.wired.com/2011/05/warrantless-house-search/ > yet houses are still sold without built-in surveillance cameras, that would let law enforcement look at the recording of what you were doing (with a warrant, of course!) yet, but it could come. I can imagine offline AI detector that spies on you 24/7 in your house and only sends footage when it detects something illegal so the police wouldn't do the monitoring. I could see plenty of people being ok with that specially if it's advertised as a good way to proof your innocence.
        Lev1a 6y ago
        I mean... people are already dumb and security-blind enough to willingly implant surveillance bugs into their homes (Alexa, Google Home, un-neutered smart TVs etc.). Just because these are manufactured and controlled by the private sector doesn't mean it's not just a stepping stone for some kind of mandated surveillance equipment installed into homes in future. No. Thanks.
        varispeed 6y ago
        Imagine people could see on their telly what they said during the day and number of likes from the officers who watch them. The more correctly you behave, more likes you get and maybe a tax rebate. This is going to be the future. Modern politics in the UK is heavy influenced by R Thaler. People are being slowly nudged towards such concepts.
  - intricatedetail 6y ago
    You can still communicate with end to end encryption even if they setup mitm. You just need to exchange keys and then encrypt/decrypt yourself. If this becomes a law someone will quickly come up with such an extra layer. It is going to be a cat and mouse game, people will have no privacy and criminals will always find a way, as you cannot regulate maths.
    - rlpb 6y ago
      > You can still communicate with end to end encryption even if they setup mitm. I already considered this in my predicate: 4. Consumers not generally being able or willing to interfere with their client end software to add E2E on top of what the service provider does, even if that is technically feasible.
      - intricatedetail 6y ago
        I am sorry, you're right. I wonder what would happen to someone and something that would make it easy for your own encryption on top.
- tpmx 6y ago
  France actually banned non approved use of encryption algorithms/math in the 90s so there's some precedence. https://www.theregister.com/1999/01/15/france_to_end_severe_encryption/ https://www.theregister.com/1999/01/15/france_to_end_severe_...
  - danarmak 6y ago
    Governments that issue patents on math/algorithms/software already claim the power to forbid you to use them. They just need to patent all public encryption algorithms, in perpetuity. (Sarcastic? Who knows?)
CraigJPerry 6y ago
>> One industry source who has spoken with government figures is skeptical that such a radical scenario will come to pass And yet the Investigatory Powers Act[1] passed into law in the UK and has never been repealed. We haven't seen a headline like "local ambulance chief spied on my wife's porn browsing habits" so far but I do wonder if there have been any abuses by now? [1] That's the law which allows people like your local fire chief or food standards agency to download a copy of your browsing history without a warrant. From the legislation itself, here are the surprisingly large list of people: https://www.legislation.gov.uk/ukpga/2016/25/schedule/4/enacted https://www.legislation.gov.uk/ukpga/2016/25/schedule/4/enac... Getting a warrant in the UK is not some huge effort, in the worst cases it can take just under 1 month but regularly can be under 35 minutes.
- asddubs 6y ago
  i assume in days of https, most of the history they would be able to obtain are only domain names, not specific URLs, right?
  - will0 6y ago
    Correct
  - PaulKeeble 6y ago
    Hence the desire to backdoor all encryption to see the full juicy details. Also the reason DNS over HTTPS exists and is spreading.
    - schmorptron 6y ago
      Does DNS over HTTPS allow the dns provider to see beyond the domain name?
      - capableweb 6y ago
        Since DNS (Domain Name System) only deals with the domain names themselves, any DNS resolver (communicated to via HTTP, TCP, UDP, QUIC or what have you) will only resolve a domain name => IP address. Adding a path in there makes no sense.
Lev1a 6y ago
It's always either "Think of the children!" or "X will only be used to investigate the most serious of crimes like terrorism, rape and murder" which shortly afterwards is then (quietly) forgotten about when something like browsing history etc. can be downloaded by basically anyone in government(s). Maybe there is a restriction snort where such an action requires a warrant but considering that "judges" and "courts" for that (like that infamous US secret court, seriously WTAF) are basically rubber-stamping enthusiasts, it's not actually a restriction and just compromises end user privacy and (online) information security. "Backdooring E2E encryption"/"Private key escrow" are some other examples of unrealistic and ultimately harmful things called for by technologically inept, old people who inexplicably have been granted the power to devise laws that will most likely only show their full effects years or decades down the line when most of those legislators are either already dead or don't have to worry about the consequences of such legislation anyway ("I don't even use a computer, what do I care? The internet is just full of criminals anyway." quote from my 80-something grandmother). In German there is a nice idiom for that kind of thought pattern: "Nach mir die Sintflut" (something like "After me, the flood/deluge" from what I could find). At the same time these old people and their accomplices - indoctrinated middle-aged people - try to stem the flow of young people into politics if their ideologies do not align with the elderly agenda by e.g. accusing them of trying to oppose the protection of children or something equally effective in the mass media (via the excuses mentioned above). It's all just so fucked up...
- agurk 6y ago
  > In German there is a nice idiom for that kind of thought pattern: "Nach mir die Sintflut" Interestingly this is originally a French saying by Louis XV, Après moi, le déluge [0]. From wiki: > It is generally regarded as a nihilistic expression of indifference to whatever happens after one is gone, though it may also express a more literal forecasting of ruination. Its meaning is translated by Brewer in the forms "When I am dead the deluge may come for aught I care", and "Ruin, if you like, when we are dead and gone." It looks like the German translation of the same idiom was popularised by Marx [1]. [0] https://en.wikipedia.org/wiki/Apr%C3%A8s_moi,_le_d%C3%A9luge https://en.wikipedia.org/wiki/Apr%C3%A8s_moi,_le_d%C3%A9luge [1] https://de.wikipedia.org/wiki/Nach_uns_die_Sintflut https://de.wikipedia.org/wiki/Nach_uns_die_Sintflut
Lammy 6y ago
Do UK and the four other Eyes play musical chairs or something to decide which of them takes a turn attacking privacy and confidentiality online? Sneaky headline wants me to think of them in a vacuum.
intricatedetail 6y ago
They want to compromise entire country security, just to make it easy for LE. Problem is that I doubt it will help in any way because criminals will still be able to communicate with e2e if they will be encrypting traffic themselves and then disguise it as normal text etc. It will be a cat and mouse game. Not sure why they don't sack people coming with such stupid, totalitarian and abusive ideas.
- datavirtue 6y ago
  Yeah, how long before it's illegal to send storage devices through the mail? Packages scanned, no storage device shipping permit, package captured and opened, sender/reciever prosecuted for trafficking encryption keys.
  - intricatedetail 6y ago
    Then stop and search and looking through phone for encryption software and so on... It's looking bleak ...
dataduck 6y ago
Is there any co-ordinated political response to this in the UK? Where do I sign up?
- max1984_2 6y ago
  I don't want to be "blackpilled" about it. But there is literally nothing that can be done about it. None of the politicians in the UK seem to care about freedom of speech, right to privacy or anything else that is classically liberal. Everyone in the UK either supports it or is resigned to it. Also almost nobody in the IT industry seems to care about it either (I've worked at quite a few places as a consultant).
  - varispeed 6y ago
    There is nothing that you can do about it, so people are just apathetic. Only way to change something is by voting, but there is no party that would have a chance of winning that would support freedom of speech. People literally think that if you have nothing to hide, then you have nothing to worry about. When I tried to move some of my friends to Signal and told them that someone can read our messages, they just said so what. You also have this propaganda about being open, transparent with everything that you do and people share things themselves and they find it enjoyable.
    - max1984_2 6y ago
      Getting people to move from something like Whatsapp to Signal is almost impossible. I have no intention of even living in the UK in the next few years to probably one of the overseas territories again (they are starting to tax the hell out of the things I make a living on).
    - pydry 6y ago
      >Only way to change something is by voting Any party with a chance of winning gets coopted. The only real way to change is to participate in internal party politics machinery, and be prepared to play dirty, because they certainly will.
    - 6y ago
account-5 6y ago
So if I use HTTPS and encrypted DNS what's my risk here? What are they able to record?
BrandoElFollito 6y ago
I am not a lawyer so sorry if this is obvious, buy how can a country been the use of software that is made in another one? I read country X is trying to ban Y, and every time I just wonder: how? I can download something off GitHub (except if the ban is in the US), or a copy somewhere else. Ideally, developers wild set a multi country repository with a canary and be done.

136 points by gunwithdots 6y ago

>“end-to-end encryption poses an unacceptable risk to user safety and society. It would prevent any access to messaging content and severely erode tech companies’ ability to tackle the most serious illegal content on their own platforms, including child abuse and terrorism.” Implying that any system which looks to casual users e2e encrypted now isn't, like the web. Are they ready to open that can of worms?

oytis 6y ago

"... and asking for stricter regulation of the technology" Like, stricter regulation of mathematics?

rlpb 6y ago
Right now, mass consumer use of technology for communication is predicated by: 1. There being a service provider that is a legal entity. 2. The service provider providing the client software. 3. The service provider gatekeeping to the social network that makes the system useful. 4. Consumers not generally being able or willing to interfere with their client end software to add E2E on top of what the service provider does, even if that is technically feasible. Under these conditions, mandating backdoors through regulation is perfectly feasible, regardless of mathematics. Maybe one day we'll see true P2P software that users actually control, with no central entity that the government can coerce, actually being used by the mass market. Until then, it's not defying mathematics at all to mandate backdoors.
- oytis 6y ago
  I would argue connecting child abusers is a pretty niche market.
  - MikeUt 6y ago
    And enabling child abusers is even more niche, yet houses are still sold without built-in surveillance cameras, that would let law enforcement look at the recording of what you were doing (with a warrant, of course!) But as it stands, private houses are warrant-proof places where anything can happen.
    - patrickaljord 6y ago
      https://www.wired.com/2011/05/warrantless-house-search/ https://www.wired.com/2011/05/warrantless-house-search/ > yet houses are still sold without built-in surveillance cameras, that would let law enforcement look at the recording of what you were doing (with a warrant, of course!) yet, but it could come. I can imagine offline AI detector that spies on you 24/7 in your house and only sends footage when it detects something illegal so the police wouldn't do the monitoring. I could see plenty of people being ok with that specially if it's advertised as a good way to proof your innocence.
      - Lev1a 6y ago
        I mean... people are already dumb and security-blind enough to willingly implant surveillance bugs into their homes (Alexa, Google Home, un-neutered smart TVs etc.). Just because these are manufactured and controlled by the private sector doesn't mean it's not just a stepping stone for some kind of mandated surveillance equipment installed into homes in future. No. Thanks.
        varispeed 6y ago
        Imagine people could see on their telly what they said during the day and number of likes from the officers who watch them. The more correctly you behave, more likes you get and maybe a tax rebate. This is going to be the future. Modern politics in the UK is heavy influenced by R Thaler. People are being slowly nudged towards such concepts.
- intricatedetail 6y ago
  You can still communicate with end to end encryption even if they setup mitm. You just need to exchange keys and then encrypt/decrypt yourself. If this becomes a law someone will quickly come up with such an extra layer. It is going to be a cat and mouse game, people will have no privacy and criminals will always find a way, as you cannot regulate maths.
  - rlpb 6y ago
    > You can still communicate with end to end encryption even if they setup mitm. I already considered this in my predicate: 4. Consumers not generally being able or willing to interfere with their client end software to add E2E on top of what the service provider does, even if that is technically feasible.
    - intricatedetail 6y ago
      I am sorry, you're right. I wonder what would happen to someone and something that would make it easy for your own encryption on top.
tpmx 6y ago
France actually banned non approved use of encryption algorithms/math in the 90s so there's some precedence. https://www.theregister.com/1999/01/15/france_to_end_severe_encryption/ https://www.theregister.com/1999/01/15/france_to_end_severe_...
- danarmak 6y ago
  Governments that issue patents on math/algorithms/software already claim the power to forbid you to use them. They just need to patent all public encryption algorithms, in perpetuity. (Sarcastic? Who knows?)

CraigJPerry 6y ago

>> One industry source who has spoken with government figures is skeptical that such a radical scenario will come to pass And yet the Investigatory Powers Act[1] passed into law in the UK and has never been repealed. We haven't seen a headline like "local ambulance chief spied on my wife's porn browsing habits" so far but I do wonder if there have been any abuses by now? [1] That's the law which allows people like your local fire chief or food standards agency to download a copy of your browsing history without a warrant. From the legislation itself, here are the surprisingly large list of people: https://www.legislation.gov.uk/ukpga/2016/25/schedule/4/enacted https://www.legislation.gov.uk/ukpga/2016/25/schedule/4/enac... Getting a warrant in the UK is not some huge effort, in the worst cases it can take just under 1 month but regularly can be under 35 minutes.

asddubs 6y ago
i assume in days of https, most of the history they would be able to obtain are only domain names, not specific URLs, right?
- will0 6y ago
  Correct
- PaulKeeble 6y ago
  Hence the desire to backdoor all encryption to see the full juicy details. Also the reason DNS over HTTPS exists and is spreading.
  - schmorptron 6y ago
    Does DNS over HTTPS allow the dns provider to see beyond the domain name?
    - capableweb 6y ago
      Since DNS (Domain Name System) only deals with the domain names themselves, any DNS resolver (communicated to via HTTP, TCP, UDP, QUIC or what have you) will only resolve a domain name => IP address. Adding a path in there makes no sense.

Lev1a 6y ago

It's always either "Think of the children!" or "X will only be used to investigate the most serious of crimes like terrorism, rape and murder" which shortly afterwards is then (quietly) forgotten about when something like browsing history etc. can be downloaded by basically anyone in government(s). Maybe there is a restriction snort where such an action requires a warrant but considering that "judges" and "courts" for that (like that infamous US secret court, seriously WTAF) are basically rubber-stamping enthusiasts, it's not actually a restriction and just compromises end user privacy and (online) information security. "Backdooring E2E encryption"/"Private key escrow" are some other examples of unrealistic and ultimately harmful things called for by technologically inept, old people who inexplicably have been granted the power to devise laws that will most likely only show their full effects years or decades down the line when most of those legislators are either already dead or don't have to worry about the consequences of such legislation anyway ("I don't even use a computer, what do I care? The internet is just full of criminals anyway." quote from my 80-something grandmother). In German there is a nice idiom for that kind of thought pattern: "Nach mir die Sintflut" (something like "After me, the flood/deluge" from what I could find). At the same time these old people and their accomplices - indoctrinated middle-aged people - try to stem the flow of young people into politics if their ideologies do not align with the elderly agenda by e.g. accusing them of trying to oppose the protection of children or something equally effective in the mass media (via the excuses mentioned above). It's all just so fucked up...

agurk 6y ago
> In German there is a nice idiom for that kind of thought pattern: "Nach mir die Sintflut" Interestingly this is originally a French saying by Louis XV, Après moi, le déluge [0]. From wiki: > It is generally regarded as a nihilistic expression of indifference to whatever happens after one is gone, though it may also express a more literal forecasting of ruination. Its meaning is translated by Brewer in the forms "When I am dead the deluge may come for aught I care", and "Ruin, if you like, when we are dead and gone." It looks like the German translation of the same idiom was popularised by Marx [1]. [0] https://en.wikipedia.org/wiki/Apr%C3%A8s_moi,_le_d%C3%A9luge https://en.wikipedia.org/wiki/Apr%C3%A8s_moi,_le_d%C3%A9luge [1] https://de.wikipedia.org/wiki/Nach_uns_die_Sintflut https://de.wikipedia.org/wiki/Nach_uns_die_Sintflut

Lammy 6y ago

Do UK and the four other Eyes play musical chairs or something to decide which of them takes a turn attacking privacy and confidentiality online? Sneaky headline wants me to think of them in a vacuum.

intricatedetail 6y ago

They want to compromise entire country security, just to make it easy for LE. Problem is that I doubt it will help in any way because criminals will still be able to communicate with e2e if they will be encrypting traffic themselves and then disguise it as normal text etc. It will be a cat and mouse game. Not sure why they don't sack people coming with such stupid, totalitarian and abusive ideas.

datavirtue 6y ago
Yeah, how long before it's illegal to send storage devices through the mail? Packages scanned, no storage device shipping permit, package captured and opened, sender/reciever prosecuted for trafficking encryption keys.
- intricatedetail 6y ago
  Then stop and search and looking through phone for encryption software and so on... It's looking bleak ...

dataduck 6y ago

Is there any co-ordinated political response to this in the UK? Where do I sign up?

max1984_2 6y ago
I don't want to be "blackpilled" about it. But there is literally nothing that can be done about it. None of the politicians in the UK seem to care about freedom of speech, right to privacy or anything else that is classically liberal. Everyone in the UK either supports it or is resigned to it. Also almost nobody in the IT industry seems to care about it either (I've worked at quite a few places as a consultant).
- varispeed 6y ago
  There is nothing that you can do about it, so people are just apathetic. Only way to change something is by voting, but there is no party that would have a chance of winning that would support freedom of speech. People literally think that if you have nothing to hide, then you have nothing to worry about. When I tried to move some of my friends to Signal and told them that someone can read our messages, they just said so what. You also have this propaganda about being open, transparent with everything that you do and people share things themselves and they find it enjoyable.
  - max1984_2 6y ago
    Getting people to move from something like Whatsapp to Signal is almost impossible. I have no intention of even living in the UK in the next few years to probably one of the overseas territories again (they are starting to tax the hell out of the things I make a living on).
  - pydry 6y ago
    >Only way to change something is by voting Any party with a chance of winning gets coopted. The only real way to change is to participate in internal party politics machinery, and be prepared to play dirty, because they certainly will.
  - 6y ago

account-5 6y ago

So if I use HTTPS and encrypted DNS what's my risk here? What are they able to record?

BrandoElFollito 6y ago

I am not a lawyer so sorry if this is obvious, buy how can a country been the use of software that is made in another one? I read country X is trying to ban Y, and every time I just wonder: how? I can download something off GitHub (except if the ban is in the US), or a copy somewhere else. Ideally, developers wild set a multi country repository with a canary and be done.