4 ms·
I disagree with him, but he makes a solid point, and many people think like him. HN is enough of an echo chamber as it is, don't make it worse.
by najqh 5y ago
I disagree with him, but he makes a solid point, and many people think like him.
HN is enough of an echo chamber as it is, don't make it worse.
- ben_w 5y agoThe article says: """The main criticism was that it is simply impossible to rule out that a backdoor - once it is built - is abused by criminals or undemocratic regimes. A lowering of the security level would immediately affect all users - and not just those who are the subject of a judicial investigation.""" The comment says: > I'm glad you're keeping safe dealers, pedophiles, and other criminals as well as their lawyers. This does not look like a solid point to me; it looks like rhetoric.
- 1337shadow 5y agoCiting two different passages from the article: > This draft included a passage that would have forced companies such as WhatsApp and Signal to decrypt their encrypted chats upon request by the authorities for criminal investigation. > Belgian intellectuals like Professor Bart Preneel said that "by putting a backdoor into Whatsapp, you would make it less safe for everyone". This does not look like a solid point to me; it looks like rhetoric. Anyway: > a backdoor - once it is built - is abused by criminals or undemocratic regimes. If they can get their hands on a governmental private key, which is unlikely.
- ttybird2 5y agoIsn't this what happened with some european "digital covid certificates"? Not really unlikely.
- 1337shadow 5y agoNot afaik, people have just been sending screenshots of their QR codes to each others, and the people "validating" just have to "scan and see Valid".
- ttybird2 5y agoThe keys themselves were leaked. https://news.ycombinator.com/item?id=29011537 https://news.ycombinator.com/item?id=29011537
- throwaway675309 5y agoJust by virtue of providing the possibility of keys to the "Proverbial kingdom" and centralizing location of those keys gives far greater incentive for hackers or state actors to find new ways to gain access to these tools for decryption.
- 1337shadow 5y agoYes, but we can always revoke them and generate new ones?
- ben_w 5y agoWhat economic damage can be done in the interval between a private key being accessed by a criminal and the key being revoked? Depends on the systems connected to the private key of course, but billions per incident are certainly possible in some cases. Even if this is just private chat on messenger platforms rather than 2FA or HTTPS, imagine how blackmailers would respond to getting all the nudes, the drunk confessions, the adultery, from 30 minutes access to all of the 10th most popular chat app in your country.
- piaste 5y ago> If they can get their hands on a governmental private key, which is unlikely. But those private keys aren't going to be created by the government. They will be created by Facebook, Signal, Telegram etc., who will then hand over one of them to my government, one to yours, and one to each and every government that makes a similar law, from Argentina to Zimbabwe. And they could just as easily hand over another to <insert billionaire or other non-governmental figure you dislike here>.
- 1337shadow 5y agoAhah! Exactly, you have figured what I would have requested to specify in this bill!
- ben_w 5y ago> If they can get their hands on a governmental private key, which is unlikely. Why do you believe this is unlikely?
- 1337shadow 5y agoBecause I know how state security works.
- ben_w 5y agoI see. Then perhaps you can explain why so much stuff leaks from, say, the USA government? Not just the stuff from government employees or contractors like Snowden and Manning who appear to be motivated by whistleblowing, but also the actual double agents working for the Soviets in the Cold War, and the apparently accidental leaks of NSA spyware: https://en.wikipedia.org/wiki/EternalBlue https://en.wikipedia.org/wiki/EternalBlue
- deleted 5y ago[deleted]
- deleted 5y ago[deleted]
- deleted 5y ago[deleted]
- 1337shadow 5y agoThese are the typical use cases for key revocation yes? The key should not be installed on non suspected user devices anyway in my opinion.
- ben_w 5y agoGreat, that just leaves the possibility that the system to install keys will itself be compromised, perhaps something like happened a few years ago with a downgrade attack to the old USA “export grade encryption” back when crypto was counted as a munition. The use of e2e encryption started to become a general standard in chat apps precisely because centralised keys proved to be a weak point after Snowden. As for revocation: https://news.ycombinator.com/item?id=29642783 https://news.ycombinator.com/item?id=29642783 Snowden got a lot of data without anyone stopping him. The risk is what if he’d been malicious instead of a whistleblower?
- natch 5y agoThe NSA leaked its own hacking tools to the internet. Oops. The US government gave… gave, not leaked, not accidental, deliberately outright gave.. the identities and other personal information of people who had worked with the US in Afghanistan to none other than the Taliban. Because the Taliban pinkie promised not to slaughter them. Too bad, the Taliban didn’t keep its word. Let’s not be naïve about the government’s ability or interest in keeping things private.
- 1337shadow 5y agoWho's the problem here? The government or the talibans? Sorry it's not really clear what you mean.