7 ms·

India wants to read everything? Why don't they just forbid the use of https. So that everyone can read everything on the internet

antikneejerk 4y ago
I read the linked source. Could not find any reference to any Indian law or Govt. order. Can you please point me to any source with credible information on the supposed provisions which are causing Signal to "exit" India.
- dagmx 4y ago
  https://www.hindustantimes.com/india-news/govt-proposes-law-to-intercept-encrypted-messages-on-whatsapp-signal-101663830524846.html https://www.hindustantimes.com/india-news/govt-proposes-law-...
  - antikneejerk 4y ago
    Thanks. Again this article does not link to the supposed draft bill, and what it actually says. They directly jump to saying government wants to "intercept". How does the Govt propose to intercept? What was actually proposed in the bill? They also say the Govt. is seeking public feedback on the draft. Ideally this news source should link to the draft in question so that people can read, and raise their objections.
- hummerbliss 4y ago
  Its was a proposed law (to solicit feedback). Signal is not exiting but would exit if such law comes to India. https://www.hindustantimes.com/india-news/govt-proposes-law-to-intercept-encrypted-messages-on-whatsapp-signal-101663830524846.html https://www.hindustantimes.com/india-news/govt-proposes-law-... But Telecom Authority of India rules out any immediate intervention. https://tech.hindustantimes.com/tech/news/trai-rules-out-regulatory-intervention-for-ott-communication-services-71600134486496.html https://tech.hindustantimes.com/tech/news/trai-rules-out-reg... I couldn't quote from the article here but looks like they are going to wait till clarity emerges from International jurisdiction.
  - antikneejerk 4y ago
    I am looking for that proposed law to understand the provisions. Can you please give me a link to that if it is available.
  - hummerbliss 4y ago
    Proposed law draft (I hate that news outlets do not link to the law they discuss) https://dot.gov.in/sites/default/files/Draft%20Indian%20Telecommunication%20Bill%2C%202022.pdf https://dot.gov.in/sites/default/files/Draft%20Indian%20Tele...
    - antikneejerk 4y ago
      Thanks
    - antikneejerk 4y ago
      Thanks. This bill seems to be about telecom infrastructure. Does not talk about metadata, or encryption. As far as I can find does not seem to touch on messaging apps as well. Was anyone able to find anything related to which provision in the bill would impact Signal.
      - itake 4y ago
        > “telecommunication services" means service of any description (including [..] electronic mail, voice mail, voice, video and data communication services, [..], internet based communication services, Which I think Signal would fall under at least one of those services. you can control+f your way through to see everything related to that phrase.
      - tecleandor 4y ago
        It's explicit on the interception of any kind of data. It defines message as: “message” means any sign, signal, writing, image, sound, video, data stream or intelligence or information intended for telecommunication; And then it says that said "messages" can be "intercepted or detained or disclosed", for a really wide range of reasons, apparently without the intervention of a judge. 24.4 On the occurrence of any public emergency or in the interest of the public safety, the Central Government or a State Government or any officer specially authorized in this behalf by the Central or a State Government, may, if satisfied that it is necessary or expedient to do so, in the interest of the sovereignty, integrity or security of India, friendly relations with foreign states, public order, or preventing incitement to an offence, for reasons to be recorded in writing, by order: (a) direct that any message or class of messages, to or from any person or class of persons, or relating to any particular subject, brought for transmission by, or transmitted or received by any telecommunication services or telecommunication network, shall not be transmitted, or shall be intercepted or detained or disclosed to the officer mentioned in such order;
zx8080 4y ago
I'm trying to imagine a ban on https for better understanfing and I remember that Australia implemented anti-encryption laws some 3-4 years ago. Can someone comment on how Australian anti-encryption laws work in a case of https? Is it illegal to use encryption (like https to send data to server in a browser) without a backdoor now in Australia?
- trissylegs 4y ago
  Australia law doesn't require you to do anything until explicitly asked by the intelligence agencies. The first stage is a gentle "Request for Technical Assistence" with no penalties for no saying no. But then they can then ask again and demand you provide assistance with jail time/fines for non-compliance. The orders also come secrecy notices so you can't inform anyone (except your lawyers) that you've received the notice. The request have to target specific users so they can't be "Collect messages on everyone with a Muslim name" or something. The chilling effect of it is. What if they demand you give them information you do not have a way of accessing. (Eg Signal). How would you comply? Do you have to pre-empt whatever requests you MIGHT get and ensure you could back-door a user if it were required. The law also seems to imply that ASIO could demand a single employee at a company backdoors something and they wouldn't be able to tell their co-workers.
  - cyphar 4y ago
    > The chilling effect of it is. What if they demand you give them information you do not have a way of accessing. (Eg Signal). How would you comply? Do you have to pre-empt whatever requests you MIGHT get and ensure you could back-door a user if it were required. That's what Technical Capability Notices are for. You don't have to implement a backdoor until they force you to. They have worded the legislation to make it sound as though this cannot be used to implement "systemic weaknesses" but this is bullshit (their definition of a "systemic weakness" would be something like getting a backdoor into OpenSSL, while a backdoor in Facebook Messenger is not a "systemic weakness" because it only affects one application).
teekert 4y ago
Of course the government should still use https, too important, even government officials' personal communication should be protected. All animals are equal, ...
miohtama 4y ago
Kazakstan mandated government issue man-in-the-middle TLS certificates: https://www.zdnet.com/article/kazakhstan-government-is-intercepting-https-traffic-in-its-capital/ https://www.zdnet.com/article/kazakhstan-government-is-inter... The EU is following this govennment friendly move: https://www.bleepingcomputer.com/news/security/experts-urge-eu-not-to-force-insecure-certificates-in-web-browsers/ https://www.bleepingcomputer.com/news/security/experts-urge-... It would not be difficult for India as well. I see itlikely Modi and BJP will make this move as part of some anti-terrorist legislation.
- chatmasta 4y ago
  Personally I find it unbelievable that major governments are not already in possession of the private key for at least one of the 150+ root certificates pre-installed on my device.
  - tialaramex 4y ago
    This would be a lot of effort for very little reward. The problem is that those keys can't be used passively. Just knowing these keys achieves nothing (lay people often assume you could snoop TLS, but, that's not how it works with a CA root even in archaic SSL versions) The only useful thing you can do with those keys is make certificates (the thing the CA gets to do legitimately) but presumably you'd make bogus ones. But in most of the world's web browsers those certificates don't work unless they come with SCTs, receipts from two or more public certificate transparency logs promising they logged these certificates. So now as well as obtaining private keys to a trusted root CA, you need to break at least two of the CT logs. This deliberately and unavoidably creates a paper trail showing what happened. All three entities (the root CA and two logs) have their reputations destroyed and if they're for-profits presumably go bankrupt (or the business unit fails). And what did you get for this? A forged certificate? Maybe a few dozen if you targeted carefully. Maybe you were able to pull this off for a whole week before alarm bells got too loud to ignore ?
    - deleted 4y ago
      [deleted]

antikneejerk 4y ago

I read the linked source. Could not find any reference to any Indian law or Govt. order. Can you please point me to any source with credible information on the supposed provisions which are causing Signal to "exit" India.

dagmx 4y ago
https://www.hindustantimes.com/india-news/govt-proposes-law-to-intercept-encrypted-messages-on-whatsapp-signal-101663830524846.html https://www.hindustantimes.com/india-news/govt-proposes-law-...
- antikneejerk 4y ago
  Thanks. Again this article does not link to the supposed draft bill, and what it actually says. They directly jump to saying government wants to "intercept". How does the Govt propose to intercept? What was actually proposed in the bill? They also say the Govt. is seeking public feedback on the draft. Ideally this news source should link to the draft in question so that people can read, and raise their objections.
hummerbliss 4y ago
Its was a proposed law (to solicit feedback). Signal is not exiting but would exit if such law comes to India. https://www.hindustantimes.com/india-news/govt-proposes-law-to-intercept-encrypted-messages-on-whatsapp-signal-101663830524846.html https://www.hindustantimes.com/india-news/govt-proposes-law-... But Telecom Authority of India rules out any immediate intervention. https://tech.hindustantimes.com/tech/news/trai-rules-out-regulatory-intervention-for-ott-communication-services-71600134486496.html https://tech.hindustantimes.com/tech/news/trai-rules-out-reg... I couldn't quote from the article here but looks like they are going to wait till clarity emerges from International jurisdiction.
- antikneejerk 4y ago
  I am looking for that proposed law to understand the provisions. Can you please give me a link to that if it is available.
- hummerbliss 4y ago
  Proposed law draft (I hate that news outlets do not link to the law they discuss) https://dot.gov.in/sites/default/files/Draft%20Indian%20Telecommunication%20Bill%2C%202022.pdf https://dot.gov.in/sites/default/files/Draft%20Indian%20Tele...
  - antikneejerk 4y ago
    Thanks
  - antikneejerk 4y ago
    Thanks. This bill seems to be about telecom infrastructure. Does not talk about metadata, or encryption. As far as I can find does not seem to touch on messaging apps as well. Was anyone able to find anything related to which provision in the bill would impact Signal.
    - itake 4y ago
      > “telecommunication services" means service of any description (including [..] electronic mail, voice mail, voice, video and data communication services, [..], internet based communication services, Which I think Signal would fall under at least one of those services. you can control+f your way through to see everything related to that phrase.
    - tecleandor 4y ago
      It's explicit on the interception of any kind of data. It defines message as: “message” means any sign, signal, writing, image, sound, video, data stream or intelligence or information intended for telecommunication; And then it says that said "messages" can be "intercepted or detained or disclosed", for a really wide range of reasons, apparently without the intervention of a judge. 24.4 On the occurrence of any public emergency or in the interest of the public safety, the Central Government or a State Government or any officer specially authorized in this behalf by the Central or a State Government, may, if satisfied that it is necessary or expedient to do so, in the interest of the sovereignty, integrity or security of India, friendly relations with foreign states, public order, or preventing incitement to an offence, for reasons to be recorded in writing, by order: (a) direct that any message or class of messages, to or from any person or class of persons, or relating to any particular subject, brought for transmission by, or transmitted or received by any telecommunication services or telecommunication network, shall not be transmitted, or shall be intercepted or detained or disclosed to the officer mentioned in such order;

zx8080 4y ago

I'm trying to imagine a ban on https for better understanfing and I remember that Australia implemented anti-encryption laws some 3-4 years ago. Can someone comment on how Australian anti-encryption laws work in a case of https? Is it illegal to use encryption (like https to send data to server in a browser) without a backdoor now in Australia?

trissylegs 4y ago
Australia law doesn't require you to do anything until explicitly asked by the intelligence agencies. The first stage is a gentle "Request for Technical Assistence" with no penalties for no saying no. But then they can then ask again and demand you provide assistance with jail time/fines for non-compliance. The orders also come secrecy notices so you can't inform anyone (except your lawyers) that you've received the notice. The request have to target specific users so they can't be "Collect messages on everyone with a Muslim name" or something. The chilling effect of it is. What if they demand you give them information you do not have a way of accessing. (Eg Signal). How would you comply? Do you have to pre-empt whatever requests you MIGHT get and ensure you could back-door a user if it were required. The law also seems to imply that ASIO could demand a single employee at a company backdoors something and they wouldn't be able to tell their co-workers.
- cyphar 4y ago
  > The chilling effect of it is. What if they demand you give them information you do not have a way of accessing. (Eg Signal). How would you comply? Do you have to pre-empt whatever requests you MIGHT get and ensure you could back-door a user if it were required. That's what Technical Capability Notices are for. You don't have to implement a backdoor until they force you to. They have worded the legislation to make it sound as though this cannot be used to implement "systemic weaknesses" but this is bullshit (their definition of a "systemic weakness" would be something like getting a backdoor into OpenSSL, while a backdoor in Facebook Messenger is not a "systemic weakness" because it only affects one application).

teekert 4y ago

Of course the government should still use https, too important, even government officials' personal communication should be protected. All animals are equal, ...

miohtama 4y ago

Kazakstan mandated government issue man-in-the-middle TLS certificates: https://www.zdnet.com/article/kazakhstan-government-is-intercepting-https-traffic-in-its-capital/ https://www.zdnet.com/article/kazakhstan-government-is-inter... The EU is following this govennment friendly move: https://www.bleepingcomputer.com/news/security/experts-urge-eu-not-to-force-insecure-certificates-in-web-browsers/ https://www.bleepingcomputer.com/news/security/experts-urge-... It would not be difficult for India as well. I see itlikely Modi and BJP will make this move as part of some anti-terrorist legislation.

chatmasta 4y ago
Personally I find it unbelievable that major governments are not already in possession of the private key for at least one of the 150+ root certificates pre-installed on my device.
- tialaramex 4y ago
  This would be a lot of effort for very little reward. The problem is that those keys can't be used passively. Just knowing these keys achieves nothing (lay people often assume you could snoop TLS, but, that's not how it works with a CA root even in archaic SSL versions) The only useful thing you can do with those keys is make certificates (the thing the CA gets to do legitimately) but presumably you'd make bogus ones. But in most of the world's web browsers those certificates don't work unless they come with SCTs, receipts from two or more public certificate transparency logs promising they logged these certificates. So now as well as obtaining private keys to a trusted root CA, you need to break at least two of the CT logs. This deliberately and unavoidably creates a paper trail showing what happened. All three entities (the root CA and two logs) have their reputations destroyed and if they're for-profits presumably go bankrupt (or the business unit fails). And what did you get for this? A forged certificate? Maybe a few dozen if you targeted carefully. Maybe you were able to pull this off for a whole week before alarm bells got too loud to ignore ?
  - deleted 4y ago
    [deleted]