4 ms·

I don't believe that France is actually willing to accept that every opposing intelligence agency will obtain the key...

dataflow 2y ago
Maybe they don't think it's as likely as you think. Or maybe they think the time horizon is long enough that it is worth it. Whatever it is, I assure you they are not too stupid to realize this is a possibility. They just differ on either the degree of the risk, or on the value they get in return. In which case, logic dictates that if you believe the actual risk is higher than they would tolerate, to find a way to convince them of that.
- whatshisface 2y ago
  That's a matter of facts rather than values. The "impossible promise" is that a private company can keep a kilobyte of data out of the hands of every spy agency on Earth for any length of time.
  - immibis 2y ago
    Why does this concern apply to the French intelligence agency but not, say, the code signing certificate for Whatsapp?
    - whatshisface 2y ago
      On one level it does apply to certificates. On another level, pushing a compromised update to every phone in Europe (to gain access equivalent to having a copy of the backdoor) would be noticed by the publisher, and the binary difference would quickly be found by security researchers.
AshamedCaptain 2y ago
And yet the immense majority of the population accept & use messaging platforms operated by "not France" where the operator would be able to obtain everyone's key with a couple clicks. (Yes, this includes Apple's).
- whatshisface 2y ago
  That makes sense because it has been brought about as a consequence of consumer preference. It wouldn't make sense for it to have been required by the government.
  - AshamedCaptain 2y ago
    Unfortunately, last time I heard, consumers actually dictate what the government cares about.
immibis 2y ago
I think they think when that happens they'll change it. Or they'll change it on a schedule... "Just use HTTPS" is good enough for every website and web app on the planet (including ones that handle more messages than the entire country of France) but not a state intelligence agency can't keep their TLS keys secret?
- whatshisface 2y ago
  "Just use HTTPS" sends French messages directly to NSA, insofar as those platforms are concerned. In that case there's not even a copy of any encryption key...
  - immibis 2y ago
    France is giving everything they receive to the NSA anyway, so there's not much difference.

dataflow 2y ago

Maybe they don't think it's as likely as you think. Or maybe they think the time horizon is long enough that it is worth it. Whatever it is, I assure you they are not too stupid to realize this is a possibility. They just differ on either the degree of the risk, or on the value they get in return. In which case, logic dictates that if you believe the actual risk is higher than they would tolerate, to find a way to convince them of that.

whatshisface 2y ago
That's a matter of facts rather than values. The "impossible promise" is that a private company can keep a kilobyte of data out of the hands of every spy agency on Earth for any length of time.
- immibis 2y ago
  Why does this concern apply to the French intelligence agency but not, say, the code signing certificate for Whatsapp?
  - whatshisface 2y ago
    On one level it does apply to certificates. On another level, pushing a compromised update to every phone in Europe (to gain access equivalent to having a copy of the backdoor) would be noticed by the publisher, and the binary difference would quickly be found by security researchers.

AshamedCaptain 2y ago

And yet the immense majority of the population accept & use messaging platforms operated by "not France" where the operator would be able to obtain everyone's key with a couple clicks. (Yes, this includes Apple's).

whatshisface 2y ago
That makes sense because it has been brought about as a consequence of consumer preference. It wouldn't make sense for it to have been required by the government.
- AshamedCaptain 2y ago
  Unfortunately, last time I heard, consumers actually dictate what the government cares about.

immibis 2y ago

I think they think when that happens they'll change it. Or they'll change it on a schedule... "Just use HTTPS" is good enough for every website and web app on the planet (including ones that handle more messages than the entire country of France) but not a state intelligence agency can't keep their TLS keys secret?

whatshisface 2y ago
"Just use HTTPS" sends French messages directly to NSA, insofar as those platforms are concerned. In that case there's not even a copy of any encryption key...
- immibis 2y ago
  France is giving everything they receive to the NSA anyway, so there's not much difference.