6 ms·

Honestly, it sounds kind of relaxing. Good excuse to get some sunshine. On a more serious note, I can't help but think David Cameron is employing the technique

by SCdF 11y ago

Honestly, it sounds kind of relaxing. Good excuse to get some sunshine. On a more serious note, I can't help but think David Cameron is employing the technique of attempting something extreme so that he can do something less extreme (but still really bad) later with less oversight. Of course you can't ban strong encryption. His advisers know that, he knows that, _everyone_ knows that. It will be very interesting to see what actually gets put (or attempted to be put) into law. Right now it's just a whole lot of unrealistic noise.

lowmagnet 11y ago
Given current trends, I'm guessing national root certificate as a license to MITM all traffic.
- beagle3 11y ago
  That would be TLS traffic at most (Good luck adding those certificates to curl, MUAs, etc. for example). That's far from being the only encryption system available - SSH doesn't even have a concept of "root certificate" to MITM with.
- SCdF 11y ago
  Yeah I was going to have that as an example in my comment, but even then that seems unrealistic to me. Why wouldn't the big tech companies simply not do that? The UK needs them more than they need the UK, and if you took away the country's access to Facebook for more than an hour you'd have a riot on your hands.
  - pjc50 11y ago
    I'd assume they'd go along with government policy, like they have done in e.g. China. And the government proposed taking down twitter and BBM during the London riots a few years ago.
    - greghinch 11y ago
      I'm afraid you might be a tad ambitious regarding the weight the UK market carries with global corporate interests, as compared to the Chinese
      - stingraycharles 11y ago
        I'm not so sure. It only takes one browser vendor with a significant interest in the UK (Google would be a good candidate, given that advertisers are very sensitive to legislation) to make the whole exercise useless.
  - jpollock 11y ago
    The big tech companies already support legal intercept for content traversing their networks.
  - pascalmemories 11y ago
    Facebook (et al) already hand over user data to UK and other authorities. There is no need for any MITM certificate and even if there was, these companies would just do it since it makes it easier for them to say to authorities they already have the key to read it without involving Facebook - instant plausible deniability for Facebook to say we don't hand over info to authorities and full access for Governments everywhere.
- visarga 11y ago
  What's to stop companies from additionally encrypting their channels end to end while passing through the backbone? They can decrypt the backbone all they want.
  - nsgi 11y ago
    If it's a website, that would be like using custom encryption on HTTP.
- dzhiurgis 11y ago
  Possibly in a form of disappearing SIM card.
- mike-cardwell 11y ago
  Do you honestly think that could happen? How? Who would co-operate? Which OS or browser vendor would knowingly distribute such a certificate? Not even Microsoft or Apple would co-operate, let alone Mozilla or the Linux distros... And it's not as if they can do it secretly. If they suddenly started to MITM all TLS traffic in the country by replacing the certs with certs signed by the national root, it would get noticed within minutes, if not seconds. And God only knows how much stuff it would break. And on top of that, they don't even have the capability... There is 0% chance they would attempt such a thing. And 100% chance that such a thing would fail immediately and fail badly. I don't know why people think there is even a slight risk of them trying such a thing. There isn't.
  - ForEnglandJames 11y ago
    >Who would co-operate? Who can resist a sufficiently determined state that still enjoys popular support? All he has to do is engineer the support for "security" over the long term. Don't misunderestimate your fellow voters.
    - mike-cardwell 11y ago
      When resistance is so damn easy, and capitulation so self-destructive, who would co-operate? You could not force a Linux distro or Mozilla to distribute that cert. It could not be done. [edit] https works based on trust. We trust the browsers and OS vendors to at least try to prevent the CAs from abusing their power. As soon as it becomes obvious that the OS and browser vendors are now letting state actors compromise all traffic, then https is dead in the water and something else will come along. Nobody is going to risk that happening. It would cost too many rich people too much money.
      - ForEnglandJames 11y ago
        That's very well thought-out. The tinfoiler in me wonders if that's true, though, and if there aren't subtler avenues for circumvention that still target this trust-based system, especially via social engineering. I had little interest in security before Snowden, so admittedly, I need to lurk moar and keep learning. Thanks for offering another argument I can try to fit against new facts I encounter and helping me continue that process.

by SCdF 11y ago

lowmagnet 11y ago

Given current trends, I'm guessing national root certificate as a license to MITM all traffic.

beagle3 11y ago
That would be TLS traffic at most (Good luck adding those certificates to curl, MUAs, etc. for example). That's far from being the only encryption system available - SSH doesn't even have a concept of "root certificate" to MITM with.
SCdF 11y ago
Yeah I was going to have that as an example in my comment, but even then that seems unrealistic to me. Why wouldn't the big tech companies simply not do that? The UK needs them more than they need the UK, and if you took away the country's access to Facebook for more than an hour you'd have a riot on your hands.
- pjc50 11y ago
  I'd assume they'd go along with government policy, like they have done in e.g. China. And the government proposed taking down twitter and BBM during the London riots a few years ago.
  - greghinch 11y ago
    I'm afraid you might be a tad ambitious regarding the weight the UK market carries with global corporate interests, as compared to the Chinese
    - stingraycharles 11y ago
      I'm not so sure. It only takes one browser vendor with a significant interest in the UK (Google would be a good candidate, given that advertisers are very sensitive to legislation) to make the whole exercise useless.
- jpollock 11y ago
  The big tech companies already support legal intercept for content traversing their networks.
- pascalmemories 11y ago
  Facebook (et al) already hand over user data to UK and other authorities. There is no need for any MITM certificate and even if there was, these companies would just do it since it makes it easier for them to say to authorities they already have the key to read it without involving Facebook - instant plausible deniability for Facebook to say we don't hand over info to authorities and full access for Governments everywhere.
visarga 11y ago
What's to stop companies from additionally encrypting their channels end to end while passing through the backbone? They can decrypt the backbone all they want.
- nsgi 11y ago
  If it's a website, that would be like using custom encryption on HTTP.
dzhiurgis 11y ago
Possibly in a form of disappearing SIM card.
mike-cardwell 11y ago
Do you honestly think that could happen? How? Who would co-operate? Which OS or browser vendor would knowingly distribute such a certificate? Not even Microsoft or Apple would co-operate, let alone Mozilla or the Linux distros... And it's not as if they can do it secretly. If they suddenly started to MITM all TLS traffic in the country by replacing the certs with certs signed by the national root, it would get noticed within minutes, if not seconds. And God only knows how much stuff it would break. And on top of that, they don't even have the capability... There is 0% chance they would attempt such a thing. And 100% chance that such a thing would fail immediately and fail badly. I don't know why people think there is even a slight risk of them trying such a thing. There isn't.
- ForEnglandJames 11y ago
  >Who would co-operate? Who can resist a sufficiently determined state that still enjoys popular support? All he has to do is engineer the support for "security" over the long term. Don't misunderestimate your fellow voters.
  - mike-cardwell 11y ago
    When resistance is so damn easy, and capitulation so self-destructive, who would co-operate? You could not force a Linux distro or Mozilla to distribute that cert. It could not be done. [edit] https works based on trust. We trust the browsers and OS vendors to at least try to prevent the CAs from abusing their power. As soon as it becomes obvious that the OS and browser vendors are now letting state actors compromise all traffic, then https is dead in the water and something else will come along. Nobody is going to risk that happening. It would cost too many rich people too much money.
    - ForEnglandJames 11y ago
      That's very well thought-out. The tinfoiler in me wonders if that's true, though, and if there aren't subtler avenues for circumvention that still target this trust-based system, especially via social engineering. I had little interest in security before Snowden, so admittedly, I need to lurk moar and keep learning. Thanks for offering another argument I can try to fit against new facts I encounter and helping me continue that process.