'All Your Data ❝Я❞ Belong To Us' Thread

[retina]

Originally Posted by xilman

What I am saying is that those who need strong encryption will continue to receive it ...

Yes, of course, you can't possibly make all secure^* encryption disappear. But when the country they are in has laws deeming it illegal to possess, or to use, or to deploy, or whatever, then those people get shafted either way.

The asymmetry is very apparent. Someone not in the political elite will have little to no privacy, but those in high ranking positions will be free to keep their corrupt and dirty secrets as they please, because "national security".

^* I use the word secure instead of strong. It is most likely IMO that the backdoored versions will still be strongly encrypted, just that they won't be secure since someone else also has the keys.

[xilman]

Originally Posted by retina

Yes, of course, you can't possibly make all secure^* encryption disappear. But when the country they are in has laws deeming it illegal to possess, or to use, or to deploy, or whatever, then those people get shafted either way.

The UK at present, for example.

It is a criminal offence not to reveal access to encrypted material if a valid court order is made. In that situation a Brit will make a value judgement.

[Uncwilly]

Instead of offering end to end via a service, why not a device? Plug in a Black-Box 432 display/camera/microphone into the USB of your machine. Connect via your service of choice. The recipient also uses their device and the one time code you provided separately.

[xilman]

Originally Posted by Uncwilly

Instead of offering end to end via a service, why not a device? Plug in a Black-Box 432 display/camera/microphone into the USB of your machine. Connect via your service of choice. The recipient also uses their device and the one time code you provided separately.

How do you propose to acquire such a device in a legal way?

[S485122]

Originally Posted by xilman

...
It is a criminal offence not to reveal access to encrypted material if a valid court order is made.
...

The proposed law, like its siblings, in France for instance, bypasses the need of of a court order. Just as the current trend that the invocation of the code word "terrorism" means the law enforcement forces are not bound by law any more. The BRD already did this at the time of Baader Meinhof, vindicating, by bypassing its constitution, by making it a punishable offence to assure the legal defence of those accused, the claim of that group that the West German state had no legitimacy.

Jacob

[xilman]

Originally Posted by S485122

The proposed law, like its siblings, in France for instance, bypasses the need of of a court order. Just as the current trend that the invocation of the code word "terrorism" means the law enforcement forces are not bound by law any more. The BRD already did this at the time of Baader Meinhof, vindicating, by bypassing its constitution, by making it a punishable offence to assure the legal defence of those accused, the claim of that group that the West German state had no legitimacy.

Jacob

I think we may be misunderstanding.

Let us assume that you have some sensitive material which you have encrypted yourself and uploaded to a cloud service. As I understand the proposed law, which understanding may be completely wrong, your encrypted data will be fully readable, even if it is re-encrypted while in transit from you to your service provider. Assuming that you did your job properly, that encrypted data will be largely meaningless to law enforcement. How then do they get to read the sensitive plaintext? Is a court order necessary or do they just send the boys round for a session of rubber hose cryptanalysis?

Here is an example of what I mean. You get to play law enforcement and I the evil hacker. I am using https for an end-to-end encrypted channel to send text to the Forum. Once it arrives which you can read that text without any problem whatsoever.

pcl@thoth:~/nums$ cat ../jacob.asc
-----BEGIN PGP MESSAGE-----

jA0EBwMCzB+cY1vjUST/0m8BJwuOu9eSWKl7OW9YtEu58mQ3jz7k8Elgj99anVVQ
5axpVl2qMd1hN7dAIwtmOJN/auZh/gfcynJTfJI6vIhyRP07RdDGLo5MrmcbJLaw
rQAPpFxO0aNfxhyoeaQPtIa/VJirAaSzYEdKkfM20eo=
=Xyq1
-----END PGP MESSAGE-----

How do you read the sensitive contents?

[paulunderwood]

Similar question to Uncwilly's about the black box: What if you have a JavaScript program that user downloads as part of a page browse and encrypts end-to-end with another person who has also the same browsed code, over any IM channel of choice. Nothing is logged on the server except the page requests.

[xilman]

Originally Posted by paulunderwood

Similar question to Uncwilly's about the black box: What if you have a JavaScript program that user downloads as part of a page browse and encrypts end-to-end with another person who has also the same browsed code, over any IM channel of choice. Nothing is logged on the server except the page requests.

These workarounds work, but at the cost of increased effort and difficulty of key exchange.

LE is well aware of this. They know they will not be able to read everything, even if they had the bandwidth and storage necessary. They want to catch the lazy and incompetent, something which is becoming ever harder.

Think of it as evolution in action.

[retina]

Originally Posted by paulunderwood

Similar question to Uncwilly's about the black box: What if you have a JavaScript program that user downloads as part of a page browse and encrypts end-to-end with another person who has also the same browsed code, over any IM channel of choice. Nothing is logged on the server except the page requests.

Only if you can't trust the provider of the JS not to backdoor it and send a copy of the key to themselves, or to LE.

The real WTF here is trusting JS code to do what someone claims it does without verifying it every time you download it to make sure it hasn't changed and still performs as claimed without any unwanted "bonus" functionality.

[ewmayer]

Originally Posted by xilman

These workarounds work, but at the cost of increased effort and difficulty of key exchange.

And people who use extra workarounds - whether legal or not - to guard their privacy face being flagged by the LE and NatSec data-hooverers for extra-special scrutiny, possibly even of the old-fashioned physical-surveillance kind, on "must have something to hide" grounds. As I've said before, any time you are using digital tools in an attempt to evade the data-sucking, you are playing on their turf. You may be 100% certain that the crypto scheme you, Alice and Bob are using is uncrackable even for state-level actors, and have reasonable assurance that the software implementation of it which you are using is sound, but what about the next e-device you order online? Get flagged for the above kind of special surveillance, and it is not out of the realm of possibility that your new gizmo which arrived factory-fresh today was briefly diverted during transit, and gifted a keystroke-logging firmware implant.

--------------------------

Google’s Promise to Delete Your Data Has a Major Loophole | Gizmodo

The thing is—at least in the context of digital ads—your data is, by design, impossible to retroactively delete. Here’s an example: A while back, I downloaded an app that I later found to be sharing my prescription data with a few third parties, including Google. That data came packaged with so-called “anonymous identifiers” like my phone’s unique ad ID—a chunk of software that Apple and Google bake into their respective hardware.

If I try to wipe any activity—say, my prescriptions—from the app using the tools Google provides here, that doesn’t wipe that same intel from those third parties: They still have the data they’ve already collected on any relevant past activity. In my case, my prescription information is out there—not connected to me by name, sure, but it’s close enough. Because an activity or history-wipe doesn’t also wipe those anonymous identifiers I mentioned before, the minute I log back into that app to order a refill on some medication, a third party can see that, even though my Google account might be “wiped clean,” I’m still the same consumer that I was before.

Put another way, this kind of third-party jig directly ties my old, sullied Google account to my new, clean one—not just in this particular app, but in every app I might open on my phone, or every site that I browse on my laptop. And when those two accounts are tied across more of my apps that I’m using, or more sites that I’m surfing, I’ll quickly end up back in the same targeted hell I was trying to escape by taking Google’s offer of a shiny new account.

[chris2be8]

The only effective way is to minimise use of the internet, without being too obvious about it. A good start is to stop using it an hour or so before going to bed and tell your friends you are doing it because blue light suppresses melatonin production so using screens shortly before bedtime makes it harder to get to sleep. That is true so it's not obvious if you do it to get to sleep or to avoid being watched.

Chris