European MEPs want to ban states from backdooring encryption | Hacker News Reader

European MEPs want to ban states from backdooring encryption

techcrunch.com

118 pointsjanober33 comments

Earlier discussion:

https://news.ycombinator.com/item?id=14592745

Yet another reason to be sad about having my EU citizenship forcibly removed. The UK government want the exact opposite of this.

I can relate but complain all you want, it wasn't "forcibly" removed, it was democratically so.

democratically

For a value of 'democratically' where billionaire media tycoons controlled the narrative.

Virtually-unknown tech companies too:

https://www.theguardian.com/technology/2017/may/07/the-great...

And a lot of people you obviously didn't agree with.

Can't say I supported neither Trump nor Brexit but at least I think I can see that it was democratic even if they weren't my choices: people were angry and scared and voted accordingly.

How not both?

You are forced to comply with the law, even if it is democratically legitimized.

When the voters were made promises about 350 million per week to the NHS, that was backtracked on within hours of the result, do you really consider it democratic?

On the flip-side, we were also promised a punishment budget, higher interest rates and the end of western civilization. I think it's rather snooty of you to think that the plebs who didn't agree with you don't know how to distinguish fact from fiction.

Where did I say that I didn't agree with them? I am merely pointing out that the lies before the referendum made it pretty undemocratic.

Sure. You can argue that it was democratic, but I personally do not choose to lose my citizenship, therefore my citizenship is being taken from me, forcibly.

Completely agree. I wonder when we are going to see whatever small tech/startup scene exists in the UK evaporate away into France/Germany/other-European-country and whether that will affect any policy change by this anti-tech government. Probably never.

edit: I guess it's worth following on from that by asking what's the closest Euro equivalent to SV we currently have? I'm seriously considering France or Spain for a variety of reasons. Though I've heard Estonia is trying hard to become Europe's SV.

How did you get EU citizenship in the first place?

By being born in the UK.

I understand. But from my point of view, this may not have happened if the UK was still a member, as they would've forcefully pushed in the opposite direction. So I'm glad the UK is exiting before they can do any lasting damage to EU values. If the UK isn't happy with the Fundamental Charter of Rights of the EU, then it's free to pass its own "Bill of (Non-) Rights".

The UK is still a member of the EU.

The UK is still an active member of the EU. We haven't left yet.

What will the EU do about operating systems developed outside the EU, such as MS Windows, iOS, or Android? If these contain a backdoor for the NSA, it is unlikely that the manufactureres will tell the EU that they do.

Therefore if the EU is serious about this (and it should be), it should develop its own operating systems, and mandate them for all enterprises that store personal or sensitive data (which means all enterprises).

Doing this, while necessary, is not sufficient to stop backdoors, because they could be implemented at the hardware level. Many chips are manufactured in the far east, and China is a state that may be hostile to the EU in future. So the EU needs all chips to be designed and manufactured on its own soil, if it wants digital independence.

I guess they could sue the hell out of any company that is revealed to have an NSA backdoor.

You mean like the companies which have been sued for selling ridiculously vulnerable routers which have been compromised for years by the CIA?

It's done this way to have plausible deniability.

The EU already forced e.g Microsoft to adapt to the European market. For example the "N" edition of Windows.

I can't see how this feature would be any different. If Microsoft wants to sell windows here then it will have to conform.

They could just leave the European market but it would be way more expensive.

They could also just hide the fact that they aren't conforming to standards and hope it's not discovered or leaked. The fines would be ridiculous (and ask VW whether it's a good idea).

> If Microsoft wants to sell windows here then it will have to conform.

Or say they are conforming but not doing so.

that is trivially possible (and likely) but if it happens it will be likely come out at some point, and the EU is likely to punish MSFT hard.

The EU Commission has previously fined MSFT for a couple billion dollars for "lesser" infractions.

They have fined microsoft billions over the years. Once 2-3 million dollars per day for failing to comply.

1.44 billion was the largest fine they got so far. Failing to comply with sometthing like this (through secrecy) would definitely be way north of that. It just wouldn't be worth it. I mean microsoft doesn't have anything to gain from having backdoored security, unlike the situation with media player and internet explorer, where there was a monopoly situation.

Which was what I said, two lines down from the quoted line. And I also tried to explain how that would probably not be a worthwile thing to do for microsoft (Naively speaking: If you have e.g. 1% risk of discovery and the fine is estimated to say $10B, then the gain from keeping the backdoor would better be $100M etc.). I can't see how they could make any kind of big money out of insecure encryption, other than the savings of not fixing it.

How does the US ensure its hardware has no Chinese backdoors?

By making its own hardware, of course.

That's interesting, do you know which companies make their hardware on US soil?

I've no idea. What the US would need to do is have a law mandating that hardware be made there, for national security purposes.

All other polities need to do the same thing as well, if they wish to retain thier independence.

Well, Linux does originate from Scandinavia (Linus Torvalds is Finland Swedish), and it's open source, so nothing stops us from building operating systems on top of Linux. But there are however a lot of good Linux-based operating systems out there already (open source, too), and the problem would rather be what comes pre-installed with the machine you buy. If Microsoft for example can't ensure the EU that Windows doesn't contain backdoors for the NSA for example, the EU could regulate the PC market to favor, say, Ubuntu over Windows pre-installed. But I really don't think it would be a good idea to do that.

I do however think that our government agencies and militaries should be forced to run Linux. They already have a problem of being too reliant on Windows for pretty much everything.

> If Microsoft for example can't ensure the EU that Windows doesn't contain backdoors for the NSA for example

What counts as ensurance? Simply MS saying "no backdoors" clearly isn't good enough. Open sourcing the whole OS, to make it harder to find backdoors, would help.

Yeah that's the tricky part. I don't think the EU could make Microsoft open source their Windows, but I guess something along the lines of Microsoft having to give access to their source code to a team of EU security researchers that audits and looks for backdoors would be a start. But even that isn't foolproof.

While this is probably a step in a good direction, I would like to see EU enforcing companies to be responsible for the security of the products they are offering if they want to conduct business in EU states.

Reply on news.ycombinator.com