If David Cameron bans secure encryption he can't intercept
blog.mythic-beasts.com
blog.mythic-beasts.com
On a more serious note, I can't help but think David Cameron is employing the technique of attempting something extreme so that he can do something less extreme (but still really bad) later with less oversight. Of course you can't ban strong encryption. His advisers know that, he knows that, _everyone_ knows that.
It will be very interesting to see what actually gets put (or attempted to be put) into law. Right now it's just a whole lot of unrealistic noise.
That's far from being the only encryption system available - SSH doesn't even have a concept of "root certificate" to MITM with.
And it's not as if they can do it secretly. If they suddenly started to MITM all TLS traffic in the country by replacing the certs with certs signed by the national root, it would get noticed within minutes, if not seconds. And God only knows how much stuff it would break. And on top of that, they don't even have the capability...
There is 0% chance they would attempt such a thing. And 100% chance that such a thing would fail immediately and fail badly. I don't know why people think there is even a slight risk of them trying such a thing. There isn't.
Who can resist a sufficiently determined state that still enjoys popular support? All he has to do is engineer the support for "security" over the long term.
Don't misunderestimate your fellow voters.
[edit] https works based on trust. We trust the browsers and OS vendors to at least try to prevent the CAs from abusing their power. As soon as it becomes obvious that the OS and browser vendors are now letting state actors compromise all traffic, then https is dead in the water and something else will come along. Nobody is going to risk that happening. It would cost too many rich people too much money.
I had little interest in security before Snowden, so admittedly, I need to lurk moar and keep learning. Thanks for offering another argument I can try to fit against new facts I encounter and helping me continue that process.
Did you mean to say it's not elected government officials? Just curious, because I definitely consider a country's intelligence apparatus to be completely and wholly part of its "government", and would be surprised to find someone who didn't.
The security services have a large amount of operational discretion and privileged access to ministers. They have the ability to present secret "evidence" which cannot be publicly challenged.
Let's not forget that the CIA effectively ran the governments of several Latin American countries, and in the UK Northern Ireland was effectively governed by the police Special Branch.
The book does veer somewhat into unfounded conspiracy territory, but I think it's an interesting read so far and the author doesn't come across as crazy so much as skeptical.
And there is the essence of why we want transparency, oversight, restricted privacy etc. I generally feel that if everything the security services did was publically available (at least on level with civilian police) there would be a lot of friction but they would get immersurably better.
I was trying to say the security services will always press for more powers and it's the job of politicians to know when to resist those requests.
My American friends were mightily amused and amazed when Belgium spent >500 days without government a couple of years ago, but of course they were interpreting the word in a much more encompassing way than it is done in Belgium. 'The goverment' is really just a couple of dozen people (with perhaps a couple of dozen assistants each).
If we don't want that to happen then the smart thing to do would be act as if that is what they are proposing.
If they propose something even worse it isn't like it will have been wasted effort.
The licence will be implemented as a fee for a digital certificate that properly authenticates.
So, you're a small startup with an idea for a secure messaging app. want a licence. no problem, its £10M. have you got the money handy?
Woo!
Obviously I'm completely against that, because once there's a backdoor, it's all too easy to collect by default, instead of only when "needed".
With this clarification though, lots of this tech would still work. Most things based on TLS will continue to work, if every computer has to have a government CA certificate installed to allow MITMs. Hopefully HTTP Public Key Pinning will become more prevalent if this looks likely to happen.
And the following day, there will ba a Chrome+Firefox extension that highlights when the government CA certificate has been used - so that you know EXACTLY when you are MITMd. Isn't it good?
HPKP is bypassed for locally-installed CA certificates (if you don't want that, set security.cert_pinning.enforcement_level to 2 on Firefox).
One possible way to backdoor it might be mandate that companies keep copies of the encrypted messages, tagged with a device ID. Then to decrypt you need to get the person's phone, which is a clearer analogy to getting a warrant to search someone's house to look for things they have stashed.
My idea was that rather than ban it outright and make it like most other internet traffic (decrypted on a server), they could mandate some kind of cacheing of the _encrypted_ data on the server. Then, once they'd lawfully executed a warrant to grab the suspects phone, they can decrypt at their leisure. Apps using per-message keys will probably be a no-no.
Myself - I live in the UK - I hope Apple, Google and Facebook all say a big "fuck you" and cut this country off from their services, but I have a feeling the 'compromise' is going to be something like the paragraph above.
The world is run by technology companies now. Not governments. Governments haven't caught on to this yet, at least officially.
But the bottom line about law is that the law is whatever Google, Apple, Facebook, Microsoft, and Amazon says it is.
That's not the most comforting thought in the world, but that's how it is. And it's sort of okay for now because all of those companies are currently run by idealists. God help us when they are not.
For right now though, there isn't a chance in hell that Cameron's ideas will have any traction. He's just saying things that will win him some support from a certain segment of the population.
I have a feeling that if they did this, the uproar would be sufficient to have the law reversed by emergency measures.
If they were followed, as they may well be, by a whole host of other essential internet services (Google Search, Wikipedia, Github, etc etc etc) just switching off simultaneously in the UK on the day the law comes into force, that might be sufficient to ensure this sort of dumb shit is never done again. The cost of billions of pounds of lost productivity would probably ensure that.
Ultimately, it's the people's right and responsibility, not one man.
Temporary, short-term downside to cure a semi-permanent problem seems reasonable.
Google at least has allowed backdooring before with PRISM, and probably will again in the future.
Of course, if only the UK was part of the Trans-Pacific Partnership... then Google and Github might be able to take the UK government to private court to protest the law in the first place, and sue for lost profits... wait... what...
That doesn't work if the message has been encrypted on transit with an one-time key, which is discarded after the message has been received. The Axolotl system (used by TextSecure/Signal and AFAIK the new encryption on WhatsApp) does that. Once the message has been received (and thus the corresponding key discarded), any copy of the encrypted message becomes useless.
The current tendency in protocol design is to use ephemeral keys (usually through some Diffie-Hellman variant) whenever possible, since it's more secure.
> With SSL they can just get a warrant (or you know, don't get a warrant) and look at the server, where everything is in plain text.
That doesn't work if the server is outside their jurisdiction.
Second point: Not sure about that, can't I just serve a warrant on Facebook UK to give me the data? If they say "Sorry, we can't get it because America", I imagine the police will say "What? Give it up or go to prison". Similarly, if Google/Apple allow banned apps in their app store, just bring a suit against their UK tentacles.
The app doesn't have to be in their app store: on Android, it's a simple checkbox to be able to install an app from outside the app store. One can also enable developer mode and install it as if it were a self-developed app.
http://www.chiark.greenend.org.uk/mailman/listinfo/ukcrypto
EG: http://www.chiark.greenend.org.uk/pipermail/ukcrypto/2015-Ma...
But there's quite a lot of useful discussion there.
Mobiles are encrypted too: https://en.wikipedia.org/wiki/A5/1
We've spent the last year running twitter campaigns, but the people that matter (voters, well tory voters) don't do social media.
This means that you need to write a letter. Yes a real letter, not a fucking email. Write a letter to your MP, then a local Lord.
Then you need to write to your boss, tell them that the cost of business will go through the roof (if you're able to do business. )
Then start looking at jobs abroad. Because no doubt there will be a twitter campaign, meaning that nobody actually bothers to engage in how the democratic process actually works.
I hope this gets the idea across to influential civilians (i.e. non-techs). Humour can work quite well in the UK. The HGTTG references may be lost on the younger ones though.
> Youtube fails to load with a secure connection error.
YouTube still refuses to use anything more recent than RC4 encryption, so, if Cameron would ban all secure encryption, YouTube would probably still work.
The connection uses TLS 1.2.
The connection is encrypted and authenticated using AES_128_GCM and uses ECDHE_ECDSA as the key exchange mechanism."
Now, the videos wouldn’t load either.
Of course they can't expect to effectively police the ban if it's put into law. But they don't have to. Everybody will encrypt anyway and that's fine, because once they want somebody put away, they will be able to simply by saying "that person broke the Snooper's Charter by using SSH".
It's not about banning encryption, it's about having a convenient law to put tech-savvy people away.
Terrorists can communicate using a book cipher or pick from any of a huge number of other options. The kind of terrorists we should actually be concerned about (competent ones) will already use extra measures such as this in conjunction with strong encryption.
This is totalitarianism.
"For too long, we have been a passively tolerant society, saying to our citizens: as long as you obey the law, we will leave you alone." - David Cameron.
I'm not defending any government's actions to remove privacy and spy on its people. Quite the contrary, once one has accepted that as inevitable, it's easier to move on. The need for human privacy is also, IMO, a fact. Some may dispute that, yet there are true, the only other option then becomes to go around the law. An unjust law must be broken. And it will. The worse the government gets, the more it will be broken.
I don't see why people in the UK and elsewhere couldn't get copies of software that still had strong encryption despite the idiotic laws. After all, it's just as easy to click one link as another. Will the UK be monitoring traffic for actual binaries and source code? Will the arrest people that use encryption they can't break? Will they arrest people for sending garbage data that looks like encrypted data but isn't and therefore can't decrypt? As the government gets more totalitarian, I think we will see even regular people training themselves in encryption and its proper uses. It's inevitable as people have more and more to lose. Once life, limb, and property are at stake, people either become competent or become victims, and people are generally a lot more competent than they appear when high stakes are on the line.
Of course, UK companies will be hurt. They won't be able to do a lot of business internationally. UK citizens will have their information stolen in massive data breaches. Bank accounts and identities will be compromised. Many accounts that are not with UK companies will be compromised because of password reuse. Cameron doesn't have to ban ALL strong encryption. Whatever systems he bans it in, will be compromised. That's inevitable. At the same time, the people don't have to put up with it. Stop online banking with banks that don't use strong encryption. Request paper bills. Clog up phone lines. Pay in cash if possible. These are all things a regular person could do in the event that strong encryption is banned that if done by even a small percentage will increase costs quite a bit. It may not get the law reversed, but it might get companies on the side of people if they have to cut paper bills again at a 10-100x cost over electronic ones, for example.
tl;dr: Governments will spy and people will use strong encryption regardless of the law as privacy is a human right and oftentimes necessary to survival. Businesses and convenience will suffer greatly.