"deal with the relentless threats of terrorism"
When are our legislators going to declare war on rust? Rust never sleeps, and neither should we. Someone should do something! It's a travesty!
Five-eyes nations want comms providers to bust crypto for them
This week's five-eyes meeting has issued its communique, promising to get the tech sector to solve the problems of online terrorism and encrypted communications. As is the way of political communiques, there's a carefully-crafted lack of detail (sufficient, for example, for plausible deniability) about what exactly is planned …
-
-
Thursday 29th June 2017 05:26 GMT Anonymous Coward
Re: "deal with the relentless threats of terrorism"
They haven't got the metal to deal with the real issues. While were at at I think we should declare war on terrierism, won't somebody think of the ankles?
I'm not worried about relentless threats I'm more concerned about actions, the ones they currently do naff all about even when they know about the people involved in advance without breaking encryption.
-
Thursday 29th June 2017 17:32 GMT Gene Cash
Re: "deal with the relentless threats of terrorism"
When are our legislators going to declare war on rust? Rust never sleeps, and neither should we. Someone should do something! It's a travesty!
And at this moment I'm reading "Rust: The Longest War" talking about the US government's efforts to stop corrosion on the Statue of Liberty, the Navy fleet, the Golden Gate bridge, and other things...
-
Friday 30th June 2017 01:42 GMT DeKrow
Re: "deal with the relentless threats of terrorism"
The only "threats of terrorism" I'm relentlessly exposed to are those from various governments continually threatening to erode privacy, human rights, and civilisations existence through various forms of denial of facts and paths of causation.
Things that terrify me more than the spectre of terrorism:
The trend of government control fetishism
Riding a bike alongside humans driving cars
My children learning to drive amongst said humans driving cars
Governments that use the word 'mandate'
Wilfully ignorant people with the right to vote
Skepticism of the scientific method
The weight given to anecdotal evidence
The government spending tax payer's money on a new coal-fired power station (what century is this?)
The lack of security around the electricity grid against the constant threat of squirrorists
-
-
-
Thursday 29th June 2017 06:04 GMT big_D
Missed by most of the tech world is the fact that Germany last week enacted a law to tackle encrypted communications.
Law enforcement, in Germany, can apply for a court order and then hack into a device and leave behind a "Bundestrojaner", a state approved piece of malware to intercept communications directly on the device.
-
Thursday 29th June 2017 06:37 GMT Stork
Germany
as you write, requires a court order. This makes a difference from what May et.al. want, and is in my mind parallel to court orders for phone tapping, opening letters etc.. I am OK with that in principle, as long as law enforcement plays by those rules.
I do not see reference to Germany wanting to weakening encryption generally.
-
This post has been deleted by its author
-
-
Thursday 29th June 2017 09:27 GMT Doctor Syntax
Re: Germany
"They accepted that protecting personal communications through encryption is generally good,"
This is the point that's totally beyond most politicians. They can't grasp the idea that electronic communications without encryption is equivalent to conducting all your business, no matter how confidential, by post-card.
-
-
Thursday 29th June 2017 07:36 GMT EricM
Re: Germany
Agreed: A court order that enables state-sponsored-hacking to infect and control a suspect's device to capture information before/after encryption is different from weakening encryption in general. It will not enable mass-surveillance. But also this solution will lower security for all. A new well-funded player enters the black market that will purchase exploits and keep them secret from manufacturers - so they won't be fixed. This in turn will enable future WannaCry/Petya/NotPetya outbreaks once these weapons caches are raided once in a while by criminals or state-sponsored actors.
So in order to make us all "safe" we in fact create the basis for a worldwide cyber-attack on developed nations, the "west", ourselves.
Sounds rather dumb if you ask me ...
-
Thursday 29th June 2017 12:05 GMT Bernard M. Orwell
Re: Germany
"Agreed: A court order that enables state-sponsored-hacking to infect and control a suspect's device to capture information before/after encryption is different from weakening encryption in general. It will not enable mass-surveillance."
Unless, of course, you don't assume that one court order is for one subject. It's simple enough for a single court order to permit the surveillance of very, very large numbers of people. Ask FISA for details. (though they may refuse to admit how many people are affected by their rulings, only the number of rulings themselves).
-
-
-
Thursday 29th June 2017 14:14 GMT handleoclast
Re: Germany
@ all those who thought the German idea was a good one
It's not.
Really, it's not.
Really, really, really.
You already understand that weak crypto is a bad idea because the bad guys will be able to break it.
You probably understand that some sort of backdoor master key for the good guys is a bad idea because the bad guys will concentrate their attacks on that back door (one success opens not just one device's communications but all of them) and/or bribing those who have the master key. Snowden, anyone?
What you have yet to understand that allowing the good guys to hack into your phone so they can see the plain text before/after it is encrypted is just as bad. It's a single point of attack for all devices. Break the Federal Trojan key (or bribe somebody to give it to you) and you can then read everything on all devices. Not just the communications but local data that is never transmitted or synched to the cloud.
At first sight it looks like a good compromise that retains secure communications for most people but gives the white hats the ability to selectively read the comms of the black hats. In reality it opens up everyone's devices to the black hats. It puts all the eggs in one very valuable basket.
This is actually the worst idea yet.
-
Friday 30th June 2017 21:33 GMT Stork
Re: Germany
Provided the German law enforcement does not hoard vulnerabilities, please explain me how it opens up systems any more than they already are?
As I understand the new law (and I am happy to be corrected) it makes it legal, with a court order, for the law enforcement to plant a trojan on one or more devices.
I have not seen reference to compulsery installation of trojans on all equipment.
Care to explain?
-
-
-
Thursday 29th June 2017 12:38 GMT NonSSL-Login
They already have the ability to pwn individual phones and spy on everything done on them, including before messages are encrypted.
What this is actually about is mass surveillance using ISP's and comms companies Man in the Middle position to strip encryption silently. They don't care about little terrorists, which is shown by the fact that most of the naughty guys lately had been reported for 'terrorist tendencies' and ignored.
The fives eyes just want stuff they can use as leverage or blackmail in their usual espionage game and mass surveillance of unencrypted gives them that.
-
Thursday 29th June 2017 03:32 GMT dan1980
As I said in response to a previous story, our Governments are like transport companies setting impossible timetables for truck drivers and then claiming not to be responsible for their drivers speeding or taking dangerous stimulants to stay awake.
They are dictating an end result that REQUIRES certain processes and then disclaiming responsibility for those same processes.
"We're aren't asking for cows to be killed, we are just saying that you need to bring us a steak when we ask."
-
Thursday 29th June 2017 04:10 GMT Mark 85
As is the way of political communiques, there's a carefully-crafted lack of detail (sufficient, for example, for plausible deniability) about what exactly is planned.
In other words... we're about to get shafted as far as encryption and privacy go and they won't tell us until long after it happens.?
-
Thursday 29th June 2017 04:59 GMT Meph
Breaking News: Water is wet
"About encryption, the HTTPS-hosted communique says it can “severely undermine public safety efforts by impeding lawful access to the content of communications during investigations into serious crimes, including terrorism.”"
I say chaps, it's blasted inconvenient of you to be speaking in a way that we can't understand!
I'm having genuine trouble believing that the leaders of multiple countries are thick enough to think that stamping their collective feet like petulant children is going to miraculously solve this problem for them.
Does anyone want to place bets on how long it is until someone writes an app that not only encrypts a message, but then uses old-school style cyphers to hide the messages inside innocuous looking plain-text internet posts?
-
-
Thursday 29th June 2017 05:35 GMT dan1980
Re: Breaking News: Water is wet
@Meph
I'm having genuine trouble believing that the leaders of multiple countries are thick enough to think that stamping their collective feet like petulant children is going to miraculously solve this problem for them.
Depends on what the 'problem' is. So far as our governments and their agencies are concerned, the 'problem' is not having on-demand access to any and all communication. I.e. - their problem is encryption.
They are smart enough, however, to know that demanding consumer software abandon encryption wholesale is not going to fly. They are also observant enough to know that the term 'backdoor' now carries a load of negative press (and rightly so), forcing them to use language that avoids - so far as is possible - any comparison or connection with a 'backdoor'.
They have been fought and, on these points, been beaten by the tech companies in the public mind. So what are they doing? Saying that they aren't going to dictate how the tech world runs itself and how they make their software - they will just insist on an outcome that they can frame in the most positive and reasonable light available to them: the ability to obtain information pursuant to a valid, legal warrant.
I believe that our governments understand that what they want isn't possible without either a backdoor or the complete removal of encryption and they don't care, so long as they can pass the buck.
For them, the problem is the existence of strong encryption - not how to access (strongly) encrypted data without weakening encryption; they couldn't care less about that.
-
Thursday 29th June 2017 06:34 GMT Milton
Re: Breaking News: Water is wet
"Does anyone want to place bets on how long it is until someone writes an app that not only encrypts a message, but then uses old-school style cyphers to hide the messages inside innocuous looking plain-text internet posts?"
I assume a touch of facetiousness, because you surely know this happens all the time. A seemingly innocuous blog post about the price of strawberries in Tesco can just as easily be the activation command for a dastardly plot.
But even such elementary codes are unnecessary if your eyewateringly expensive national security apparatus, which collects a million hours of phone intercepts every week in highly accented, idiomatic, convoluted Arabic dialects, employs only 77 people as translators.
There are many examples of vast budgets being deployed on magical technical projects which actually gum up the works, when what's needed is plain old-fashioned humint, shoe leather and for want of a better word: traditional police work
-
Thursday 29th June 2017 09:42 GMT Doctor Syntax
Re: Breaking News: Water is wet
"Does anyone want to place bets on how long it is until someone writes an app that not only encrypts a message, but then uses old-school style cyphers to hide the messages inside innocuous looking plain-text internet posts?"
A double book cypher. Use two books. Look up the page and word number of the first instance a word, e.g. "the", in one book. Substitute the word, e.g. "attack" in the same position in the second.
If only we knew the two books amanfrommars uses...
-
-
Thursday 29th June 2017 16:25 GMT Charles 9
Re: Breaking News: Water is wet
"Steganography has already been done."
But it gets trickier the more information you have to pass along at a time, especailly in a "low-shared-knowledge" situation where you and the target have little if any in common. Plus for many methods of steganography, there are ways to sanitize them. For example, hiding in whitespace can be defeated by sanitizing whitespace to minimum spacing standards, and so on. Nonsense messages like book codes will tend to stand out (as will outlandish sports predictions), images can be stretched, flattened, etc. There are limits.
PS. As for the idea the Panopticon will be Too Much Information, ever considered they could winnow the stuff through machines first? They do that already with large camera arrays like in casinos.
-
Thursday 29th June 2017 22:00 GMT Meph
Re: Breaking News: Water is wet
"As for the idea the Panopticon will be Too Much Information, ever considered they could winnow the stuff through machines first?"
The trouble here is that while machines are excellent at pattern recognition, they'll only ever find the precise thing you tell them to look for. Heuristic scanning is notoriously hit and miss, and even then, you still need to give the system a series of baseline behaviours to check against.
I think Vic has the heart of it though, there are two ways to hide a message. Either squirrel it away and hope nobody trips over it, or generate so much noise that nobody is sure if what they're hearing is random crap or something of value. Too much signal tends to make your average Joe tune out.
-
Friday 30th June 2017 12:53 GMT Charles 9
Re: Breaking News: Water is wet
"The trouble here is that while machines are excellent at pattern recognition, they'll only ever find the precise thing you tell them to look for. Heuristic scanning is notoriously hit and miss, and even then, you still need to give the system a series of baseline behaviours to check against."
Fine enough. As long as it's the first line, it can winnow out the noise to leave less for the humans to skim.
"Too much signal tends to make your average Joe tune out."
That's the beauty of machines. They DON'T tire. In fact, given the right learning system, the more data the merrier for it.
-
-
-
-
Thursday 29th June 2017 14:12 GMT Vic
Re: Breaking News: Water is wet
Does anyone want to place bets on how long it is until someone writes an app that not only encrypts a message, but then uses old-school style cyphers to hide the messages inside innocuous looking plain-text internet posts?
I imagine it's already happening - and the *ideal* vector already exists.
Spam.
Receiving a piece of spam is all the plausible deniability you need. Everyone gets it - it's a menace. Not my fault, guv'nor.
You could even send the appropriate spam to the email address of the bloke supposed to be surveilling the operation - if it isn't filtered by his mail provider, it'll get thrown away. Even NSA agents won't admit to needing penis growth medicines...
But if the Bad Guy(tm) checks with his stego tool, he'll find the message that was sent to him - and a million others, although they don't know it - and so the communication has happened, in plain sight of everyone including the investigating authorities. And everyone except the terrorists will simply ignore it.
Vic.
-
-
Thursday 29th June 2017 05:13 GMT technoise
Follow that camel
Given that, after the unfortunate result when he turned on his satellite phone, Bin Laden relied only on couriers and sneakernet to convey messages, and T.E Lawrence managed to conduct an entire insurgency campaign in the Middle East using nothing more for communication than messages carried by camel, could the "Five Eyes" prove to us what plots could have been averted using the decryption of strongly encrypted messages, what plots were coordinated using strong encryption, and what terrorist actions could not be coordinated by other means, i.e messengers and sneakernet? Bearing in mind that once an operation is under way, communications won't even need to be encrypted, and you'll have a pretty good idea the operation is happening, anyway?
The clock ticking while the boffins try to decipher the message to discover the location of the bomb, while the grinning terrorist sits there in his cell, keeping stumm, is just too much of a Hollywood movie plot scenario.
-
This post has been deleted by its author
-
-
Thursday 29th June 2017 06:08 GMT Paul Hargreaves
So they could go back to the good old days and say 'nothing over 56 bit' or some random number above that.
Except - AWS. In ye olde days it would be troublesome to decrypt something unless you had lots of computers, something governments have but the unwashed didn't.
Cores are so cheap to rent now by the thousand. Weak crypto won't work.
Really they can play wack-a-mole and ask / tell each, and, every, single, developer, and, tech, company to give them the private keys.
Excluding China/Russia (oops), that'll work for big companies (in western countries) that provide SSL keys, and large app vendors such as Google, Microsoft etc.
Those pesky criminals, however, will use something else... since 'crypto' worked well before computers. Mine's a copy of 'The Catcher in the Rye'.
-
Thursday 29th June 2017 13:41 GMT Anonymous Coward
Allegedly at the sunny internationale standardisation process which started in 1982, GSM's A5/1 was originally proposed to have a key length of 128 bits. (it would have remained 'safe' for ~32 years!),
wikipedia says that the British insisted on weaker encryption, . . .the British delegate [said] that this was to allow the Brits geheimpolizei to eavesdrop more easily.
The British proposed a key length of 48 bits, while the (West) Germans wanted stronger encryption to protect against (East) German spying, so the compromise became a key length of 54 bits (A5/1 had 10 of the key bits fixed at zero, resulting in an effective key length of 54 bits)
It's an old story, as you say, as even Mary QoS's encrypted barrels were subject to MITM, with likely agent-provocation and fake-news compromat combined
-
-
Thursday 29th June 2017 07:21 GMT EricM
Carefully crafted lack of knowledge or just cowards?
Once information is end-to-end encrypted, no amount of political wishful thinking can unencrypt it without compromised endpoints. The only way for the "5 eyes" (and everyone else) to keep spying on everyone else unhindered will be to force insecure encryption systems for everyone. This will enable the "5 eyes" (and everyone else) to read every communication.
So this will also enable crooks to read your banking passwords, your sensitive company information and your medical data.
So dear "5 eyes", maybe you should stand up and tell the world you want to ban working encryption, so we can start discussing the _real_ pro's and con's.
But please stop suggesting "solutions" from fairy-tale-land, just because you do not dare to name the full consequences of said "solutions" for society.
-
Thursday 29th June 2017 13:15 GMT cbars
Re: Carefully crafted lack of knowledge or just cowards?
I hate all this stuff as much as you guys - but really they will end doing it and it will be this:
SSL between me and WhatsApp server
SSL between WhatsApp server and you
web service from WhatsApp server to 5 eyes - probably through a VPN
Now there are 3 points of attack instead of 2, but in the example of online banking - this isn't really all that different to what we have now. Thing is, I just think lists are a bad thing and this doesn't stop me having a conversation outside, so it's completely pointless. I'm also sure it'll end up being more expensive for consumers and the government will tax something to pay for it.
No need, but yes it will happen
-
-
Thursday 29th June 2017 07:34 GMT John H Woods
Arms race ...
Although the codebreakers have been snapping at the heels of the codemakers ever since the end of the Second World War, I'm guessing they will remain a little behind right up to an eventual limit where all non quantum cryptography can be broken instantly, and quantum cryptography never.
Even then, I suspect there'll be absolutely no way of detecting, let alone comprehending, a signal formed by including, in set of innocuous looking Facebook photos of the account holder's dogs and cats, say three pictures in succession of only the dog.
And all this effort for what ... to counter a threat that takes less lives than bathtubs, let alone traffic.
Biting the hand that feeds IT
