UK Home Sec: Give us a snoop-around for WhatApp encryption. Don't worry, we won't go into the cloud The UK government is once again suggesting encryption has no place in citizens' hands, in the wake of revelations that Westminster attacker Khalid Masood was using WhatsApp shortly before murdering pedestrians with his car, and stabbing a police officer to death. While she stopped short of threatening a Brazilian-style …
Do you remember Snowdon? Perhaps that was too long ago: do you remember the CIA leaks that are currently being dribbled out?
Here's the thing: information leaks from law enforcement agencies. And when this super-secret key leaks, which it will, *every bit of communication it protected is now plain text*.
Seriously, you need to think a bit harder about this, because you are looking silly here.
"I'll restate my point for clarity. Encrypted communication between two devices could be "backdoored" for law-enforcement without making it easier for a third-party who snoops on the traffic to decrypt."
You can state "Two plus two make five." as frequently and clearly as you like, but that does not affect the fact that two plus two makes four.
You are proposing a system with a master backdoor key that can be deliberately stolen or accidentally leaked. A system with a master backdoor key that can be deliberately stolen or accidentally leaked is less secure than a system without a master backdoor key that can be deliberately stolen or accidentally leaked. QED.
Nonsense. This suggestion introduces a gaping hole in security -- all a hacker needs to do is get into the system where the private key is stored (or suborn one of the bureaucratic drones in charge of it) and he has unlimited access to everything.
The correct solution is for governments to recognize that they'll have to adapt to the new environment and use techniques that aren't affected by end-to-end encryption (hack into suspects' phones and computers to access traffic outside the encryption envelope, plant shoulder-surf spycams to snoop suspects' passwords, good old-fashioned shoe-leather investigation, etc). The government desk jockeys don't like this idea because it means 1)doing actual work instead of just pushing a few buttons and 2)because it involves actual work, they're limited to monitoring actual suspicious characters instead of snooping on everybody. Too bad.
Vast numbers of comments on this thread presume that just because a desirable public key is in existence, it will leak. If this were the case the banking system would have crumbled years ago and your digital passports would all have long been cloned, yet mysteriously this isn't the case. "All a hacker needs to do is get into the system" comes from an absurdly simplified view that everything is stored online, no doubt on a Windows 95 box protected with "password" like you see on the telly. That's just not how it works, and (@MMalik et al) if you'd bothered to read my post you would see it's not what I described.
Properly designed, properly implemented secure systems can and do exist, and the fact we're in the era of both the "Internet of Shit" and some very high profile recent data breaches doesn't negate that. Both Manning and Snowden walked away with data because it was available to download, and because they were trusted to do so; that was the problem. You need to first get that shit offline, and then start with a complete lack of trust between all parties to do this properly. If nothing else I think we can agree we have that already.
Enough with the "what about the l33t hackerz" replies please. This isn't slashdot.
... our totalitarian rulers propose to ban, circumvent or backdoor open source communication tools like Bitmessage and ChatSecure?
The problem with such Draconian measures is, as with DRM, that they just inconvenience the law-abiding masses, while the actual criminals/terrorists carry on regardless.
This post has been deleted by its author
Amber Rudd: Cheltenham Ladies' College, followed by History at Edinburgh.
Andrew Marr: Loretto School (an independent school in Musselburgh, East Lothian), followed by English at Cambridge.
And you're surprised that an interview between those two involved no coherent questioning and a total lack of understanding of encryption, secure messaging, and related subjects?
I think they have generic statements ready to be updated and used within minutes. Like news outlets have obituaries etc for A-celebrities etc ready (it always used to be the first job a new intern had to do, update those to keep them current). Or very much something like this.
"It was written far in advance, and saved until an appropriate crisis occurred."
Entirely correct.
Once again I can't recommend highly enough that you read Naomi Klein's The Shock Doctrine. If you get to the end without your blood boiling, you haven't read it properly.
Major General Jonathan Shaw said decrypting social media messages would see terrorists use other secure methods to communicate
So, if he used sms or a call before the act (like for example the Paris attackers) we would have banned SMS?
Did they have a IQ 80 selection bar on this government or something?
Also, even if the message was not encrypted - who cares. What would have been interesting would have been his communications if he was under instructions. That is clear - he was not.
If he was under instruction from IS, Al Qaeda or another similar outfit, he would have chosen a different car. Modern consumer cars even if they look big and "brutal" have significant pedestrian protection as well several other features designed to minimize damage in an accident. It is extremely difficult to kill multiple persons with most of them "on purpose" (the results of the accident show that quite clearly too).
So the fact that we cannot decrypt that ONE message which she is using a reason for pulling the speech her predecessor long prepared in the drawer for her is irrelevant. The maimed would have still been maimed. The dead would have still be dead regardless of us knowing the content.
"He would indeed. Of the type spelled "lorry"."
Simple solution for a government minister then - ban all cars and lorries. Even horses and carts can do real damage - so let's make it only pedal bicycles, rickshaws, and possibly put-puts are allowed to be used by the public.
A useful by-product will be the saving of many of the 1,732 lives lost to Great Britain road accidents in 2015. Not to mention the 186,209 casualties of all severities.
"They could probably persuade trump to throw in the Clipper chip with the trade deal they're cooking up. It'll be a good fit."
So how do I load the driver for this Clipper chip thing into say OpenVPN? What happens if I don't?
Times have moved on since Mr Clinton was running the show across the pond. Nowadays I look sideways at things like iDRAC and iLO. No need to fear the Clipper - those beasts are far more scary.
“there should be no place for terrorists to hide”
Which, unfortunately, also means there can be no place for passwords to hide during logins, no place for banking or health data to hide in transit, etc.
Apparently the UK and US government position is that the sheeple have to accept the 100% chance of being cyber crime victims in trade for protection from the .0001% chance of being affected by a terrorist attack.
This will be forced on us under the cover of protection from terrorists and paedophiles. Anyone resisting will be labelled a sympathiser. But the biggest problem is that most people won't care..... Anonymous Coward
Howdy, AC,
Governments' bigger and rapidly expanding problem is that more than just a smarter few do care and would have both the inclination and the wherewithal to expose and deride the terrorist/paedophile justifications for such draconian self-preservationisms as all wannabe absolute emperor and glorious leader types profess and express to be vital for the greater general wellbeing, when it really revolves around everything staying very much the same in order to preserve the advantages and riches gained by that and those they take their orders from.
It aint rocket science to see and understand the smoke and mirrors desperately employed by such oxymorons to maintain an elite exclusive executive class of austere day traders releasing debt into systems to confiscate assets and destroy prime novel futures with the creation of ignorant slaves to fiat paper production .... aka Quantitative Easing for all those Ponzis on Steroids.
Please note there are no questions trailed there. Such things as are there mentioned, are as is. And they are as nectar of the gods to radical fundamentalists of every hue and cry, too.
Apparently the UK and US government position is that the sheeple have to accept the 100% chance of being cyber crime victims in trade for protection from the .0001% chance of being affected by a terrorist attack.
I think it's more like we're all suspected criminals and need to be watched. But then if the governments watch us will they have any time left to watch the criminals?
> incidentally, how the actual fuck do we know matey boy used WhatsApp before the attack? a copper went nudge nudge wink wink to a tame journo? they've got his phone and WhatsApp installed?
A far more interesting question, that few have asked so far. I asked myself the same question. From what I have gathered, the arrests in Birmingham happened directly because the attacker sent two whats-app messages to contacts at those addresses before he did his deed.
This leads me to think that they probably had the "metadata" (i.e. they were doing real time scanning of the whatsapp network to see who is messaging who), but are unable to decipher the messages themselves.
So now they want to decrypt the messages to find out if the people they arrested were in on the attack, or just unfortunate people who he texted last (maybe to say good bye or something).
Unless they knew in advance an attack was going to happen, I can only assume they are constantly monitoring who is talking to who on whatsapp, and (for the moment at least) it seems they can't actually read the message contents. Facebook can provide them with access to the network, but the enctyption is still client side "end-to-end".
Perhaps a future version of whatsapp will be crippled by fb, not unlike how MS crippled Skype after they purchased it.
Upvote for the thinking, but I don't think constant monitoring is implied. The information more likely came from his phone network's and ISP's logs of his activity (which they'll have demanded and the companies won't have made any serious efforts to oppose), and anywhere that may have led.
