"after official support ends"
How would one differentiate this from normal function?
42030 publicly visible posts • joined 16 Jun 2014
"their lawyers can interpret the law"
Their lawyers can argue how they want the law interpreted. It will be the courts and no-one else who actually decide how it should be interpreted and they'll listen to arguments and expert witness from both sides, maybe also from amicus curiae briefs.
It's high time the RFCs for email were updated to make end-to-end encryption the default rather than an add-on, together with adding the required public key infrastructure into the mechanism (add the information as to location of the key store to the domain data and extend the mail sending protocol to request the key). Key store* would mostly become a part of the MSPs' offering.
PGP (I'm assuming this would be the mechanism) would become part of the mail client. Plebmail would scarcely see any difference as Microsoft and Google would provide all that anyway and the user will continue see plain text via MAPI but everyone else will get secure mail. It would get over the problem that virtually nobody uses encrypted email because they don't know anyone who uses it because virtually nobody uses it..
Correction - it's not high time for that now. It was high time for it years ago. It should have been the norm for years so the governments trying to pull this now would have to explain to the world why they're trying to unilaterally wanting to reduce confidential business communication to the equivalent of being written on the back of a post-card.
*Yes, I know. There's also have to be a mechanism for getting the key into the store.
"Clearly, none of them were listening."
I'm sure some of them were. Unfortunately the various agencies who just want their jobs made easier - and preferably done for them by somebody else - have a lot more influence on the relative ministers than backbench MPs. Home Secs are notoriously well house trained very quickly, apart from the few who start that way.
New - and old - laws have to deal with situations, including technologies, that have not even been thought of when they're drawn up. Fitting them to current reality is the job of the courts. Normally this works and has done from the time of Henry II or earlier. The trick is to draw them up without inherent nonsense. In this particular instance the courts are going to have a bit of a problem.
An inbox is not the place to store read mail. A well-run paper-based system will have a filing system to handle old documents. What doesn't fit the filing criteria won't get filed. Problem solved.
Having said that and worked in an organisation with a filing system like that it was important to keep lab notes, instrument charts and any case document received from outside because it might become important a few years down the line. That would have applied even if the information was incorrect; in fact it might have been even more important to have preserved a copy if it was incorrect. Cases can have a long life so the case files have to as well. The best way of dealing with that sort of storage problem back in those days was microfilm.
Nevertheless there seems to be a difference in the way any good programmer asks themselves that question and the way Microsoft do.
Good programmers ask it to probe for likely problems and deal with them in advance. For Microsoft it seems to be a form of self-assurance inviting the answer "Nothing". Of course for the rest of us nowadays, when asked in the context of a Microsoft product, it's asked ironically.
I never found FORTRAN a difficult language to learn, nor did the instructors in QUB. It had been decided that all the lab staff (included me as research assistant but not SWMBO as a research student) would go on a 1 week (i.e. 5 days) course in this mysterious computing stuff.
Compulsory courses did not go down well with me and that may have been how the timing of the previous week's field trip to Scotland for SWMBO somehow ended up with missing the Monday of the course. I never found out what they did on that day because all the programming was fitted in on the Tuesday to Friday and I had no sense of having missed anything. And it was easy.
Having said it was easy we were using coding sheets and punched cards with professional keypunch operators to join the two together. It wasn't something that would have been quite so easy dealing with the rigid line formatting at a terminal although I did, much later, use Microsoft's CP/M version. It also helped that FORTRAN was at its best with what I wanted to do with it - doing some calculations and producing nicely laid out tables of results to plot by hand. Nevertheless, a four day course surely makes it an easy language to learn.
" I assume you use a different long, random password on every site and also different username...."
By and large, yes.
Of course the sites that want an email address as a UID are a bit of a problem. If they're important (i.e. my money's at stake), they get an individual email address - one reason to have a personal domain. Sites which want an email address just for marketing purposes to be annoying (hi, there, booking.com) get an individual email address which will be blocked between my usage or one that's discarded immediately as appropriate.
Sites which issue their own UIDs can be a bit of a problem too in that sometimes they follow a predictable pattern.
It's a curation problem but one largely due to individual services' predilection for annoyance. I can't imagine passkeys being different in that regard. Essentially the combination of UID and password is just a long string of characters as is a passkey with only the protocol differentiating them.
It's the practicality that matters. As things stand I keep passwords on a laptop with a master-password protected password manager. The laptop login is also password protected, of course. Those two passwords are all I need to remember. The laptop is synced to a NextCloud instance.
I only access whatever the passwords protect from my laptop so if I don't have the laptop available I don't need them anyway and the laptop is a big chunk to carry around so I don't accidentally not have it with me.
If what's being proposed is to replace the password manager by a passkey manager on the same laptop then I have to ask what's the difference (I'll come to that in a moment). Or is the passkey to replace the password that's currently protecting the laptop login? If the latter then it means I have to have the laptop and something else to hand. Given that it's already the case that I need the laptop plus a charged, switched on and in-signal mobile to do some things I know from personal experience that that's all too often a complete fail.
But if you're telling me it's "just" replacing my passwords by something with a more secure protocol and that my everyday usage is unchanged then I'm still going to have to take a look at how that protocol's being implemented. I have one end of that in the form of S/W in my laptop and each remote service will have its own implementation. Oh. Just. Great. We all know what happens next, don't we? Some scrote working for either my laptop OS provider or for the S/W used by one or more service is going to spot an opportunity for an improvement, optimisation or tweak (icon: looking for idle hands) and the whole thing gets screwed on a regular basis - shall we say every other Patch Tuesday?
Data is being collected for long enough to be processed. As a general member of the public entering the place I'd have wanted to know what was being done during that time and in particular, could it put be in the way of some sort of harm or disadvantage? What if it made a false identification of me? What would then happen?
If they tried to answer "nothing" I, and, presumably the court, wouldn't believe them because in that case there'd be not point in having the kit installed.