Vast majority of criminals are actually stupid though. For every criminal using quantum guaranteed encryption there will be 10 just doing normal unencrypted calls over regular GSM - you use the same tactics against criminals that have been used forever, before IMs were even invented - you infiltrate these groups, arrest lower members, get them to incriminate the people higher up until you dismantle the entire structure. Yeah I know it sounds simple and in reality there are million other steps to do this - but it has been done in the past and is still being done now. That's what the police will do. They caught criminals before they could read their messages, they will catch them again when they can't read their messages.
What makes you believe they don't / didn't already? That's the thing, if it's done right you'll never know until it's found out and decrypted like what is in this article.
If the marketing is to be believed we are months away from having AI assist someone with no dev, technology, devops background just asking for an app like this.
I mean, nobody really believes that, this is just what you have to say if you have a stake in an AI company. Or you don’t know what you’re talking about.
When you have tens of thousands of criminals using a single app, the reward of cracking that in some way is gigantic, and these apps are created by a team of a few people which can't cover every angle like Apple can.
> The Serbian criminals shared photos of their victims on Sky without realizing police had installed a probe on the Sky ECC servers in France, which allowed authorities to intercept and read every user’s messages.
I'm surprised criminals keep picking these niche messaging services, which keep turning out not to use proper end to end encryption, rather than Signal.
I guess you didn't really read the article so I'll put it here :
> They intercepted one billion messages, but they couldn't read them at first because they were encrypted. It wasn’t until late 2020 that they managed to decrypt them.
The article is extremely vague on how they did this. The one big red flag though is that the protocol for the messenger in the article was a bespoke secret design by a single person who wasn't a cryptographer and not a well vetted public one.
I would love to see a technical analysis of the supposed end-to-end encryption methodology used here.
I believe I once read that back in the day, Al-Qaeda decided that AES and the like was probably compromised because it was made by the infidels, and launched their own "Islamic secure messenger" with an encryption algorithm their people had designed themselves.
This is not only terrible from a "let's get the list of all accounts who downloaded this app and perhaps track their phones" perspective, but also the encryption turned out to be exactly as good as you might have guessed.
Just a fun aside: Islam is responsible for the foundations of algebra and the al in algorithm is of the same Arabic root.
I'm not an Imam but I feel like if someone wanted to justify using a Western created algorithm they could just say "well technically this is just built on our initial work"
> The origins of algebra can be traced to the ancient Babylonians,[6] who developed a positional number system that greatly aided them in solving their rhetorical algebraic equations. The Babylonians were not interested in exact solutions, but rather approximations, and so they would commonly use linear interpolation to approximate intermediate values.[7] One of the most famous tablets is the Plimpton 322 tablet, created around 1900–1600 BC, which gives a table of Pythagorean triples and represents some of the most advanced mathematics prior to Greek mathematics.[8]
Algebra as we know it today has its roots in the Islamic world. They took prior works and formalized them into a discipline.
From the History of Algebra Wikipedia link:
> "Al-Khwarizmi's text can be seen to be distinct not only from the Babylonian tablets, but also from Diophantus' Arithmetica. It no longer concerns a series of problems to be resolved, but an exposition which starts with primitive terms in which the combinations must give all possible prototypes for equations, which henceforward explicitly constitute the true object of study. On the other hand, the idea of an equation for its own sake appears from the beginning and, one could say, in a generic manner, insofar as it does not simply emerge in the course of solving a problem, but is specifically called on to define an infinite class of problems."
No. The algebra of Al-Khwarizmi is almost certainly a pale reflection of Indian mathematics, probably stuff invented by people like Bhāskara II and Brahmagupta. Then there's Diophantus.
The funniest thing I read this week was the results of a poll asking "reds" whether schools in the US should teach Arabic numbers.
Islam is, in fact, responsible for the first known treatise on cryptanalysis of simple substitution ciphers. One technique is assuming a letter begins "In the name of Allah" and working out letter values from there; another technique is counting letters, noting that alif and lam are the most frequent ones.
i think these are the criminals that dont know the concept of local encyption vs encryption services, multiple serial encryptions, subjective "in" euphemisms, or other obfusication of clear payload
How any group of one thousand people could be truly safe? Of course they would get infiltrated. Groups who want to survive being hunted kinda have to either be smaller, or divide themselves into cells.
> “Privacy is really, really important and we all have the right to our privacy,” said Catherine De Bolle, executive director of Europol, the law enforcement agency of the European Union. “But when we see now that encrypted communication is really an enabler for crime, then we have to do something.”
Can she hear herself when she talks? Apparently we don’t have a right to our privacy. Interpol intercepting every message going across a server just because some of the messages might be criminal is explicitly acting in a way that does not imply any right to privacy.
As soon as someone follows "we all have the right to privacy" with "but", a springboard should pop up from under their feet and launch them into space.
Unsurprising the first time I see a CBC article at the top of HN, it's a puff piece about how taking people's privacy is supposedly good for us. Real glad I paid for this article, but it's not like I'm not constantly paying for these clowns to produce slop that I find appalling. They recently spent $2 million to create a bunch of liberal propaganda podcasts that got a few hundred views per episode.
When the entire point of the enterprise (sky in this case) is to enable criminals, wouldn’t the enterprise itself be part of the criminal conspiracy?
I am all for privacy, but I’m also for rule of law. If I could start an encrypted messaging company that marketed exclusively to criminals, then wouldn’t I expect to be charged as abetting the crimes committed as a result of facilitating that communication?
It’s a question of intent. Law isn’t black and white- and law recognizes that tools can be dual use. It’s not perfect but nothing is.
No one is arguing that the company shouldn’t face consequences, people are arguing that their customers who aren’t part of some criminal enterprise shouldn’t have all of their messages intercepted, decrypted and put in a database.
I think that's the unstated part: Encryption doesn't handicap law enforcement if they weren't monitoring the communication anyway.
[Edit: Though in fairness, if they weren't monitoring everything but then decided they had grounds - or even (gasp) a warrant - to monitor a specific set of communications, then encryption handicaps law enforcement.]
I think the inherent contradiction stands. You are right to point it out.
However, there _is_ another side to it: the law enforcement agencies have a harder job now and it needs to be acknowledged as such.
The acknowledgement does not require agreeing to let up on fundamental principles of privacy. But, so that resources could be invested in ways that do not require hoovering up people's personal data en masse.
Criminal communications have always existed, and I don’t buy that a smartphone is a fundamental change from encoded letters, whispers, or any more primitive signaling device. With an electronic surveillance warrant it is easier than ever to compromise communications. If they suspect that a crime is being committed they should use the existing legal framework that exists for exactly this purpose.
"Harder" is a blue extremist lie. The information position of law enforcement has never been this good before. Yet they ask for more - a clear indication for their true motive: Power.
That’s my take. It has never been easier for LE to follow your every move than now. Encryption might make it hard to know the exact content of messages, but location services, trivially cheap gps trackers, metadata harvesting, data companies that will sell anything to the highest bidder, etc… all make it near impossible to lose track of someone and what they are up to
Harder in the sense that never before in human history could any person communicate with any other person on most of the inhabited planet through instant wireless internet. They can do all this with end-to-end encryption, if sufficiently motivated, via apps like Signal.
Most (I would hazard > 99%) people won't use this capability for criminal enterprise.
Some would. Some do.
BTW, This does not mean that we should open illegal backdoors to our end-to-end encryption. Private communication must remain possible and viable and easy for everyone.
It also does not mean that law enforcement should resort to unconstitutional means (at least in the US).
But, this is just a different game than what they are used to. It is okay to acknowledge it and resource them to do without.
Yes. She knows you know she's talking out of both sides of her mouth. She knows you know she knows. She knows you can't do anything about it. But still, she tells you sweet little lies.
What makes this different from a typical attack on encryption is that this company (probably) knowingly distributed to and worked with criminal enterprises.
But this article is written in a way that suggests that encryption is dangerous - an angle that the CBC has taken before - which makes sense considering that it is a government-owned news outlet in a Five Eyes member state.
That's doing a lot of heavy lifting. I'm sure they knew, personally, but since everything is encrypted, even for themselves, they have plausible deniability. If there is no solid proof of e.g. the company selling to someone they knew is a criminal, there's nothing to be done, legally speaking.
And even then, criminals can talk using e.g. commercially available phones and mobile networks; are those networks / manufacturers / anyone but the criminal responsible for what is talked about?
Yes the seller could reasonably assume their stuff was used by criminals, but so can Signal, Whatsapp, Messenger, anyone offering (encrypted) communication. It doesn't make them guilty themselves.
>>If there is no solid proof of e.g. the company selling to someone they knew is a criminal, there's nothing to be done, legally speaking.
If you look at the article it has examples found of the company employees explicitly saying they are meeting with criminals so to play it safe. It doesn't get any more "solid proof" than that.
>>are those networks / manufacturers / anyone but the criminal responsible for what is talked about?
No, but again - read the article. There are examples of their employees saying that a client of theirs was arrested so they proactively wiped their phone - that could be interpreted as knowingly destroying evidence. They did end up changing this policy to not wipe phones of people who have been arrested, precisely because of this concern.
>>Yes the seller could reasonably assume their stuff was used by criminals, but so can Signal, Whatsapp, Messenger, anyone offering (encrypted) communication
The difference is most likely in how it's advertised and sold. Whatsapp is a free app that anyone can use, Facebook can reasonably claim that they don't advertise to criminals or encourage illegal use because the app is free to anyone. The owners of this app made it paid and they actively pursued clients they knew were members of criminal rings. Whether that passes the threshold for holding the company liable - that's for courts to decide. But that's generally where I think the line is. Anyone can make and sell a knife, but start selling knives(knowingly) to gang members and you're going to be in trouble even though selling a knife isn't illegal in itself.
Even if true, this sure feels like a loophole though, like the Saul Goodman's burner phone side business, doesn't it? Should there perhaps be a stricter KYC requirement/similar measures to the same end when it comes to re-/selling technology explicitly designed for encrypted communication? Note that we are not just talking about an end-to-end encrypted messenger app, it's a whole integrated phone with an explicit special purpose. This feels more like a regulation oversight: the encrypted transmissions in AM/FM bands are outright prohibited in most Western jurisdictions after all, and so is possession of the respective equipment.
There are thousands of millions of people who are not criminals, who are not trying to be criminals.. yet somehow the literate audience is led by media such that a small, dedicated bunch of adults half-way around the world is proof positive that all encryption is "for me, not for thee"
> which makes sense considering that it is a government-owned news outlet in a Five Eyes member state
re the mention of FVEY, I strongly suspect it's law enforcement rather than the spooks who have any issue with encryption there. I don't think FVEY SIGINT are having any issue reading the messages they want to read, it's the City of Spokane Police Department, FBI Tampa, and the Manitoba RCMP who are struggling, and would like Apple to give them decryption keys. SIGINT would love you to believe they can't read your messages because of encryption.
> SIGINT would love you to believe they can't read your messages because of encryption.
I think this line of thinking can lead to a sort of defeatist ignorance. For example, can anyone break the default cipher suite of wireguard or gpg? I really don't think so.
> But this article is written in a way that suggests that encryption is dangerous - an angle that the CBC has taken before - which makes sense considering that it is a government-owned news outlet in a Five Eyes member state.
While neither of these points is completely incorrect, that is a heck of a connection to make without evidence.
>“Privacy is really, really important and we all have the right to our privacy,” said Catherine De Bolle, executive director of Europol, the law enforcement agency of the European Union. “But when we see now that encrypted communication is really an enabler for crime, then we have to do something.”
That was a pretty terrifying line to read - the idea that they feel comfortable assuming a great deal of the public will agree with or find this reasonable is pretty worrisome.
The public would probably say that they agree that things that reduce anti-social behavior.
But if you instead phrase it as: “should international law enforcement have a perpetual copy of every single written message you have ever sent in order to reduce anti social behavior?” You will discover that there is a limit to what people will tolerate.
There hopefully is, but it never ceases to amaze me how many, even highly intelligent, reasonable people, buy into the 'I don't do anything illegal, hence I have nothing to hide and off to the races we go' mindset.
Heck, even if I try to point out all the fun side effects - say, how embarrassing it would be if a copy of your, ahem, correspondence with that cute intern was leaked, or simple guilt by association, like finding yourself on a watchlist after buying a car from a suspected Islamic militant or something similar, I am mostly met with a shrug and a variation on the theme 'Oh, they'd never do that / surely if that was to happen, it would be fixed in due course'.
Basically, I more and more feel like the odd man out - as my position that 'Seeing as I am not doing anything criminal, the authorities have no business snooping on me' is seen as the militant one. Won't somebody think of the children, etc.
But this isn't the same, though? People might be more than happy to share information with you, but they're probably not too keen on giving you ownership over it or anything else they might own. There is a bit of a difference between "access to my information" and "control over it", and you're kind of conflating the two
I didn’t say I wanted to take control of anything, or even use the information, I just want to know what the credentials are…
The point is that everyone has information that they would rather not have distributed. To prove the point, you just have to find the right piece of information to ask for. There’s always something that people do, in fact, have to hide.
> I didn’t say I wanted to take control of anything, or even use the information, I just want to know what the credentials are…
But giving you the credentials is giving you control? They're the same thing in this case! The fact that you're asking for them implies that you want to use them, does it not? Otherwise, why would you ask?
> The point is that everyone has information that they would rather not have distributed. To prove the point, you just have to find the right piece of information to ask for. There’s always something that people do, in fact, have to hide.
But they're saying they have nothing to hide because they haven't done anything illegal. The original statement was "I don't do anything illegal, hence I have nothing to hide". They're saying that someone looking through the history of the things they've said and done would find no evidence of wrongdoing.
If you asked for their banking records, that might be an appropriate thing to ask for in the pursuit of evidence of wrongdoing. But asking for the ability to control their finances isn't the same thing. The ability to control their finances has no relevance to any illegal behaviors they may or may not have partaken in. So you're not really finding the "right piece of information to ask for". Instead, you're cleverly moving the goalposts from "information relevant to the search for wrongdoing" to a much broader scope.
I don't think anyone who says "I have nothing to hide" believes that law enforcement should have access to your bank account to spend your money; but they're probably fine with some level of law enforcement having the ability to view their financial records under the right circumstances. Since they've committed no financial crimes, there will be nothing to see.
Of course you'll argue the hypothetical that "everyone has committed some crime" (which is probably true!), but plenty of people commit crimes accidentally and are let go with no punishment (or never even prosecuted) when it became clear that there was no intention of breaking the law. This obviously isn't true in call cases, because lack of criminal intent does not prevent damages, etc. However, the best way to prove that there was no criminal intent is by having more information about that person, to demonstrate that their previous actions are consistent with such a narrative.
> There hopefully is, but it never ceases to amaze me how many, even highly intelligent, reasonable people, buy into the 'I don't do anything illegal, hence I have nothing to hide and off to the races we go' mindset.
I think this is due to a very large difference in mindset. Let's use your "fun side effects" as examples:
> how embarrassing it would be if a copy of your, ahem, correspondence with that cute intern was leaked
Maybe this embarrassment would be deserved? If you're having inappropriate conversations at work, maybe you should get called out on it? I'd argue that being able to hide these kinds of things contributes to a toxic work environment. So a) I wouldn't be having any correspondence with the cute intern, and b) I'd want to know if I'm working at the kind of place where that kind of behavior is acceptable (so I could not work there).
> simple guilt by association, like finding yourself on a watchlist after buying a car from a suspected Islamic militant or something similar
Big deal? If that's my only interaction with that person, no one who has access to that kind of information is going to care. I'll be accurately classified as a spurious contact and promptly ignored. I might be watched for future interactions, but since the interaction truly was a one-off, there will be no future interactions, and none of my other actions will be of interest to those who are watching.
So again... big deal?
> I am mostly met with a shrug and a variation on the theme 'Oh, they'd never do that / surely if that was to happen, it would be fixed in due course'.
If they mean "they" as in "themselves", why would you disbelieve them? They probably would never do any of those things.
> Basically, I more and more feel like the odd man out - as my position that 'Seeing as I am not doing anything criminal, the authorities have no business snooping on me' is seen as the militant one. Won't somebody think of the children, etc.
Because there are increasing numbers of people who share the view "the authorities have no business snooping on me" and who are in fact exactly the people who the authorities should be snooping on. However, none of them would ever admit to that, so they prefix that view with the same thing you did: "seeing as I am not doing anything criminal". Ostensibly the difference between you and them is that they're lying about the first part; but given that others have no way of verifying whether or not you're lying, can you fault them for assuming the worst and lumping you in with the actual criminals?
Because this is literally a thing criminals say, and criminals generally aren't beholden to telling the truth.
To put a finer point on it: the vast majority of criminals in the world are privacy advocates out of necessity. They may or may not be good at exercising privacy, but the easier it is to achieve effective levels of privacy ("effective" meaning "keeping their activities hidden from the relevant authorities/groups"), the more of them become good at it by default. It is becoming easier and easier to achieve effective levels of privacy (especially online), which means the privacy advocates are actually winning. As a consequence, so too are the criminals. You, as a non-criminal, non-antisocial privacy advocate might not want criminals to be your allies in this, but they are out of unavoidable necessity. (feel free to s/criminals/antisocial individuals/g, if you want to consider the point even more generally)
OK, poor choice on my part. Let's say that your correspondence with the neighbour's wife, or for that matter your love E-mails to $CONSENTING_ADULT_OF_SAME_SEX got aired. Point is, there's all sorts of communication we desire to keep private - some of it because parts of society frowns upon its contents (infidelity, above), some because it is illegal or otherwise puts you at risk (same sex relations), or some just because you would feel embarrassed if it was made public, and it's nobody else's damn business anyway.
As for the watchlist part, yes, it is hyperbole - but the assumption that your contact would be readily dismissed as random relies on the authorities collecting said information being competent. I think it is naïve to assume that such info will never be misinterpreted and that it will never be retained just in case it proves useful later on. The 'they' I referred to were the authorities collecting and analysing the information, by the way.
And yes, I fault the powers that be for assuming criminal intent in all of the citizenry.
> OK, poor choice on my part. Let's say that your correspondence with the neighbour's wife, or for that matter your love E-mails to $CONSENTING_ADULT_OF_SAME_SEX got aired. Point is, there's all sorts of communication we desire to keep private - some of it because parts of society frowns upon its contents (infidelity, above), some because it is illegal or otherwise puts you at risk (same sex relations), or some just because you would feel embarrassed if it was made public, and it's nobody else's damn business anyway.
I may be biased in the particulars, but I think it's good that society frowns upon certain behaviors. So if you're cheating on your spouse, I would rather they find out than be kept in the dark. If you're secretly embezzling money from the city government, I think the public has a right to find out about that sort of thing. Better still if there's enough transparency that you can't get away with it in the first place. You say "it's nobody else's damn business anyway", but in the example of infidelity, it isn't exactly a victimless thing. If everyone's informed and consenting, it's not really "infidelity" anymore, and not really a problem if you want to keep your swinging a secret from your family.
Your examples so far have mostly been cases where the behavior is inappropriate in some way:
- Infidelity: the ignorant spouse is a victim, so this isn't a victimless behavior
- Flirting with the intern at work: probably against the workplace policies you and they agreed to when you took the job.
- Giving money to an Islamic militant: If you were actually ignorant, this is generally appropriate behavior and anyone who looks at your history will probably agree. However, if you knew they were a militant and gave them money anyway, this is probably not appropriate behavior and your history would show that
I guess it's not very convincing to argue that people doing inappropriate things should be allowed to get away with it? It seems like in each of these contexts, privacy is only in service of hiding bad behavior? It's somewhat worrisome that these kinds of examples are also the examples most predominantly offered by privacy advocates. You're not the only one who gives examples like these, and the shared themes have concerning implications. Examples like these definitely do not work in favor of arguing for more privacy, because people will pick up on this throughline and start to associate "people hiding things they shouldn't be doing" with "privacy advocacy".
The only example you've given so far that seems convincing is the "love emails to consenting adult of same sex", which case I'd argue that it being embarrassing is probably more a problem of assholes in society than anything else. Someone giving you shit for that (and anyone who cares to listen to their shit-slinging) is probably saying more about their own antisocial tendencies than anything else. This is also a victimless thing, so I'm more amenable to just agreeing that folks should have privacy in this case... they're not doing anything wrong, after all.
However, the other solution to that particular issue is to make society more tolerant of people with differing harmless beliefs. I'm generally in favor of solutions that improve society overall and seem to have fewer downsides, rather than the solutions that prioritize empowering individuals in antisocial ways. To use an extreme example to illustrate the point: I don't think anyone is in favor of allowing folks to freely kill each other. Having the freedom to take someone else's life is in some ways the ultimate expression of an individual's freedom, but I think almost everyone would agree that the downsides heavily outweigh the upsides of that particular freedom.
I mean that it is worrisome that the public would agree with this, or at least that public sentiment is shifting in that direction enough that this statement doesn't cause visceral outlash against anyone that would say it.
As encryption and other privacy technologies become more widespread, so too have those who take advantage of them for the sake of enabling their anti-social behaviors. It also allows people with anti-social behaviors to coordinate in ways that are increasingly hidden from the groups they are working against.
So yeah, people are going to have an increasingly negative response to something they generally used to have neutral-to-positive responses to.
No one should be surprised that this is the case, least of the very people advocating for more (and more widely available) privacy tools! Ubiquitous privacy leads to ubiquitous distrust. After all, how do people know someone is trustworthy? By being able to see their actions, and see how they compare to their stated intentions. A mismatch between stated intentions and actions is evidence that a person is not trustworthy; the more of their actions they can hide from others, the more duplicitous they can be without being discovered.
Put differently, and more personally: In my face-to-face interactions, I may have never met a person before, but I can still "vibe check" them based on the wealth of side channels available to my senses and intuition. It's subject to my own personal biases and things, but I have come to trust my intuitions. Online, I have next to none of those same contextual clues, so my default is to just not trust anyone. If I choose to do something online that requires trust, I appreciate the fact that people have online histories; and if someone has chosen to scrub theirs, this isn't so much of a red flag as it is a reason to not diverge from the status quo. So when I imagine the world that privacy advocates want, where you know nothing about anyone that isn't voluntarily disclosed, I see a vary dark, mistrustful place where effective social cooperation has been utterly neutered. Even when people are willing to share information that "validates" their trustworthiness, the fact that _all_ information about them would be voluntarily disclosed convinces me that it would be so curated as to be useless for the task. This is made even worse if you imagine the deniable authentication folks get their way.
I also personally believe that the effective anonymity of the internet is in large part behind the decay of trust in general, for many of the same reasons. We no longer trust each other because we know so little about each other; and what we do know we trust less and less, because it's becoming increasingly easier to hide or curate that information. Online privacy advocates have already largely gotten their wish: it's not terribly difficult to be anonymous online, and I think our online discourse has been decimated as a result. Obviously not only due to accessible anonymity, but it's certainly a substantial factor.
I'm pretty sure the vast majority of my interactions online these days are with people I've never seen before and will never see again. And the people I do recognize are generally the people I'm least inclined to want to interact with (i.e. basically any Twitter personality). It's all pretty fucked up, if you ask me
Your belief that no one has the right to privacy because you feel personally feel uncomfortable interacting with people you don't know is not a very convincing argument for the explicit support of a core tenet of fascism.
I could not begin to fathom what lead you to have this level of trust issue, even with unimportant conversation between complete strangers, but every anecdote you have described is a deeply personal issue of your own, not a justification for any change in society.
> Your belief that no one has the right to privacy because you feel personally feel uncomfortable interacting with people you don't know is not a very convincing argument for the explicit support of a core tenet of fascism.
Wow, way to completely lose the plot. You didn't respond to a single thing I said, and what you're claiming I'm saying wasn't what I said at all. Like, where did I say no one had a right to privacy? I didn't. What I said was if everyone utilized privacy the way you and others in this thread are advocating for, the world would be even more distrustful than it is today, that I think the downsides of increasingly ubiquitous privacy vastly outweigh the upsides. I also think that the majority of the world agrees more with me than you, given the lack of the visceral reaction you seemed to expect from TFA. That lack of reaction would at least indicate they don't agree with you, even if they don't agree with me, either.
Like, it's perfectly fine if you want to share nothing with the world rest of the world. I'll just consider you to be a wildly selfish individual (because your position amounts to "fuck you I got mine"), and probably not interact with you unless I can avoid it. But please, consider the consequences of your philosophy, both good and bad! I feel like you're trying to avoid addressing the downsides with this deflection. After all, you'd apparently rather call me a fascist and put words in my mouth than even bring attention to these downsides.
You kind of missed the mark with this response entirely. Maybe it's the halo effect (or whatever the inverse is), but when you and others who share your beliefs respond like this, you're really not making me trust you all that much, which means I also will think even less of your beliefs.
Maybe reflect on that, too? If you want to advocate for privacy, you'd do a lot more good if you actually came across as an attractive individual.
> I could not begin to fathom what lead you to have this level of trust issue, even with unimportant conversation between complete strangers, but every anecdote you have described is a deeply personal issue of your own, not a justification for any change in society.
Cool, way to discount my entire lived experience entirely out of hand. You could, you know, try some empathy, and consider that I'm likely just as intelligent and learned as you are (or maybe even more so? Again, with internet anonymity the way it is, who can tell?)
"Freedom of movement, freedom of speech, freedom to assemble, freedom of religion, these are really, really important and we all have rights to them..." said a law enforcement director who would soon make clear they didn't believe in rights at all.
"But," they continued rather than stopping at defending rights, "when those rights can be used to enable activity which we deem criminal but hasn't yet been tested in court, we have to take them away."
If you enjoy this story, read the book Dark Wire which focuses on the FBI’s infiltration of Anom, another encrypted message service. It also covers sky briefly. Fascinating story
Pretty ironic that they got caught after going out of their way to buy secure phones and use secure messaging services when an off-the-shelf iPhone and Whatsapp/Signal/Telegram would have made them 100% untraceable.
Probably Signal would have been a safe bet. Telegram doesn't do encryption by default (on group messages? Been a year or two since I've used it). And Facebook complies with law enforcement agencies, and I don't think it's unreasonable for them to have a feature flags to selectively and transparently disable encryption for some participants if need be.
Facebook certainly likes to at least have sense to know what you are conversating about. Sometime in 2016 we and my buddy abroad got our accounts frozen "due to security reasons" at exact same time; what we were doing is having fun with FB Messenger and sending each other PGP-encrypted messages. This least about 2 months and my buddy is Egyptian, so I am pretty sure at some point FB said "we don't know what they chat about and enough is enough". I got my account recovered after multiple layers of verification including video-call to hold up my ID done by third-party ... my friend never gotten his reinstated.
Facebook definitely has some kind of chat monitoring and real-time censorship in place. For example, I once couldn't send a message in private chat if it included a link to one of the online weed stores. Remove the link, and it goes through just fine. Put the link there, and the thing just hangs and errors out with no coherent explanation.
One of the features the phones had was that they could be remotely deleted and were locked down to prevent other apps on them. So an off the shelf iphone with signal is going to be vulnerable to having the device itself hacked via text message, bluetooth, or something else in a way the Sky ECC phones theoretically can't be, so it's not necessarily a slam dunk.
A cheap netbook from a no-name Chinese OEM, running weird software you've never heard of named 'TAILS' which doesn't auto-update or anything, and which the makers say is very secure.
A cheap phone from a no-name Chinese OEM, running weird software you've never heard of named 'Sky ECC' which doesn't auto-update or anything, and which the makers say is very secure.
You've got to be fairly knowledgeable to appraise the two options correctly.
I suppose the hope is that if relatively good people, maybe bad actors but with certain limits, if they get exposed to or inadvertently the "opportunity" to be involved in higher orders of magnitude of bad - that they may then act as a light that helps create cracks in the armour to expose such horrific behaviour?
> In 2011, Eap started developing an encrypted messaging system with the help of his father, who holds a master’s degree in computer science from Simon Fraser University in Burnaby, B.C. The app was initially designed for BlackBerry phones and later made available for iPhones.
> His father designed the data encryption algorithm.
> “My dad's a genius,” said Eap. “It had the highest level of encryption available.”
It's hard to imagine that this level of ignorance wasn't intentional from the beginning.
For this one however this seems to be the case? The wording of the article isn't crystal clear, but it looks like the cops took control of the servers, and decrypted messages from there. So either the messages weren't truly end-to-end encrypted, or the encryption truly was broken.
"My dad's a genius" because you're not supposed to rely on genius to make a good crypto system, and also because it makes Eap sounds like he has absolutely zero knowledge on the subject.
"highest level of encryption available" because there's a fairly low floor above which it's all uncrackable anyway (ChaCha20 + BLAKE2B authenticated encryption, and Curve448 + post quantum winners for the public stuff, should go beyond total overkill).
I don't believe it was intentional though. I'm just out of a quick job implementing SSCPv2 (encryption over RS485 to secure communication between card readers and central computer, typically used to secure buildings). Good specs, fairly good separation between cryptography and business logic, and as far as I could tell the crypto isn't broken… but it is quite old school: AES CBC + HMAC SHA256, using MAC then encrypt. https://moxie.org/2011/12/13/the-cryptographic-doom-principl... And while I think my implementation is okay, I did have to pay special attention to specific traps raising from this design, and to be honest wouldn't bet my life on having ironed out all possible timing attacks.
SSCPv2 was almost certainly designed after 2020, but it took books from 2005. Good books for their time, but a bit dated unfortunately. I'm pretty sure no actual cryptographer was involved. If there were, they would almost certainly have used standard authenticated encryption scheme like AES CGM, or ChaPoly (RFC 8439), they would have authenticated the unencrypted header, and provided an even better separation between crypto and business logic.
> Not only did Sky ECC provide end-to-end encryption, like Whatsapp or Signal, but unlike those free apps, it also redirected the data on its own secure network.
So how the messages were intercepted if e2e encryption is used?
The exact approach used to break the encryption of Sky ECC phones is not fully detailed in the sources I found. However, there are some insights into the methods used:
1. One source mentions that law enforcement agencies used cloned devices running a fake phishing application designed to impersonate the Sky ECC app https://www.bleepingcomputer.com/news/security/europol-unloc.... This allowed them to intercept messages as they were being sent and received.
These methods suggest that the encryption itself wasn't directly broken, but rather the security of the devices and the integrity of the app were compromised.
I’ve seen it before—a SaaS claiming to offer end-to-end encryption simply because it uses HTTPS/SSL for communication between the client and server. It’s laughable, but the lack of clear regulations or standards defining E2E encryption lets them get away with treating the client and server as the “ends.”
Not sure if that’s what happened here but it wouldn’t surprise me.
I have thoughts and feelings about a lot of this, but the part that stands out to me is LE folks intentionally working with agents out of their jurisdiction to circumvent the laws in their own jurisdiction.
You want to talk about unethical behaviour? That sounds borderline like a poison tree to me.
The only practical check acting against the whims of these agencies is that if they do things that are too horrible the resulting public perception will be bad for the career advancement prospects of the top ranks who want to move into politics where optics matters.
"His father designed the data encryption algorithm.
“My dad's a genius,” said Eap. “It had the highest level of encryption available.”
Not only did Sky ECC provide end-to-end encryption, like Whatsapp or Signal, but unlike those free apps, it also redirected the data on its own secure network.
"
This was the basis for users to think the system was secure? Seriously!?!
I'm reminded of the saying 'don't roll your own crypto'. Obviously the authorities were able to crack the crypto, probably at multiple points.
> This was the basis for users to think the system was secure? Seriously!?!
Charisma and similar flavours of "trust me bro" works more than reasonable people would anticipate. See every pseudo science and conspiracy theory ever. Cryptography is no exception.
The key aspect here is that both Sky ECC and Encrochat got F. over by the modern day equivalent of Crypto AG which is the french hosting provider OVH.
While intelligence agencies were pumping in real-time all the data from Encrochat's and Sky ECC;s dedicated OVH servers, the OVH co-founder Octave Klaba and their ex-CEO Michel Paulin were selling the company with statements like:
- We don't dig in our customer's data unlike the the "others".
- US secret services have no access to our data.
However there are many interesting anecdotes:
1) For many years OVH was hiding a "maintenance" backdoor in "/etc/ssh/authorized_keys2", authorized_keys2 was used for ssh protocol 2 which was depreciated in 2001 yet OVH was using it to store a maintenance key until around 2018. This was very poorly documented and a user warned of the backdoor on HN back in 2012. https://news.ycombinator.com/item?id=4839414
2) In 2013 the TOR hidden service hosting provider "Freedom hosting" was taken down, "they" had rented 400 servers at OVH and in June 2013 "they" let all but one expire, likely moving to another provider, this is when through an unknown way the FBI obtained the IP address of the only remaining server at OVH. The server was imaged but it contained an encrypted "container".
The FBI claims that they were able to break the encryption within a week using "cryptanalysis" and to recover the "root" password used to encrypt these "containers".
This is total BS, they must just have used the ssh maintenance key or added "something" to the server when they did the imaging.
3) Later that same year Silk Road was taken down. It is undisputed that law enforcement lied about key parts in their investigation.
According to law enforcement Ross Ulbricht was ssh'ing into the Silk Road server using a "VPN server". When they got to the "VPN server" it had been wiped out BUT, the hosting provider had kept "VPN" "logs"??? which led them to the IP address of a cafe where Ross Ulbricht had been.
Ross Ulbricht kept a list with all the servers he was and had been operating. There is no mention of a VPN server, however in the "retired" server section there is a "VNC Desktop" server with the note "SR related".
This appears to be a server running a virtual desktop that Ross Ulbricht was using to connect to the Silk Road.
It was a VPS hosted at ... OVH and rented through an intermediary called momentovps.
But it gets even worse, just bellow he listed another VPS at OVH and it has the remark "Will / personal backup / deadman switch"...
Source: Silk Road Exhibit GX-264
4) The creation story is quite strange. OVH was offering very low prices while not having any funding. The secret was that for years Xavier Niel who is one of Octave Klaba's competitors and has been outed as being a former agent for the french government was hosting the OVH servers in his datacenter for FREE. Obviously if you do not pay for the electricity, internet and rent life is easy. The question is what did Xavier Niel get in return? According to him (Interview on BFMTV) he did it out of generosity. Of course...
Now we pretty much know that Pavel Durov founder of Telegram got his french passport because he agreed to work with the french intelligence agencies but failed to deliver. Guess who was the first person he called when he got arrested, and then the person he met once he was released? Xavier Niel!
You can add What.CD, the de facto Music Library of Alexandria at the time, to this list, along with a number of other private torrent trackers. When What.CD's servers got raided by the French authorities, a number of other trackers that were hosted at OVH also got raided "by accident". The authorities went in with a warrant for one site, but oh so luckily just happened to also stumble on a number of other private trackers hosted by OVH at the time, never mind that they're spread across separate servers in separate racks etc. You can smell the foul play from half a continent away.
What.CD is dead, long live What.CD (and Oink's Pink Palace).
129 comments
[ 0.24 ms ] story [ 160 ms ] threadI'm surprised criminals keep picking these niche messaging services, which keep turning out not to use proper end to end encryption, rather than Signal.
What? No. That is exactly what a Fed (or anyone else) would say to encourage Signal use.
"Presumably you don’t hear about the ones that use signal for a reason…"
The reason being that they don't get caught so you don't hear about them.
https://www.mintpressnews.com/the-open-technology-fund-makes...
Likewise for corporations, on both counts.
Myself I'm not so cynical as to see that everywhere, but I've seen it. Hard to miss when it gets in the news.
Don’t forget our service plan, which you’ll need because only the manufacturer knows how to fix it.
I would love to see a technical analysis of the supposed end-to-end encryption methodology used here.
This is not only terrible from a "let's get the list of all accounts who downloaded this app and perhaps track their phones" perspective, but also the encryption turned out to be exactly as good as you might have guessed.
I'm not an Imam but I feel like if someone wanted to justify using a Western created algorithm they could just say "well technically this is just built on our initial work"
I don't think that's true. Algebra has history that goes way back to Babylonian times, long before Islam.
From https://en.wikipedia.org/wiki/History_of_algebra
> The origins of algebra can be traced to the ancient Babylonians,[6] who developed a positional number system that greatly aided them in solving their rhetorical algebraic equations. The Babylonians were not interested in exact solutions, but rather approximations, and so they would commonly use linear interpolation to approximate intermediate values.[7] One of the most famous tablets is the Plimpton 322 tablet, created around 1900–1600 BC, which gives a table of Pythagorean triples and represents some of the most advanced mathematics prior to Greek mathematics.[8]
Islam is much more recent than that. From https://en.wikipedia.org/wiki/Islam#History
> Muhammad and the beginning of Islam (570–632)
From the History of Algebra Wikipedia link:
> "Al-Khwarizmi's text can be seen to be distinct not only from the Babylonian tablets, but also from Diophantus' Arithmetica. It no longer concerns a series of problems to be resolved, but an exposition which starts with primitive terms in which the combinations must give all possible prototypes for equations, which henceforward explicitly constitute the true object of study. On the other hand, the idea of an equation for its own sake appears from the beginning and, one could say, in a generic manner, insofar as it does not simply emerge in the course of solving a problem, but is specifically called on to define an infinite class of problems."
Islam is, in fact, responsible for the first known treatise on cryptanalysis of simple substitution ciphers. One technique is assuming a letter begins "In the name of Allah" and working out letter values from there; another technique is counting letters, noting that alif and lam are the most frequent ones.
No e2e is going to help you if you invite the cops to your group chat I guess.
I had one detail wrong. They were apparently around 900 people: https://sverigesradio.se/artikel/polisen-infiltrerade-foxtro...
https://sverigesradio.se/artikel/polisen-infiltrerade-foxtro...
Because social engineering is the foundation of hacking. Not technology.
Can she hear herself when she talks? Apparently we don’t have a right to our privacy. Interpol intercepting every message going across a server just because some of the messages might be criminal is explicitly acting in a way that does not imply any right to privacy.
Unsurprising the first time I see a CBC article at the top of HN, it's a puff piece about how taking people's privacy is supposedly good for us. Real glad I paid for this article, but it's not like I'm not constantly paying for these clowns to produce slop that I find appalling. They recently spent $2 million to create a bunch of liberal propaganda podcasts that got a few hundred views per episode.
I hate this country.
I am all for privacy, but I’m also for rule of law. If I could start an encrypted messaging company that marketed exclusively to criminals, then wouldn’t I expect to be charged as abetting the crimes committed as a result of facilitating that communication?
It’s a question of intent. Law isn’t black and white- and law recognizes that tools can be dual use. It’s not perfect but nothing is.
Fixed for her.
[Edit: Though in fairness, if they weren't monitoring everything but then decided they had grounds - or even (gasp) a warrant - to monitor a specific set of communications, then encryption handicaps law enforcement.]
However, there _is_ another side to it: the law enforcement agencies have a harder job now and it needs to be acknowledged as such.
The acknowledgement does not require agreeing to let up on fundamental principles of privacy. But, so that resources could be invested in ways that do not require hoovering up people's personal data en masse.
Criminal communications have always existed, and I don’t buy that a smartphone is a fundamental change from encoded letters, whispers, or any more primitive signaling device. With an electronic surveillance warrant it is easier than ever to compromise communications. If they suspect that a crime is being committed they should use the existing legal framework that exists for exactly this purpose.
Most (I would hazard > 99%) people won't use this capability for criminal enterprise.
Some would. Some do.
BTW, This does not mean that we should open illegal backdoors to our end-to-end encryption. Private communication must remain possible and viable and easy for everyone.
It also does not mean that law enforcement should resort to unconstitutional means (at least in the US).
But, this is just a different game than what they are used to. It is okay to acknowledge it and resource them to do without.
Yes. She knows you know she's talking out of both sides of her mouth. She knows you know she knows. She knows you can't do anything about it. But still, she tells you sweet little lies.
https://youtu.be/uFyk5UOyNqI?si=i-GtpeCR1QEj69cz
But this article is written in a way that suggests that encryption is dangerous - an angle that the CBC has taken before - which makes sense considering that it is a government-owned news outlet in a Five Eyes member state.
That's doing a lot of heavy lifting. I'm sure they knew, personally, but since everything is encrypted, even for themselves, they have plausible deniability. If there is no solid proof of e.g. the company selling to someone they knew is a criminal, there's nothing to be done, legally speaking.
And even then, criminals can talk using e.g. commercially available phones and mobile networks; are those networks / manufacturers / anyone but the criminal responsible for what is talked about?
Yes the seller could reasonably assume their stuff was used by criminals, but so can Signal, Whatsapp, Messenger, anyone offering (encrypted) communication. It doesn't make them guilty themselves.
If you look at the article it has examples found of the company employees explicitly saying they are meeting with criminals so to play it safe. It doesn't get any more "solid proof" than that.
>>are those networks / manufacturers / anyone but the criminal responsible for what is talked about?
No, but again - read the article. There are examples of their employees saying that a client of theirs was arrested so they proactively wiped their phone - that could be interpreted as knowingly destroying evidence. They did end up changing this policy to not wipe phones of people who have been arrested, precisely because of this concern.
>>Yes the seller could reasonably assume their stuff was used by criminals, but so can Signal, Whatsapp, Messenger, anyone offering (encrypted) communication
The difference is most likely in how it's advertised and sold. Whatsapp is a free app that anyone can use, Facebook can reasonably claim that they don't advertise to criminals or encourage illegal use because the app is free to anyone. The owners of this app made it paid and they actively pursued clients they knew were members of criminal rings. Whether that passes the threshold for holding the company liable - that's for courts to decide. But that's generally where I think the line is. Anyone can make and sell a knife, but start selling knives(knowingly) to gang members and you're going to be in trouble even though selling a knife isn't illegal in itself.
Even if true, this sure feels like a loophole though, like the Saul Goodman's burner phone side business, doesn't it? Should there perhaps be a stricter KYC requirement/similar measures to the same end when it comes to re-/selling technology explicitly designed for encrypted communication? Note that we are not just talking about an end-to-end encrypted messenger app, it's a whole integrated phone with an explicit special purpose. This feels more like a regulation oversight: the encrypted transmissions in AM/FM bands are outright prohibited in most Western jurisdictions after all, and so is possession of the respective equipment.
re the mention of FVEY, I strongly suspect it's law enforcement rather than the spooks who have any issue with encryption there. I don't think FVEY SIGINT are having any issue reading the messages they want to read, it's the City of Spokane Police Department, FBI Tampa, and the Manitoba RCMP who are struggling, and would like Apple to give them decryption keys. SIGINT would love you to believe they can't read your messages because of encryption.
I think this line of thinking can lead to a sort of defeatist ignorance. For example, can anyone break the default cipher suite of wireguard or gpg? I really don't think so.
I think one would be very lucky to have an adversary who’s focusing their attacks at the strongest points
While neither of these points is completely incorrect, that is a heck of a connection to make without evidence.
That was a pretty terrifying line to read - the idea that they feel comfortable assuming a great deal of the public will agree with or find this reasonable is pretty worrisome.
In general, "the public" is usually okay with things that reduce anti-social behavior.
But if you instead phrase it as: “should international law enforcement have a perpetual copy of every single written message you have ever sent in order to reduce anti social behavior?” You will discover that there is a limit to what people will tolerate.
Heck, even if I try to point out all the fun side effects - say, how embarrassing it would be if a copy of your, ahem, correspondence with that cute intern was leaked, or simple guilt by association, like finding yourself on a watchlist after buying a car from a suspected Islamic militant or something similar, I am mostly met with a shrug and a variation on the theme 'Oh, they'd never do that / surely if that was to happen, it would be fixed in due course'.
Basically, I more and more feel like the odd man out - as my position that 'Seeing as I am not doing anything criminal, the authorities have no business snooping on me' is seen as the militant one. Won't somebody think of the children, etc.
Sigh. Rant over.
The point is that everyone has information that they would rather not have distributed. To prove the point, you just have to find the right piece of information to ask for. There’s always something that people do, in fact, have to hide.
But giving you the credentials is giving you control? They're the same thing in this case! The fact that you're asking for them implies that you want to use them, does it not? Otherwise, why would you ask?
> The point is that everyone has information that they would rather not have distributed. To prove the point, you just have to find the right piece of information to ask for. There’s always something that people do, in fact, have to hide.
But they're saying they have nothing to hide because they haven't done anything illegal. The original statement was "I don't do anything illegal, hence I have nothing to hide". They're saying that someone looking through the history of the things they've said and done would find no evidence of wrongdoing.
If you asked for their banking records, that might be an appropriate thing to ask for in the pursuit of evidence of wrongdoing. But asking for the ability to control their finances isn't the same thing. The ability to control their finances has no relevance to any illegal behaviors they may or may not have partaken in. So you're not really finding the "right piece of information to ask for". Instead, you're cleverly moving the goalposts from "information relevant to the search for wrongdoing" to a much broader scope.
I don't think anyone who says "I have nothing to hide" believes that law enforcement should have access to your bank account to spend your money; but they're probably fine with some level of law enforcement having the ability to view their financial records under the right circumstances. Since they've committed no financial crimes, there will be nothing to see.
Of course you'll argue the hypothetical that "everyone has committed some crime" (which is probably true!), but plenty of people commit crimes accidentally and are let go with no punishment (or never even prosecuted) when it became clear that there was no intention of breaking the law. This obviously isn't true in call cases, because lack of criminal intent does not prevent damages, etc. However, the best way to prove that there was no criminal intent is by having more information about that person, to demonstrate that their previous actions are consistent with such a narrative.
I think this is due to a very large difference in mindset. Let's use your "fun side effects" as examples:
> how embarrassing it would be if a copy of your, ahem, correspondence with that cute intern was leaked
Maybe this embarrassment would be deserved? If you're having inappropriate conversations at work, maybe you should get called out on it? I'd argue that being able to hide these kinds of things contributes to a toxic work environment. So a) I wouldn't be having any correspondence with the cute intern, and b) I'd want to know if I'm working at the kind of place where that kind of behavior is acceptable (so I could not work there).
> simple guilt by association, like finding yourself on a watchlist after buying a car from a suspected Islamic militant or something similar
Big deal? If that's my only interaction with that person, no one who has access to that kind of information is going to care. I'll be accurately classified as a spurious contact and promptly ignored. I might be watched for future interactions, but since the interaction truly was a one-off, there will be no future interactions, and none of my other actions will be of interest to those who are watching.
So again... big deal?
> I am mostly met with a shrug and a variation on the theme 'Oh, they'd never do that / surely if that was to happen, it would be fixed in due course'.
If they mean "they" as in "themselves", why would you disbelieve them? They probably would never do any of those things.
> Basically, I more and more feel like the odd man out - as my position that 'Seeing as I am not doing anything criminal, the authorities have no business snooping on me' is seen as the militant one. Won't somebody think of the children, etc.
Because there are increasing numbers of people who share the view "the authorities have no business snooping on me" and who are in fact exactly the people who the authorities should be snooping on. However, none of them would ever admit to that, so they prefix that view with the same thing you did: "seeing as I am not doing anything criminal". Ostensibly the difference between you and them is that they're lying about the first part; but given that others have no way of verifying whether or not you're lying, can you fault them for assuming the worst and lumping you in with the actual criminals?
Because this is literally a thing criminals say, and criminals generally aren't beholden to telling the truth.
To put a finer point on it: the vast majority of criminals in the world are privacy advocates out of necessity. They may or may not be good at exercising privacy, but the easier it is to achieve effective levels of privacy ("effective" meaning "keeping their activities hidden from the relevant authorities/groups"), the more of them become good at it by default. It is becoming easier and easier to achieve effective levels of privacy (especially online), which means the privacy advocates are actually winning. As a consequence, so too are the criminals. You, as a non-criminal, non-antisocial privacy advocate might not want criminals to be your allies in this, but they are out of unavoidable necessity. (feel free to s/criminals/antisocial individuals/g, if you want to consider the point even more generally)
As for the watchlist part, yes, it is hyperbole - but the assumption that your contact would be readily dismissed as random relies on the authorities collecting said information being competent. I think it is naïve to assume that such info will never be misinterpreted and that it will never be retained just in case it proves useful later on. The 'they' I referred to were the authorities collecting and analysing the information, by the way.
And yes, I fault the powers that be for assuming criminal intent in all of the citizenry.
I may be biased in the particulars, but I think it's good that society frowns upon certain behaviors. So if you're cheating on your spouse, I would rather they find out than be kept in the dark. If you're secretly embezzling money from the city government, I think the public has a right to find out about that sort of thing. Better still if there's enough transparency that you can't get away with it in the first place. You say "it's nobody else's damn business anyway", but in the example of infidelity, it isn't exactly a victimless thing. If everyone's informed and consenting, it's not really "infidelity" anymore, and not really a problem if you want to keep your swinging a secret from your family.
Your examples so far have mostly been cases where the behavior is inappropriate in some way:
- Infidelity: the ignorant spouse is a victim, so this isn't a victimless behavior
- Flirting with the intern at work: probably against the workplace policies you and they agreed to when you took the job.
- Giving money to an Islamic militant: If you were actually ignorant, this is generally appropriate behavior and anyone who looks at your history will probably agree. However, if you knew they were a militant and gave them money anyway, this is probably not appropriate behavior and your history would show that
I guess it's not very convincing to argue that people doing inappropriate things should be allowed to get away with it? It seems like in each of these contexts, privacy is only in service of hiding bad behavior? It's somewhat worrisome that these kinds of examples are also the examples most predominantly offered by privacy advocates. You're not the only one who gives examples like these, and the shared themes have concerning implications. Examples like these definitely do not work in favor of arguing for more privacy, because people will pick up on this throughline and start to associate "people hiding things they shouldn't be doing" with "privacy advocacy".
The only example you've given so far that seems convincing is the "love emails to consenting adult of same sex", which case I'd argue that it being embarrassing is probably more a problem of assholes in society than anything else. Someone giving you shit for that (and anyone who cares to listen to their shit-slinging) is probably saying more about their own antisocial tendencies than anything else. This is also a victimless thing, so I'm more amenable to just agreeing that folks should have privacy in this case... they're not doing anything wrong, after all.
However, the other solution to that particular issue is to make society more tolerant of people with differing harmless beliefs. I'm generally in favor of solutions that improve society overall and seem to have fewer downsides, rather than the solutions that prioritize empowering individuals in antisocial ways. To use an extreme example to illustrate the point: I don't think anyone is in favor of allowing folks to freely kill each other. Having the freedom to take someone else's life is in some ways the ultimate expression of an individual's freedom, but I think almost everyone would agree that the downsides heavily outweigh the upsides of that particular freedom.
As encryption and other privacy technologies become more widespread, so too have those who take advantage of them for the sake of enabling their anti-social behaviors. It also allows people with anti-social behaviors to coordinate in ways that are increasingly hidden from the groups they are working against.
So yeah, people are going to have an increasingly negative response to something they generally used to have neutral-to-positive responses to.
No one should be surprised that this is the case, least of the very people advocating for more (and more widely available) privacy tools! Ubiquitous privacy leads to ubiquitous distrust. After all, how do people know someone is trustworthy? By being able to see their actions, and see how they compare to their stated intentions. A mismatch between stated intentions and actions is evidence that a person is not trustworthy; the more of their actions they can hide from others, the more duplicitous they can be without being discovered.
Put differently, and more personally: In my face-to-face interactions, I may have never met a person before, but I can still "vibe check" them based on the wealth of side channels available to my senses and intuition. It's subject to my own personal biases and things, but I have come to trust my intuitions. Online, I have next to none of those same contextual clues, so my default is to just not trust anyone. If I choose to do something online that requires trust, I appreciate the fact that people have online histories; and if someone has chosen to scrub theirs, this isn't so much of a red flag as it is a reason to not diverge from the status quo. So when I imagine the world that privacy advocates want, where you know nothing about anyone that isn't voluntarily disclosed, I see a vary dark, mistrustful place where effective social cooperation has been utterly neutered. Even when people are willing to share information that "validates" their trustworthiness, the fact that _all_ information about them would be voluntarily disclosed convinces me that it would be so curated as to be useless for the task. This is made even worse if you imagine the deniable authentication folks get their way.
I also personally believe that the effective anonymity of the internet is in large part behind the decay of trust in general, for many of the same reasons. We no longer trust each other because we know so little about each other; and what we do know we trust less and less, because it's becoming increasingly easier to hide or curate that information. Online privacy advocates have already largely gotten their wish: it's not terribly difficult to be anonymous online, and I think our online discourse has been decimated as a result. Obviously not only due to accessible anonymity, but it's certainly a substantial factor.
I'm pretty sure the vast majority of my interactions online these days are with people I've never seen before and will never see again. And the people I do recognize are generally the people I'm least inclined to want to interact with (i.e. basically any Twitter personality). It's all pretty fucked up, if you ask me
I could not begin to fathom what lead you to have this level of trust issue, even with unimportant conversation between complete strangers, but every anecdote you have described is a deeply personal issue of your own, not a justification for any change in society.
Wow, way to completely lose the plot. You didn't respond to a single thing I said, and what you're claiming I'm saying wasn't what I said at all. Like, where did I say no one had a right to privacy? I didn't. What I said was if everyone utilized privacy the way you and others in this thread are advocating for, the world would be even more distrustful than it is today, that I think the downsides of increasingly ubiquitous privacy vastly outweigh the upsides. I also think that the majority of the world agrees more with me than you, given the lack of the visceral reaction you seemed to expect from TFA. That lack of reaction would at least indicate they don't agree with you, even if they don't agree with me, either.
Like, it's perfectly fine if you want to share nothing with the world rest of the world. I'll just consider you to be a wildly selfish individual (because your position amounts to "fuck you I got mine"), and probably not interact with you unless I can avoid it. But please, consider the consequences of your philosophy, both good and bad! I feel like you're trying to avoid addressing the downsides with this deflection. After all, you'd apparently rather call me a fascist and put words in my mouth than even bring attention to these downsides.
You kind of missed the mark with this response entirely. Maybe it's the halo effect (or whatever the inverse is), but when you and others who share your beliefs respond like this, you're really not making me trust you all that much, which means I also will think even less of your beliefs.
Maybe reflect on that, too? If you want to advocate for privacy, you'd do a lot more good if you actually came across as an attractive individual.
> I could not begin to fathom what lead you to have this level of trust issue, even with unimportant conversation between complete strangers, but every anecdote you have described is a deeply personal issue of your own, not a justification for any change in society.
Cool, way to discount my entire lived experience entirely out of hand. You could, you know, try some empathy, and consider that I'm likely just as intelligent and learned as you are (or maybe even more so? Again, with internet anonymity the way it is, who can tell?)
"But," they continued rather than stopping at defending rights, "when those rights can be used to enable activity which we deem criminal but hasn't yet been tested in court, we have to take them away."
https://www.hachettebookgroup.com/titles/joseph-cox/dark-wir...
https://darknetdiaries.com/transcript/146/
Truly fascinating story
https://www.youtube.com/watch?v=uFyk5UOyNqI
End to end encryption is available for one-to-one conversations, but must be turned on manually.
- Run a basic script to disable app installs, phone calls and some other features.
- Never update the OS. Don't do any security patching.
- Write your own encrypted messaging app with your own crypto. Don't get any external reviews or audits.
- Resell this as a Sky ECC phone with some marketing dollars labeling it as "secure" and "private".
What do you think is more hackable, this or a regular iPhone/Samsung Galaxy/Pixel?
A cheap netbook from a no-name Chinese OEM, running weird software you've never heard of named 'TAILS' which doesn't auto-update or anything, and which the makers say is very secure.
A cheap phone from a no-name Chinese OEM, running weird software you've never heard of named 'Sky ECC' which doesn't auto-update or anything, and which the makers say is very secure.
You've got to be fairly knowledgeable to appraise the two options correctly.
Remote wipe is provided by both Android and iPhone iirc even to end users.
A stock android phone, a knowledgeable user could already remove a bunch of stock apps.
> His father designed the data encryption algorithm.
> “My dad's a genius,” said Eap. “It had the highest level of encryption available.”
It's hard to imagine that this level of ignorance wasn't intentional from the beginning.
"My dad's a genius" because you're not supposed to rely on genius to make a good crypto system, and also because it makes Eap sounds like he has absolutely zero knowledge on the subject.
"highest level of encryption available" because there's a fairly low floor above which it's all uncrackable anyway (ChaCha20 + BLAKE2B authenticated encryption, and Curve448 + post quantum winners for the public stuff, should go beyond total overkill).
I don't believe it was intentional though. I'm just out of a quick job implementing SSCPv2 (encryption over RS485 to secure communication between card readers and central computer, typically used to secure buildings). Good specs, fairly good separation between cryptography and business logic, and as far as I could tell the crypto isn't broken… but it is quite old school: AES CBC + HMAC SHA256, using MAC then encrypt. https://moxie.org/2011/12/13/the-cryptographic-doom-principl... And while I think my implementation is okay, I did have to pay special attention to specific traps raising from this design, and to be honest wouldn't bet my life on having ironed out all possible timing attacks.
SSCPv2 was almost certainly designed after 2020, but it took books from 2005. Good books for their time, but a bit dated unfortunately. I'm pretty sure no actual cryptographer was involved. If there were, they would almost certainly have used standard authenticated encryption scheme like AES CGM, or ChaPoly (RFC 8439), they would have authenticated the unencrypted header, and provided an even better separation between crypto and business logic.
So how the messages were intercepted if e2e encryption is used?
The exact approach used to break the encryption of Sky ECC phones is not fully detailed in the sources I found. However, there are some insights into the methods used:
1. One source mentions that law enforcement agencies used cloned devices running a fake phishing application designed to impersonate the Sky ECC app https://www.bleepingcomputer.com/news/security/europol-unloc.... This allowed them to intercept messages as they were being sent and received.
2. Another report indicates that unauthorized devices with modified security features were sold through unauthorized channels, which likely played a role in the interception https://www.vice.com/en/article/sky-ecc-decrypted-hacked-pol....
These methods suggest that the encryption itself wasn't directly broken, but rather the security of the devices and the integrity of the app were compromised.
Not sure if that’s what happened here but it wouldn’t surprise me.
You want to talk about unethical behaviour? That sounds borderline like a poison tree to me.
The only practical check acting against the whims of these agencies is that if they do things that are too horrible the resulting public perception will be bad for the career advancement prospects of the top ranks who want to move into politics where optics matters.
“My dad's a genius,” said Eap. “It had the highest level of encryption available.”
Not only did Sky ECC provide end-to-end encryption, like Whatsapp or Signal, but unlike those free apps, it also redirected the data on its own secure network. "
This was the basis for users to think the system was secure? Seriously!?!
I'm reminded of the saying 'don't roll your own crypto'. Obviously the authorities were able to crack the crypto, probably at multiple points.
Charisma and similar flavours of "trust me bro" works more than reasonable people would anticipate. See every pseudo science and conspiracy theory ever. Cryptography is no exception.
You keep using that word...
While intelligence agencies were pumping in real-time all the data from Encrochat's and Sky ECC;s dedicated OVH servers, the OVH co-founder Octave Klaba and their ex-CEO Michel Paulin were selling the company with statements like:
- We don't dig in our customer's data unlike the the "others".
- US secret services have no access to our data.
However there are many interesting anecdotes:
1) For many years OVH was hiding a "maintenance" backdoor in "/etc/ssh/authorized_keys2", authorized_keys2 was used for ssh protocol 2 which was depreciated in 2001 yet OVH was using it to store a maintenance key until around 2018. This was very poorly documented and a user warned of the backdoor on HN back in 2012. https://news.ycombinator.com/item?id=4839414
2) In 2013 the TOR hidden service hosting provider "Freedom hosting" was taken down, "they" had rented 400 servers at OVH and in June 2013 "they" let all but one expire, likely moving to another provider, this is when through an unknown way the FBI obtained the IP address of the only remaining server at OVH. The server was imaged but it contained an encrypted "container". The FBI claims that they were able to break the encryption within a week using "cryptanalysis" and to recover the "root" password used to encrypt these "containers". This is total BS, they must just have used the ssh maintenance key or added "something" to the server when they did the imaging.
Source criminal complaint Eric Eoin Marques: https://www.justice.gov/d9/press-releases/attachments/2019/0...
3) Later that same year Silk Road was taken down. It is undisputed that law enforcement lied about key parts in their investigation.
According to law enforcement Ross Ulbricht was ssh'ing into the Silk Road server using a "VPN server". When they got to the "VPN server" it had been wiped out BUT, the hosting provider had kept "VPN" "logs"??? which led them to the IP address of a cafe where Ross Ulbricht had been. Ross Ulbricht kept a list with all the servers he was and had been operating. There is no mention of a VPN server, however in the "retired" server section there is a "VNC Desktop" server with the note "SR related". This appears to be a server running a virtual desktop that Ross Ulbricht was using to connect to the Silk Road. It was a VPS hosted at ... OVH and rented through an intermediary called momentovps. But it gets even worse, just bellow he listed another VPS at OVH and it has the remark "Will / personal backup / deadman switch"...
Source: Silk Road Exhibit GX-264
4) The creation story is quite strange. OVH was offering very low prices while not having any funding. The secret was that for years Xavier Niel who is one of Octave Klaba's competitors and has been outed as being a former agent for the french government was hosting the OVH servers in his datacenter for FREE. Obviously if you do not pay for the electricity, internet and rent life is easy. The question is what did Xavier Niel get in return? According to him (Interview on BFMTV) he did it out of generosity. Of course...
Now we pretty much know that Pavel Durov founder of Telegram got his french passport because he agreed to work with the french intelligence agencies but failed to deliver. Guess who was the first person he called when he got arrested, and then the person he met once he was released? Xavier Niel!
What.CD is dead, long live What.CD (and Oink's Pink Palace).
But what really matters is that intelligence agencies are sniffing in your data at OVH and that the company wants you to think otherwise.