-

Mon, 16 Oct 2023 16:07:49 +0200

hans@social.woefdram.nl

Tutanota wrote the following post Mon, 16 Oct 2023 16:06:07 +0200

Picture of backdoor on an iPhone; behind this these guys are standing in line for access: FBI, hackers, oppressive regimes, etc.

#ChatControl #OnlineSafetyBill #EarnIt - Lots of politicians want to undermine encryption once again. When will they ever learn that a "backdoor for the good guys only" is simply not possible?

Learn here why we must keep fighting for strong #encryption: https://tutanota.com/blog/posts/why-a-backdoor-is-a-security-risk

#OSB #CSAM #ClientSideScanning #Privacy

Politiker wollen wieder einmal die Verschlüsselung untergraben. Wann werden sie jemals lernen, dass eine "Hintertür nur für die Guten" einfach nicht möglich ist?

show all 11 comments

Mon, 16 Oct 2023 17:20:26 +0200

Hans van Zijst

hans@social.woefdram.nl

@Rik Schraag Oh yes, I tell remember the old days where PRZ was almost thrown in jail because he created PGP. Apparently the American government was panicking over the idea that they couldn't snoop on email anymore.

Mon, 16 Oct 2023 18:37:35 +0200

Hans van Zijst

hans@social.woefdram.nl

@Rik Schraag That's pretty bad, but can hardly be a surprise. So we know what China is doing. Do we also have a clear idea of what other governments are doing?

I trust the US only marginally better than China. History has taught us that the US is at least as hungry for all kinds of data as China, and has no problem lying about it to the people either:

This past March, James Clapper, the director of the Office of National Intelligence, the top intelligence official in the country, testified that the NSA does “not wittingly” collect data on Americans. After the Snowden leaks he sent a letter to Sen. Dianne Feinstein, apologizing for his “clearly erroneous” testimony, because he “simply didn’t think” of a major provision of the Patriot Act.

https://www.pbs.org/wgbh/frontline/article/just-the-facts-what-we-know-about-the-nsa-spying-on-americans/

I've heard many stories from different people about black boxes (literal black boxes) installed in (all?) Internet Exchanges in Europe, where one cable goes in and another comes out. Nobody has access to those boxes, and nobody can tell what happens inside, we only know that all traffic passes through it.

I'd be surprized if the US isn't as dirty as China, only difference is that news like "China is bad" spreads a lot better than "America is bad".

Mon, 16 Oct 2023 19:07:07 +0200

Khurram Wadee

mkwadee@diasp.eu

Yes, the US government classifies encryption software as a munition, or at least it did then.

Mon, 16 Oct 2023 20:04:19 +0200

Hans van Zijst

hans@social.woefdram.nl

@Khurram Wadee Yup. So then they created the tern "export grade encryption": encryption that can easily be broken, at least by American agencies.

Mon, 16 Oct 2023 20:35:32 +0200

Khurram Wadee

mkwadee@diasp.eu

Can PGP be easily broken?

Mon, 16 Oct 2023 21:41:42 +0200

Hans van Zijst

hans@social.woefdram.nl

@Khurram Wadee That depends on the encryption you're using. If you use "export", it can.

Not sure if that is still a thing btw, it was pretty silly to begin with. The source code could not be exported from the US as source, but apparently printing it on paper, exporting that and OCR'ing it back into source was legal. So that happened with every new release for a while.

Mon, 16 Oct 2023 23:00:00 +0200

Khurram Wadee

mkwadee@diasp.eu

Did you mean if you don't use "expert" it can.

Mon, 16 Oct 2023 23:08:28 +0200

Hans van Zijst

hans@social.woefdram.nl

@Khurram Wadee No, I mean that if you use encryption-strength "export grade", then you're wide open for at least the American agencies.

I don't think modern software uses that anymore, however. The cat's been out of the bag for decades, and all kinds of new, better encryption algorithms have emerged. Developed in countries where you can actually export that kind of dangerous stuff 😏

Mon, 16 Oct 2023 23:09:57 +0200

Khurram Wadee

mkwadee@diasp.eu

Sorry, I misread it as "expert" rather than "export".

Mon, 16 Oct 2023 23:14:21 +0200

Hans van Zijst

hans@social.woefdram.nl

@Khurram Wadee What you wanted at the time, was "military grade": the pinnacle of digital security. Real or perceived, that doesn't really matter: you didn't want to use "export grade", because you knew it was weak enough for American agencies to crack. There was also "commercial grade", IIRC, because you need something like small-medium-large.

"Export grade" got its name because it was weak enough to allow the export of it. Commercial and military grade had to be printed/exported/OCR'ed, so you could never get it directly from the vendor.

Mon, 16 Oct 2023 23:16:14 +0200

Khurram Wadee

mkwadee@diasp.eu

Thanks Hans.