Slashdot Mirror
Google, Facebook, WhatsApp and Others To Beef Up Encryption (thestack.com)
An anonymous reader writes: Tech giants including Google, Facebook, Whatsapp and Snapchat are looking to increase the privacy of user data by expanding their encryption features. The recent reports mark growing industry support for Apple in its fight to not allow authorities backdoor access into users' devices. Facebook has suggested that it is increasing privacy of its Messenger service, while its instant messaging app Whatsapp also confirmed that it would be extending its encryption offering to secure voice calls. Others reportedly joining the industry shift include Snapchat, which is working on securing its messaging service, and search heavyweight Google, which is currently developing an encrypted email project. From The Guardian's substantially similar story from which the above-linked article draws:
WhatsApp has been rolling out strong encryption to portions of its users since 2014, making it increasingly difficult for authorities to tap the service's messages. The issue is personal for founder Jan Koum, who was born in Soviet-era Ukraine. When Apple CEO Tim Cook announced in February that his company would fight the government in court, Koum posted on his Facebook account: "Our freedom and our liberty are at stake."
His efforts to go further still are striking as the app is in open confrontation with governments. Brazil authorities arrested a Facebook executive on 1 March after WhatsApp told investigators it lacked the technical ability to provide the messages of drug traffickers. Facebook called the arrest "extreme and disproportionate."
The sooner, the better on this front: as TechDirt points out, WhatsApp may be next on the list of communication tools to which the U.S. government would like to give the Apple Treatment.
Everybody wants to have privacy from everyone except them.
Does this mean for a moment that Facebook won't harvest your personal data for their advertisers, and Google won't track your behavior around the internet? No, it does not. It just means they don't want to share. Few to none of these companies want you to have actual privacy or anonymity online.
Let's not celebrate replacing a nominally democratic republic with a corporate oligarchy. Bad things will happen when large corporations are completely above the law.
Don't think for a minute any one of these companies will do anything that inhibits their ability to mine your data.
Dance like no one is watching, but encrypt like everyone is.
It's good to see industry actually doing the right thing for once. I just hope the US Supreme Court does the right thing and tosses this whole mess...
Quo usque tandem abutere, Nimbus, patientia nostra?
This is happening not just in support of Apple, but because the US has announced they will be using their surveillance infrastructure for law enforcement, not just antiterrorism.
https://www.washingtonpost.com...
All the US Government is going to do with this is force all of these companies to go overseas, or largely go out of business, because eventually the only ones left in the USA will be doing business only in the US.
The days of having to use TOR are nearing an end.
The government has muffed this big time, they have systematically destroyed our trust in their spy services, and so, we, as citizens, have no choice but to insist on end-to-end encryption for EVERYTHING.
We simply don't care about your 'but TERRORISM' story line. We see that as total garbage. We are more afraid of being hit by lightning than by being killed in a terrorist attack.
So, to big government spying agencies, I say this. FUCK OFF. Your days of snooping on my data are done.
Should app vendors get to scan our address book, read our messages, tap our mic, and collect our position 24/7? that just a few of the things we have already lost. Why should it be OK for app vendors to suck our lives dry but claim the High Ground (TM) when the government comes calling? its Big Time double speak. If we care more about the government peeking over our shoulder, why do we so easily surrender to the software vendors?
Time for a new Political party in the US (or two!) One is off the rails Other cant pony up a leader.
The more you tighten your grip, the more star systems will slip through your fingers.
Imagine all the people...
Here's what the real issue is: the amount of effort spy/law enforcement agencies want or have to spend to be able to detect and solve crimes. And the fact that now the pendulum is swinging to where they have to get back to spending real time and effort to solve and prevent crimes.
For the last couple of decades, law enforcement / intelligence agencies have had the benefit of all this data and metadata simplifying their detection and solving of crimes. They were able to use all this technology to their advantage because they had access to everyone's communications, and everyone was putting more and more of their communications online or using centralized tools that the FBI could listen to.
As a result of that, the FBI got used to that capability, and thought that being able to solve a crime with only 2 guys tapping a phone should be the norm. Instead of say, having to put 5 guys undercover, inside a crime organization, or have more law enforcement officers on the corners of streets. When was the last time you saw a policeman "walking his beat"? Not any more.
And now the pendulum has swung the other way. Now that people have the tools to safeguard their communications, the FBI is finding that the levels of staffing or intelligence resources are not matching the capability of individuals to counter it.
Yet the FBI is not helpless. They did solve crimes before wiretaps and modern technology. Do you remember that? They are just unhappy that their outdated tools now are making them expend more effort to gather similar information that would help them solve crimes. It just has to be more manual.
No one said things would stay the same forever. And none of their arguments are highly principled -- they just want crime prevention and solving to be easier and cheaper. They have not said that they would never have foiled crime without technology. If that were true, why are there even field agents? Technology doesn't make it impossible, just like it wasn't impossible before the cell phone. It is totally within reason for people to adopt technology that makes some things easier to do their job, and other things harder for others to do their job - that's what technology is all about.
In all these services, there should be an option that allows you to take 100% control of your data decryption. Gmail, for example, should have a choice where you can lock Gmail sort of like how an iPhone locks. The encryption key for the data is encrypted with your password like how LUKS does it. If you "password reset" you lose everything inside the account and start from scratch. Google can't decrypt the data without your password, so they can't hand it to the government either. I realize this isn't a perfect solution but it needs to happen for all major online services.
Facebook securing your messenger chats is nothing about security at all. Facebook is the central server and has access to all messages whether they are encrypted or not. The only thing Facebook can achieve is to prevent third parties from eavesdropping. But they still have the content on their servers which can be handed over at will.
The encryption Apple is defending is the encryption of the data on the phone. It's not on the cloud, but simply on the phone. Facebook seems to be claiming security and privacy features to try to let ignorant people believe that everything on Facebook is secure and private....
What we need is some kind of portable version of Apple's secure enclave protected by a pin and a self destruct mechanism. A Yubikey NEO on steroids.
again!
The issue is personal for founder Jan Koum, who was born in Soviet-era Ukraine.
- it should be personal for everybody, not just people who have come from parts of the world where in the not so distant past (and in the present) the government has been and is the main villain. It should be understood that any government at all, regardless of what you think of it today is capable of being a villain because it has the power to be the villain. An individual can be a villain and do some damage, a villain government can and does massive amounts of damage to many, sometimes to millions and even to greater numbers of individuals. This understanding should not be limited to those, who have recent personal dealings with villain governments. People, of-course, are very short sighted and do not necessarily see the obvious reality of such things.
You can't handle the truth.
It's long been illegal to export encryption to parts of the world. I wonder how long until it's illegal to import it (in the form of a complete, law enforcement unfriendly communications package)?
I mean...with modern plans, txt messaging has been unlimited and free for quite awhile now...so, why bother with a 3rd party app. that I assume you have to have both parties using for it to work?
Txt messaging is pretty much universal if you have a cell phone...right?
I'd be interested in the newer encrypted services, voice would be quite interesting..but wondering what has been the impetus to use this WhatsApp to this point?
I'd not really ever heard of it till the past 2-3 articles on Slashdot that mentioned it in the same breath as recent encryption topics.
Light travels faster than sound. This is why some people appear bright until you hear them speak.........
Google can't decrypt the data without your password...
Which is why Google, Facebook, or any of these other "free" services will never do something like that. The entire reason these services exist is to harvest that data. What needs to happen is for people to realize that these services cost something to provide and be ok with self-hosting or paying a marginal amount of real money for these services instead of paying with unfettered access to their data. (Paying for email service is dirt cheap, especially compared with what you're paying Google if you actually value your privacy.)
If you want a vision of the future, imagine a youtube comments section scrolling - forever.
This is a test. /. is generating "open proxy" error messages... ?!
Er... sure, sometimes bad law enforcement is terrorism--using terror to accomplish political objectives.
Good law enforcement wrestles with the questions of when it is best to punish people and when it is best to warn them for violating the law, wrestles with questions about when you need to prosecute someone to discourage bad behavior in the community, wrestles with questions like where the boundary should be between the needs of law enforcement to legitimately deter and detect crime and the individual sphere of privacy that defends individuals against government intrusion.
That is truly informative.
I would really appreciate my local LEO's if they were to struggle with these complicated issues.
However I can state that *NOWHERE* in this country does such a struggle take place.
If you truly believe it does then you a just another dumb running around deaf, dumb and blind.
It doesn't happen with every case, but it certainly happens.
1. Punish v. Warn: this one happens all the time, on the beat. Cops decide to write a ticket for violating a city's open container law or to ignore it; they decide whether to give you a warning for going over the speed limit or to write you a ticket; they decide whether to give you a ticket or to arrest you and tow your car; they decide whether to make twenty-year-old throw out his beer or whether to arrest him for it.
2. When you need to prosecute: this one happens all the time, with cops and more with prosecutors. Should they throw the book at you or should they make a deal that seems reasonable? How reasonable of a deal can they make? If a kid dies because a gun was unsecured, can they let a family grieve or do they think charging them for leaving the gun unsecured will get news and save other kids? Yes, they deal with this.
3. Law enforcement needs vs. privacy rights: this one happens in a massive number of court cases every year, and those court decisions alter police behavior. This also happens in policy debates when you get to people establishing department policy. They don't always make the right decision (see, e.g., license plate scanners) because they have a very strong bias from their experience dealing with criminals, but they certainly think about it. There's a reason they don't release the home addresses of victims of domestic violence, for example.
I'm not saying they're perfect--far from it. Most of the time they're just trying to do their job. Sometimes they irrationally defend dirty cops or infringe on the rights of citizens and some of them even beat or kill innocent people. And there are reasons why there is such a distrust of police officers--legitimate ones, like the fact that most investigations involve lying to suspects during interrogation, so all of the millions of people who are arrested in America and all of their families know about how the police lied to and took advantage of so-and-so's ignorance to destroy their lives, and the fact that arrest records effectively eliminate people from eligibility for a large number of jobs.
But most of them, most of the time, are trying to be professionals, help their community, and do the job they've been trained to do. And these questions really do get asked.
Google, Facebook, Whatsapp, Snapchat, and all the rest can look forward to the following, in escalating order:
1). A request to supply the Feds with data for specific cases;
2). A demand to supply the Feds with data for specific cases;
3). A request to create a generalized decryption system. You know, because efficiency and there so darned many of these specific cases. The originating company will of course keep control (it's crazy to suggest otherwise!);
4). That generalized decryption system? Created by threats and intimidation? Now the Feds want it. National Security you understand, need to know and all that. They might allow that data request volumes had something to do with it;
5). Warrants? Those are so Twentieth Century and besides, there's No Damn Time to get one. Retroactive warrants only from this point forward;
6). Terr'ists only? No, it hasn't been just Terr'ists for a couple of years now. Drug cases, Capital murder, Conspiracy, Racketeering, Organized Crime. These are serious matters, surely you don't object?
7). The Local Police Departments put in a compelling case to have access. It's so convenient, and they are clearing cases off the docket in record time! Policing is expensive, do you want your taxes to go up? No, no one wants that, let's say no more;
8). Alimony owed, parking tickets, all are being enforced at record rates! The municipalities have asked for access but we're not sure their justification is sound. Maybe next year;
9). Bullying on the Net has become a big problem. Big data analysis is now being applied to search for hurtful words and chastise the users of such words. From now on 'Tool', 'Jerk', 'Dickwad', 'Idiot', 'Facist', 'Communist' and many others will result in an investigation. We recommend cleaning up your language now, during the onboarding period.
It's laughable now, but the Feds want it all.
You already have that option. It's called run-you-own-postfix-and-dovecot.
The idea that Gmail should be secure is laughable; go back a decade and look at all the debate over Gmail (or go back another to see people having the same discussions about Hotmail). What you'll find is that all the Gmail defenders were saying "I don't care." I am not making this up: that was the essence of all those peoples' insanity defense.
I understand why people are finally changing their minds, but don't blame Gmail. Webmail is for people who don't value privacy. That hasn't changed and isn't going to change. (If you value privacy, webmail is ruled out because the server would have to have your key, and that's a silly idea on the face of it.)
As copyright owner of this comment, I authorize everyone to defeat any technological measure which limits access to it.
Since that potentially means any country, then that probably also means development distributed amongst multiple, mutually hostile nationalities. Which will go down like a lead balloon with La Trumpette and the people afraid of offshoring.
Birds are not dinosaur descendants;birds are dinosaurs, for all useful meanings of "birds", "are" and "dinosaurs"