Slashdot Mirror
EU: No Encryption Backdoors But, Let's Help Each Other Crack That Crypto (theregister.co.uk)
The European Commission has proposed that member states help each other break into encrypted devices by sharing expertise around the bloc. From a report: In an attempt to tackle the rise of citizens using encryption and its effects on solving crimes, the commission decided to sidestep the well-worn, and well-ridiculed, path of demanding decryption backdoors in the stuff we all use. Instead, the plans set out in its antiterrorism measures on Wednesday take a more collegiate approach -- by offering member states more support when they actually get their hands on an encrypted device. "The commission's position is very clear -- we are not in favour of so-called backdoors, the utilisation of systemic vulnerabilities, because it weakens the overall security of our cyberspace, which we rely upon," security commissioner Julian King told a press briefing. "We're trying to move beyond a sometimes sterile debate between backdoors or no backdoors, and address some of the concrete law enforcement challenges. For instance, when [a member state] gets a device, how do they get information that might be encrypted on the device." [...] Share the wealth. "Some member states are more equipped technically to do that [extract information from a seized device] than others," King said. "We want to make sure no member state is at a disadvantage, by sharing the tech expertise among the member states and reinforcing the support that Europol can offer."
So we have a device of someone that we suspect to be a criminal, now aid us to access it.
That is something we can actually work with. Provided there is oversight and it's not "we probably have (population count) terrorists in our country, let's find out how to up the surveillance so we can track them all!"
We used to have a Bill of Rights. Now, with the rights gone, all we have left is the bill.
If any member state has that capability, there is no way in hell they'll share it. That is of utmost importance to national security and is most likely top secret. That's not stuff you share, ever.
If the second part is the solution against encryption, I'm sorry, we have bigger problems. As a matter of fact, if they think that is the solution they really don't understand the problem.
"We don't know, but we should share". It's grasping at straws, really
Ahhh...the great dumpster continuum. Many a free computer will be found there. -- sowth (748135)
The irony here is that even if they put a gun to everyones heads and forced them to ruin encryptions' value by compromising it with 'backdoors' (that anyone would eventually be able to discover and leverage) criminals and terrorists would not just use non-compromised encryption (copied from before the ban on 'real' encryption), they'd use codebooks and other types of obfuscation (book ciphers, and so on; the list is endless) that have been used for much longer than we've had computers, and goverments and cops would be back at Square One again: needing to do REAL police work, not just be jackbooted thugs with guns forcing their will on everyone. Are they really so blind to all this, or is it just another power-grab?
Every CPU since 2006 has backdoors built in, they don't need to have backdoors in individual protocols. If they have cyber-backdoor agreements with the nation manufacturing the chips they have a backdoor.
The more encryption is challenged, the better it is. And with so many people involved, somebody with blabber if it has been hacked and better encryption can be found.
I think we should tell them that all Linux and other OSS software is involved. Having "free" peer review would be great.
Don't fight for your country, if your country does not fight for you.
Or have they just struck a secret deal somewhere?
Let's hope the first. Being a big fan of EU (the idea) and sometimes utterly revolted by EU (the implementation), this makes my week.
Do share all your cracking and hacking tricks. Publicly.
so we can patch the vulns
why not publish all those vulnerabilities they're using to decrypt devices (after a suitable period of time given to the manufacturer to fix the defect)? Could it be they don't really care about security in our shared cyberspace? Naw, they could never be so callous.
Hi! I make Firefox Plug-ins. Check 'em out @ https://addons.mozilla.org/en-US/firefox/addon/youtube-mp3-podcaster/
Is when the encryption wars began. The war was long and had many casualties. After many years of trying to crack encryption most governments around the world agreed to make encryption used by anyone other than the government illegal.
Weakening encryption is bad. Trying to break encryption is expected.
Encryption weenies place a lot more faith in it's power than I do. So, are we supposed to trust SSL? I don't. Besides being eat-up with a laundry list of past vulnerabilities, I'm supposed to trust some megacorp that says some other megacorp or boiler-room-scam operation capable of issuing a certificate signing request is trustworthy? Why again? Just because they can pay folks to answer the phone or to supposedly check someone's business license? That doesn't mean *squat*. There are so many instances where that system has broken down due to technical and logistical reasons, it's not even funny.
You ever notice how everyone gets all concerned about algorithms being broken but it's usually the implementation that the hackers go after and break? What difference does it make if you have a steel vault door if it's mounted on a balsa wood frame? So, because of that fact, how is anyone supposed to trust anything that's "encrypted" ? You can't trust the OS to not be keylogging you, the feds or the author not to have backdoored the implementation, nor can you trust that someone won't simply beat the password out of user (ie.. rubber hose decryption method). If you ask me, the promise of encryption is a lie. It's marginally useful to obfuscate sensitive details in transit or for hashing. The idea that it can always be trusted and is some kind of panacea against hacking is laughable and been proven idiotic over and over, especially when pronounced upon high by evil megacorporations who have ZERO credibility anymore.
You don't. If you could, the encryption would be pointless.
For instance, when [a member state] gets a device, how do they get information that might be encrypted on the device." [...] Share the wealth. "Some member states are more equipped technically to do that [extract information from a seized device] than others," King said. "We want to make sure no member state is at a disadvantage, by sharing the tech expertise among the member states and reinforcing the support that Europol can offer."
I think they're worried about the Five Eyes countries sharing information with each other, but not with EU countries
https://en.wikipedia.org/wiki/...
One of the interesting contradictions of the UK being a member of the EU was that it always had much better intelligence sharing with the Five Eyes countries than it did with any EU country.
echo -e 'global _start\n _start:\n mov eax, 2\n int 80h\n jmp _start' > a.asm; nasm a.asm -f elf; ld a.o -o a;
Who bankrolls the EU now that Britain is out?
The same as before: not Britain.
First, often asking for something (backdoors) is cover for already having it. Second, pretending to not ask for it is cover for getting it without public scrutiny. Third, knowing of vulnerabilities and keeping them secret and exploiting them is ethically just as bad as having backdoors. You find it, you announce it, or you're hurting security for everyone. You think you're the only one that found it? Unlikely. Russians, Iranians, Pakistanis, and Israelis have found it but the only way to block their use of it is to inform the manufacturer and the public and get it plugged/fixed. It's not like they're going to tell you they found it.
AC "Reminder: Spies, cops don't need to crack ... They'll just hack your smartphone" (26 Jul 2017) ..... , and instead simply hack devices to snoop on suspects"
"Police in Germany will forego seeking decryption keys for secure messaging apps,
AC governments are just going for the remote communication interception software (RCIS) solution to advanced end to end crypto.
Domestic spying is now "Benign Information Gathering"
You wish. And hopefully, you won't get - the exacerbated nationalism and just plain xenophobia latent in Brexit and the Catalonian attempts to secede are in the spirit of the times that kept Europe embroiled in more or less continuing internecine wars for hundred of years. Get rid of the EU and prepare yourself to enjoy such times again - with modern weaponry.
You are accusing the EU of incompetence for stating that they are “not in favour of so-called backdoors, the utilisation of systemic vulnerabilities, because it weakens the overall security of our cyberspace, which we rely upon”, and at the same time you are praising Brexit, when Theresa May (and Cameron before her) as well as officials from other individual states (including France and Germany) have been advocating the mandatory use of backdoors. So I take it that you are a supporter of weak encryption.
The obvious problem is that it won’t stop high-calibre criminals (those used by governments to justify the need for backdoors) from using secure encryption, while putting everybody else at risk of exploitation by lower-calibre (but still tech-savvy) criminals. In the words of Matthew Green, cryptography professor at the Johns Hopkins University Information Security Institute): “There’s no chance whatsoever you’re going to stop people who really want to use encryption, like terrorists and serious criminals. That’s just impossible.” (Source: The parallax, “Could strong encryption and backdoors coexist? Nope, experts say”)