[Closed] Tech Thread - will SSH be banned?

No suggestion in these proposals about routinely scanning every email.

Not following the Snowden leaks then?

Not following the Snowden leaks then?

Yes, closely. But I've also read what is being proposed closely (since it impacts directly on my business) so I know what it says, and what it doesn't say.
Criticise the govt. for illegal internet snooping by all means, but if you want to criticise a specific proposal then criticise what it says, not what you imagine it says.

probably do the same as last general election and pass some ludicrous things thru as legislation without the proper parliamentary consideration, in the washup

will end up as con-lib-lab negotiation of what they can pass, with an opposition "letting" the outgoing govt pass it, because they would be in no hurry to undo it if they should win.

well we can forget internet snooping;

[url= http://boingboing.net/2015/01/12/keysweeper-creepy-keystroke-l.html ]http://boingboing.net/2015/01/12/keysweeper-creepy-keystroke-l.html[/url]

[i]Keysweeper is a super-creepy keystroke logger disguised as a USB wall charger that piggybacks on GSM networks.

ts developer, Samy Kamkar, describes it as a "stealthy Arduino-based device, camouflaged as a functioning USB wall charger, that wirelessly and passively sniffs, decrypts, logs and reports back (over GSM) all keystrokes from any Microsoft wireless keyboard in the vicinity."

It logs keystrokes online and locally, and the user can set up SMS alerts to be sent when certain trigger words, usernames or URLs are sent, to better identify passwords.

"If unplugged, KeySweeper continues to operate using its internal battery and auto-recharges upon repowering. A web based tool allows live keystroke monitoring[/i]

*reverts to wired keyboard*

I read about that the other day. To be fair, it's a pretty unlikely attack to be a victim of in the real world. An attacker would need physical access to your machine, and at that point your security is already compromised anyway.

As a proof of concept though it's pretty impressive.

Rusty, the point was that emails etc can be, and are, opened and searched on mass, unlike letters, so encryption is needed in the digital world to even have parity of “secrecy” with normal post.

[quote=Cougar ]I read about that the other day. To be fair, it's a pretty unlikely attack to be a victim of in the real world. An attacker would need physical access to your machine, and at that point your security is already compromised anyway.

I think the whole point is that an attacker doesn't need to access your machine, not if you're using a wireless keyboard. You simply have to be persuaded to take in the Trojan horse.

Sorry, I skim-read that and thought it was something else (Thunderstrike). Ignore me.

ts developer, Samy Kamkar, describes it as a "stealthy Arduino-based device, camouflaged as a functioning USB wall charger, that wirelessly and passively sniffs, decrypts, logs and reports back (over GSM) all keystrokes from any Microsoft wireless keyboard in the vicinity."

It logs keystrokes online and locally, and the user can set up SMS alerts to be sent when certain trigger words, usernames or URLs are sent, to better identify passwords.

"If unplugged, KeySweeper continues to operate using its internal battery and auto-recharges upon repowering. A web based tool allows live keystroke monitoring

*reverts to wired keyboard*

Exactly. Or pretty much anyone else's BT keyboard.

I think getting stuck in the nitty-gritty of the exact implementation the law may take loses sight of the point.

I think the main things to be worried about are, vague lawmaking, and misuse of powers. For example "Seventy-seven councils who responded to a Freedom of Information request admitted using the Regulation of Investigatory Powers Act [introduced to help the police fight terrorism in 2000]to crack down on "domestic waste, littering or fly-tipping offences" in the last three years." (Sunday Telegraph, 2010).

God knows how the definition of this and further laws may be stretched especially as technology is constantly shifting and harder to pin down in law.

If we accept that terrorist attacks are going to continue to happen then should we also accept that every time they do, it's OK slip a little more legislation in while the public are scared? Because that could keep going ad infinitum until we arrive in police state territory.

Finally I really believe that when we send information to our girlfriends, mothers, solicitors it should be a private communication between ourselves and them and we should be able to encrypt it to ensure that's the case. While I've no doubt I'm of the least interest to the government my business is my business not anyone else's to view as they please. I certainly don't want government employees freely reading my messages. If they suspect me they can get a warrant from our courts to get data from my ISP and make me give them my private keys. That way there is judicial oversight.

One of the Independent's comments struck me "I understand that some homes and apartments are built without government listening devices in every room. That makes the work of the police more difficult -- makes it harder to fight terrorism. Obviously this situation should be remedied." That's really not too far off it.

spot on

I think the main things to be worried about are, vague lawmaking, and misuse of powers. For example "Seventy-seven councils who responded to a Freedom of Information request admitted using the Regulation of Investigatory Powers Act [introduced to help the police fight terrorism in 2000]to crack down on "domestic waste, littering or fly-tipping offences" in the last three years." (Sunday Telegraph, 2010).

Bit lazy reporting. RIPA was not introduced to fight terrorism it was introduced to provide a legal framework for a number of activities that were not covered by any uk statute including surveillance to detect or prevent crime. Pre ripa a number of authorities undertook surveillance and other activities but there was no legal system of authorisation or review or legislation to govern this, RIPA introduced this. I suspect the LAs are using aspects of RIPA, possible surveillance or billing requests to investigate what they perceive to be crime because this is the legislation that covers these activities not because it is a handy fix

Genius.

[img] [/img]

This sounds easily enforceable and thoroughly thought through.

Bit lazy reporting. RIPA was not introduced to fight terrorism it was introduced to provide a legal framework for a number of activities that were not covered by any uk statute including surveillance to detect or prevent crime. Pre ripa a number of authorities undertook surveillance and other activities but there was no legal system of authorisation or review or legislation to govern this, RIPA introduced this. I suspect the LAs are using aspects of RIPA, possible surveillance or billing requests to investigate what they perceive to be crime because this is the legislation that covers these activities not because it is a handy fix

Fair enough how about police abuse of section 44 of The Terrorism Act 2000, (now repealed) "More than 100,000 people were stopped and searched by police under counter-terrorism powers last year but none of them were arrested for terrorism-related offences, according to Home Office figures published today.
The statistics show that 504 people out of the 101,248 searches were arrested for any offence – an arrest rate of 0.5%, compared with an average 10% arrest rate for street searches under normal police powers." {Guardian 2010] My point is that any new laws need watertight definitions to stop the data equivalent of this.

I wouldn't worry about it. You can add it to the list of completely unworkable brain farts Cameron has come up with that will quietly get dropped or covered up by a new soundbite.

Someone will have a quiet work in Call Me Dave's ear and point out that governments - even Tory ones - can't ban maths.

Next week Dave will be harping on about EU reform again

This is all a huge over-reaction.

We faced far more serious threats from the Germans in WW1 and WW2 who killed a damn sight more people, not to mention a bit of N. Irish discord, and we didn't have so many attacks on our freedom from our own govt.

threats from the Germans in WW1 ... N. Irish discord, and we didn't have so many attacks on our freedom from our own govt.

Well, WW1 and pub licensing laws spring to mind.

And there was all that silliness about broadcasters not being allowed to transmit NI politicians words. Remember all those Gerry Adams speeches where they showed him talking and had to use the voice of an actor to overdub the speech?

somewhatslightlydazed - Member

And there was all that silliness about broadcasters not being allowed to transmit NI politicians words. Remember all those Gerry Adams speeches where they showed him talking and had to use the voice of an actor to overdub the speech?

Yup, but nowhere near as intrusive as what is being mooted.

and now to confuse things a bit more you can now use WhatsApp in a web browser on a PC

http://blog.whatsapp.com/

It would probably just mean a subtle change to T&C's for certain things (if not already in place?) informing users that Google/FB/twitter/Microsoft/apple /etc will comply with any warrant backed requests for access to user's data without user consent or knowledge (beyond accepting the T&Cs) being sought... Accept the T&Cs and they're covered and the intelligence services get their legal access rights...

As I understand it, from stuff I read when the whole issue of spooks snooping on online traffic blew up in the States, Tim Cook said categorically that even if presented with warrants Apple could not deliver the contents of personal messages sent from iPhones because the info (this is iMessage traffic, not email) is heavily encrypted/decrypted by the phones, and Apple has absolutely no means of accessing this traffic in any meaningful fashion.
This is similar to the Blackberry message system, I believe, which was why Crackberries were so popular with government and business types. And gangs and drug dealers...
Of course, most people would be using email, Whatsapp, Whatever; fewer would be using iMessage purely because it's device/OS specific, and thanks to revelations exposed by a certain ex-spook, terrorists have gotten wise and any laws passed to try to access electronic traffic is now subject to the Stable Door Principle, as the horse bolted a while back, and is thus entirely useless.
May the spooks enjoy hours of fun rummaging around in the murky depths of 4chan, 8chan, and the Darknet. 😀

Debate in the House of Lords on adding a 'snoopers charter' to an existing bill.

Quote from Lords who have put forward the motion so far;

[i]'VoIP makes "transmissions untraceable"'

"I don’t know what Whatsapp or Twitter are, but the terrorists do."[/i]

Good grief...

and another;

[i]Lord Blair: says mobile location data will disappear in a few years, endangering missing children[/i]