[Closed] Terrorism

I have no objection to law enforcement agencies having controlled, legal, access to communications.

I do object when that access comes at the cost of weakening protection against illegal access.

A backdoor is open to anyone that has a key, regardless of whether you let them have it or not. The government need to realise this.

If you criminalise encryption, all you do is ensure that only criminals use encryption 🙂

It's.
Not.
Difficult.

It's also not difficult for the NSA or GCHQ to identify encrypted emails and communications (just a lot more difficult for them to crack them open) - guess what, if possession and use of the software without a licence becomes an offence, then the unlicensed people sending encrypted communications around start to stick out like a sore thumb, and come under extra scrutiny, don't they?

If you criminalise encryption, all you do is ensure that only criminals use encryption

Precisely - sending around encrypted communications becomes like waving a big red flag, doesn't it? Just like all those people using Tor magically started getting nicked for things - because it flagged them as being up to no good.

you will see where your data has been breached already by people exploiting holes and backdoors in security that you want to introduce more into.

But one minute you are saying we shouldnt make this security available to the security services then you are saying the data is already out there. I am finding it difficult to follow your logic.

A backdoor is open to anyone that has a key, regardless of whether you let them have it or not. The government need to realise this.

Exactly. And I'm going to keep banging this drum until it gets into people's ****ing skulls, the WannaCrypt outbreak is a perfect example of why it's a bad idea.

You want compromised encryption, you get WannaCry. No ifs, no buts, no whataboutery, it is that black and white I'm afraid.

Do you really think Email is secure now?

It is if you secure it.

There are easy ways of encrypting personal emails. SQA used to insist that all exam related information was encrypted with PGP before emailing - not sure if they still do.

You can also encrypt specific tunnels so all traffic is automatically encrypted. That's how our work internal email works if it has to pass over public networks (i.e. from one site to another).

ninfan - Member
It's.
Not.
Difficult.
It's also not difficult for the NSA or GCHQ to identify encrypted emails and communications (just a lot more difficult for them to crack them open) - guess what, if possession and use of the software without a licence becomes an offence, then the unlicensed people sending encrypted communications around start to stick out like a sore thumb, and come under extra scrutiny, don't they?

you seem to under the impression that hackers won't run circles around the government?

Cougar you are showing your naivity. I know you are a techie so tell me, do you know the admin password for your Email server? Do you know the O365 admin password for domain? How well are these secured in your organisation. If the security services wanted to access data what method would they use?

It is if you secure it.

Yes it may be encrypted in transit, and even at rest however when the recipient forwards it on or prints it and leaves it on the printer then the information is hardly secure is it?

It's also not difficult for the NSA or GCHQ to identify encrypted emails and communications (just a lot more difficult for them to crack them open) - guess what, if possession and use of the software without a licence becomes an offence, then the unlicensed people sending encrypted communications around start to stick out like a sore thumb, and come under extra scrutiny, don't they?

It's not difficult to recognise something you can't read. It's several orders of magnitude more difficult from looking at the data alone to ascertain whether it's an email or a WhatsApp message or a VPN tunnel or someone buying Network Security for Dummies off Amazon because - and I can't believe I'm actually having to type this - it's ENCRYPTED. It's not an "encrypted email" or an "encrypted communication," it's encrypted data.

Sure, there's other tells. Port numbers give you a clue, but they're easily changed. Source and destination endpoints might tip you off - a connection to Amazon is probably going to be Internet shopping. Probably. Unless a rogue Amazon employee sets up a VPN endpoint in their address range. But that'd never happen because as we've already established, we all "trust" Amazon.

Yes it may be encrypted in transit, and even at rest however when the recipient forwards it on or prints it and leaves it on the printer then the information is hardly secure is it?

surfer - Member

you will see where your data has been breached already by people exploiting holes and backdoors in security that you want to introduce more into.

But one minute you are saying we shouldnt make this security available to the security services then you are saying the data is already out there. I am finding it difficult to follow your logic.

I can see the problem here you really have no idea do you. Stop trying to combine different points.
The link shows you where people have had breaks or problems with existing exploits - like government imposed back doors and peoples info has been leaked.
Saying that encryption is bad because people have already been compromised by bad security makes no sense at all.

then the unlicensed people sending encrypted communications around start to stick out like a sore thumb, and come under extra scrutiny, don't they?

Cougar you are showing your naivity. I know you are a techie so tell me, do you know the admin password for your Email server? Do you know the O365 admin password for domain? How well are these secured in your organisation.

The latest exploit that hit the NHS
https://www.nytimes.com/2017/05/12/world/europe/uk-national-health-service-cyberattack.html?_r=0
Leaked from the NSA, so imagine all the backdoor keys get leaked what next?

Because they can. And if they couldn't, they'd use something else. And if there was nothing else commercially available, they'd undoubtedly create something. This is the point:

No the point is inconvenience and disruption. As I said earlier having access to Whatsapp wont stop this violence and there is no silver bullet but it is easily available and secure. Once it is not secure they may eventually find another way but unless it is on the app store it will be disruptive. Try getting your users to generate a more complex password and see the havoc it causes!!

Do you really think Email is secure now?

No, email is like sending a postcard you have to assume anyone can read it, not least because they can end up in court cases unexpectedly. I have a colleague who corresponded with someone engaged in a civil suit in the USA. All of those emails because they loosely touched on the matter of the court case ("Hey mate, how's business" sort of thing) have become public. There's nothing in them as such but one does have info about his family, where he's going on holiday etc. Nothing top secret of course.

The thing is though, email COULD be secure if you wanted it to be. I could easily install some software on my computer and send emails completely unreadable to anyone but the intended recipient (assuming they have the relevant software and keys).

Unless a rogue Amazon employee sets up a VPN endpoint in their address range. But that'd never happen because as we've already established, we all "trust" Amazon.

Try getting your users to generate a more complex password and see the havoc it causes!!

I used to regularly crack all login passwords when I was a network admin. If your password was cracked in under 5 mins, you had a new one inflicted on you by me. The thing is though, it's not the same thing is it. I'm sure someone who is contemplating an attack that will kill both their targets (randomly chosen or otherwise) and themselves can probably be bothered to install software; it's not like they are lacking commitment.

I know you are a techie so tell me, do you know the admin password for your Email server? Do you know the O365 admin password for domain?

I used to, but I don't any more. Though there isn't "the" password, rather the people who administer the Exchange server and our O365 service have the privileges assigned to them in order to do their job. Administrative rights are given out on the basis of Least Privilege as per best practices and we have a strong password policy enforced via Group Policy.

If the security services wanted to access data what method would they use?

A warrant / court order, I would expect.

Yes it may be encrypted in transit, and even at rest however when the recipient forwards it on or prints it and leaves it on the printer then the information is hardly secure is it?

Not forwarding on sensitive data is a user training issue. Email can be secured but "regular" email is of course insecure. Anyone dealing with sensitive data outside of the organisation should be provided with means of doing so securely.

As for printouts, when we print something it goes to a central server, nothing is actually printed. The user then goes to their nearest printer, swipes an ID card, and can then choose which jobs they want printing. There's a secure paper bin next to each printer for unwanted documents. If they don't get collected then the jobs get deleted after a period of time (24 hours I think). Leaving things on the printer never happens - well, I suppose it's technically possible, but you'd pretty much have to wilfully do it.

And it's whataboutery anyway, printouts aren't emails. My bank card PIN is secure, but it won't be if I post it in a forum post.

Saying that encryption is bad because people have already been compromised by bad security makes no sense at all.

Thats not what I am saying. You are contradicting yourself in the same paragraph. The point of Email security was raised as being secure. The point is the data in transit and at rest may be, so the medium is secure, but if you send it to every member of your organisation by accident then only an idiot would consider it secure because it was secure in flight!

Signal uses something not dissimilar to get round censorship. Not sure of the finer details but uses domain fronting to bounce the message from google.com to their internal google appservice address.

More or less correct; it's using a hidden (within the header) server address which Google's services resolve but isn't visible in clear as it's part of the HTTPS header. Anyway, not relevant. However, there's also the concept that one man's terrorist is another man's freedom fighter. Whilst we can probably all agree that attacks like in London or Kabul are evil, once you get down to people in North Korea, Myanmar, China etc struggling against the government, where do you draw the line?

Should people who just want basic freedoms also be forced into the glare of sunlight as, sadly, they not only have something to hide from their governments but their governments may well torture or kill them for the info these tools help them hide.

Thats not what I am saying. You are contradicting yourself in the same paragraph. The point of Email security was raised as being secure

I literally have no idea what you are on about now but you should be put in charge of the case for this. It would be open and shut in 5 minutes.

All you want to achieve is about 10 minutes of disruption before it moves onto something else.

then the unlicensed people sending encrypted communications around start to stick out like a sore thumb, and come under extra scrutiny, don't they?

Only if the security services can tell who they are.

surfer - Member
Once it is not secure they may eventually find another way

Are we measuring eventualities in nanoseconds? 😆

only an idiot would consider it secure because it was secure in flight!

At university a security researcher from IBM told us that the only secure computer was one disconnected from a network and power, buried in a lead-lined concrete box where the person burying it had died or been killed. And even then he reckoned it was at best only "a bit" secure as inevitably someone would find it sooner or later. Anything with humans attached is insecure by nature, it's just about being secure enough for long enough (see also declassified top-secret docs etc).

[b]Edit[/b] - that doesn't mean we shouldn't try though 🙂

No the point is inconvenience and disruption.

To whom? The only people who will be genuinely inconvenienced are the likes of you and me. Well, you at least.

Once it is not secure they may eventually find another way but unless it is on the app store it will be disruptive.

This is what you're not getting. It really won't.

I can get the source code for an open-source cross-platform messenger app [i]right now.[/i] I can get the Android .apk for Telegraph and stick it on a pendrive somewhere. If you banned secure messaging tomorrow and somehow managed to nobble all the existing clients (and good luck with that), anyone with half a clue about programming would be up and running again in minutes.

Try getting your users to generate a more complex password and see the havoc it causes!!

Apples and oranges, but complex passwords are easily enforceable. You make it too complex though and people just write it on Post-Its. Passwords are pretty poor as security measures go, as always the weak link is people. There are better options, 2FA for instance, and there's always biometrics (which is what I use on my work laptop) though they come with their own unique set of issues.

then the unlicensed people sending encrypted communications around start to stick out like a sore thumb, and come under extra scrutiny, don't they?

Despite the fact that you're missing the point that encryption has many legitimate and legal uses which are beneficial, I won't address that becasue it's obvious you're (others aren't) willing to forgo those uses...

BUT

Even if it were outlawed/licensed/backdoored/whatever then covert messages can still be sent using myriad steganographic methods in un-encrypted forms* so if your goal is to 'catch naughty people' you'll still fail miserably, with the added kick in the goolies of removing all the legal and legit uses.

Bravo, that's what's known as a lose-lose scenario.

*and even in the clear using methods that aren't 'watched'

attackers

yes, but doesn't mean that someone is not going to bury them

Their remains will be disposed of certainly. But funeral rites are often down to custom and culture, the Imans refusal to say prayers for them is symbolic. It would only require muslims somewhere pray for them. There will be no shortage of their supporters world wide doing that :(. In any case it's Allah's who decides who goes to heaven, people can't change his will (as they believe )

I can get the source code for an open-source cross-platform messenger app right now. I can get the Android .apk

Yep you would have you disparate group of contacts in different continents up and running in no time 😀

Apples and oranges, but complex passwords are easily enforceable

Enforcable in a heart beat, watch the chaos

Yep you would have you disparate group of contacts in different continents up and running in no time

What does it tell you when a load of people tell you the massive problems with what you propose and still you don't listen - sick of experts?

You are too incoherent Mike.

As an expert are you able to tell me why the FBI and Iran want my comms data yet?

Yep you would have you disparate group of contacts in different continents up and running in no time

I'd expect that in the months between the government banning encryption and every IM company on the planet making their apps compliant, the terrorists might just be able to find fifteen minutes to deploy whatever they're replacing it with. If they've half a brain between them then they'll already have a contingency plan or twelve lined up.

Are you labouring under the impression that disabling secure encryption is as simple as going "yeah, you can switch it off now"? This isn't the movies.

Even if it were outlawed/licensed/backdoored/whatever then covert messages can still be sent using myriad steganographic methods in un-encrypted forms* so if your goal is to 'catch naughty people' you'll still fail miserably, with the added kick in the goolies of removing all the legal and legit uses.

Indeed. People have been using encryption for as long as we've had writing. Roman legionnaires used to encode messages by writing them on material wrapped round their staff - the only* way to decrypt it was to wrap it round another identical staff at the other end.

(* - clearly this isn't the "only" way, it's not the most secure of cyphers. But it was probably sufficient to stop the casual observer.)

Your attempts to stop it will not work.
There are literally hundreds of ways around it.
It will only cause more problems for people doing nothing wrong.

Read the NHS Hack link, the NSA had a back door, they let that out/lost it. Then a load of other people have your information. Who cares if they want to read it or not they don't get access because some idiot politician wants to make a headline.

but complex passwords

Enforcable in a heart beat, watch the chaos

Yes they are, but we need to retrain peopple about what complex means...

Complex (in terms of strength* of security) doesn't [i]have[/i] to mean difficult to remember, it just needs high entropy and to not be predictable, people have been conditioned into very poor password practises over the years, all via good intentions but poor implementation.

Enforcing a a complexity policy doesn't necessarily mean chaos, enforcing a poor policy will though 😉

* function of character set, length and 'randomness'

EDIT - I was in two minds about posting the XKCD strip as it's become a bit cliched over the years but it is still relevant!

@Cougar, your Roman example is still a form of recognisable key exchange encryption though, an observer may not be able to read the message, but could identify that there [i]is one[/i]. Although I agree with your point I was actually trying to highlight other forms of steganography, which still requires the sender and recipient to agree on a protocol to reveal the message, but allows communications to be sent over traditional mediums while NOT appearing to be encrypted, as the previous comments from other poster were about [i]identifying[/i] encrypted comms either in order to collar infringers, or for further scrutiny. But if the comms don't even look encrypted, and you can't prove they are encrypted without knowing how to decrypt them then your entire reason for banning it, however poorly justified, falls down immediately.

[img] [/img]

https://xkcd.com/936/

Your attempts to stop it will not work.
There are literally hundreds of ways around it.
It will only cause more problems for people doing nothing wrong.

Read the NHS Hack link, the NSA had a back door, they let that out/lost it. Then a load of other people have your information. Who cares if they want to read it or not they don't get access because some idiot politician wants to make a headline.

This.

Plus bear in mind - the NSA tool exploited an inherent vulnerability in SMB. Read that again, "vulnerability," the clue's in the name here. It's not only vulnerable to the NSA, or to anyone with a leaked copy or EternalBlue, it's vulnerable full stop. Even if the NSA software had never got out into the wild, someone totally unrelated could have later tripped over the vulnerability and done something similar.

And here's something for you to mull over, which I don't have the answer to. Did the NSA discover the vulnerability and not disclose it to Microsoft (which is what I'd guess happened), or were they instrumental in putting it there in the first place? And, which of those two scenarios is worse?

gmail is read / scanned by google in order to sell advertising. No one seems to be too worried about that. No end-to-end encryption "needed" there

jamby, doesn't mean people don't want a secured and encrypted means of communication for innocent and legal reasons.

Still no practical reasons or useful ways to implement this or how it will prevent terror attacks then?

Still no practical reasons or useful ways to implement this or how it will prevent terror attacks then?

nah its a great [img] [/img]
though

I can only claim to speak for myself.

I think this is half the problem. Is there value in [b]your[/b] data? Probably not, but surely you can see the issue if they have access to [b]everyone's[/b] data, no?

I'll have his data. String with the credit card number, passport, banking login etc etc...

gmail is read / scanned by google

It's a tad disingenuous to lump those two actions together there as if they were the same thing. Gmail is [i]scanned[/i] by Google, yes. But it is not [i]read [/i]by them.

In a typical email server deployment other people's mailboxes are not readable by anyone else, even the administrators. As I said before, best practice in the security world is what we call "least privilege" - you give people the bare minimum access to what they require to do their job.

This can of course be changed, but we're then back into the realms of "trust." Google say they don't read emails, they could be lying.

in order to sell advertising.

... unless you opt out.

No one seems to be too worried about that. No end-to-end encryption "needed" there

Because as we've been discussing, email isn't secure. Whether it's "needed" or even needed is another matter. I send emails day in, day out but none of it is secure or particularly needs to be. I doubt very much that finding out I'm restarting a non-critical FTP server at 4pm today or that a customer's pre-stage is ready to go out for delivery is going to be of national tactical advantage to a terrorist or valuable corporate data to a competitor.

That doesn't however mean that I don't occasionally need to send, say, a username and password to someone. If I wanted to send confidential data to someone I wouldn't use plain email; just because the bulk of my communications are innocuous doesn't mean that there isn't sometimes a requirement for secure communication.

In this brave new unencrypted world, cyber-terrorism will become very easy.

Good summary for the hard if understand (including Maybot- you'd think she of all android s would get it ). https://www.newscientist.com/article/2133644-theresa-mays-repeated-calls-to-ban-encryption-still-wont-work/

No end-to-end encryption "needed" there

Oh, and,

Just because it's not true end-to-end encryption, don't think there's no encryption. Email works by hopping from server to server as it gets to its destination, and it's likely that the bulk (if not all) of that message transfer is encrypted whilst it's in transit.

Certainly any data you send / receive between your email client (be that a phone app, a full-fat desktop client or webmail) and Gmail's servers will be encrypted. Whether the rest of it is encrypted depends on the other servers on the journey supporting / negotiating secure communications between themselves but in this day and age there's little reason for them not to.

Do we need it? Consider this. If you're reading your emails on a public Wi-Fi hotspot in a web cafe or a hotel somewhere, and you're using regular SMTP / POP3, then I could be reading them too. It is [i]trivially[/i] easy.

Still don't care? If I can read your emails, I can request a "forgot my password" reset from any services you have linked to that account. Amazon? Ebay? Paypal? Online banking?

Still don't care? I have your email address, here, have some malware. Spoofed to look like it's been sent by your partner (I can now copy her writing style, remember) and convincing SMTP to lie on my behalf is even more trivial, it's a protocol that's been around for well over 30 years. Boom, I now have full remote admin access to your laptop. all your saved website usernames and passwords (they should be encrypted of course but you want to do away with that), corporate secrets (they should be encr... you get the idea), your secret hentai collection (I wonder if your partner knows about that, possible blackmail material?), maybe install a keylogger so I can record what you type in the future, and then when I'm done I can fire a parting shot of Cryptolocker using actually unbreakable encryption because banning it doesn't stop it from ****ing existing.

FFS.

In this brave new unencrypted world, cyber-terrorism will become very easy.

Indeed. Lest we not forget: encryption may protect the criminals from the authorities, but it protects everyone from the criminals.

Problem: A terrorist has locked himself in his house where we can't get to him.
Solution: Ban locks.

So,

Problem: A terrorist has locked himself in his house where we can't get to him.
Solution: Ban locks.

Welll, no, we don't need to, because brute force works. Now, how well do brute force attacks work on encryption?

In other news - Knife and hammer wielding terrorist attack in Paris this afternoon... and look what happens when [b]all[/b] police are armed, instead of the first policeman on scene having to take him on armed just with a metal stick.

May cut numbers of armed police at a faster rate than normal police.

She's now doing another u-turn as she describes measures that are equivalent to the labour control orders she scrapped in 2010