News for hackers. Stuff that matters.
Re:Annoyed at crypto, Brazilian judge orders mobile carriers... by JoshTriplett on Tuesday July 19, 2016 @03:25PM (#12124158)
This is exactly why people build services such that they themselves don't have access to user data, because anything you have access to you can be compelled to produce (by a jurisdiction that has power over you, or that you let have power over you because you want its business more than your users' trust). WhatsApp is feeling the pain here because they're popularizing end-to-end encryption, and jurisdictions are trying to test the boundaries and push back. As long as there are only a few such applications and services, blocks like this will remain feasible.

We need a whole generation full of such applications and services, all of which have no access to user data, so that jurisdictions get used to the idea that user data is owned by the users, and that there's no point in going after the service. And with enough such essential services woven into everyday life, it'll become less feasible or politically acceptable to attempt to block them.

Consider the very short list of countries that block Google, or YouTube, or Wikipedia, and what properties those countries have in common, versus the much larger set of countries making attacks on encryption right now. Consider the expected length of a political career in a reasonable country for someone who tried to block YouTube, versus the disturbing lack of backlash against attacks on encryption. We need to make attacking encryption a political third-rail.

Re:Annoyed at crypto, Brazilian judge orders mobile carriers... by AJ007 on Tuesday July 19, 2016 @05:08PM (#12124919)
How many commercial services should just be have just been open internet protocols in the first place?

If email was created today it would be one company and they would call it a platform. More than one company is trying to co-opt email in to their own app and do just this. May be it would be totally free at first but gradually exposure would decrease and eventually companies would have to pay to ensure that their customers saw their messages. If a gag order was attached with the backdoor, no debate would even happen.

This isn't an anti-business rant. Every tech company today has benefitted tremendously because of open standards - from Linux powering servers to http to the peering among internet providers. What if every free piece of the pie came at a cost?

There are a lot of funded tech companies right now creating free services in an attempt to grow their platforms as large as possible. Then, when they hit the critical mass of the network effect they either start charging or do something to cash in.

This means that the next generation of tools not only have the potential to "tax" the next generation of businesses for every little piece they have, but it also brings immense cross-border regulatory exposure increasing the risk of broken dependancies. What a different story it would be if the headline read "Brazilian judge orders mobile carriers to block the internet." We would all laugh.

Re:Annoyed at crypto, Brazilian judge orders mobile carriers... by superuser2 on Tuesday July 19, 2016 @09:32PM (#12126262)
The overwhelming majority of email is in cleartext, and the overwhelming majority of email users vulnerable to phishing and impersonation, precisely because email is an open federated standard. We wouldn't be having this conversation about email, because the prosecutor would have read it already.

The laughably tiny adoption of GPG, and even TLS between SMTP servers for that matter, should make it abundantly clear that voluntary extensions aren't good enough. A federated system which respects peers' "freedom" to not react adequately to a changing threat profile is somewhere between irresponsible and actively malicious to its end-users.

I, for one, celebrate the death of open standards like email in favor of mechanisms that can actually be improved (i.e. by forcing people to upgrade on pain of being locked out of the network) in response to new developments in security.

Re:Annoyed at crypto, Brazilian judge orders mobile carriers... by JoshTriplett on Tuesday July 19, 2016 @06:07PM (#12125313)
I agree completely. That's fundamentally what a federated service is: a definition of a protocol, and an implementation of that protocol.
Re:Annoyed at crypto, Brazilian judge orders mobile carriers... by eggie on Tuesday July 19, 2016 @05:31PM (#12125085)
Do you (or does anyone) know if WhatsApp/Facebook have a contact log available for each user? I thought this was visible to the service end despite the use of e2e encryption on the contents of messages, but maybe I misunderstand the protocols they are using.
Re:Annoyed at crypto, Brazilian judge orders mobile carriers... by ucy on Tuesday July 19, 2016 @06:05PM (#12125302)