End to end encryption under threat

Tefal · 21 Dec 2015 at 14:35

Caged said:
. For a start I assume it would have a massive impact on international trade if a customer in China had to assume that all communications carried out with a US supplier were being eavesdropped by a US government agency.

that's already true.

the patriot act, the us government can monitor any phone call or communication between an American citizen and a non American citizen, because the tap is on the non us citizen...

scorza · 21 Dec 2015 at 14:43

Tefal said:
would you accept this for phsycial security by any chance?

like the TSA luggage locks.

say if they made it law every house in the uk had to be fitted with a door lock, that as well as its normal unique key could also be opened by a singular master key for all locks that would be supplied to police and other authorities (no more smashing in doors with battering rams!).

and no other lock could be fitted.

would you be satisfied with this? or would be thinking "eventually someone is going to get a copy of that master key"

I believe this system already exists. It'd certainly be very surprising if the security services and certain police SC&O departments didn't have ways of getting into people's houses without them knowing. For example, the Met managed to place hidden cameras inside the home of one of Stephen Lawrence's killers.

scorza · 21 Dec 2015 at 14:44

Tefal said:
that's already true.

the patriot act, the us government can monitor any phone call or communication between an American citizen and a non American citizen, because the tap is on the non us citizen...

Also, the US customer can be damned sure that anything he says to his supplier in China is being eavesdropped by the Chinese Army and probably other elements of the Chinese state.

Burnsy2023 · 21 Dec 2015 at 14:47

scorza said:
I believe this system already exists. It'd certainly be very surprising if the security services and certain police SC&O departments didn't have ways of getting into people's houses without them knowing. For example, the Met managed to place hidden cameras inside the home of one of Stephen Lawrence's killers.

Well done on completely missing the point.

Caged · 21 Dec 2015 at 14:48

scorza said:
I believe this system already exists. It'd certainly be very surprising if the security services and certain police SC&O departments didn't have ways of getting into people's houses without them knowing. For example, the Met managed to place hidden cameras inside the home of one of Stephen Lawrence's killers.

That wasn't the question though. The proposals around encryption when applied to a lock on a house effectively say that you can have a lock system as complicated as you like - you could have physical locks and biometric locks in addition if you wanted to - but your system had to be compatible with a police swipe card that let them in without telling you either before or after the event.

Would you be happy that there is no way of a card being misplaced and agree because you saw the police being able to get into your house without you knowing as a crucial element of keeping you safe?

Tefal · 21 Dec 2015 at 14:50

scorza said:
I believe this system already exists. It'd certainly be very surprising if the security services and certain police SC&O departments didn't have ways of getting into people's houses without them knowing. For example, the Met managed to place hidden cameras inside the home of one of Stephen Lawrence's killers.

lock picking etc is a good way to get in etc, but there is not currently a physical lock master system.

scorza · 21 Dec 2015 at 14:50

Caged said:
That wasn't the question though. The proposals around encryption when applied to a lock on a house effectively say that you can have a lock system as complicated as you like - you could have physical locks and biometric locks in addition if you wanted to - but your system had to be compatible with a police swipe card that let them in without telling you either before or after the event.

Would you be happy that there is no way of a card being misplaced and agree because you saw the police being able to get into your house without you knowing as a crucial element of keeping you safe?

In case I wasn't clear enough; I'm quite satisfied that the current system strikes the right balance between security and privacy.

Tefal · 21 Dec 2015 at 14:51

scorza said:
In case I wasn't clear enough; I'm quite satisfied that the current system strikes the right balance between security and privacy.

but this is a new system that is different to the current system/

Caged · 21 Dec 2015 at 14:52

scorza said:
Also, the US customer can be damned sure that anything he says to his supplier in China is being eavesdropped by the Chinese Army and probably other elements of the Chinese state.

The point is that currently, to the best of our knowledge, you can encrypt a payload in a way that makes it impossible for either party to eavesdrop on. Now granted targeted malware placed by a state actor on either endpoint could get that data after it has been decrypted, but it's not the same thing as purposefully weakening an encryption algorithm at the request of a government.

Caged · 21 Dec 2015 at 14:53

scorza said:
In case I wasn't clear enough; I'm quite satisfied that the current system strikes the right balance between security and privacy.

You can't apply the current system of lockpicking to an encryption legislation debate though. That's the point people are trying to get across to you.

scorza · 21 Dec 2015 at 15:00

Tefal said:
lock picking etc is a good way to get in etc, but there is not currently a physical lock master system.

I believe there is - any British Standard lock manufacturer will make master keys available to privileged people. I don't exactly know how the system works (for obvious reasons people don't like talking about it) but it's what I've been led to believe.

Lockpicking ain't like in computer games - from what I understand if you lose your keys the main reason for calling a locksmith is so that he can put a new lock in after he's broken the original one

Mynight · 21 Dec 2015 at 15:06

scorza said:
I believe there is - any British Standard lock manufacturer will make master keys available to privileged people. I don't exactly know how the system works (for obvious reasons people don't like talking about it) but it's what I've been led to believe.

The very basis of a lock prevents such a thing as a masterkey unless the lock is designed to accept one.

Picking a lock really isnt that hard depending on the lock but theres no way a one size fits all is plausible. Unless its a form of bumping the lock but thats far removed from being a master key.

Work on the basis if such a weakness does truely exist. Whats to stop some enterprising criminal from getting ahold of such a key? How do you then stop the criminal from using it?

Burnsy2023 · 21 Dec 2015 at 15:07

scorza said:
I believe there is - any British Standard lock manufacturer will make master keys available to privileged people. I don't exactly know how the system works (for obvious reasons people don't like talking about it) but it's what I've been led to believe.

Lockpicking ain't like in computer games - from what I understand if you lose your keys the main reason for calling a locksmith is so that he can put a new lock in after he's broken the original one

You're showing you ignorance around the subject again. Master keys are not available for the majority of cylinder locks.

As for lock picking, it's not that difficult for most of the run of the mill locks but lock drilling is usually easier and quicker.

scorza · 21 Dec 2015 at 15:09

Mynight said:
The very basis of a lock prevents such a thing as a masterkey unless the lock is designed to accept one.

Exactly - the British Standards ensure that the lock is designed to accept one.

Mynight · 21 Dec 2015 at 15:11

scorza said:
Exactly - the British Standards ensure that the lock is designed to accept one.

Got a link to this?

Caged · 21 Dec 2015 at 15:13

You can't make a master key for a lock that isn't designed for master keyed operation, which your normal tumbler lock isn't. Any master key would effectively take the form of a lock pick.

platypus · 21 Dec 2015 at 15:14

scorza said:
Exactly - the British Standards ensure that the lock is designed to accept one.

Ok, so now that it seems you've completely missed the point, can you go back and re-read it and try again?

scorza · 21 Dec 2015 at 15:16

Burnsy2023 said:
You're showing you ignorance around the subject again. Master keys are not available for the majority of cylinder locks.

As for lock picking, it's not that difficult for most of the run of the mill locks but lock drilling is usually easier and quicker.

Fair enough - my information might well be outdated as I don't deal with physical security in my day job. I'd be interested to know why master keys aren't required for cylinder locks but I guess I won't find out

Caged · 21 Dec 2015 at 15:18

Because the police can just put a door through and repair it later. And if an agency needed to get covert access to your property they will manage it. You can't really make effective analogies about the physical world and apply them to encryption.

Burnsy2023 · 21 Dec 2015 at 15:20

scorza said:
I'd be interested to know why master keys aren't required for cylinder locks but I guess I won't find out

Probably for the same reason that we don't want a backdoor to encryption. The government wouldn't get through any proposal to have master keys to everyone's house.