amal/ungleich-staticcms
1
0
Fork 0
Code Issues Pull requests Projects Releases Wiki Activity

Merge branch 'master' of code.ungleich.ch:ungleich-public/ungleich-staticcms

Browse source
This commit is contained in:
Nico Schottelius 2020-11-09 12:40:18 +01:00
commit bdfadbd3aa
1 changed files with 20 additions and 22 deletions
Show stats Download patch file Download diff file Expand all files Collapse all files

42
content/u/blog/the-dangerous-eu-draft/contents.lr
View file

@ -30,13 +30,13 @@ which requires everyone who is offering secure communication channels
to allow authorities to read the communication. to allow authorities to read the communication.
The motivation is clear: terrorist attacks and unlawful behaviour The motivation is clear: terrorist attacks and unlawful behaviour
should be prevented by wiretapping. Nobody wants crimes, do you? should be prevented by wiretapping. No crime is better for everyone.
So far, so good. In theory. So far, so good. In theory.
## First problem: reducing security, endagering people ## First problem: reducing security affects everybody
The first problem is that modern encryption is not easy to break, or The first problem is that modern encryption is not easy to break, or
let's say it clearly: it's almost impossible to break. Thus passing let's put it clearly: it is almost impossible to break. Thus passing
this law requires decades of work to be undone. To make systems that this law requires decades of work to be undone. To make systems that
have been mathematically proven to be secure, more insecure. have been mathematically proven to be secure, more insecure.
@ -44,27 +44,27 @@ This reduces security for any communication by default. And this does
not only affect terrorists, but also government agencies and the not only affect terrorists, but also government agencies and the
general public. general public.
Thus it also reduces the freedom of speech. There are groups out there Thus it also reduces the freedom of speech. There are activists out there
(f.i. in the area of climate change) that fear their life, if (f.i. in the area of climate change) that fear their life, if their
communication is revealed, because some governments do not allow free communication is revealed, because some governments do not allow free
speech. speech.
## Second problem: the bad guys don't comply ## Second problem: the bad guys don't comply
One of the strangest problems with the EU proposal is that the idea is One of the strangest problems with the EU proposal is that the idea is
to make it a law that everyone has to follow. Or, more precisely: the to make this into a law that everyone has to follow. Or, more precisely: the
idea is that companies like Whatsapp or Signal have to provide keys or idea is that companies like Whatsapp or Signal have to provide keys or
backdoors into their systems that authorities can use for wiretapping. backdoors into their systems that authorities can use for wiretapping.
Now, this is a crucial problem. Because companies like us, ungleich, Now, this is a crucial problem. Because companies like us, ungleich,
also provide [secure communication using also provide [secure communication using
Matrix](https://ungleich.ch/u/products/hosted-matrix-chat/). And we Matrix](https://ungleich.ch/u/products/hosted-matrix-chat/). And we
are not in the EU (for real: Switzerland is not in the EU). are not in the EU (fact check: Switzerland is not in the EU).
See the problem? No? Well. Let's say you are the bad guys and you plan See the problem? No? Well, let's say you are the bad guys and you plan
to coordinate some attack. What do you do? to coordinate some attack. What do you do?
You run your own chat system. It is trivial to do so. It cannot be You run your own chat system. It is very easy to do. It cannot be
technically prevented. It might be against the law in the EU to run a technically prevented. It might be against the law in the EU to run a
chat system that does not allow backdoor access, ok. But then again - you chat system that does not allow backdoor access, ok. But then again - you
are going to do something that is against the law anyway. So this is are going to do something that is against the law anyway. So this is
@ -73,46 +73,44 @@ the least of your problems.
So the proposed law is actually doing the opposite of its intention: So the proposed law is actually doing the opposite of its intention:
* It reduces security for everyone who is behaving according to law * It reduces security for everyone who is behaving according to law
* It does not prevent unlawful acting parties to communicate securely * It does not prevent unlawful parties from communicating securely
## Third problem: criminalizing science ## Third problem: criminalizing science
Apart from the obvious two really strong problems, the law might Apart from the obvious two really strong problems, the law might
actually lead to research and science being prohibited. The underlying actually lead to research and science being prohibited. The underlying
algorithms are usually based on mathematical hard to solve algorithms are usually based on mathematically hard-to-solve
problems. problems.
The problems are carefully researched and in the end used to provide The problems are carefully researched and in the end used to provide
security, confidentiality and integrity. security, confidentiality and integrity.
Researchers might be hindered by legal questions whether or not they Researchers can be hindered by legal questions whether or not they
are able to solve mathematical problems. Which then again stops are able to solve mathematical problems. Which then again can and will stop the progress in other areas of science as well. This all sounds terribly wrong, doesn't it?
progress in other areas of science as well Sounds wrong? It is.
## Fourth problem: a new attack vector ## Fourth problem: a new attack vector
For a moment let's assume that none of the above problems is already Let's assume for a moment that none of the above problems is already
crucial enough to stop the whole motion. There is one more big and crucial enough to stop the whole motion. There is one more big and
crucial problem: if authorities have a backdoor into your crucial problem: if authorities have a backdoor into your
communication, this backdoor needs to be submitted to the communication, this backdoor needs to be submitted to the
authorities. It needs to be securely stored by authorities. authorities. It needs to be securely stored by authorities.
And this makes authorities very interesting for hacking into. You do It means that this law will make authorities a very interesting target for hacking into. You do
not need to attack a technical very secure system. You can just hack not need to attack a technically very secure system. You can just hack
the authorities server and you gain access to everyone's the authorities server and you gain access to everyone's
communication. communication.
A much easier access. For terrorists, foreign (enemy) governments and This enables much easier access for terrorists, foreign (enemy) governments and
everyone else who is interested in getting access to your everyone else who is interested in getting access to your
communication. communication.
## Summary ## Summary
The proposed draft is dangerous, but not for criminals. It is The proposed draft is dangerous for everyone except the criminals. It is dangerous for civilians,
dangerous for everyone else. It is dangerous for civilians, governments, journalists, whistle-blowers and even the science and medical
governments, journalists, whistle-blowers and even the medicinal sectors.
sector.
The whole approach is fundamentally flawed and if passed as is reduces The whole approach is fundamentally flawed and if passed as is reduces
security for everyone, but the bad guys. security for everyone, but the bad guys.