Hacker News new | ask | show | jobs
by cesarb 3495 days ago
> All my encrypted traffic to my overseas based VPN will be logged (legal). Then you'll demand my keys so that you can decrypt it.

If the VPN connection uses ephemeral keys (IIRC, at least IPSEC, SSH, and TLS 1.3 always use ephemeral keys, while older TLS uses them when possible), by then it's too late: the keys are gone.

2 comments

You can imagine someone being locked up for this though. If you are required by law to decrypt your data, and you chose technology that does not allow this, then that's on you. To use an analogy, if you choose to ride a bike that doesn't have lights, and then get pulled over for riding without lights, the lack of lights is not a defense because you were required to have them in order to be on the road at night.
The law as written protects you against this:

RIPA S49(2) (http://www.legislation.gov.uk/ukpga/2000/23/part/III/crosshe...):

If any person with the appropriate permission under Schedule 2 believes, on reasonable grounds—

(a)that a key to the protected information is in the possession of any person,

(b)that the imposition of a disclosure requirement in respect of the protected information is—

(i)necessary on grounds falling within subsection (3), or

(ii)necessary for the purpose of securing the effective exercise or proper performance by any public authority of any statutory power or statutory duty,

(c)that the imposition of such a requirement is proportionate to what is sought to be achieved by its imposition, and

(d)that it is not reasonably practicable for the person with the appropriate permission to obtain possession of the protected information in an intelligible form without the giving of a notice under this section,

the person with that permission may, by notice to the person whom he believes to have possession of the key, impose a disclosure requirement in respect of the protected information.

If the technology by implementation never gives you the keys and doesn't retain them, then there can't be a reasonable belief that you're in possession of the keys, so the requirement fails at the first hurdle.

I can see one of those situations where you get held indefinitely because they obviously cannot charge you but don't want to let you go to a) prove a point and b) hopefully let the law "catch up" to this situation.
If "they" are going to hold you indefinitely and contramand the rule of law then it doesn't matter what the law says.

IIRC the UK government was defeated in the UK courts over extending the time a terrorism suspect could be held without charge.

Cool. Now all I have to do is prove that to the satisfaction of the investigation while they crawl all over the rest of my life looking for clues as to what it is I'm so keen on hiding. The process is the punishment.