{"id":40439,"date":"2023-08-24T14:06:17","date_gmt":"2023-08-24T18:06:17","guid":{"rendered":"https:\/\/mjtsai.com\/blog\/?p=40439"},"modified":"2025-02-21T17:15:28","modified_gmt":"2025-02-21T22:15:28","slug":"u-k-proposal-to-weaken-messaging-security","status":"publish","type":"post","link":"https:\/\/mjtsai.com\/blog\/2023\/08\/24\/u-k-proposal-to-weaken-messaging-security\/","title":{"rendered":"UK Proposal to Weaken Messaging Security"},"content":{"rendered":"

Ioannis Kouvakas<\/a>:<\/p>\n

The existing IPA regime appears to already allow the U.K. government to demand that companies alter their services<\/a> in a manner that may affect all users. For example, a technical capability notice<\/a> requiring the “removal by a relevant operator of electronic protection” could be used to force a service, such as WhatsApp or Signal, to remove or undermine the end-to-end encryption of the services it provides worldwide, if the government considers that such a measure is proportionate to the aim sought.<\/p>

[…]<\/p>

As a result, an operator of a messaging service wishing to introduce an advanced security feature would now have to first let the Home Office know in advance. Device manufacturers would likely also have to notify the government before making available important security updates<\/a> that fix known vulnerabilities and keep devices secure<\/a>. Accordingly, the Secretary of State, upon receiving such an advance notice, could now request operators to, for instance, abstain from patching security gaps to allow the government to maintain access for surveillance purposes.<\/p><\/blockquote>\n\n

Via John Gruber<\/a> (Mastodon<\/a>):<\/p>\n

Removing E2EE wouldn’t require some mere tweak to the protocols, it would require replacing the protocols entirely (with inherently insecure ones).<\/p>

And the notion that security updates, for every user in the world, would need the approval of the U.K. Home Office just to make sure the patches weren’t closing vulnerabilities that the government itself is exploiting — it boggles the mind. Even if the U.K. were the only country in the world to pass such a law, it would be madness, but what happens when other countries follow?<\/p>

[…]<\/p>

What will actually happen, I believe, is that E2EE messaging platforms like WhatsApp (overwhelmingly popular in the U.K.), Signal, and iMessage will stop working and be pulled from app stores in the U.K.<\/em>, full stop. The U.K. seems to think it’s a bluff; I don’t.<\/p><\/blockquote>\n\n

Previously:<\/p>\n