Hacker News new | past | comments | ask | show | jobs | submit login

Require PGP signed requests, and you should have more guarantee?



The problem would be establishing a web of trust of which PGP keys are valid, who still is "law enforcement", and whether they're on gardening leave or have retired etc.

There's too many (US) law enforcement bodies to make a centralised system work, as you'd need to get a certificate authority managing every individual officer's status for every one of these (small and large) agencies, and handle onboarding and offboarding.

In other countries there are more formal structures for these request through verifiable channels, with standard operating procedures in place.

The question is whether the companies are adopting a lowest common denominator model (a false but assumed valid US request can request any user's data) or not, as that might start to make it a more global concern, and get it on European data protection regulators' radars.


There is already a FedPKI and it's already the Department of Justice's job to track law enforcement, is it not?


No, I don't believe it's the DoJ's job to track law enforcement. There is some Federal-level recordkeeping of crime statistics... training... intelligence sharing.

Could you explain what you mean, or give some examples?


How do you verify the PGP key for a random LEO? The web of trust is a total failure for general use verification, it only solves the special ultra-paranoid use case.

Key distribution has always been the weak point of PGP.


You would use something like WKD and not the web of trust. https://wiki.gnupg.org/WKD


DHS already has a portal LEOs use to collaborate - would be pretty easy to set up something at the federal level - if there was the will.


Government institutions are some of the best places where centralized certificate handling/signing infrastructures shine.


And yet it's basically impossible to get a government organization to sign emails except internally using MS Exchange's encrypted email support.




Join us for AI Startup School this June 16-17 in San Francisco!

Guidelines | FAQ | Lists | API | Security | Legal | Apply to YC | Contact

Search: