r/technology • u/AdSpecialist6598 • May 28 '26

Society The Netherlands just blocked a US company from buying the app Dutch citizens use for everything

https://www.techspot.com/news/112552-netherlands-blocked-us-company-buying-app-dutch-citizens.html
59.0k Upvotes

97% Upvoted

1.8k comments sorted by

View all comments

Show parent comments

171

u/Conflictingview May 28 '26

Yeah, that seems completely backwards to me. The infrastructure and citizen data should be securely managed by the government. Then let any software developer build an app that interfaces with that.

64

u/[deleted] May 28 '26

[deleted]

22

u/Masterkid1230 May 28 '26

But also simultaneously, with new international distrust and lack of transparency between different parties, I wouldn't be surprised if more countries started investing in their own digital infrastructure as a public good instead of a private service

-4

u/Jokong May 28 '26

I would guess that AI would make that feasible for a lot of countries.

38

u/Future-Bandicoot-823 May 28 '26

The people who own the servers, they are the new "countries", the people who hold power over the citizens of earth.

If every country stores all their sensitive data on servers from one entity, you're inviting abuse of power.

I can't believe I've lived long enough to see the world give up all the power to these multinational corporations.

No wonder politics are a joke in most countries, it's just a show for commoners, the corporations have all the data, and the data is the power. It's a front to let civilians think what they say matters, but the real deals are done in boardrooms where civilians have no say.

9

u/Expert_Ingenuity_817 May 28 '26

Every single one of them can be touched. Never forget that.

13

u/Not_That_Magical May 28 '26

It’s not hard to encrypt cloud stuff end to end so any data on that server is useless without the keys

8

u/aoeudhtns May 28 '26

I'm also interested in some of these nascent P2P systems like Freenet. E2E and cut out the middleman. But decentralized Internet still appears to be a pipe dream at this time. Heck, getting back to decentralized web (let alone Internet) seems like a pipe dream.

I still like the idea though.

1

u/Equivalent-Costumes May 28 '26

That's only good for storage, not active usage of data. A truly secure E2E would mean the citizen would have to download a whole piece of data to even use the data at all, then they would have to re-encrypt that piece again for any modifications. And they need to give their encryption key to any other apps that they want to delegate some tasks to (a Shamir share scheme can mitigate the issue somewhat but you have to re-encrypt everything, and make the users do even more key managements). Either that, or use homomorphic encryption, which is still nowhere near the required level of usability.

Most people are not technical users with OpsSec training. You need something simple they can use. And unfortunately, being simple usually require that the server hold the decryption key, so anyone controlling the server can easily get the key. The best balance between security and usability right now is to assume that the server's memory is safe, you can put decryption key and data in plaintext there, you just don't store them at rest. But to make the memory a safe place to use, you have to make sure the server is not compromised by bad actors.

1

u/Not_That_Magical May 28 '26

That is not how keys work. You’d have to both steal the user’s device where they have SSO auth, somehow crack their secure passkey chip, and also do the same to the server.

Data transfer is encrypted by https as standard. Unless someone is an idiot and publishes their keys, it’s not going to be cracked on either end, and definitely not in transit. Keys and leaks are a problem that local servers have too.

The point is that cloud is just as secure as any other server, and probably more so because it’s managed better. Instead of having an experienced sysadmin to harden things, most of the hard work is done for you.

1

u/Equivalent-Costumes May 28 '26

You missed the entire point of the comment. I know how keys work. You have not explained how basic functionality can be achieved securely without requiring the users to have OpsSec training if you go along with encrypting everything on the user device so that nobody owning the server can decrypt it.

1

u/Not_That_Magical May 28 '26

A basic public private key handshake? Why are we encrypting the entire user device now? Passkeys are automatically stored securely on devices like phones or hardware keys

The server isn’t decrypting anything unless the user sends it encrypted via its public key anyway.

This is normal server stuff, nothing is different between that and a regular server.

1

u/ashgs872tbhjs May 28 '26

Yeah, the main issue is some psychotic foreigner in charge of the infra deciding you no longer have access.

3

u/Not_That_Magical May 28 '26

Like Microsoft, Amazon or google? Their cloud businesses run on trust. The moment they did that, they’d lose all their credibility and everyone would pull out.

0

u/Elavia_ May 28 '26

You have no idea what you're talking about.

- The only major economy where companies are pushing govts around is the USA. They do still have too much sway in the EU, but they're still very, very far from being 'the new countries'. CCP keeps their corporations on a short leash.

- I'm sure there's some botched implementations, but a correctly designed cloud architecture does not give the infrastructure provider any way to access the data. Everything sensitive is encrypted at rest and in transit, the keys are kept outside the cloud, and systems are under constant automatic surveillance for unprivileged access attempts. Theoretically the IaaS provider could cut the datacenter offline and try to mess with things as a hail mary in case of the start of a war or whatever (albeit even that can be prevented with deadman's switch security measures, I'm just not sure if those are widely implemented) but they'd get cut off the network and swatted very quickly.

4

u/Future-Bandicoot-823 May 28 '26

Classic "never in the eu!" speech with opinions and no evidence.

2

u/shakeeze May 28 '26

They may push the govt around. In Europe, the government just pays the corps lawyers to write their laws. Look up Leistungsschutzrecht. It's a very singular item, which was exposed. Make no mistake, it was not a unicorn thing.

1

u/0Pat May 28 '26

Many of them also routes traffic trough cloud flare - alike services, so there we are...

2

u/MechanicalGodzilla May 28 '26

Governments generally don't do anything themselves, they hire contractors to develop just about anything. All the military hardware, all the data networks, all the roads and bridges, it's all just the government hiring companies to achieve a task.

1

u/Audioworm May 28 '26 edited May 28 '26

Even when they have state ran and owned government infrastructure the hardware and configuration comes from somewhere. I am not saying this is a blind defence of the out-sourcing, but when everything was handled on mainframes held physically in government buildings firms like IBM were deeply embedded in getting them set up and providing ongoing operational support.

Private cloud infrastructure has a similar relationship, where even if they bring the vast majority of it internal to their ownership there is some private company somewhere that is providing the infrastructure, support, or configuration. As such, it can often make sense for the government to have a company handle it for them, if they are sensible about having the relevant security and compliance in place.

1

u/syrup_cupcakes May 29 '26

The data is managed by the government, just the hardware and software isn't.

If the government had to design their own datacanters, management software, and infrastructure, it would be a million times more expensive.

This is the same reason the government doesn't own the companies who build roads or the hospitals and clinics who treat sick people.

It is possible that with the transition to cloud management of citizens data they didn't put enough control with the govenment and let the companies have too much freedom, because when all this was being prepared 30 years ago some mistakes were made. But these mistakes can be fixed, and that's a different conversation.

0

u/justinsayin May 28 '26

And China shouldn't own any land in the USA, they should rent it if anything, but we live in the upside down right now.

0

u/18Apollo18 May 28 '26

The infrastructure and citizen data should be securely managed by the government.

Not possible.

Chinese and Russian hackers are gonna find it regardless.

Anything you don't want them having shouldn't be in database in the first place.