5 ms·

Open source encryption has been available for decades. Yet, whatsapp got a billion users before they enabled end-to-end encryption. The data shows you're wrong

by ikeboy 10y ago

Open source encryption has been available for decades. Yet, whatsapp got a billion users before they enabled end-to-end encryption. The data shows you're wrong: lack of encryption does not prevent a significant number of people from using a product. I'm mostly repeating what I said in https://news.ycombinator.com/item?id=10580829 https://news.ycombinator.com/item?id=10580829. Further down I had several links supporting the claim that even people who have a lot to gain from encryption will often not use it if it's not enabled by default.

Bartweiss 10y ago
Which returns to the top commenter's point: Brennan is well aware that this won't end usage of newly-unencrypted US products. It will drive away foreign companies, and those with something to hide, but it will still expand CIA access to the bulk of everyday, non-criminal users.
- ikeboy 10y ago
  My point is that "the terrorists/people with something to hide will switch" is incorrect, and so the claim that this isn't about catching them is unsupported. Data shows that even terrorists or other people committing high profile crimes won't always make sure to use encryption. It's very possible preventing encryption by default will help catch a couple of those.
  - chopin 10y ago
    It's very possible preventing encryption by default will help catch a couple of those. I doubt that. I agree with you that many use unencrypted products though, so you have a point. However in almost all events I can remember the people committing terrorist acts where already known to at least some agencies. The agencies already drown in false positives. There is no indication that this will change. This strengthens my point: it is not about terrorists.
    - Bartweiss 10y ago
      Notably, the Orlando shooter was even more known to security agencies than usual. He had been investigated twice and 'cleared'. After that, he was turned away from a gun store before the shooting for suspicious requests, which led to a tip the FBI didn't follow up on! Somehow, James Comey spun that as "we did everything we could". If even that level of prior knowledge is being ignored to push for yet more data (and more false positives) it becomes really hard to believe that this request is being made on the level.
      - dsfyu404ed 10y ago
        Don't forget the time that the Russians(!) put the name of two brothers in the Boston area on a list of "people we think are up to no good" and sent that list to one of the three letter agencies.
    - ikeboy 10y ago
      Once you have an active lead, investigation is easier if they aren't using encryption. You're focusing on the successes, which necessarily are the cases where the agencies failed.
sametmax 10y ago
+1. Most users don't care about encryption. They don't care about privacy. Hell, they don't even care about democracy, as long as it doesn't have any bad effect directly applied to their life right now. They start cary about privacy if a picture of them naked is exposed or if somebody "pirate" their social accounts, then they will ask for someone to blame, and then go back to business as usual. You can't expect the average population to be proactive on this.
- uola 10y ago
  It's not that they don't care, it's that they are asked to give up a lot for fairly vague risks. I have friends who don't use social platforms and go trough the effort to use encryption and deploy their own systems. They loose more freedom not expressing themselves than they gain, especially since intelligence agencies can still target you. Not only can they correlate things with all your friends that use social platforms, they will get much more targeted profile from the data you inadvertently leak. I don't think technologists who ask users to do complicated things or blame them when things go wrong care about privacy Especially when large tech companies make bank by not standardizing things that should be fundamental rights in communication. To me a lot of this (but not everything) is banker level arrogance similar to pension funds or housing markets where "people should have known we were selling them crap".
  - sametmax 10y ago
    I agree the trade off is not in favor of privacy and tech saavy users tend to live far away from the regular users needs. But it's also that people value most things over privacy. To me, valuing the hability to express yourself on facebook over freedom is not a good bet. Just like valuing the hability to smoke over your health is not a good one. I do understand why people do it. I have my share of similar self-destructive behaviours. Still it's commun that important things like ecology, freedom, health are discarded over confort, convenience and quick rewards. And privacy falls exactly in that category.
- rhindi 10y ago
  Actually, we have an example of this happening with messenging apps. No one used to care about end to end encryption, until Telegram and Signal became popular and WhatsApp followed up. The result is that today, consumers demand it in any messenging app.
yardie 10y ago
WhatsApp has made encryption easy, easy to use and easy to understand. Just the day before my mother received a notification saying her WhatsApp messages were now encrypted. And she understood right away. Sending a GnuPG encrypted email on the other hand is way too much to ask for the layperson. Getting the message sent and successfully received is of more importance. It's better if its also encrypted. It's best if the messaging and encryption work together, seamlessly.

by ikeboy 10y ago

Bartweiss 10y ago

Which returns to the top commenter's point: Brennan is well aware that this won't end usage of newly-unencrypted US products. It will drive away foreign companies, and those with something to hide, but it will still expand CIA access to the bulk of everyday, non-criminal users.

ikeboy 10y ago
My point is that "the terrorists/people with something to hide will switch" is incorrect, and so the claim that this isn't about catching them is unsupported. Data shows that even terrorists or other people committing high profile crimes won't always make sure to use encryption. It's very possible preventing encryption by default will help catch a couple of those.
- chopin 10y ago
  It's very possible preventing encryption by default will help catch a couple of those. I doubt that. I agree with you that many use unencrypted products though, so you have a point. However in almost all events I can remember the people committing terrorist acts where already known to at least some agencies. The agencies already drown in false positives. There is no indication that this will change. This strengthens my point: it is not about terrorists.
  - Bartweiss 10y ago
    Notably, the Orlando shooter was even more known to security agencies than usual. He had been investigated twice and 'cleared'. After that, he was turned away from a gun store before the shooting for suspicious requests, which led to a tip the FBI didn't follow up on! Somehow, James Comey spun that as "we did everything we could". If even that level of prior knowledge is being ignored to push for yet more data (and more false positives) it becomes really hard to believe that this request is being made on the level.
    - dsfyu404ed 10y ago
      Don't forget the time that the Russians(!) put the name of two brothers in the Boston area on a list of "people we think are up to no good" and sent that list to one of the three letter agencies.
  - ikeboy 10y ago
    Once you have an active lead, investigation is easier if they aren't using encryption. You're focusing on the successes, which necessarily are the cases where the agencies failed.

sametmax 10y ago

+1. Most users don't care about encryption. They don't care about privacy. Hell, they don't even care about democracy, as long as it doesn't have any bad effect directly applied to their life right now. They start cary about privacy if a picture of them naked is exposed or if somebody "pirate" their social accounts, then they will ask for someone to blame, and then go back to business as usual. You can't expect the average population to be proactive on this.

uola 10y ago
It's not that they don't care, it's that they are asked to give up a lot for fairly vague risks. I have friends who don't use social platforms and go trough the effort to use encryption and deploy their own systems. They loose more freedom not expressing themselves than they gain, especially since intelligence agencies can still target you. Not only can they correlate things with all your friends that use social platforms, they will get much more targeted profile from the data you inadvertently leak. I don't think technologists who ask users to do complicated things or blame them when things go wrong care about privacy Especially when large tech companies make bank by not standardizing things that should be fundamental rights in communication. To me a lot of this (but not everything) is banker level arrogance similar to pension funds or housing markets where "people should have known we were selling them crap".
- sametmax 10y ago
  I agree the trade off is not in favor of privacy and tech saavy users tend to live far away from the regular users needs. But it's also that people value most things over privacy. To me, valuing the hability to express yourself on facebook over freedom is not a good bet. Just like valuing the hability to smoke over your health is not a good one. I do understand why people do it. I have my share of similar self-destructive behaviours. Still it's commun that important things like ecology, freedom, health are discarded over confort, convenience and quick rewards. And privacy falls exactly in that category.
rhindi 10y ago
Actually, we have an example of this happening with messenging apps. No one used to care about end to end encryption, until Telegram and Signal became popular and WhatsApp followed up. The result is that today, consumers demand it in any messenging app.

yardie 10y ago

WhatsApp has made encryption easy, easy to use and easy to understand. Just the day before my mother received a notification saying her WhatsApp messages were now encrypted. And she understood right away. Sending a GnuPG encrypted email on the other hand is way too much to ask for the layperson. Getting the message sent and successfully received is of more importance. It's better if its also encrypted. It's best if the messaging and encryption work together, seamlessly.