6 ms·

No, the problem is that the SMS standard was never updated with an encrypted version. Apple didn't want to open iMessage to the world. EU/USA should enforce a

No, the problem is that the SMS standard was never updated with an encrypted version. Apple didn't want to open iMessage to the world. EU/USA should enforce a common, secure method for sending text messages to mobiles.

simias 8y ago
I agree with your main point but I feel like SMS is going to remain cleartext forever. It's basically like email (it's not like encrypted email formats ever gained mainstream traction). Besides I can't really imagine the EU/USA pushing for end-to-end SMS encryption. Fortunately as data plans get cheaper we have plenty of alternatives for encrypted messaging on smartphones.
- dbdjfjrjvebd 8y ago
  Didn't the UK prevent SMS encryption when the standard was developed?
wyldfire 8y ago
> EU/USA should enforce a common, secure method for sending text messages to mobiles. No way do we want any regulation here! I will accept balkanization of messaging apps for the lack of government interference here. If a government messaging standard is introduced, it will absolutely be designed to consider lawful intercepts like US CALEA. It would be a key escrow system upon inception. EDIT: downvoters, join the debate. Do you feel differently? If so, why?
- romshark 8y ago
  Shouldn't such old standards like SMS just die? I didn't write or receive any SMS for like 5 years now (except some confirmation codes) since encrypted messengers became so common and accessible. I think it's obvious that SMS is outdated either way and I too think that encryption should be P2P on the "application layer" for many reasons. Encrypting the actual physical transport would add extra cost in terms of latency and hardware and could become a maintenance disaster over time if I'm not mistaking.
- toomuchtodo 8y ago
  I downvoted you because you show disdain regulation but it is clear the marketplace for a secure, unified messaging solution has failed. EU regulation of the telcom sector has proven effective in protecting consumers from poor decisions (such as exorbitant roaming fees). Regulation should not be the first option, but the last, and it is clear it is the only solution left in this regard.
  - wyldfire 8y ago
    It's not a general disdain but IMO here it makes sense. Has it really failed though?
    - toomuchtodo 8y ago
      Do we have secure SMS messages? Do we have unified mobile messaging with a mature protocol that is both widely accessible as well as secure? How many more decades shall we wait? (asked rhetorically, yet politely) Yes, I argue it has failed, and an SMS/MMS successor would look like a descendent of iMessages and Google's RCS. iMessages supports CALEA (but is still end to end encrypted, as well as FaceTime), all US messaging products must support it (even Twilio supports it [1] [2]). You are unable to subvert nation state legal jurisdictions within fundamental telcom infrastructure. Signal can get away with it, Apple, Google, and cellular carriers cannot. Can't have your cake (universal messaging) and eat it (end to end encryption with zero trust requirement) too. So can't we push from something better than SMS, using regulation if required? It must not be perfect, but simply extensible in the future (similar to SS7). In jurisdictions that are favorable to it, you support E2E encryption. In those that are not, you downgrade loudly. Compromises must occasionally be made. [1] https://www.twilio.com/legal/law-enforcement-guidelines https://www.twilio.com/legal/law-enforcement-guidelines [2] https://support.twilio.com/hc/en-us/articles/223136547-Submitting-subpoenas-court-orders-or-other-official-legal-requests-to-Twilio https://support.twilio.com/hc/en-us/articles/223136547-Submi...
      - _red 8y ago
        The telcos were a national monopoly, which then became "deregulated" but for all practical purpose they hold a monopoly position with regards to cable-in-the-ground and various local right-of-way rights. So, the SMS solution is what these quasi-regulated entities gave you. Whereas iMessage, RCS, Signal, etc is what private industry gave you.
- drb91 8y ago
  It seems silly to reject regulation without seeing it and assuming the worst. After all, we already have the worst—closed source manipulative chat apps that exploit for profit for a small cabal of capitalists.
  - briandear 8y ago
    It’s better than entrusting messaging to a cabal of socialists. Capitalism means that there is diversity in products. If you don’t like Apple’s iMessage or What’s App, create your own. You might like your government today, but I am unwilling to bet my life on government being trusted to do the right thing. Also, the right thing for you might not be the right thing for everyone. That’s what capitalism understands that socialism doesn’t.
    - drb91 8y ago
      Capitalism means there’s a diversity of products and they are ALL bad. We need collectivization to actually produce software that primarily benefits the user.
      - briandear 8y ago
        If we want the equivalent of 1987 Aeroflot, then sure, let’s do that. If the products are all bad, what’s stopping you from making a good one? You’d be a billionaire overnight, assuming the market agrees that they are all bad. I’ve used France’s government sponsored taxi app and it doesn’t come close to Uber’s. I’ve ridden in public buses and they don’t come close to the private FAANG shuttles in Silicon Valley. If you build technology optimized for everyone, that means it’s necessarily optimized for no one. As far as messaging apps, iMessage benefits me greatly. The premise that apps don’t benefit the user is flawed: if they didn’t benefit the user, nobody would use it — except government, we have no choice on using government or not. If the government meets 99 people’s needs, but doesn’t meet my needs, I’m stuck. I can’t switch to an alternative. If an app meets 99 people’s needs but not mine, I can switch to an alternative or build my own. Nothing is stopping you and your friends from building the most amazing messaging app ever. From someone who grew up remember Lada and Yugo, my faith in collectivism in product development is admittedly thin. Very few products from Soviet era factories were any good, I have no expectation that a government built Messaging service would be any better.
- mcbutterbunz 8y ago
  I agree with you. If security is the goal, trusting a nation state with the rules would be antithetical.
- Xorlev 8y ago
  More importantly, even if the standard wasn't required to have lawful intercepts, carriers want would provide it. They aren't in the business of making legal stands to protect privacy. There is a new standard to replace SMS in flight called RCS. Arguably, this makes the world better -- SMS sucks, RCS brings a lot of the iMessage features to standard carrier messaging. But therein lines the problem: it's carrier-controlled, and carriers want lawful intercept. So, the standard does not call for end-to-end encryption and it is not implemented. I still think this is a better state of the world than SMS, but it's pretty depressing that it's 2019 and e2e encryption isn't the default. I understand why it isn't when there's government interests in play, but it's still depressing.
- SllX 8y ago
  I agree with you. The Balkanization of messaging services is a minor inconvenience compared to the cost of a government mandated standard. That, and I’m fairly certain any government mandated standard would just be one more service to support.
- shawnz 8y ago
  > If a government messaging standard is introduced, it will absolutely be designed to consider lawful intercepts like US CALEA. Then that is obviously not what the parent is asking for. The government could decide to enforce an insecure messaging standard at any time. What does that have to do with the people demanding them to enforce a secure one? Are you suggesting that if we demand a secure messaging standard, it will give them the idea of turning around and enforcing an insecure one instead, as though they haven't had that idea already?
- krageon 8y ago
  "it will absolutely be designed to consider lawful intercepts" is a bit of a stretch. If we were talking just the US, I would agree that that precedent has been set. But we're not, we're also talking the EU - which doesn't have a history that dystopic.
  - philpem 8y ago
    I dunno, Articles 11 and 13 came pretty close... the old EUCD proposal some years ago...
    - krageon 8y ago
      Those articles were rejected.
- freeflight 8y ago
  > If a government messaging standard is introduced, it will absolutely be designed to consider lawful intercepts like US CALEA. Happened exactly like that when Germany introduced their "official version" of e-mail, called "De-Mail". When the Chaos Computer Club pointed out how their whole system is insecure, due to, amongst other issues, a lack of end-to-end encryption. The German government simply decided to declare the whole thing as "secure" trough legal definitions [0]. Which means that in practice the system is not secure, but the law considers it secure because it fulfills the arbitrary, political, definitions for "secure transmission", which also includes the capabilities for lawful interception. [0] http://www.spiegel.de/netzwelt/netzpolitik/de-mail-bundestag-erklaert-bundes-mail-per-gesetz-als-sicher-a-895361.html http://www.spiegel.de/netzwelt/netzpolitik/de-mail-bundestag...
- detaro 8y ago
  Introducing a better "SMS" standard wouldn't kill your messaging apps, so I don't see the problem, even if they come with lawful intercept crap. SMS gets strictly better, even more secure messengers still exist and will continue to be used widely.

simias 8y ago

I agree with your main point but I feel like SMS is going to remain cleartext forever. It's basically like email (it's not like encrypted email formats ever gained mainstream traction). Besides I can't really imagine the EU/USA pushing for end-to-end SMS encryption. Fortunately as data plans get cheaper we have plenty of alternatives for encrypted messaging on smartphones.

dbdjfjrjvebd 8y ago
Didn't the UK prevent SMS encryption when the standard was developed?

wyldfire 8y ago

> EU/USA should enforce a common, secure method for sending text messages to mobiles. No way do we want any regulation here! I will accept balkanization of messaging apps for the lack of government interference here. If a government messaging standard is introduced, it will absolutely be designed to consider lawful intercepts like US CALEA. It would be a key escrow system upon inception. EDIT: downvoters, join the debate. Do you feel differently? If so, why?

romshark 8y ago
Shouldn't such old standards like SMS just die? I didn't write or receive any SMS for like 5 years now (except some confirmation codes) since encrypted messengers became so common and accessible. I think it's obvious that SMS is outdated either way and I too think that encryption should be P2P on the "application layer" for many reasons. Encrypting the actual physical transport would add extra cost in terms of latency and hardware and could become a maintenance disaster over time if I'm not mistaking.
toomuchtodo 8y ago
I downvoted you because you show disdain regulation but it is clear the marketplace for a secure, unified messaging solution has failed. EU regulation of the telcom sector has proven effective in protecting consumers from poor decisions (such as exorbitant roaming fees). Regulation should not be the first option, but the last, and it is clear it is the only solution left in this regard.
- wyldfire 8y ago
  It's not a general disdain but IMO here it makes sense. Has it really failed though?
  - toomuchtodo 8y ago
    Do we have secure SMS messages? Do we have unified mobile messaging with a mature protocol that is both widely accessible as well as secure? How many more decades shall we wait? (asked rhetorically, yet politely) Yes, I argue it has failed, and an SMS/MMS successor would look like a descendent of iMessages and Google's RCS. iMessages supports CALEA (but is still end to end encrypted, as well as FaceTime), all US messaging products must support it (even Twilio supports it [1] [2]). You are unable to subvert nation state legal jurisdictions within fundamental telcom infrastructure. Signal can get away with it, Apple, Google, and cellular carriers cannot. Can't have your cake (universal messaging) and eat it (end to end encryption with zero trust requirement) too. So can't we push from something better than SMS, using regulation if required? It must not be perfect, but simply extensible in the future (similar to SS7). In jurisdictions that are favorable to it, you support E2E encryption. In those that are not, you downgrade loudly. Compromises must occasionally be made. [1] https://www.twilio.com/legal/law-enforcement-guidelines https://www.twilio.com/legal/law-enforcement-guidelines [2] https://support.twilio.com/hc/en-us/articles/223136547-Submitting-subpoenas-court-orders-or-other-official-legal-requests-to-Twilio https://support.twilio.com/hc/en-us/articles/223136547-Submi...
    - _red 8y ago
      The telcos were a national monopoly, which then became "deregulated" but for all practical purpose they hold a monopoly position with regards to cable-in-the-ground and various local right-of-way rights. So, the SMS solution is what these quasi-regulated entities gave you. Whereas iMessage, RCS, Signal, etc is what private industry gave you.
drb91 8y ago
It seems silly to reject regulation without seeing it and assuming the worst. After all, we already have the worst—closed source manipulative chat apps that exploit for profit for a small cabal of capitalists.
- briandear 8y ago
  It’s better than entrusting messaging to a cabal of socialists. Capitalism means that there is diversity in products. If you don’t like Apple’s iMessage or What’s App, create your own. You might like your government today, but I am unwilling to bet my life on government being trusted to do the right thing. Also, the right thing for you might not be the right thing for everyone. That’s what capitalism understands that socialism doesn’t.
  - drb91 8y ago
    Capitalism means there’s a diversity of products and they are ALL bad. We need collectivization to actually produce software that primarily benefits the user.
    - briandear 8y ago
      If we want the equivalent of 1987 Aeroflot, then sure, let’s do that. If the products are all bad, what’s stopping you from making a good one? You’d be a billionaire overnight, assuming the market agrees that they are all bad. I’ve used France’s government sponsored taxi app and it doesn’t come close to Uber’s. I’ve ridden in public buses and they don’t come close to the private FAANG shuttles in Silicon Valley. If you build technology optimized for everyone, that means it’s necessarily optimized for no one. As far as messaging apps, iMessage benefits me greatly. The premise that apps don’t benefit the user is flawed: if they didn’t benefit the user, nobody would use it — except government, we have no choice on using government or not. If the government meets 99 people’s needs, but doesn’t meet my needs, I’m stuck. I can’t switch to an alternative. If an app meets 99 people’s needs but not mine, I can switch to an alternative or build my own. Nothing is stopping you and your friends from building the most amazing messaging app ever. From someone who grew up remember Lada and Yugo, my faith in collectivism in product development is admittedly thin. Very few products from Soviet era factories were any good, I have no expectation that a government built Messaging service would be any better.
mcbutterbunz 8y ago
I agree with you. If security is the goal, trusting a nation state with the rules would be antithetical.
Xorlev 8y ago
More importantly, even if the standard wasn't required to have lawful intercepts, carriers want would provide it. They aren't in the business of making legal stands to protect privacy. There is a new standard to replace SMS in flight called RCS. Arguably, this makes the world better -- SMS sucks, RCS brings a lot of the iMessage features to standard carrier messaging. But therein lines the problem: it's carrier-controlled, and carriers want lawful intercept. So, the standard does not call for end-to-end encryption and it is not implemented. I still think this is a better state of the world than SMS, but it's pretty depressing that it's 2019 and e2e encryption isn't the default. I understand why it isn't when there's government interests in play, but it's still depressing.
SllX 8y ago
I agree with you. The Balkanization of messaging services is a minor inconvenience compared to the cost of a government mandated standard. That, and I’m fairly certain any government mandated standard would just be one more service to support.
shawnz 8y ago
> If a government messaging standard is introduced, it will absolutely be designed to consider lawful intercepts like US CALEA. Then that is obviously not what the parent is asking for. The government could decide to enforce an insecure messaging standard at any time. What does that have to do with the people demanding them to enforce a secure one? Are you suggesting that if we demand a secure messaging standard, it will give them the idea of turning around and enforcing an insecure one instead, as though they haven't had that idea already?
krageon 8y ago
"it will absolutely be designed to consider lawful intercepts" is a bit of a stretch. If we were talking just the US, I would agree that that precedent has been set. But we're not, we're also talking the EU - which doesn't have a history that dystopic.
- philpem 8y ago
  I dunno, Articles 11 and 13 came pretty close... the old EUCD proposal some years ago...
  - krageon 8y ago
    Those articles were rejected.
freeflight 8y ago
> If a government messaging standard is introduced, it will absolutely be designed to consider lawful intercepts like US CALEA. Happened exactly like that when Germany introduced their "official version" of e-mail, called "De-Mail". When the Chaos Computer Club pointed out how their whole system is insecure, due to, amongst other issues, a lack of end-to-end encryption. The German government simply decided to declare the whole thing as "secure" trough legal definitions [0]. Which means that in practice the system is not secure, but the law considers it secure because it fulfills the arbitrary, political, definitions for "secure transmission", which also includes the capabilities for lawful interception. [0] http://www.spiegel.de/netzwelt/netzpolitik/de-mail-bundestag-erklaert-bundes-mail-per-gesetz-als-sicher-a-895361.html http://www.spiegel.de/netzwelt/netzpolitik/de-mail-bundestag...
detaro 8y ago
Introducing a better "SMS" standard wouldn't kill your messaging apps, so I don't see the problem, even if they come with lawful intercept crap. SMS gets strictly better, even more secure messengers still exist and will continue to be used widely.