5 ms·

"We are writing to request that Facebook does not proceed with its plan to implement end-to-end encryption across its messaging services without ensuring that t

"We are writing to request that Facebook does not proceed with its plan to implement end-to-end encryption across its messaging services without ensuring that there is no reduction to user safety." Isn't the entire point of E2E Encryption for user safety, as in safety from the government reading your message?

kamyarg 7y ago
True E2E Encryption would also mean the platform(FB, Telegram, Google, Apple, etc.) also can not read the messages and thus the law enforcement can not force them to reveal what a user said because it would be impossible for them to know.
- snarf21 7y ago
  You are partially right but the issue is that E2E isn't even enough. E2E doesn't matter if they force a patched binary that also sends the data to the government. This is EXACTLY what the Australian laws saws they must do, oh and it is a gag order so they can't disclose it. I'm starting to wonder if this is a smokescreen. Eventually give in to E2E because you know you have got app store signing keys for the apps so you can upload a patched one with backdoors.
  - vageli 7y ago
    > You are partially right but the issue is that E2E isn't even enough. E2E doesn't matter if they force a patched binary that also sends the data to the government. This is EXACTLY what the Australian laws saws they must do, oh and it is a gag order so they can't disclose it. > I'm starting to wonder if this is a smokescreen. Eventually give in to E2E because you know you have got app store signing keys for the apps so you can upload a patched one with backdoors. Is there no way to prevent auto-updating of apps? If the app blocks access barring upgrade it may be suspicious. Though I guess the upgrade would probably be veiled in new features.
    - colejohnson66 7y ago
      On iOS, you can disable automatic app updates in the Settings.
      - autoexec 7y ago
        Some apps (like Signal) force you to upgrade or they eventually stop working. It's a terrible practice.
        josh2600 7y ago
        Right, because the alternative of having a broken user experience for a monotonically increasing set of your users isn’t terrible.
        autoexec 7y ago
        How would letting people continue to use what's been working for them cause a "broken user experience"? Users should have to power to decide when and if to update. If their old version causes them technical problems or exposes them to security issues that is their business. Software can (and often should) offer auto-updates to make things easier for most users but it should respect a user's choice not to update. Especially when updates often introduce anti-features and/or disable existing features.
        judge2020 7y ago
        Can't speak for Signal but an app might reasonably require an update when the API also had a breaking change.
  - Miner49er 7y ago
    This is a good point. E2E is better then not, but you still can't trust FB. Anybody who seriously cares about privacy will still use something open source.
    - nickik 7y ago
      But its not about those couple people, its about rolling out better security to billions of people. Even a 0.01% increase in secuirty is an incredible benefit if it runs on a platform like Facebook. It also totally changes how government has to force Facebook into giving them something. They can't just request access to some server anymore. The main way to defeat a state is to make mass survailance difficult enough that it doesn't scale well.
  - lysp 7y ago
    And not just the gag order, there is limited reporting so you don't even know if the laws are or are not being used.
- mlindner 7y ago
  Apple has true E2E encryption with iMessage if you don't turn on iCloud backup of your messages. It's encrypted when it leaves your device and decrypted on the receiving device. Furthermore the messages on your device are locked via passwords from the Secure Enclave.
  - adwww 7y ago
    > if you don't turn on iCloud backup of your messages You and whoever you are messaging of course.
whoisjuan 7y ago
They’re talking about national security. They want to read your messages so they can see if you’re a potential terrorist. They are not talking about users security. They don’t give a fuck about that as evidenced by the equifax debacle.
- ncallaway 7y ago
  > They want to read your messages so they can see if you’re a potential terrorist. That is their stated reason. If given access they will also read your messages to determine if you are a drug dealer, or a drug user, or have committed financial crimes, or if you're organizing disfavored political activity, or...
  - smolder 7y ago
    Even the capability of mass surveillance means that the public can be abused by the powers that be without much worry of backlash. It takes fear of the public out of the policy making equation, along with having a chilling effect. I don't think a representative democracy is really representative or a democracy anymore with a power imbalance that steep. Nevermind Citizens United.
driverdan 7y ago
Of course. That's exactly why they don't want E2E encryption.

kamyarg 7y ago

True E2E Encryption would also mean the platform(FB, Telegram, Google, Apple, etc.) also can not read the messages and thus the law enforcement can not force them to reveal what a user said because it would be impossible for them to know.

snarf21 7y ago
You are partially right but the issue is that E2E isn't even enough. E2E doesn't matter if they force a patched binary that also sends the data to the government. This is EXACTLY what the Australian laws saws they must do, oh and it is a gag order so they can't disclose it. I'm starting to wonder if this is a smokescreen. Eventually give in to E2E because you know you have got app store signing keys for the apps so you can upload a patched one with backdoors.
- vageli 7y ago
  > You are partially right but the issue is that E2E isn't even enough. E2E doesn't matter if they force a patched binary that also sends the data to the government. This is EXACTLY what the Australian laws saws they must do, oh and it is a gag order so they can't disclose it. > I'm starting to wonder if this is a smokescreen. Eventually give in to E2E because you know you have got app store signing keys for the apps so you can upload a patched one with backdoors. Is there no way to prevent auto-updating of apps? If the app blocks access barring upgrade it may be suspicious. Though I guess the upgrade would probably be veiled in new features.
  - colejohnson66 7y ago
    On iOS, you can disable automatic app updates in the Settings.
    - autoexec 7y ago
      Some apps (like Signal) force you to upgrade or they eventually stop working. It's a terrible practice.
      - josh2600 7y ago
        Right, because the alternative of having a broken user experience for a monotonically increasing set of your users isn’t terrible.
        autoexec 7y ago
        How would letting people continue to use what's been working for them cause a "broken user experience"? Users should have to power to decide when and if to update. If their old version causes them technical problems or exposes them to security issues that is their business. Software can (and often should) offer auto-updates to make things easier for most users but it should respect a user's choice not to update. Especially when updates often introduce anti-features and/or disable existing features.
      - judge2020 7y ago
        Can't speak for Signal but an app might reasonably require an update when the API also had a breaking change.
- Miner49er 7y ago
  This is a good point. E2E is better then not, but you still can't trust FB. Anybody who seriously cares about privacy will still use something open source.
  - nickik 7y ago
    But its not about those couple people, its about rolling out better security to billions of people. Even a 0.01% increase in secuirty is an incredible benefit if it runs on a platform like Facebook. It also totally changes how government has to force Facebook into giving them something. They can't just request access to some server anymore. The main way to defeat a state is to make mass survailance difficult enough that it doesn't scale well.
- lysp 7y ago
  And not just the gag order, there is limited reporting so you don't even know if the laws are or are not being used.
mlindner 7y ago
Apple has true E2E encryption with iMessage if you don't turn on iCloud backup of your messages. It's encrypted when it leaves your device and decrypted on the receiving device. Furthermore the messages on your device are locked via passwords from the Secure Enclave.
- adwww 7y ago
  > if you don't turn on iCloud backup of your messages You and whoever you are messaging of course.

whoisjuan 7y ago

They’re talking about national security. They want to read your messages so they can see if you’re a potential terrorist. They are not talking about users security. They don’t give a fuck about that as evidenced by the equifax debacle.

ncallaway 7y ago
> They want to read your messages so they can see if you’re a potential terrorist. That is their stated reason. If given access they will also read your messages to determine if you are a drug dealer, or a drug user, or have committed financial crimes, or if you're organizing disfavored political activity, or...
- smolder 7y ago
  Even the capability of mass surveillance means that the public can be abused by the powers that be without much worry of backlash. It takes fear of the public out of the policy making equation, along with having a chilling effect. I don't think a representative democracy is really representative or a democracy anymore with a power imbalance that steep. Nevermind Citizens United.

driverdan 7y ago

Of course. That's exactly why they don't want E2E encryption.