18 ms·

Open Letter from Governments to Facebook Is an All-Out Attack on Encryption

530 points by schoen 7y ago

michannne 7y ago
Is there some way Facebook can implement it quietly?
- deleted 7y ago
  [deleted]
- bryan_w 7y ago
  It's actually available today in messenger, but you have to start a "Secret conversation" first. FB's plan is to make it default
no_opinions 7y ago
EFF is special in that is completely disregards legitimate use cases to access information. I thought civil liberties was about fine tuning the scope of the government's power from sweeping in innocent citizens. EFF doesn't attempt to suggest a statute to do a better job in these areas. It lumps together a complicated subject. They appear to believe any reason the government has to want to access E2E communication is illegitimate. > Facebook and others would face immense pressure to also provide them to authoritarian regimes, who might seek to spy on dissidents in the name of combatting terrorism or civil unrest, for example. It's blocked in China. Russians use VK. > Many people—including journalists, human rights activists, and those at risk of abuse by intimate partners—use encryption to stay safe in the physical world as well as the online one. If someone's safety was at risk, why would they be on Facebook at all though. They sell their data in bulk. Maybe what you really want is a GDPR-like assurance as a consumer. > “enable law enforcement to obtain lawful access to content in a readable and usable format.” It's public information this is already done by large companies. Why not make this into a conversation about who can access the data, for what reasons, and what threshhold of proof is needed to minimize the sweep? > law enforcement and national security agencies in these three countries are asking for nothing less than access to every conversation that crosses every digital device. Law enforcement and national security are not the same thing. They're exacerbated by places like EFF that blur them together to get donations and keep laypeople running in circles. EFF is supposed to be staffed with lawyers. The least it could do is help the public understand the intricacies.
- koboll 7y ago
  I strongly disagree with you. But I just want to say it's disappointing that you're being downvoted by people because they disagree with you, rather than because you're not contributing to the conversation.
  - geomark 7y ago
    I feel the same. Upvoted not because I agree, but because I disagree and want to hear arguments that oppose mine. That's how it's done, son.
    - natch 7y ago
      Same, but I think saying these arguments "oppose yours" is a bit too flattering to the arguments. They aren't really legitimate enough to rise to the level of opposing a reasoned view. But I understand what you mean. Let's just recognize that they are ill-founded arguments coming from someone who has not grasped the basic points of the article, or the basic issues of what is being discussed.
  - kick 7y ago
    Paul Graham: I think it's ok to use the up and down arrows to express agreement. Obviously the uparrows aren't only for applauding politeness, so it seems reasonable that the downarrows aren't only for booing rudeness. It only becomes abuse when people resort to karma bombing: downvoting a lot of comments by one user without reading them in order to subtract maximum karma. Fortunately we now have several levels of software to protect against that. https://news.ycombinator.com/item?id=117171 https://news.ycombinator.com/item?id=117171
    - smudgymcscmudge 7y ago
      That’s good to know. I hadn’t read that before.
    - deleted 7y ago
      [deleted]
thelazydogsback 7y ago
But they aren't demanding this of Apple, for instance?
- dna_polymerase 7y ago
  They were at one point in time [0]. Formally they asked for unlocking the iPhone, which ultimately isn't too hard given we are talking about a 3 letter agency. It was more about a general rule for backdoors. [0]: https://en.wikipedia.org/wiki/FBI%E2%80%93Apple_encryption_dispute https://en.wikipedia.org/wiki/FBI%E2%80%93Apple_encryption_d...
- heretoo 7y ago
  I don't think this open letter is for Facebook. It is for the general public.
  - buboard 7y ago
    It's for Zuck
- ub 7y ago
  Apple makes a big deal about on-device security but they heavily promote backing up data to iCloud. They hold the keys to iCloud encrypted backups, and your backed up messages are happily handed over to LE when asked. That's why "going dark" isn't a problem on iMessage.
yen223 7y ago
One good thing from this kerfuffle is the tacit confirmation that end-to-end encryption actually works.
- BubRoss 7y ago
  Mathematically we know it works.
  - seandougall 7y ago
    Mathematically we can be reasonably certain it works, but afaik it’s not formally proven that, say, there isn’t an efficient algorithm for prime factorization. It just seems unlikely that the U.S. government would know of one that nobody else has managed to figure out. Plus, flawed implementations can open up side channels; this seems like an endorsement of Facebook’s implementation in that sense.
    - lucb1e 7y ago
      > afaik it’s not formally proven that, say, there isn’t an efficient algorithm for prime factorization Correct. AES or something is also not proven secure, we just don't know of an efficient attack on it. Since loads of people tried with significant resources, since there is often parallel discovery (so if the NSA discovers a flaw, it's likely that someone else figures it out as well), and since an algorithm is usually weakened before a complete break is found, the security community is quite sure it's secure. But it's not proven or certain.
    - bouncycastle 7y ago
      A one-time pad has been proven to be unbreakable. https://en.wikipedia.org/wiki/One-time_pad https://en.wikipedia.org/wiki/One-time_pad Quote "Claude Shannon proved, using information theory considerations, that the one-time pad has a property he termed perfect secrecy"
      - mantap 7y ago
        One time pads just push the problem to the random number generator (which has to be 100% perfect, free from correlations and bias). How exactly does one prove that their hardware RNG is uncorreleated? e.g. what you thought was RF noise could actually contain the theme tune to Barney the dinosaur. The most provable way we have to generate random numbers of the quality necessary is to generate them using... cryptographic ciphers.
deogeo 7y ago
Let me remind everyone to never let the "going dark" rhetoric go unchallenged. People are under vastly more surveillance (with data flowing one way, towards governments and corporations, not reciprocal like neighbors) than ever in history. But somehow the tiny scrap of privacy that encryption allows us to keep is framed as "going dark".
heretoo 7y ago
Perhaps if we only broke encryption only for messages to/from all children, that would satisfy their requirements?
- RealStickman 7y ago
  How are you going to check the age of somebody? Requiring them to sign up with an ID? From my experience PayPal for example doesn't actually verify your age, although you have to provide an ID.
- bayesian_horse 7y ago
  That's not such a bad idea actually, because text messaging is a primary part of predatory "grooming" activity. I'm sure those predators would appreciate "secret" Facebook messaging. They'll probably tell their victims that nobody can ever see the pictures they send "secretly".
K0SM0S 7y ago
What is the (business) rationale for Facebook to refuse? I mean, beyond the personal political opinion of Mark and shareholders, why would this company defy those governments? (asking naively because I feel blinded by my opinion, I can't make a good strategic case for it, only a moral one)
- nyolfen 7y ago
  opening up for one could subject them to opening up for everybody would be an easy one
- deogeo 7y ago
  Less time and money spent in legal battles (that can get especially tricky in international cases) over individual surveillance requests if Facebook can just throw their hands up saying "It is not within our ability to comply". It would also let them avoid inevitable articles such as "Facebook helps Beijing/Erdogan/Putin spy on protesters". I'm sure an executive could argue those drive away some users.
- oarabbus_ 7y ago
  Don't you think a significant number of users would leave the platform if they knew the service was backdoored by the government? There are plenty of competitors, many of which offer end-to-end encryption.
- dodobirdlord 7y ago
  > What is the (business) rationale for Facebook to refuse? Advertising, market segment/product substitution. There's a pervasive idea that Facebook must be gobbling up your communication data and it's starting to weird the general public out. It's very common to see people discussing how their phones must be recording for Facebook because they said something near their phone and then they saw a Facebook ad for it. Making a big publish show of fighting the government over whether messages can be intercepted at all provides the kind of advertising that money can't buy. Also, there will likely always be some subset of people who are more technically savvy and care more about their privacy. These people tend to also set technical trends for the rest of the population. People may leave your platform for being too insecure, but nobody is going to leave your platform for being too secure, so build a secure product and target both market segments. This will give you a larger market, and will also deny your competitors the opportunity to grow by luring away a subset of your users by offering what is to those users a superior product.
edoo 7y ago
An all out attack on encryption is an all out attack on free speech. It is no different than using shorthand, or symbols, or a made up language to communicate.
- chimi 7y ago
  You make me wonder if perhaps new languages evolved for exactly this purpose. To conceal ideas and thoughts from the enemy.
  - Intermernet 7y ago
    There are elements of this. Two examples: 1. Younger generations develop colloquial terms that the older generations don't understand. This allows the younger generation to communicate more freely. 2. Highly specialised positions develop "jargon" which, although arguably allows more accurate and concise communication, also allows elements of protectionism and in-group gatekeeping. Both of these examples are more complex than just "To conceal ideas and thoughts from the enemy", but it's definitely a motivating factor in language evolution.
    - beefalo 7y ago
      Do you have any citations for [1]? My intuition is that it's no different than the jargon mentioned in [2], more of just a made up term to more accurately/efficiently communicate.
      - Intermernet 7y ago
        No citations, just personal experience :-) Many nicknames for drugs, code words for parties, colloquial terms for sex have survived the 20+ years since I last had to use them. EDIT: An interesting article that may aid in further research: https://www.theguardian.com/media/mind-your-language/2016/apr/08/in-with-the-in-crowd-secret-languages-can-confuse-exclude-or-empower https://www.theguardian.com/media/mind-your-language/2016/ap...
  - nxpnsv 7y ago
yellow_postit 7y ago
In addition to the defense of the need for real encryption I’d like to see EFF and others go on a more proactive offense as well proposing solutions for the bogeymen that governments keep raising — especially around child exploitation.
- Canada 7y ago
  Why should the burden of solving that be placed on the defenders of privacy? The people calling for the power to spy on everyone have not offered any explanation of how backdooring everyone's communication reduces sexual abuse of children. Of course, they don't really care about child exploitation. They are cynically using the issue as a pretext to preserve and normalize a massive expansion of their power. The DOD budget is $617B[1]. The entire DOJ budget is $6B, with about half of that allocated to law enforcement[2]. I'm not sure precisely how much of that is spent investigating child exploitation, but the DOJ doesn't view it as a high enough high priority to even mention it in the budget. A couple of highlights: - $295 to fight the opioid crisis. How successful was the drug war with the ability to tap phones again? - $486M for violence against women programs and $45M for victims of human trafficking. Maybe next they will tell us that reading our messages and snooping our video calls will make women safer. [Edit: Also interesting, the FBI's nearly $10B budget request[3]. The budget request doesn't break down the spending, but it does include a section on crimes against children almost at the very end. They highlight their recent investigations have led to about 1000 arrests. The FBI's stated top priorities[4] do not include crimes against children.] [1] https://en.wikipedia.org/wiki/Military_budget_of_the_United_States https://en.wikipedia.org/wiki/Military_budget_of_the_United_... [2] https://www.justice.gov/jmd/page/file/1033086/download https://www.justice.gov/jmd/page/file/1033086/download [3] https://www.fbi.gov/news/testimony/fbi-budget-request-for-fiscal-year-2019 https://www.fbi.gov/news/testimony/fbi-budget-request-for-fi... [4] https://en.wikipedia.org/wiki/Federal_Bureau_of_Investigation#Budget,_mission,_and_priorities https://en.wikipedia.org/wiki/Federal_Bureau_of_Investigatio...
  - jonnybgood 7y ago
    Looking at priorities is not a good metric. Federal law enforcement priorities will be different than a state’s law enforcement priorities. It may be the law enforcement of the states who see it as priority and pushing it up to the federal government to do something to make their job easier.
riazrizvi 7y ago
Throughout history when societies enjoy above average improvement, it is because they are able to displace inheritance-based systems. These inheritance-based systems hand out benefits to random children, they subvert progress by enabling the incompetent and disabling the competent. Commonly, people who inherit stuff (money, authority, property) keep skewing laws to prevent others benefiting from the fruits of their labor, so that inheritors can maintain ownership. They do this by paying to skew laws to benefit owners over achievers. If privacy doesn't exist anymore, then the inheritors will receive a level of power they have never had before. They will be unstoppable. We will reach an end-state of cultural-political development where the inheritors will no longer be challenged. We have had dark periods of time when inheritors have ruled for long periods, ancient Egypt with mass enslavement for example. Without privacy we will reach an event-horizon of wealth inequality, and no political counter-movement will be able to take root to challenge it. We are seeing the beginning of this in Hong Kong, we are seeing it in an uncompetitive pay-to-play patent system, in an increasingly monopolistic corporate environment, in increasingly uncompetitive marketplaces in dark pool trading systems, and in Apple/Microsoft/Facebook/Google/Amazon app stores and tech markets. The threat to privacy is the greatest threat to progressive civilization we have ever encountered IMO.
- f883l 7y ago
  This reminds me of one curious legend / hypothesis about the last days of Atlantis that I read in some book. The story was basically that during the Atlantis era, the "world config" was tuned slightly differently and that allowed what we'd call magic: curious long distance effects that could be caused without the modern tech. For some time it went well, but then it started sliding to the dark side: bad and evil people, that could use anything to gain power, kept winning over the good people who were restricted by "moral" and things like that. By about 10,000 B.C. the power of evil people became indisputable: they could see nearly everything and could instantly squash any opposition by means of notoriously powerful black magic. There were a couple unsuccessful attempts to bring power back to good people, but it never worked for long time: evil people kept taking it back quickly and efficiently. I think, the Lord of The Rings book took the idea from that story. The situation looked completely hopeless and there was no point to continue running this show, so shortly before 10,000 B.C. the entire civilization was "hard reset" and the "world config" was tweaked to prevent any long distance effects. Since then people are following the technology track. As we see, it's taken only 12,000 years to replicate the very same system without any magic: powerful long distance weapons and amazing surveillance technology that would impress even the Sauron form the movie. We are only missing that Sauron who would consolidate all the power.
pharrington 7y ago
The open letter, for context: [https://www.justice.gov/opa/pr/attorney-general-barr-signs-letter-facebook-us-uk-and-australian-leaders-regarding-use-end https://www.justice.gov/opa/pr/attorney-general-barr-signs-l...] [https://www.gov.uk/government/publications/open-letter-to-mark-zuckerberg https://www.gov.uk/government/publications/open-letter-to-ma...] [https://www.gov.uk/government/publications/open-letter-to-mark-zuckerberg/open-letter-from-the-home-secretary-alongside-us-attorney-general-barr-secretary-of-homeland-security-acting-mcaleenan-and-australian-minister-f https://www.gov.uk/government/publications/open-letter-to-ma...]
darawk 7y ago
It's interesting how governments come to feel entitled to forms of surveillance. For thousands of years financial transactions were completely illegible to government. They took place hand to hand, either in cash or barter. But now that transactions are digitized, it is actually illegal to conduct certain types of transactions anonymously (KYC/AML laws). This came about because governments got used to being able to peer into the financial lives of their citizens, and once they got used to it, they didn't like it when people circumvented that, so they made it a crime. The same is true here of private messaging. Governments got used to being able to read our messages. They have come to rely on it. And so now they want to make it illegal for us to keep them out. I guess what i'm saying is: We ought to be extremely careful what we allow our governments to get used to doing. There is an argument to be made that the original sin here was allowing wiretaps at all, even when the medium was un-encrypted.
- lisper 7y ago
  You talk about governments as if they were an alien sentient life form ("governments ... feel entitled"). They're not. They are groups of people who serve constituencies. You could tell the exact same story in reverse: the lack of surveillance technology made people feel entitled to anonymous financial transactions. The feelings of entitlement (if you want to call them that) follow the available technology. But ultimately these decisions are always trade-offs between one feeling of entitlement in one constituency and another feeling of entitlement in another. In this case, one side feels entitled to privacy, the other, to security (or the illusion of security, which some people find valuable even in the absence of actual security). I point this out not because I disagree with your baseline position that privacy is valuable. I don't. I point this out because i believe that arguing for it on the basis that government feelings of entitlement are somehow less legitimate than the feeling of entitlement of non-governmental constituencies is not going to be an effective strategy because it's based on a false premise.
  - darawk 7y ago
    > I point this out not because I disagree with your baseline position that privacy is valuable. I don't. I point this out because i believe that arguing for it on the basis that government feelings of entitlement are somehow less legitimate than the feeling of entitlement of non-governmental constituencies is not going to be an effective strategy because it's based on a false premise. I am not arguing that. I was explaining the process by which the feeling of entitlement arose. The argument for the legitimacy of privacy rights is one I assumed I didn't have to make at all in this venue. I suppose we could have that debate if you want, but I was not trying to make that case here. If we assume as an axiom that privacy is a right, the question then becomes: how do we structure our governments and public institutions to protect those rights? And one answer to that is to be more intentional about which invasions of privacy we allow than perhaps we have been in the past. With the foreknowledge that governments and institutions will come to depend on any access they are given.
throwaway13337 7y ago
The ability to privately communicate with other citizens of your country is fundamental to a functioning representative democracy. It should be as clear as day that an attack on encryption is an attack on the values of America. This is the tact that should be taken in the conversation - is the attorney general so anti-American as to request this?
deleted 7y ago
[deleted]
EGreg 7y ago
Bruce Shneier always had a good response to these governments: Which other governments would you like to have a backdoor?
- TheCapeGreek 7y ago
  Five to Fourteen-eyes[0] wouldn't mind. [0]: https://en.wikipedia.org/wiki/Five_Eyes https://en.wikipedia.org/wiki/Five_Eyes
- bayesian_horse 7y ago
  You can always switch to VK.
EGreg 7y ago
You know, for many years I have been writing and speaking about the dangers of centralizing power in the hands of a few social networks. That’s what all this comes from. (Remember this? https://www.eff.org/deeplinks/2018/12/congress-censors-internet-eff-continues-fight-fosta-2018-review https://www.eff.org/deeplinks/2018/12/congress-censors-inter...). We have no good software alternatives to Facebook and Google — for now. So we accept FEUDALISM on the Web! Look at the latest post here for example: https://qbix.com/blog https://qbix.com/blog On HN and at EFF we all diagnose the problem correctly, but the solution requires a platform to coordinate everyone. This platform currently does not exist. And it must be open source, permissionless and work across domains. If you want, come join me in making it. (Yes, scuttlebutt, matrix, mastodon etc. exist but they are not mainstream. SAFE network is probably the best design around, but they never even release it.) I already went ahead and put about half a million $ of our company’s revenues into building this platform. We have to go the other way — get people to use it first, like they do Wordpress! 34% of all websites now. And then attract developers. We designed a crypto ecosystem for it to incentivize people to participate: https://qbix.com/token https://qbix.com/token This is not encouraging anyone to buy anything. Just information about what we are working on. I feel like very few people will get what we are doing until it’s ready: liberating people from giant centralized corporations and giving them control and choice. Like Linux and Wordpress and the Web did. Contact me if you’re interested to contribute to this platform or use it for your own web projects like you use Wordpress/Drupal (greg at-symbol and then qbix.com)
deleted 7y ago
[deleted]
Havoc 7y ago
I find it rather ominous that they are coordinated in this too. Not big on shadow world gov conspiracy theories but that seems rather...strange
gorgoiler 7y ago
Writing “open letters” always feels incredibly passive aggressive. It’s shameful to see it used as a tool of government policy. If democratic governments want to force Facebook to keep files on their citizens for law and order purposes, pass a law that says that explicitly. This whole “nice social media business you have there, would be a shame if something were to happen to it...” is extra-democratic bullying.
sbhn 7y ago
Your governments have been reading your facebook messages, sms, logging telephone calls forever. This attack on encryption is attempt by the governments to suggest that somehow facebook is actually your friend and has some weight in protecting you. Facebook is losing dominance on the access of your communications, and your government wants you back on facebook where its contractors monetise it most with the least amount of effort. The security contracts need to maintain high ROI, otherwise they will lobby for more of your tax money in the name of security.
bayesian_horse 7y ago
Users will eventually switch to services that offer end-to-end encryption, and Facebook won't have a choice. Some governments will eventually try to shut down such services.
nerbert 7y ago
I'm baffled to see how governments are able to synchronize, send a crystal clear message and take action when it serves their interests.
concordDance 7y ago
> As well as child abuse imagery, these referrals include more than 8,000 reports related to attempts by offenders to meet children online and groom or entice them into sharing indecent imagery or meeting in real life. It would be nice if people could commit to seperating out the requests by shoolmates for naked pics of 17 year olds and requests by older men for naked pics of 10 year olds when presenting these stats. :/ As it is, information like this (and indeed most stats you see in public discourse) is useless for determining the scale of a problem and sensible public policy approaches.
m-p-3 7y ago
It's always about control under the pretense of security. Rights to privacy can be violated and dismissed, but good encryption itself cannot. Encryption is the last frontier of privacy, and we must defend it vigorously. Encryption, like any tool, can be used to do good things and bad things, stop blaming the tool for the user's behavior. Law enforcement agencies will need to adapt to that reality instead of using a blanket ban or backdoors into everyone's lives under the pretense that there are bad people out there and to think of the children™ excuse that has been used and abused over and over again.
nhumrich 7y ago
I find it funny, that in effort to "catch criminals", government tries to pass laws to make things those criminals do, illegal. If you make encryption illegal, its not going to stop the human trafficker from using it. They are already breaking the law... what's another smaller law to help protect them? So they go to jail for encryption rather than human trafficking. The laws are now helping them, while hurting all the good citizens that just want privacy.

530 points by schoen 7y ago

michannne 7y ago

Is there some way Facebook can implement it quietly?

deleted 7y ago
[deleted]
bryan_w 7y ago
It's actually available today in messenger, but you have to start a "Secret conversation" first. FB's plan is to make it default

no_opinions 7y ago

EFF is special in that is completely disregards legitimate use cases to access information. I thought civil liberties was about fine tuning the scope of the government's power from sweeping in innocent citizens. EFF doesn't attempt to suggest a statute to do a better job in these areas. It lumps together a complicated subject. They appear to believe any reason the government has to want to access E2E communication is illegitimate. > Facebook and others would face immense pressure to also provide them to authoritarian regimes, who might seek to spy on dissidents in the name of combatting terrorism or civil unrest, for example. It's blocked in China. Russians use VK. > Many people—including journalists, human rights activists, and those at risk of abuse by intimate partners—use encryption to stay safe in the physical world as well as the online one. If someone's safety was at risk, why would they be on Facebook at all though. They sell their data in bulk. Maybe what you really want is a GDPR-like assurance as a consumer. > “enable law enforcement to obtain lawful access to content in a readable and usable format.” It's public information this is already done by large companies. Why not make this into a conversation about who can access the data, for what reasons, and what threshhold of proof is needed to minimize the sweep? > law enforcement and national security agencies in these three countries are asking for nothing less than access to every conversation that crosses every digital device. Law enforcement and national security are not the same thing. They're exacerbated by places like EFF that blur them together to get donations and keep laypeople running in circles. EFF is supposed to be staffed with lawyers. The least it could do is help the public understand the intricacies.

koboll 7y ago
I strongly disagree with you. But I just want to say it's disappointing that you're being downvoted by people because they disagree with you, rather than because you're not contributing to the conversation.
- geomark 7y ago
  I feel the same. Upvoted not because I agree, but because I disagree and want to hear arguments that oppose mine. That's how it's done, son.
  - natch 7y ago
    Same, but I think saying these arguments "oppose yours" is a bit too flattering to the arguments. They aren't really legitimate enough to rise to the level of opposing a reasoned view. But I understand what you mean. Let's just recognize that they are ill-founded arguments coming from someone who has not grasped the basic points of the article, or the basic issues of what is being discussed.
- kick 7y ago
  Paul Graham: I think it's ok to use the up and down arrows to express agreement. Obviously the uparrows aren't only for applauding politeness, so it seems reasonable that the downarrows aren't only for booing rudeness. It only becomes abuse when people resort to karma bombing: downvoting a lot of comments by one user without reading them in order to subtract maximum karma. Fortunately we now have several levels of software to protect against that. https://news.ycombinator.com/item?id=117171 https://news.ycombinator.com/item?id=117171
  - smudgymcscmudge 7y ago
    That’s good to know. I hadn’t read that before.
  - deleted 7y ago
    [deleted]

thelazydogsback 7y ago

But they aren't demanding this of Apple, for instance?

dna_polymerase 7y ago
They were at one point in time [0]. Formally they asked for unlocking the iPhone, which ultimately isn't too hard given we are talking about a 3 letter agency. It was more about a general rule for backdoors. [0]: https://en.wikipedia.org/wiki/FBI%E2%80%93Apple_encryption_dispute https://en.wikipedia.org/wiki/FBI%E2%80%93Apple_encryption_d...
heretoo 7y ago
I don't think this open letter is for Facebook. It is for the general public.
- buboard 7y ago
  It's for Zuck
ub 7y ago
Apple makes a big deal about on-device security but they heavily promote backing up data to iCloud. They hold the keys to iCloud encrypted backups, and your backed up messages are happily handed over to LE when asked. That's why "going dark" isn't a problem on iMessage.

yen223 7y ago

One good thing from this kerfuffle is the tacit confirmation that end-to-end encryption actually works.

BubRoss 7y ago
Mathematically we know it works.
- seandougall 7y ago
  Mathematically we can be reasonably certain it works, but afaik it’s not formally proven that, say, there isn’t an efficient algorithm for prime factorization. It just seems unlikely that the U.S. government would know of one that nobody else has managed to figure out. Plus, flawed implementations can open up side channels; this seems like an endorsement of Facebook’s implementation in that sense.
  - lucb1e 7y ago
    > afaik it’s not formally proven that, say, there isn’t an efficient algorithm for prime factorization Correct. AES or something is also not proven secure, we just don't know of an efficient attack on it. Since loads of people tried with significant resources, since there is often parallel discovery (so if the NSA discovers a flaw, it's likely that someone else figures it out as well), and since an algorithm is usually weakened before a complete break is found, the security community is quite sure it's secure. But it's not proven or certain.
  - bouncycastle 7y ago
    A one-time pad has been proven to be unbreakable. https://en.wikipedia.org/wiki/One-time_pad https://en.wikipedia.org/wiki/One-time_pad Quote "Claude Shannon proved, using information theory considerations, that the one-time pad has a property he termed perfect secrecy"
    - mantap 7y ago
      One time pads just push the problem to the random number generator (which has to be 100% perfect, free from correlations and bias). How exactly does one prove that their hardware RNG is uncorreleated? e.g. what you thought was RF noise could actually contain the theme tune to Barney the dinosaur. The most provable way we have to generate random numbers of the quality necessary is to generate them using... cryptographic ciphers.

deogeo 7y ago

Let me remind everyone to never let the "going dark" rhetoric go unchallenged. People are under vastly more surveillance (with data flowing one way, towards governments and corporations, not reciprocal like neighbors) than ever in history. But somehow the tiny scrap of privacy that encryption allows us to keep is framed as "going dark".

heretoo 7y ago

Perhaps if we only broke encryption only for messages to/from all children, that would satisfy their requirements?

RealStickman 7y ago
How are you going to check the age of somebody? Requiring them to sign up with an ID? From my experience PayPal for example doesn't actually verify your age, although you have to provide an ID.
bayesian_horse 7y ago
That's not such a bad idea actually, because text messaging is a primary part of predatory "grooming" activity. I'm sure those predators would appreciate "secret" Facebook messaging. They'll probably tell their victims that nobody can ever see the pictures they send "secretly".

K0SM0S 7y ago

What is the (business) rationale for Facebook to refuse? I mean, beyond the personal political opinion of Mark and shareholders, why would this company defy those governments? (asking naively because I feel blinded by my opinion, I can't make a good strategic case for it, only a moral one)

nyolfen 7y ago
opening up for one could subject them to opening up for everybody would be an easy one
deogeo 7y ago
Less time and money spent in legal battles (that can get especially tricky in international cases) over individual surveillance requests if Facebook can just throw their hands up saying "It is not within our ability to comply". It would also let them avoid inevitable articles such as "Facebook helps Beijing/Erdogan/Putin spy on protesters". I'm sure an executive could argue those drive away some users.
oarabbus_ 7y ago
Don't you think a significant number of users would leave the platform if they knew the service was backdoored by the government? There are plenty of competitors, many of which offer end-to-end encryption.
dodobirdlord 7y ago
> What is the (business) rationale for Facebook to refuse? Advertising, market segment/product substitution. There's a pervasive idea that Facebook must be gobbling up your communication data and it's starting to weird the general public out. It's very common to see people discussing how their phones must be recording for Facebook because they said something near their phone and then they saw a Facebook ad for it. Making a big publish show of fighting the government over whether messages can be intercepted at all provides the kind of advertising that money can't buy. Also, there will likely always be some subset of people who are more technically savvy and care more about their privacy. These people tend to also set technical trends for the rest of the population. People may leave your platform for being too insecure, but nobody is going to leave your platform for being too secure, so build a secure product and target both market segments. This will give you a larger market, and will also deny your competitors the opportunity to grow by luring away a subset of your users by offering what is to those users a superior product.

edoo 7y ago

An all out attack on encryption is an all out attack on free speech. It is no different than using shorthand, or symbols, or a made up language to communicate.

chimi 7y ago
You make me wonder if perhaps new languages evolved for exactly this purpose. To conceal ideas and thoughts from the enemy.
- Intermernet 7y ago
  There are elements of this. Two examples: 1. Younger generations develop colloquial terms that the older generations don't understand. This allows the younger generation to communicate more freely. 2. Highly specialised positions develop "jargon" which, although arguably allows more accurate and concise communication, also allows elements of protectionism and in-group gatekeeping. Both of these examples are more complex than just "To conceal ideas and thoughts from the enemy", but it's definitely a motivating factor in language evolution.
  - beefalo 7y ago
    Do you have any citations for [1]? My intuition is that it's no different than the jargon mentioned in [2], more of just a made up term to more accurately/efficiently communicate.
    - Intermernet 7y ago
      No citations, just personal experience :-) Many nicknames for drugs, code words for parties, colloquial terms for sex have survived the 20+ years since I last had to use them. EDIT: An interesting article that may aid in further research: https://www.theguardian.com/media/mind-your-language/2016/apr/08/in-with-the-in-crowd-secret-languages-can-confuse-exclude-or-empower https://www.theguardian.com/media/mind-your-language/2016/ap...
- nxpnsv 7y ago

yellow_postit 7y ago

In addition to the defense of the need for real encryption I’d like to see EFF and others go on a more proactive offense as well proposing solutions for the bogeymen that governments keep raising — especially around child exploitation.

Canada 7y ago
Why should the burden of solving that be placed on the defenders of privacy? The people calling for the power to spy on everyone have not offered any explanation of how backdooring everyone's communication reduces sexual abuse of children. Of course, they don't really care about child exploitation. They are cynically using the issue as a pretext to preserve and normalize a massive expansion of their power. The DOD budget is $617B[1]. The entire DOJ budget is $6B, with about half of that allocated to law enforcement[2]. I'm not sure precisely how much of that is spent investigating child exploitation, but the DOJ doesn't view it as a high enough high priority to even mention it in the budget. A couple of highlights: - $295 to fight the opioid crisis. How successful was the drug war with the ability to tap phones again? - $486M for violence against women programs and $45M for victims of human trafficking. Maybe next they will tell us that reading our messages and snooping our video calls will make women safer. [Edit: Also interesting, the FBI's nearly $10B budget request[3]. The budget request doesn't break down the spending, but it does include a section on crimes against children almost at the very end. They highlight their recent investigations have led to about 1000 arrests. The FBI's stated top priorities[4] do not include crimes against children.] [1] https://en.wikipedia.org/wiki/Military_budget_of_the_United_States https://en.wikipedia.org/wiki/Military_budget_of_the_United_... [2] https://www.justice.gov/jmd/page/file/1033086/download https://www.justice.gov/jmd/page/file/1033086/download [3] https://www.fbi.gov/news/testimony/fbi-budget-request-for-fiscal-year-2019 https://www.fbi.gov/news/testimony/fbi-budget-request-for-fi... [4] https://en.wikipedia.org/wiki/Federal_Bureau_of_Investigation#Budget,_mission,_and_priorities https://en.wikipedia.org/wiki/Federal_Bureau_of_Investigatio...
- jonnybgood 7y ago
  Looking at priorities is not a good metric. Federal law enforcement priorities will be different than a state’s law enforcement priorities. It may be the law enforcement of the states who see it as priority and pushing it up to the federal government to do something to make their job easier.

riazrizvi 7y ago

Throughout history when societies enjoy above average improvement, it is because they are able to displace inheritance-based systems. These inheritance-based systems hand out benefits to random children, they subvert progress by enabling the incompetent and disabling the competent. Commonly, people who inherit stuff (money, authority, property) keep skewing laws to prevent others benefiting from the fruits of their labor, so that inheritors can maintain ownership. They do this by paying to skew laws to benefit owners over achievers. If privacy doesn't exist anymore, then the inheritors will receive a level of power they have never had before. They will be unstoppable. We will reach an end-state of cultural-political development where the inheritors will no longer be challenged. We have had dark periods of time when inheritors have ruled for long periods, ancient Egypt with mass enslavement for example. Without privacy we will reach an event-horizon of wealth inequality, and no political counter-movement will be able to take root to challenge it. We are seeing the beginning of this in Hong Kong, we are seeing it in an uncompetitive pay-to-play patent system, in an increasingly monopolistic corporate environment, in increasingly uncompetitive marketplaces in dark pool trading systems, and in Apple/Microsoft/Facebook/Google/Amazon app stores and tech markets. The threat to privacy is the greatest threat to progressive civilization we have ever encountered IMO.

f883l 7y ago
This reminds me of one curious legend / hypothesis about the last days of Atlantis that I read in some book. The story was basically that during the Atlantis era, the "world config" was tuned slightly differently and that allowed what we'd call magic: curious long distance effects that could be caused without the modern tech. For some time it went well, but then it started sliding to the dark side: bad and evil people, that could use anything to gain power, kept winning over the good people who were restricted by "moral" and things like that. By about 10,000 B.C. the power of evil people became indisputable: they could see nearly everything and could instantly squash any opposition by means of notoriously powerful black magic. There were a couple unsuccessful attempts to bring power back to good people, but it never worked for long time: evil people kept taking it back quickly and efficiently. I think, the Lord of The Rings book took the idea from that story. The situation looked completely hopeless and there was no point to continue running this show, so shortly before 10,000 B.C. the entire civilization was "hard reset" and the "world config" was tweaked to prevent any long distance effects. Since then people are following the technology track. As we see, it's taken only 12,000 years to replicate the very same system without any magic: powerful long distance weapons and amazing surveillance technology that would impress even the Sauron form the movie. We are only missing that Sauron who would consolidate all the power.

pharrington 7y ago

The open letter, for context: [https://www.justice.gov/opa/pr/attorney-general-barr-signs-letter-facebook-us-uk-and-australian-leaders-regarding-use-end https://www.justice.gov/opa/pr/attorney-general-barr-signs-l...] [https://www.gov.uk/government/publications/open-letter-to-mark-zuckerberg https://www.gov.uk/government/publications/open-letter-to-ma...] [https://www.gov.uk/government/publications/open-letter-to-mark-zuckerberg/open-letter-from-the-home-secretary-alongside-us-attorney-general-barr-secretary-of-homeland-security-acting-mcaleenan-and-australian-minister-f https://www.gov.uk/government/publications/open-letter-to-ma...]

darawk 7y ago

It's interesting how governments come to feel entitled to forms of surveillance. For thousands of years financial transactions were completely illegible to government. They took place hand to hand, either in cash or barter. But now that transactions are digitized, it is actually illegal to conduct certain types of transactions anonymously (KYC/AML laws). This came about because governments got used to being able to peer into the financial lives of their citizens, and once they got used to it, they didn't like it when people circumvented that, so they made it a crime. The same is true here of private messaging. Governments got used to being able to read our messages. They have come to rely on it. And so now they want to make it illegal for us to keep them out. I guess what i'm saying is: We ought to be extremely careful what we allow our governments to get used to doing. There is an argument to be made that the original sin here was allowing wiretaps at all, even when the medium was un-encrypted.

lisper 7y ago
You talk about governments as if they were an alien sentient life form ("governments ... feel entitled"). They're not. They are groups of people who serve constituencies. You could tell the exact same story in reverse: the lack of surveillance technology made people feel entitled to anonymous financial transactions. The feelings of entitlement (if you want to call them that) follow the available technology. But ultimately these decisions are always trade-offs between one feeling of entitlement in one constituency and another feeling of entitlement in another. In this case, one side feels entitled to privacy, the other, to security (or the illusion of security, which some people find valuable even in the absence of actual security). I point this out not because I disagree with your baseline position that privacy is valuable. I don't. I point this out because i believe that arguing for it on the basis that government feelings of entitlement are somehow less legitimate than the feeling of entitlement of non-governmental constituencies is not going to be an effective strategy because it's based on a false premise.
- darawk 7y ago
  > I point this out not because I disagree with your baseline position that privacy is valuable. I don't. I point this out because i believe that arguing for it on the basis that government feelings of entitlement are somehow less legitimate than the feeling of entitlement of non-governmental constituencies is not going to be an effective strategy because it's based on a false premise. I am not arguing that. I was explaining the process by which the feeling of entitlement arose. The argument for the legitimacy of privacy rights is one I assumed I didn't have to make at all in this venue. I suppose we could have that debate if you want, but I was not trying to make that case here. If we assume as an axiom that privacy is a right, the question then becomes: how do we structure our governments and public institutions to protect those rights? And one answer to that is to be more intentional about which invasions of privacy we allow than perhaps we have been in the past. With the foreknowledge that governments and institutions will come to depend on any access they are given.

throwaway13337 7y ago

The ability to privately communicate with other citizens of your country is fundamental to a functioning representative democracy. It should be as clear as day that an attack on encryption is an attack on the values of America. This is the tact that should be taken in the conversation - is the attorney general so anti-American as to request this?

deleted 7y ago

[deleted]

EGreg 7y ago

Bruce Shneier always had a good response to these governments: Which other governments would you like to have a backdoor?

TheCapeGreek 7y ago
Five to Fourteen-eyes[0] wouldn't mind. [0]: https://en.wikipedia.org/wiki/Five_Eyes https://en.wikipedia.org/wiki/Five_Eyes
bayesian_horse 7y ago
You can always switch to VK.

EGreg 7y ago

You know, for many years I have been writing and speaking about the dangers of centralizing power in the hands of a few social networks. That’s what all this comes from. (Remember this? https://www.eff.org/deeplinks/2018/12/congress-censors-internet-eff-continues-fight-fosta-2018-review https://www.eff.org/deeplinks/2018/12/congress-censors-inter...). We have no good software alternatives to Facebook and Google — for now. So we accept FEUDALISM on the Web! Look at the latest post here for example: https://qbix.com/blog https://qbix.com/blog On HN and at EFF we all diagnose the problem correctly, but the solution requires a platform to coordinate everyone. This platform currently does not exist. And it must be open source, permissionless and work across domains. If you want, come join me in making it. (Yes, scuttlebutt, matrix, mastodon etc. exist but they are not mainstream. SAFE network is probably the best design around, but they never even release it.) I already went ahead and put about half a million $ of our company’s revenues into building this platform. We have to go the other way — get people to use it first, like they do Wordpress! 34% of all websites now. And then attract developers. We designed a crypto ecosystem for it to incentivize people to participate: https://qbix.com/token https://qbix.com/token This is not encouraging anyone to buy anything. Just information about what we are working on. I feel like very few people will get what we are doing until it’s ready: liberating people from giant centralized corporations and giving them control and choice. Like Linux and Wordpress and the Web did. Contact me if you’re interested to contribute to this platform or use it for your own web projects like you use Wordpress/Drupal (greg at-symbol and then qbix.com)

deleted 7y ago

[deleted]

Havoc 7y ago

I find it rather ominous that they are coordinated in this too. Not big on shadow world gov conspiracy theories but that seems rather...strange

gorgoiler 7y ago

Writing “open letters” always feels incredibly passive aggressive. It’s shameful to see it used as a tool of government policy. If democratic governments want to force Facebook to keep files on their citizens for law and order purposes, pass a law that says that explicitly. This whole “nice social media business you have there, would be a shame if something were to happen to it...” is extra-democratic bullying.

sbhn 7y ago

Your governments have been reading your facebook messages, sms, logging telephone calls forever. This attack on encryption is attempt by the governments to suggest that somehow facebook is actually your friend and has some weight in protecting you. Facebook is losing dominance on the access of your communications, and your government wants you back on facebook where its contractors monetise it most with the least amount of effort. The security contracts need to maintain high ROI, otherwise they will lobby for more of your tax money in the name of security.

bayesian_horse 7y ago

Users will eventually switch to services that offer end-to-end encryption, and Facebook won't have a choice. Some governments will eventually try to shut down such services.

nerbert 7y ago

I'm baffled to see how governments are able to synchronize, send a crystal clear message and take action when it serves their interests.

concordDance 7y ago

> As well as child abuse imagery, these referrals include more than 8,000 reports related to attempts by offenders to meet children online and groom or entice them into sharing indecent imagery or meeting in real life. It would be nice if people could commit to seperating out the requests by shoolmates for naked pics of 17 year olds and requests by older men for naked pics of 10 year olds when presenting these stats. :/ As it is, information like this (and indeed most stats you see in public discourse) is useless for determining the scale of a problem and sensible public policy approaches.

m-p-3 7y ago

It's always about control under the pretense of security. Rights to privacy can be violated and dismissed, but good encryption itself cannot. Encryption is the last frontier of privacy, and we must defend it vigorously. Encryption, like any tool, can be used to do good things and bad things, stop blaming the tool for the user's behavior. Law enforcement agencies will need to adapt to that reality instead of using a blanket ban or backdoors into everyone's lives under the pretense that there are bad people out there and to think of the children™ excuse that has been used and abused over and over again.

nhumrich 7y ago

I find it funny, that in effort to "catch criminals", government tries to pass laws to make things those criminals do, illegal. If you make encryption illegal, its not going to stop the human trafficker from using it. They are already breaking the law... what's another smaller law to help protect them? So they go to jail for encryption rather than human trafficking. The laws are now helping them, while hurting all the good citizens that just want privacy.