26 ms·

The EARN IT act is an attack on end-to-end encryption

• wilkystyle 7y ago
  The argument from those in power against encryption is mind-bogglingly stupid, and I don't know if it is due to an extreme ignorance, or because of a lust for the power and leverage that mass surveillance grants a governing entity (I suppose it could be both?) Regardless, using the argument of child pornography and sex trafficking is an emotional play, and it is solely designed to resonate with those who also do not understand the technology. If this same argument took another form, e.g. if this were an attempt ban walls made out of non-transparent material because opaque walls allow child abuse to occur hidden from sight, the obvious violation of privacy would be evident to the average person. What inevitably happens with laws that create such a drastic power imbalance between your average citizen and the governing entity is that those with power and status are exempt.
  • throwaway55554 7y ago
    > The argument from those in power against encryption is mind-bogglingly stupid... Is it, though? I mean, most people think all sorts of bad stuff happens on the internet, so playing to those emotions would garner more support. > ... extreme ignorance, or because of a lust for the power and leverage... The latter. They believe that tech companies have too much power right now.
    • cjfd 7y ago
      Whether or not the tech companies have too much power does not sound like the most relevant question here. The lack of power of citizens of communicate privately is the more worrisome thing. And maybe some random person is right to say that all of his communications are not something to hide. It becomes something else if lawyers and journalists can't protect their communications. If the state cannot suffer that it is rather likely that it is engaging in dirty business that it wants to hide, as pretty much all of them are.
    • TrueDuality 7y ago
      The funny thing is that true end-to-end encryption actually weakens the power a lot of tech companies have. That content isn't available for them to scrape. By mandating that the encryption can't be end-to-end guarantees these large companies access to private data they wouldn't otherwise have. Data they can then use for their own gain. When people complain that they have that access, they'll now have the excuse the government made them do it.
      • throwaway55554 7y ago
        So that would beg the question; are tech companies helping write the EARN IT act?
  • bilekas 7y ago
    > using the argument of child pornography and sex trafficking is an emotional play It is and it's used everytime something like this comes up actually. But if you take it for what it is; most of the lawmakers don't fully undersand what their deciding on, so they depend on lobbyists for their info and unfortunately, they're always just interested in making money, so the lawmakers get a skewed view and some nice talking points. I'm not sure if I feel bad for them or just be confident that the next generation of life long politicians might be people like us who are aware of this problem and enact laws to protect privacy. The old pendulum that swings example.
    • inetknght 7y ago
      > just be confident that the next generation of life long politicians might be people like us who are aware of this problem and enact laws to protect privacy. Do you want a pay cut? I don't want a pay cut. Unless we take a pay cut and go become a elected, it won't be people like us who are the next generation of life long politicians.
      • bilekas 7y ago
        Personally, no, I'll be the first to put my hand up and say I don't have the patience to try and deal with the bureaucracy but I do believe that there are some people who go into politics to genuinely make a difference and improve the society. As cynical as we can be about politicians, for sure there are people out there who would just like to 'fix' things. - Usually the roadblock to that is the interest bodies with influence.. It's annoying at best, but I hold out hope..
        • inetknght 7y ago
          > I hold out hope You are a better person than I.
          • bilekas 7y ago
            I wouldn't say that, hope is free.. Maybe it's a dream like a unicorn. But hey, if we don't know what is better, we might never work towards it.
  • duxup 7y ago
    Not even the governing entity... ALL the governing entities, or any entity with bad intentions, because whatever magical backdoor or whatever are available will surely leak and in that case everyone is at the mercy not just their own government (let's say they're responsible folks) but other government groups who do not care what happens to anyone outside their borders....
  • saber6 7y ago
    > The argument from those in power against encryption is mind-bogglingly stupid, and I don't know if it is due to an extreme ignorance, or because of a lust for the power and leverage that mass surveillance grants a governing entity (I suppose it could be both?) The people we are talking about are not stupid. We both know which reality is true, as sad as the admission feels.
  • CJefferson 7y ago
    Encryption isn't like transparent walls in my opinion. In the real world, the police can get into anywhere, and get basically any physical object, once they have a warrant. Most people seem to agree that is reasonable -- I don't think there is a big push for an easy way for people to hide physical objects from police.
    • ptero 7y ago
      I do not see it that way. In years past if one did something he thought government might find offensive he could hide the evidence. Which was perfectly fine -- one would not be jailed for refusing to provide self incrimination. "Go search, but I will hide it; I never had it by the way".
    • kelnos 7y ago
      Perhaps a better analogy: we haven't seen legislation that attempts to outlaw physical safes that are capable of destroying the contents in response to an attempt to tamper with or force them open, have we?
      • SpicyLemonZest 7y ago
        Such safes are very uncommon. If some major bank announced that it's going to install destroy-on-tamper on all its safety deposit boxes, I'd definitely expect some reactive legislation about it.
    • GaryNumanVevo 7y ago
      Consider this: If encryption is suddenly turned off for all communications, and police have access to all of it via warrants, that's like getting a warrant for every home in the US. Obviously if the police had a perpetual warrant to your home, you wouldn't want that, why is it reasonable they have one to your data?
      • bjelkeman-again 7y ago
        And it has been proven many times that not only will the access be abused, the secret backdoor will not remain secret and now every unscrupulous person can potentially have the same access.
  • wju3h3uwh 7y ago
    Why can't people who also understand technology be vulnerable to emotional pleas too? Basically all of my tech friends are passionately against guns despite never having been victims of guns, knowing someone who was a victim of guns, or guns being especially problematic by the numbers in the US. And yet they're drawn to the position because of the emotional overtones that are ubiquitous in coverage of the subject. Not that the situations are perfect parallels, but I think it's worth reflecting on since this ultimately seems like consternation born from hubris. Everyone is vulnerable to emotional appeals in the same way that everyone is vulnerable to appeals to logic and authority. Highlighting the rhetorical nature of a specific appeal without making a counter appeal doesn't do anything productive to shift the dialogue. It's the same reason that the 'nothing to fear if you have nothing to hide' crowd haven't lost much ground in the mainstream despite years of the digital privacy movement trying different tactics. Most people in the mainstream, even if they accept the expanded definitions of privacy unique to the digital landscape, don't feel like they've suffered in a significant enough way to be worth resisting the emotional appeal of helping the 1% of victims who the current system fails.
    • ccktlmazeltov 7y ago
      > And yet they're drawn to the position because of the emotional overtones that are ubiquitous in coverage of the subject. or because they are tools made to kill? Let's be honest this is not a good comparison (to stay polite). Not having guns at worst would force a group of people to find a new and less dangerous hobby, while not having encryption pretty much puts people's lives at risk in many countries and make having a democracy much more difficult.
      • SpicyLemonZest 7y ago
        Surely you see that this is the same kind of emotional appeal the original commenter is decrying. "Tools made to kill" and "less dangerous hobby" aren't dispassionate statements of fact.
        • post_below 7y ago
  • garmaine 7y ago
    > If this same argument took another form, e.g. if this were an attempt ban walls made out of non-transparent material because opaque walls allow child abuse to occur hidden from sight, the obvious violation of privacy would be evident to the average person. Someone should move to amend this act to mandate new construction be transparent.
  • m463 7y ago
    > the obvious violation of privacy would be evident to the average person. I keep on thinking the violations of privacy we have been enduring would spark some pushback but it has not. I know some very intelligent people who realize the implications, but they eventually just give in.
  • tomc1985 7y ago
    With politics its ALWAYS an emotional play. That's the only way you're going to achieve any kind of support in a large portion of your constituency. Politicians are only going to try plays that they think will work, and logical arguments have to be so blindingly obvious that they are hardly logical at all -- because there will always be someone on the other side, with a playbook that knows how to shoot down anything.
  • BiteCode_dev 7y ago
    It's not stupid, it's just not meant to be right. Politics is not about taking the right decision.
  • blargmaster33 7y ago
    You only think it's stupid because you are ignorant of the nature of power.
  • tracker1 7y ago
    Just sell the counter-argument as... Do you really want China/Russia to know the inner details of the airplane you're flying on? Or to be able to intercept communications with the military and congress? Which is frankly, much more honest than what the govt is selling reducing encryption as.
• ctoth 7y ago
  Please won't someone think of the children?
  • bostik 7y ago
    I'd like it if someone actually thought of the adults, for a change.
  • dntbnmpls 7y ago
    There should be a political version of logical fallacies. "Won't you think of the children" fallacy should be top of that list.
    • teddyh 7y ago
      https://en.wikipedia.org/wiki/Four_Horsemen_of_the_Infocalypse https://en.wikipedia.org/wiki/Four_Horsemen_of_the_Infocalyp...
• faeyanpiraat 7y ago
  Couldn't homomorphic encryption be part of a possible solution to enable end-to-end encryption and server-side scanning aswell?
  • jagged-chisel 7y ago
    Perhaps. What’s the state-of-the-art in homomorphic encryption? I only recall vaporware, platitudes, and non-starters in the last year.
  • nullc 7y ago
    Fully homomorphic encryption doesn't provide an ability to operate on encrypted data and get a decrypted output. It is also absurdly slow, with order-of-magnitude performance of a minute per and-gate in the operation being performed. But, lets forget the terms you used and consider the question of "can fancy crypto do something here"? A protocol could be created using a zero knowledge proof and a private set intersection that could do the following: I compute the hash of a file, blind it, and then submit it for you to query against a secret database of naughty hashes (Private set intersection / Private information retrieval). Then I encrypt the file, send it, the opened intersection result, and a ZKP that the encrypted file has a hash corresponding to the query. The server only learns if the encrypted file was a hit on your database, it doesn't even learn the file's hash if it wasn't a hit. If the private intersection scheme is setup right the user doesn't learn if it was a hit or not. Assuming the naughty hash databases was reasonably small (like tens of thousands of items), and users were assumed to be on very fast smart phones or desktops... then could actually this could have workable performance with existing tech-- on the order of tens of seconds processing on the client, milliseconds on the server. But, this kind of scheme is pointless: I just make a one bit change to every file I send and it'll never match. You could invoke some kind of fuzzy match but then false positives are a real problem, the fuzzy hashing is a lot more expensive to perform inside the ZKP (now you need every user on a 8 core desktop), and the fuzzy matching is prohibitively expensive inside the private intersection (so the server side scales poorly). You could go further and make it so that the server could decrypt the entire file if and only if there was a fuzzy match (and still, the user still can't tell if a match happened)-- but even that would create really bad incentives to stuff the database with false-positive producing data (or just loads of legally protected speech which they'd like to covertly monitor). You couldn't make the database public and transparent without distributing the naughty-data yourself and without making it easy for users to self-censor anything that might match. ... and that kind of supercharged scheme is also still easily defeated by just pre-encrypting the data. So you'd have a system that was absurdly expensive to create, expensive to operate (both for the client and server), extremely non-transparent due to its complexity (even if it was open source) and private database, and would have extremely limited ability to do its job. Users would be subjected to an uncertain and non-transparent level of non-privacy. To me that seems more dystopian than a transparent "we're gonna watch everything you do", at least with a simple surveillance state you know where you stand and you'll refrain from complaining about Dear Leader online, where it might result in you ending up in a prison camp. The whole discussion misses the point that the real goal of these systems isn't to protect children, stop child porn, etc. (which, as awful as it is, is essentially a rounding error in the risks we face) the real purpose it to subject the population to pervasive whole-take retroactively accessible surveillance.
• motohagiography 7y ago
  The risk of backdoors in encryption has changed since the last crypto wars. With Huawei entering the 5G market, all ostensible law enforcement encryption backdoors now become de-facto Chinese communist party backdoors because of the pervasiveness of their equipment, and that nations interception capabilities. The UK and Canada have approved Huawei to supply critical networks, and now end-to-end encryption on our personal devices is the only thing preventing interception by Beijing. It also explains why the US president was so angry with Bojo over approving Huawei, because it means if the U.S. allows Huawei, it must also allow end to end encryption for citizens to protect themselves. The national security priority of mitigating that aggressive foreign interception capability for every business in the country should outweigh the special interest of law enforcement using victims groups as human shields.
  • jszymborski 7y ago
    > The UK and Canada have approved Huawei to supply critical networks, If you're referring to 5G, Huawei has yet to be given a green light in Canada. Perhaps you're referring to some other infrastructure, however.
    • mrybczyn 7y ago
      You mean other than Huawei 5g being chosen and deployed (or about to be) at Telus 1 of the 3 major carriers? And the fact that both Telus and Bell use Huawei for their 4g/LTE networks?
      • dblohm7 7y ago
        That does not mean that the government has approved it. In fact, the telcos are freaked out right now that the government will say no and force the telcos to replace the Huawei stuff.
  • vkou 7y ago
    > With Huawei entering the 5G market, all ostensible law enforcement encryption backdoors now become de-facto Chinese communist party backdoors because of the pervasiveness of their equipment, and that nations interception capabilities. How is this different from those backdoors being CIA/NSA backdoors, when that equipment was made by US vendors? Nothing fundamentally changed. We should be building protocols that don't require us to trust the underlying network.
• cassalian 7y ago
  I have a feeling that the EARN IT act will pass based on that it so cleverly disguises it's ability to ban end-to-end encryption... I imagine most elected officials will hear something like this: Person explaining: "It's establishes a committee to make sure people are using best practices to ensure child pornography etc isn't being distributed on their platforms" Elected official: "Hmm, it actually sounds like this will help the children!" Maybe it's just me shrug, but I have little faith in our elected officials to parse out the ramifications to encryption based on how the act is written.
  • tapoxi 7y ago
    >I have little faith in our elected officials to parse out the ramifications to encryption based on how the act is written. Then its your duty to contact your Senators/Representative. It's not hard.
    • hope-striker 7y ago
      Does this really work? I see no reason why my local "representative" would bother listening to me.
      • JChase2 7y ago
        In some cases it can work remarkably well, or so I've been told. The more people who reach out, the more fearful said rep will be of backlash.
• seemslegit 7y ago
  FB and google aside - why does something like signal need section 230 protections to operate ?
  • unnouinceput 7y ago
    World-wide? It doesn't. In US? it does. Also once Google will obey to out Signal from their store, usage will decrease (and is not a wide usage currently to begin with). Short-term effects? Power back to surveillance / power grabbers. They don't care about CSAM, they care about money/power. Long-term effects? Like dark web, Signal (or something similar) will be used mostly by criminals, so EARN IT will fail it's "honorable" goal 100%, while achieving its hidden goal (strip privacy from ordinary citizen). Also this will accelerate Splinternet. The future looks bleak, welcome to it.
    • seemslegit 7y ago
      Why does it need them in the US ? - From what I understand section 230 protects a company from lawsuits related to content posted by their users, signal is not a content platform as it does person-to-person communication
      • Klonoar 7y ago
        Signal also doesn't retain the content, I believe, which... well, if it's more or less auto-killed, there's no argument, no? Note that I don't support doing away with Section 230, but I find this train of thought interesting.
      • vharuck 7y ago
        Section 230 isn't only for services that handle public posts. It covers any "interactive computer service" [0], which includes internet forums, internet messaging applications, ISPs, and even public libraries with public computers. Check out the cases in which judges cited section 230 [1]. https://www.law.cornell.edu/definitions/uscode.php?def_id=47-USC-1900800046-1237841278&term_occur=999&term_src=title:47:chapter:5:subchapter:II:part:I:section:230 https://www.law.cornell.edu/definitions/uscode.php?def_id=47... [1] https://en.wikipedia.org/wiki/Section_230_of_the_Communications_Decency_Act https://en.wikipedia.org/wiki/Section_230_of_the_Communicati...
• toss1 7y ago
  Obviously, as TFA describes, this is a huge end-run to create a problem. But, would this leave a loophole for text-only and/or highly bandwidth-limited communications to remain end-to-end encrypted? If you cannot sent a photo, audio or video, kind of hard to send CSAM material, yet end-to-end real-time SMS type messages are still somewhat useful in many instances (better than nothing). Anyone with more detailed info?
  • ISO-morphism 7y ago
    Base64 encode, no such thing as text-only.
    • toss1 7y ago
      Good point, but if you bandwidth-limit and message-size-limit the channel to something like the speed of a world-record typist, sending a Base64 encoded pic of any good resolution would take days rendering it essentially useless for that sort of thing.
      • DuskStar 7y ago
        And now you've blocked me copy-pasting my novel's manuscript...
      • undersuit 7y ago
        For what sort of thing? Images of CSAM delivered days later is still CSAM. It doesn't expire.
        • toss1 7y ago
          OK, let's get real What is your argument - that "think of the children" therefore ban all end-end encryption? If so, then any form of encryption should be absolutely banned. So should carrier pigeons, as they are very hard to intercept, and a leg band could carry a chip w/gigabytes of CSAM images. My point is that in within a regime of highly restricted encryption (for the purposes of CSAM prevention), there should be space for a text-based conversational system that is very useful for text comms, but highly impractical for CSAM. Limiting it to 30KB/day of transmission leaves plenty of room for useful conversational communication. That's ~45min of world-record typist speed on a full keyboard (17char/sec), or about 10 pages of single-spaced text -- a more than adequate secure conversations channel. Yet transmitting a single 1MB image in Base64 encoding would take 45 days. One could literally be 2x faster by carrying it on a bicycle from Los Angeles to NYC.
• clarry 7y ago
  > So in short: this bill is a backdoor way to allow the government to ban encryption on commercial services. I'm all for this. Suddenly people in tech would have to start taking free & open source decentralized services seriously instead of lazily relying on Google and Facebook while complaining about how evil they are.
  • danShumway 7y ago
    We want decentralized systems so that people will be more free. Giving up freedom in order to get them is completely counterproductive. Decentralized systems aren't nothing; they're more resilient against these types of attacks than the alternatives. However, decentralized systems don't welcome these attacks any more than anybody else does. These attacks still hurt us, and they still make our life harder -- China isn't more free because its centralized services are all back-doored. There's a (thankfully fringe) group of people who keep saying that if Section 230 goes away everyone will just switch to more Open protocols and it'll be fine. But this is painfully naive; a pseudo-requirement to backdoor communications will make it harder to build Open platforms and onboard users, because no commercial host will want to touch a platform that exposes them to liability. Getting rid of Internet freedom turns the people using these systems into criminals, which will make Open platforms much more dangerous to use, much more risky to sponsor, and much harder to advertise or develop. What happens when you go to host your private encrypted email on Linode, and Linode says, "no, because then we can't scan your server for CSAM"? What happens when the Matrix org tries to set up a free server to onboard new users and the government prosecutes them? What happens when every user running a Tor exit node becomes liable for content traced back to that IP? What on earth makes you think the DOJ won't prosecute hosts of Open services? There are so many ways this law can go wrong, and so many ways it can be expanded from here to shut down the projects you think it's helping.
    • clarry 7y ago
      > There are so many ways this law can go wrong, and so many ways it can be expanded from here to shut down the projects you think it's helping. It'd have to be expanded by a ridiculous amount. To the point where it's practically speaking illegal for anyone to run non-approved software on their computers, if it can send messages over the internet. I'm not saying they wouldn't try that, but in practice it's completely unrealistic. Which means, at best, it'll be a law that criminalizes everyone and nobody really cares. Hilariously, the same tech behemoths that people give up their freedom to are doing everything they can to push us into the same exact situation, with their walled gardens and power asymmetry that allows them to squeeze out competition. > But this is painfully naive; a pseudo-requirement to backdoor communications will make it harder to build Open platforms and onboard users, because no commercial host will want to touch a platform that exposes them to liability. If you play your cards right, these "platforms" are more like internet routers and load balancers that facilitate message exchange between computers. You build your platform on top of this technology. Banning the technology would be akin to banning TCP/IP+TLS or UDP+DTLS. I don't see hosting providers having a case for banning encrypted transport protocols. And the law in question doesn't go that far; again, for it to go there we'd need a law that virtually bans all encrypted message exchange on the internet. > What happens when the Matrix org tries to set up a free server to onboard new users and the government prosecutes them? Once decentralization becomes a thing techies care about because they need it, I'm sure we can spread software by word of mouth just like we did back in the early days of Kazaa, DC++, Torrents, etcetra. In fact that's pretty much how software gets adopted today. You only need faddy & flashy onboarding when you're trying to growth hack a product that has no intrinsic demand for it. We'd be way past that point. > What happens when every user running a Tor exit node becomes liable for content traced back to that IP? That's already something you should worry about if you're about to run a Tor exit node. I don't recommend it. Exit nodes are just bowing down to the centralized clearnet. A proper decentralized network is one where the exchange stays within, and doesn't rely on a single point source as a hosting node that can be taken down. If a message is in the network, it can be anywhere, and it can and will replicate itself if requested. > What on earth makes you think the DOJ won't prosecute hosts of Open services? The easy way out for them is that everyone uses the same handful of services provided by a handful of tech behemoths. Then they only need to prosecute those, if they don't play along. That's largely where we've been headed, and I think it really sucks, because I lose my freedom and privacy both to these tech companies as well as their government. If individual people started participating in a network and hosting their own nodes, the situation becomes much harder. If they seriously tried to prosecute everyone, it'd end up being much like the neverending war on drugs (or piracy or similar). Except that in this case, you wouldn't be up against just potheads and kids downloading movies, you'd also be up against professionals (and not only in tech) keeping their comms confidential. But everyone, individually, is a small fry, so fighting a legal battle against everyone is very nonproductive, unlike slapping one megacorp with millions in fines they can actually pay. The status quo is terrifying, and it is not getting better because even technical users are too lazy to care if they don't have to. If I move to decentralized services that try to provide freedom and anonymity, I'm just isolating myself from everything else and simultaneously painting a target on my back. That's because these things do not have enough mindshare, and they will never have enough mindshare when techies just encourage everyone to keep using google & fb & co.
• pat2man 7y ago
  Couldn't Apple and Google just ship a client side model for detecting certain images and apps could use it to detect CSAM without leaving the device?
  • kodablah 7y ago
    Linked to from the article: https://blog.cryptographyengineering.com/2019/12/08/on-client-side-media-scanning/ https://blog.cryptographyengineering.com/2019/12/08/on-clien...
  • SkyBelow 7y ago
    How long before someone extracted the algorithm and turned it into an application to test images before they are shared? Could even use it as a benchmark for software to hide from authorities. One thing to remember is that "The Net interprets censorship as damage and routes around it." applies regardless of how agreeable the censorship is.
  • bostik 7y ago
    The US regulators are painfully aware of device rooting and how it allows to subvert any client-side security measures. Disclosure: I have been dealing with certain state regulators and their morbid fear of forged geo-location data for a number of months. It would be inane to assume other regulators would be any less informed about the threat vector.
  • michaelmrose 7y ago
    If you were a criminal would you use a device/software that you knew would report you to transmit illegal materials?
• squarefoot 7y ago
  I might be playing Captain Obvious here, but anyway, this worldwide coronavirus pandemic state of panic is the best possible scenario in which corrupt politicians in any country could enact restrictive laws or do nasty things while their citizens look elsewhere. If they were waiting for a good mass distraction weapon, well, this is it.
  • petargyurov 7y ago
    Governments don't have to wait for such natural distractions; we already live in a world where nefarious law changes are snuck into bills with positive sounding policies when major holidays occurs... Look at net neutrality, Patriot Act, etc.
• andrewflnr 7y ago
  Is there any real evidence that restricting distribution of CSAM creates better outcomes for victims? More to the point is there evidence that increased aggression in enforcement of CSAM possession laws produces proportionately better outcomes? I would expect the ROI curve to go flat pretty quickly.
  • mindslight 7y ago
    It's a hot button for lawmakers because they want the privilege reserved for themselves. That is why these psychopaths lust after power over others, right? To partake in what money cannot buy.
  • JackRabbitSlim 7y ago
    It's one of the most powerful weapons authorities can swing at anyone at anytime. It's dead simple to poison some website, insert a thumb drive, or just flat out lie and put it on a device after the fact and make any target an instant socially repugnant felon. The ROI on that is fantastic
  • RonanTheGrey 7y ago
    There's no evidence of it at all. In fact, logically, it doesn't make any sense that there would be: the deed has already been committed, all you are preventing is the possibility for what is called "re-victimization" and the only evidence that that ever happens is when authorities do it themselves by forcing victims to confirm they are the ones in the photos/videos. In other words, even the claim itself is garbage.
• Klonoar 7y ago
  Has there been any public statement from Apple, Google, and assorted companies? I'd imagine they have to be concerned about this. This one feels kind of weird in that I'm not seeing the same level of uproar/pushback as I've seen in the past, which is a slightly frightening bit.
  • cft 7y ago
    If one of them is behind on encryption relative to others it's a competitive disadvantage. If all of them are forced to abolish encryption it's a welcome opportunity for better ad targeting . Additionally this increased regulatory and technological burden is a good start-up deterrent. What's not to like?
    • Klonoar 7y ago
      The bill is specifically going after Section 230 on the surface, though, which I would think would be of more immediate concern to them. Most blog posts even note that the encryption aspect is being targeted as a run-around. I'm willing to entertain the logic, sure, just not sure I agree with it. Feels like there's more at stake for them (collectively) here.
• throwbackThurs 7y ago
  It's also very easy to implement your own client side encryption methods with wrappers around service provider APIs. Sure they may be private APIs but if people are desperate libraries and apps will appear to do this. Really anyone who wants to encrypt data WILL, the algo ithms are public knowledge, it ain't going anywhere. Why is the English speaking world becoming so authoritarian in its policing of its people? This isn't going to end well, I honestly believe the English Empire is burning right now.
• bilekas 7y ago
  There is another reason its not really effective to try to ban or even limit e2e encryption. If you're intentions are nefarious, and you have a group that you need to communicate with, you will just implement the encryption yourself. Or buy burner phones etc. Honestly, with my cynical hat on, I feel this is actually being pushed by the marketing and advertisement lobbyists, such as Facebook, google and others, in order to data mine for advertisers into your communications.. Maybe my tinfoil hat is a little bit too big, but I really use encrypted communications so that at least there is one dialogue that's not being warped into advertisements for me. I genuinely fear for future generations privacy, in all regards. It's worrying and it really does deserve more attention. It's so crazy to my younger nieces and nephews that when I was their age, I didn't have a phone. It blows their minds. And I'm only in my 30's.
  • ta999999171 7y ago
    It's not too big. Metaphorically. Realistically, it will amplify signals/readings, so, it's outdated. Anyway, what happens when messaging with ciphertext becomes illegal?
    • bilekas 7y ago
      I'm not sure what you mean about the outdated, you might be writting to another post but: > Anyway, what happens when messaging with ciphertext becomes illegal? Those who have nefarious intentions don't really care what the legality is.. Also those who are not nefarious encrypted aren't identified because they're encrypted.. Thats why this argument seems very.. Moronic at best.
    • AnimalMuppet 7y ago
      Steganography. Hide the cyphertext in the LSB noise of a PNG image, or something like that.
      • Mirioron 7y ago
        Or just regular text. Or algorithms with PNG or binary blob seeds.
• carapace 7y ago
  > The new bill would make it financially impossible for providers like WhatsApp and Apple to operate services unless they conduct “best practices” for scanning their systems for CSAM. I'm okay with that, as long as e2e isn't actually banned.
  • cfv 7y ago
    As the author states, encrypting your data impedes scanning it, so any encryption that is actually worth anything inmediately puts them at fault, so it wont be applied. Any unmonitored user upload is at risk here. This is dark.
    • carapace 7y ago
      Well let's be clear here: I do not expect e.g. the phone system to scan my calls, nor the carriers of my IP traffic to scan my packets. Carriers are not and should not be liable for the traffic they carry. On the other hand, online "clubs" or services like FB etc. are not neutral carriers, they are content providers or "publishers" who source a lot of their content from the people who use them. Right or wrong, that's the mental model I'm operating from: you're a carrier and you just take bits from here to there, or you're a kind of club, like a "Sam's Club" but for Internet ( https://en.wikipedia.org/wiki/Sam%27s_club https://en.wikipedia.org/wiki/Sam%27s_club ) and you're responsible for the stuff you stock on your shelves. Now then, my opinion (such as it is) is that "I won't make enough money" is not a valid reason for not scanning for and preventing CSAM on your internet clubhouse.
      • sphuff 7y ago
        Messaging apps like Signal or WhatsApp are not providing content in the way that you describe. They are just carrying messages from one user to another, and would be rendered useless by this bill.
      • twitch-chat 7y ago
        How is WhatsApp different from a phone system aside from the fact that it's text-based? And how is WhatsApp a publisher? Your analogy makes no sense.
• tboyd47 7y ago
  How do you figure? The word "encryption" doesn't appear anywhere in the bill.
  • darawk 7y ago
    The whole article is an explanation of how he figures.
• zupreme 7y ago
  This, if passed, will only accelerate private citizens in various countries into launching their own clandestine “internets” outside of traditional channels. This is shaping up to be the end of a golden age of internationally-open communication.
  • torified 7y ago
    Excellent! It's about time the public started to take an interest in their own privacy. Even Snowden wasn't able to wake up the lobotomized masses. Hopefully the techies will come up with more and better solutions to work around around brain-dead power grabs like this. Incidentally, Matrix seems pretty damn good.
• hanse00 7y ago
  This again? Making effective encryption that lets law makers access our data, isn't just "hard" in the traditional sense. I'm willing to bet it's impossible (At least with the kinds of technologies we'll have in my life time). Yes the cops can get a warrant for our doors, why not our computers? Because cryptography isn't an efing wooden door. They are not the same. Get it. It's not like all of silicone valley hates lawmakers (Although many do), it's that they're asking for unicorns and pixie dust.
  • qeqeqeqe 7y ago
    Why is a search warrant on electron data not comparable to a search warrant for some physical documents?
    • upofadown 7y ago
      It is if the physical documents are hidden somewhere in a vast area. A search warrant isn't magic, it can't find the documents.
    • WiseWeasel 7y ago
      As our personal devices increasingly augment our capabilities, we will only feel more violated when their access is beyond our control.
    • hanse00 7y ago
      Because they aren't the same kind of "thing". Data isn't manifested in physical space in the same way as "my house" is. For one, my home is in one physical place. A bad actor needs to at least get to me, to... you know, get to me. With my data, if it's open to be seen, it's open to people in China, Russia, and on the moon as well. It's not limited to my government. Second: When the police are given a warrant to my house, I can be there, and I can observe that only actual police officers are entering my home. Data doesn't have any kind of global logging and auditing system like that. Any particular system may or may not log or audit access, but it's not a sure thing. Once it's accessible, once again, I have no way of knowing who actually accessed it. Third: As WiseWeasel mentioned, I would argue that in the modern world, having access to my data isn't like having access to my home. It's like having access to my mind. My phone knows everything: My intimate conversations with my wife, where I go shopping, what I buy, what my political opinions are, every single photo I've taken in the last 10 years (Which in large part means: Knowing every single place I've been in the last 10 years), my financial transactions, and much more. If the cops cannot get a search warrant to forcibly read my mind, I don't think it's reasonable they should be able to see my data either. Fourth: It encroaches on the privacy of others. Generally speaking a warrant for my stuff, is because I am suspected of things. My neighbor isn't also searched because they happen to be near me. But plenty of the data in my life (Especially in the context of conversations) isn't just my data, it's the data of my conversation partner too. Who is now having their data investigated, without knowing it at all (And depending on where they are from, do the local cops in my own even have jurisdiction over the data of my friend in Europe?). I could go on, but I think I've made my point: Data is not "a thing", it's an entirely different plane of existence. And we need lawmakers that understand that, and are ready to tackle the real challenges that it undoubtedly is, to write reasonable legislature about data. What we currently have, is a bunch of people trying to fit this new square data peg, into their existing round hole legislature.
• Kim_Bruning 7y ago
  "But won't you think of the children?" (E2E) encryption protects our families from predators and criminals who mean them harm. While weakening protections surely makes it easier to catch criminals, it equally opens up vulnerable families to predation.
  • pensatoio 7y ago
    100% this! “Let’s guarantee everyone will loose their privacy so we can maybe possibly catch a fantastically small minority of criminals.”
• RileyJames 7y ago
  This same debate has begun this week in Australia, I find it difficult to believe it's unrelated. I posted these this link yesterday to HN: https://news.ycombinator.com/item?id=22491565 https://news.ycombinator.com/item?id=22491565 Defending these attacks on encryption require defending the same laws with ALL countries in the 5 eyes spying partnership. (Australia, New Zealand, United Kingdom, United States & Canada). Failure to do so will ensure these laws will come into effect in time due to either A) the use of the 5 eyes pact to leverage the laws of other countries within the pact. Or B) through constantly pointing to the 'standard' set in Australia (or any country which does progress these laws, I use Australia as it has already implemented legislation which enables meta data collection & require participation in weakening encryption). The Australian legal/political system IS the backdoor here.
  • RonanTheGrey 7y ago
    I get downvoted everytime I suggest that a ton of what we see coming out of government, the news, popular culture, all at the same time, is being orchestrated by a focused and very powerful few and that most of what we actually see is nothing but theater intended to distract us from their real purpose (like the "impeachment trial"). But honestly... when the same idea tears across the planet at the same time from a dozen "independent" sources... how is that so hard to believe?
• dropoutcoder 7y ago
  (Fully expecting this comment to be destroyed.) If you give E2EE to the masses, then the endpoints will need to remain vulnerable by design, or LE/IC won't be able to do their jobs fighting criminals. If the endpoints are designed to be as free of vulnerabilities as possible (which isn't the case anyway - consumer phones and computers are still Mickey Mouse by design), and provide E2EE at scale, criminals will be able to operate with impunity at scale. This isn't a desirable solution. I'd rather see a trend towards locking down endpoints, but allowing Exceptional Access for communications at scale. Allow the math to exist (code for encrypted comms can exist on GitHub, for instance) but disallow it to be distributed at scale (walled garden App Stores, large Social Networks for instance). Reduce the (growth of) entropy. Guns aren't sold via the App Store, and Signal shouldn't be given to the masses. The community here seems more or less unified in the belief that essentially unbreakable E2EE at scale, distributed by GOOGLE, FACEBOOK, and APPLE, is always a good idea. I don't agree with this at all. Few people in this neck of the woods are willing to argue the counterpoint - the risks of E2EE at scale. Somewhat related: I'd personally rather see a move towards better cooperation between social network service providers, internet service providers, government agencies, and device manufacturers. Apple, for instance, won't get involved at all if your device is hacked. Rather, it would be nice to see a trend towards designing devices to have automatic cooperation between the various parties to both prevent and investigate hacks.
  • burrows 7y ago
    Shameless FBI shill. “hacker”news.com
    • dropoutcoder 7y ago
      Your comment makes a laughably wrong assumption, and is also low value.
      • burrows 7y ago
        Mmhmmm, yup, confirmed shill.
  • 7y ago
• lukifer 7y ago
  As much as guns have grown deadlier since 2A was penned, they ultimately scaled linearly; we don't currently have weapons available to citizens which can destroy a city. If the police need to counter a citizen's misuse of guns, they can easily deploy 10x guns of their own. This used to be true of secrets: if there was a legitimate reason for police to crack a safe, it was difficult, but possible. But with encryption, you no longer need 10x force; you need closer to (10^100)x force (not an expert, but close enough for illustration). What's neglected/forgotten is that weakened crypto creates a power asymmetry in the other direction: while there's no way to scale safe-cracking to (10^100), such that the feds can auto-crack every safe at will, that is absolutely feasible for digital locks, if those locks are forced to be arbitrarily weak. The NSA would have the resources to pre-crack and cache every single encrypted signal, "just in case". The nature of the mathematical asymmetry leaves no middle ground: either every citizen has access to unbreakable locks, or no one will [0] (except for the Feds themselves, of course): https://www.youtube.com/watch?v=VPBH1eW28mo https://www.youtube.com/watch?v=VPBH1eW28mo [0] There is one cogent comparison to the arguments of 2A advocates here: "if you outlaw crypto, only outlaws have crypto". In fact, it's even worse: hypothetically the feds can track gun-running, and guns are (currently) non-trivial to manufacture oneself. But all it takes is a small snippet of GitHub code and/or a white paper to craft an unbreakable lock, and disguise the data as noise, regardless what violence governments threaten. The only people affected by restrictions would be law-abiding citizens.
• august125 7y ago
  Who's going to be the first startup out the door to try to sell "EARN IT" compliant encryption and lobby the government to recommend their product for "best practices" implementation?
  • teddyh 7y ago
    The first one which recieves YC backing.
• maxhedrome 7y ago
  Kelsey Graham wants to turn America into China
• copperfitting1 7y ago
  If this same argument took another form, e.g. if this were an attempt to ban walls made out of non-transparent material because opaque walls allow child abuse to occur hidden from sight, the obvious violation of privacy would be evident to the average person.
• gorgoiler 7y ago
  Negotiation. Open with something ludicrous. Scale it back in exchange for concessions. Also known as bullying when round one is “end all end to end communications” but round two is “ok we’ll drop that if you pay more tax”. Taxing FAANG is the perennial government concern about big tech over which they slather the most. How can they get their hands on more profits! (At least, that’s the case outside the US, for the US corporations.)
• seer 7y ago
  The argument against backdoors by law enforcement is a very clear and understandable one - “misplace” and now everyone has access. Also if they can use it for getting data from an individual under warrant, there would be nothing stopping them from getting all data from everyone in aggregate when none is looking “to protect the children” and the like. And lastly even if those two are not the case, there’s also foreign governments. OK so this stems mostly of the fact that real warrants are bound by locality- if you get one warrant it’s physically impossible to just use it for everyone. Thus reducing the risk of wrongly given one of affecting everyone else on the planet. The question is - is there a way to effectively replicate something like that with encryption / maths? I mean obviously not with public / private key encryption, but we do have more complex ones already in the form of cryptocurrencies. Maybe there’s a way to make reading a backdoor very expensive and public operation so everyone knew a backdoor was used, it would be expensive to employ (as in money and resources) and could only be used once per backdoor use? I’m genuinely curios though I’d wager the answer would be that even if it could be made it would be too expensive and impractical...
• foxx-boxx 7y ago
  Professors hate the idea of earning it. They do meaningless job in age of YouTube and want government (actually, the public through taxation) to sustain their life style.
• foxx-boxx 7y ago
  What I am hearing here is “oh, my job is about to disappear!!! What I am going to do?!”
• tjpnz 7y ago
  What would the likely impact be on non-US tech firms?
• alfiedotwtf 7y ago
  We’ve already had the Cryptography is Free Speech test, so why is this not the same argument - you can’t tell what a person or company can or can’t say, including how it says something (plaintext or encrypted)
• hosteur 7y ago
  So what are we to do about this?
• frankzen 7y ago
  If you think identity theft is bad now, wait until this gets passed! Not to mention embezzlement, corporate espionage, etc. They'll need to set up a recovery fund in addition.
• 34679 7y ago
  Amendment IV The right of the people to be secure in their persons, houses, papers, and effects, against unreasonable searches and seizures, shall not be violated, and no warrants shall issue, but upon probable cause, supported by oath or affirmation, and particularly describing the place to be searched, and the persons or things to be seized.
  • RonanTheGrey 7y ago
    Those in power, along with most Americans, abandoned those ideals a long time ago. Not that that's any justification for what is happening... but you can't fight an enemy you don't understand (or underestimate).
• xg15 7y ago
  I agree, in this context it's likely an emotional play to go against encryption (especially if you look who is behind the law), I'd like to know more about what tech companies mean when they say they have their own plans to tackle this problem. To me, it seems the requirements that: 1) you should be unable to access the data and 2) you should monitor the data for certain content seem hard mutually exclusive: Even if you developed some magic AI technology that could detect child porn in an end-to-end encrypted connection, well congrats, you broke the encryption, but then it's not end-to-end encrypted anymore. (And you could likely use the same technology to detect other things) The only way I can see how you could keep both promises in some sense would be to move the detection into the client scan for content before it's being encrypted. This would require that you tightly control all clients any kind of tampering or use of alternative clients impossible. I'm not sure, that's a good vision for the future either. (It would also render the encryption mostly useless, because the vendor could simply instruct the client to extract whatever data they are interested in. I can get the same level of security with plain HTTPS and a vendor promising not to look at the data.) If this is the alternative, maybe a controlled, traceable way to intercept connections would be the lesser evil. So, what are the tech companies' takes on this?
• mintyc 7y ago
  Such a shame that this conversation is always so one sided because the 'other' side is not vocal or portrayed clearly in the media. There is a controlled middle ground where the alternative to end to end encryption isn't a full surveillance state but gives safety and protection to society at the expense of trusting the other side with some of our information. The majority?? of people want govts/intelligence to monitor, detect and pre-emptively manage: Terrorism plots Paedophiles Large scale criminals - drugs, human trafficking etc. Kidnapping Lost person location Rescue coordination If that cannot be done without viewing content (and I'm not sure that statement is true) then personally I'm ok to trade some of my theoretical privacy for the security. Let's face it, how likely is it that the other side would be interested in my cat video content? But also don't be fooled that encrypted content means your privacy is secure. Just knowing when and to whom messages are sent is a powerful tool already and not something easily protected. App providers already use this in surveillance capitalism used by the likes of Facebook, Google etc.
• tracker1 7y ago
  While I do appreciate the sentiment, and would prefer to see a bit more sanity in terms of blanket protections... Leaving this definition as obtuse as it is, is worse than actually creating a limited definition. Realistically, having requirements similar to a DMCA notification would be more prudent. As well as requiring a contact form and/or email address that does not require login for notification.
• gigama 7y ago
  Bruce Schneier posted a summary today that referenced a great write-up by Matthew Green of Johns Hopkins. [1] https://www.schneier.com/blog/archives/2020/03/the_earn-it_act.html https://www.schneier.com/blog/archives/2020/03/the_earn-it_a... [2] https://blog.cryptographyengineering.com/2020/03/06/earn-it-is-an-attack-on-encryption/ https://blog.cryptographyengineering.com/2020/03/06/earn-it-...