6 ms·

It's not really a "threat". I don't think Signal could legally operate in the US with this act in place. More like saying: "If you effectively ban end-to-end en

It's not really a "threat". I don't think Signal could legally operate in the US with this act in place. More like saying: "If you effectively ban end-to-end encryption, we can't offer our end-to-end encrypted chat app in your jurisdiction any more."

FigmentEngine 7y ago
it is a threat. signal could still operate, they would just be at risk of being killed by a thousand cuts.
pacificmint 7y ago
> I don't think Signal could legally operate in the US with this act in place. Of course they could operate. They would just have to backdoor their encryption. Which, presumably, is what this legislation wants to achieve. They don't want a world with no chat apps, they want a world with chat apps they can listen to. What Signal is saying in this blog post is that they would rather give up the US market than weaken their encryption. Which is worth saying, because it's probably not true for most other apps. Most corporations would not give up the US market, no matter what compromises they have to make.
- maqp 7y ago
  Spot on. The thing is, content is still valuable and companies would like to access it on behalf of the government, but they now have to compete with private messaging apps. The big tech companies want the government to force them to make more profits on user data by forcing the backdoor. If this was something the tech companies didn't want, they'd be spending billions to lobby for the human right to privacy.
- AlexandrB 7y ago
  > Of course they could operate. They would just have to backdoor their encryption. Is it even possible to have end-to-end encryption (in the technical sense of the term) with a backdoor? If your product's marquee feature is security via end-to-end encryption your product is a non-starter in a jurisdiction that bans end-to-end encryption, no?
  - mumbisChungo 7y ago
    ask the CEO of Zoom
ardy42 7y ago
> It's not really a "threat". I don't think Signal could legally operate in the US with this act in place. More like saying: "If you effectively ban end-to-end encryption, we can't offer our end-to-end encrypted chat app in your jurisdiction any more." Could they operate, so long as they implemented a mechanism to scan for and report child pornography? Assuming (optimistically) that the government committee that the EARN IT act mandates adopts reasonable standards. I think this article gives a good background on the problem: https://blog.cryptographyengineering.com/2020/03/06/earn-it-is-an-attack-on-encryption/ https://blog.cryptographyengineering.com/2020/03/06/earn-it-... I (personally) think that client-side photo hashing and automated comparison against one of the child abuse databases should be sufficient. Alternatively, Signal could probably just disable features for sharing images in the US.
- toast0 7y ago
  > Could they operate, so long as they implemented a mechanism to scan for and report child pornography? Signal's model is that their servers are never able to understand any user content. You can't effectively scan for prohibited content on the client side for several reasons: A) someone who wants to send or receive prohibited content could alter the client to skip the checks. B) shipping the check to the clients makes it possible for distributors to run the checks and alter their content until it passes the checks. If client side filtering was effective, the ask should be for Google, Microsoft, and Apple to scan and report prohibited content on their operating systems, which together cover the vast majority of user terminals.
  - ardy42 7y ago
    > You can't effectively scan for prohibited content on the client side for several reasons: I disagree. I think these scanners can only be good, but never perfect, so they're mainly effective against technically unsophisticated abusers. Weakness that are only exploitable by someone with advanced technical skills are not actually a problem. > A) someone who wants to send or receive prohibited content could alter the client to skip the checks. That's true in any kind of scanner. Server side checks could be defeated pretty trivially by using any encoding scheme not anticipated by the scanner's authors (e.g. sending an image as text messages encoded with rot13 Base64). No scanner can be robust against even a mildly technically savvy opponent unless the scanner has complete end-to-end control over everything, including the clients. > B) shipping the check to the clients makes it possible for distributors to run the checks and alter their content until it passes the checks. My understanding is those databases and algorithms are not secret information, but are publicly available to provide low barriers to implementation, so someone could download one and do what you propose now.
mirimir 7y ago
> I don't think Signal could legally operate in the US with this act in place. I could do that, because nobody knows who I am. But then, I'm not technical enough. And I couldn't do that as Mirimir, because that persona has existed too long, and has been far too public. The point, though, is that I'm confident that it's doable.
0x262d 7y ago
isn’t Signal funded indirectly by the CIA? that’s not a joke.

FigmentEngine 7y ago

it is a threat. signal could still operate, they would just be at risk of being killed by a thousand cuts.

pacificmint 7y ago

> I don't think Signal could legally operate in the US with this act in place. Of course they could operate. They would just have to backdoor their encryption. Which, presumably, is what this legislation wants to achieve. They don't want a world with no chat apps, they want a world with chat apps they can listen to. What Signal is saying in this blog post is that they would rather give up the US market than weaken their encryption. Which is worth saying, because it's probably not true for most other apps. Most corporations would not give up the US market, no matter what compromises they have to make.

maqp 7y ago
Spot on. The thing is, content is still valuable and companies would like to access it on behalf of the government, but they now have to compete with private messaging apps. The big tech companies want the government to force them to make more profits on user data by forcing the backdoor. If this was something the tech companies didn't want, they'd be spending billions to lobby for the human right to privacy.
AlexandrB 7y ago
> Of course they could operate. They would just have to backdoor their encryption. Is it even possible to have end-to-end encryption (in the technical sense of the term) with a backdoor? If your product's marquee feature is security via end-to-end encryption your product is a non-starter in a jurisdiction that bans end-to-end encryption, no?
- mumbisChungo 7y ago
  ask the CEO of Zoom

ardy42 7y ago

> It's not really a "threat". I don't think Signal could legally operate in the US with this act in place. More like saying: "If you effectively ban end-to-end encryption, we can't offer our end-to-end encrypted chat app in your jurisdiction any more." Could they operate, so long as they implemented a mechanism to scan for and report child pornography? Assuming (optimistically) that the government committee that the EARN IT act mandates adopts reasonable standards. I think this article gives a good background on the problem: https://blog.cryptographyengineering.com/2020/03/06/earn-it-is-an-attack-on-encryption/ https://blog.cryptographyengineering.com/2020/03/06/earn-it-... I (personally) think that client-side photo hashing and automated comparison against one of the child abuse databases should be sufficient. Alternatively, Signal could probably just disable features for sharing images in the US.

toast0 7y ago
> Could they operate, so long as they implemented a mechanism to scan for and report child pornography? Signal's model is that their servers are never able to understand any user content. You can't effectively scan for prohibited content on the client side for several reasons: A) someone who wants to send or receive prohibited content could alter the client to skip the checks. B) shipping the check to the clients makes it possible for distributors to run the checks and alter their content until it passes the checks. If client side filtering was effective, the ask should be for Google, Microsoft, and Apple to scan and report prohibited content on their operating systems, which together cover the vast majority of user terminals.
- ardy42 7y ago
  > You can't effectively scan for prohibited content on the client side for several reasons: I disagree. I think these scanners can only be good, but never perfect, so they're mainly effective against technically unsophisticated abusers. Weakness that are only exploitable by someone with advanced technical skills are not actually a problem. > A) someone who wants to send or receive prohibited content could alter the client to skip the checks. That's true in any kind of scanner. Server side checks could be defeated pretty trivially by using any encoding scheme not anticipated by the scanner's authors (e.g. sending an image as text messages encoded with rot13 Base64). No scanner can be robust against even a mildly technically savvy opponent unless the scanner has complete end-to-end control over everything, including the clients. > B) shipping the check to the clients makes it possible for distributors to run the checks and alter their content until it passes the checks. My understanding is those databases and algorithms are not secret information, but are publicly available to provide low barriers to implementation, so someone could download one and do what you propose now.

mirimir 7y ago

> I don't think Signal could legally operate in the US with this act in place. I could do that, because nobody knows who I am. But then, I'm not technical enough. And I couldn't do that as Mirimir, because that persona has existed too long, and has been far too public. The point, though, is that I'm confident that it's doable.

0x262d 7y ago

isn’t Signal funded indirectly by the CIA? that’s not a joke.