5 ms·

Unless this bill's critics are mistaken, if your friends are using "file encryption", i.e, encrypting the contents of the communications themselves before sendi

Unless this bill's critics are mistaken, if your friends are using "file encryption", i.e, encrypting the contents of the communications themselves before sending, then this bill has no effect on that. IMO, your friends, unless they are nerds, are never going to place much value on encryption when they never actually use it themselves. When some third party tech company is doing the "end-to-end encryption" for them then your friends are really not in control of the situation, let alone having any reason to understand it. It could be a sham and they might not know it. This bill stands to hurt tech companies but according to its critics (surprise: it's the tech companies) it does not interfere with any individual's use of encryption for communications. No one wants third parties to have potential access their communications. However there is no law preventing a tech company that provides "encrypted messaging" from decrypting people's communications. There is not even a contract with users. If they do this, their liability is zero. There are only "promises", something like, "We promise we won't do it, unless we receive a valid subpoena" or "We have made it technically impossible to see your messages." (Nevermind metadata.) Well, what if some other third party, like the people pushing this bill, made the same promises? Would that be "good enough"? Of course not. For the record, I am not taking a for/against position here. I am not a tech company nor someone trying to get access to encrypted messaging services provided by tech companies. However if something came along -- not suggesting this is it -- that created the necessary evolutionary pressure to make every person, not just "bad guys", have a basic understanding of how to encrypt a file and send it over an insecure network, without relying on a third party for the encryption, then I would think that would be a good thing.

a1369209993 6y ago
> "We have made it technically impossible to see your messages." That one's not actually a "promise"; it's either true and sufficient (although it's hard to imagine how if the software supports automatic updates), or a direct lie because they have not in fact made it impossible.
- pwdisswordfish2 6y ago
  Seems like it is impossible to verify whether it is true because we cannot see exactly what they are doing. We are just taking their word for it. It can be nothing more than a "promise" because we are not the ones responsible for carrying out the encryption. We have to trust both (a) the encryption software, which we can examine, and (b) the third person doing the encryption, who is unfortunately operating outside our view. Even if the third person is trustworthy, if they make a mistake, they are not liable for anything. They are not even obligated to tell us they made a mistake. Usually when we trust people to do something important for us, we have some recourse against them if things go south. It is more than just a promise. They have skin in the game.
  - a1369209993 6y ago
    "Promise" generally means a statement about someone's future behaviour; they're lying (or theoretically not) about something they already did (write the software in such a way that they are literally incapable of retrieving the plaintext of messages). If I say I'm not going to steal and eat your cookies, that's a promise, which I might reneg on or never have intended to keep in the first place, but ultimately it depends on future events; if I say I didn't eat your cookies, that's a statement of fact, true or false. Edit: Er, obviously you should never trust tech companies about anything, promise or otherwise; I was making a distinction about what kind of deceit they were engaging in.
    - pwdisswordfish2 6y ago
      Understood. Never trust tech companies about anything. Wise words.

a1369209993 6y ago

> "We have made it technically impossible to see your messages." That one's not actually a "promise"; it's either true and sufficient (although it's hard to imagine how if the software supports automatic updates), or a direct lie because they have not in fact made it impossible.

pwdisswordfish2 6y ago
Seems like it is impossible to verify whether it is true because we cannot see exactly what they are doing. We are just taking their word for it. It can be nothing more than a "promise" because we are not the ones responsible for carrying out the encryption. We have to trust both (a) the encryption software, which we can examine, and (b) the third person doing the encryption, who is unfortunately operating outside our view. Even if the third person is trustworthy, if they make a mistake, they are not liable for anything. They are not even obligated to tell us they made a mistake. Usually when we trust people to do something important for us, we have some recourse against them if things go south. It is more than just a promise. They have skin in the game.
- a1369209993 6y ago
  "Promise" generally means a statement about someone's future behaviour; they're lying (or theoretically not) about something they already did (write the software in such a way that they are literally incapable of retrieving the plaintext of messages). If I say I'm not going to steal and eat your cookies, that's a promise, which I might reneg on or never have intended to keep in the first place, but ultimately it depends on future events; if I say I didn't eat your cookies, that's a statement of fact, true or false. Edit: Er, obviously you should never trust tech companies about anything, promise or otherwise; I was making a distinction about what kind of deceit they were engaging in.
  - pwdisswordfish2 6y ago
    Understood. Never trust tech companies about anything. Wise words.