7 ms·

Everyone should actually just go read the bill rather than just get news from a bunch of sources that stand to gain or lose from aspects of it. A ton of these

by jjcon 6y ago

Everyone should actually just go read the bill rather than just get news from a bunch of sources that stand to gain or lose from aspects of it. A ton of these claims are unsubstantiated if you look in the latest versions. There is so much Fear slinging going on around the web it’s seriously just bizarre to me after actually reading the bill.

raspyberr 6y ago
Tell me how anything can be done about encryption (especially E2E encryption) that won't be abused. US considered encryption arms less than 30 years ago. We're living in the best possible time for it. Genuine open-source end-to-end encryption, that can only be seen by your recipient. No one can do anything about it. In the current world where privacy feels like it's non-existent, you have these islands of hope and even these are being eroded. Yes, I agree you should always read first-hand rather than second-hand reports but is there literally anything the government would do that I would want them to do to the current state of encryption?
- VLM 6y ago
  "can only be seen by your recipient" Both endpoints are DRM'd and controlled and recorded by big brother, you don't have root on either although uncountable exploits and viruses do, and often at least one of the endpoints is big brother himself so obtaining logs will be quite easy.
  - bjelkeman-again 6y ago
    But, isn’t the argument that access this way is cumbersome and only available economically to priority targets? Also, if you need you can run Linux as end points.
    - Reelin 6y ago
      Run Linux ... on a device whose CPU has an unauditable security coprocessor? A CPU whose microcode is implemented in encrypted firmware? A device whose physical hardware can't be meaningfully audited without state actor level resources? I don't really think such approaches are used or even viable currently. But if it ever were a concern, "run Linux" doesn't even begin to address it. (Anyway you can't run Linux if your endpoint is a phone with a locked bootloader.)
      - Mirioron 6y ago
        The only way that I can see this being actually safe is if you make the hardware to encrypt and decrypt the data yourself.
michaelmrose 6y ago
Lawmakers proposed a law that would allow them to eat babies. Since lawmaking is a process eventually this eventually morphs into a law that only allows the eating of teenagers and then only those who also have red hair or blue eyes. Without infinite time lots of people only know that the bill allows eating people and aren't entirely clear on the exact criteria of people allowed to be eaten. A process that starts in extremely bad faith is unlikely to be negotiated into something reasonable. The best solution is to keep threatening lawmakers who pass stuff like this with replacement in hopes that nothing lands because there is no universe in which they are capable of producing good legislation on a topic they know less than nothing about.
- anticensor 6y ago
  How is E2EE related to cannibalistic eating of humans?
  - callalex 6y ago
    It’s called an Analogy. https://www.merriam-webster.com/dictionary/analogy https://www.merriam-webster.com/dictionary/analogy
- cinquemb 6y ago
  > The best solution is to keep threatening lawmakers who pass stuff like this with body bags and toe tags FTFY ;)
  - michaelmrose 6y ago
    The problem of course is that every faction in American politics has lots of guns. Unless you want to be ruled by whomever can prevail thunderdome style in an all out war we need to keep solving things with voting and debate.
    - cinquemb 6y ago
      The way things are set up, one can only vote and debate for people who routinely get "persuaded" by K street when elected
rbecker 6y ago
> A ton of these claims are unsubstantiated if you look in the latest versions. Could you be more specific? And which claims remain valid?
wahern 6y ago
Which bill? The Lawful Access to Encrypted Data Act bill (https://www.judiciary.senate.gov/imo/media/doc/S.4051%20Lawful%20Access%20to%20Encrypted%20Data%20Act.pdf https://www.judiciary.senate.gov/imo/media/doc/S.4051%20Lawf...) is on its face every security engineer's worst nightmare. It explicitly mandates that large service providers and device manufacturers implement backdoors. Full stop. Not only would that suck for Apple and Signal, it would probably suck for AWS (i.e. AWS KMS), too, presuming AWS doesn't already provide those backdoors. I agree that there seems to be more hyperbole (slippery slope, parade of horribles hand wringing) surrounding the EARN IT bill (https://www.congress.gov/bill/116th-congress/senate-bill/3398/text https://www.congress.gov/bill/116th-congress/senate-bill/339...). It would make CDA Section 230 Safe Harbor protections contingent on complying with "best practices", but only for civil suits related to child sexual exploitation. In practice I assume this would mean the only exposure for, e.g., Facebook if they failed to comply with "best practices" would be suits from those victimized over the platform. Theoretically large social media platforms could probably absorb whatever minimal liability that creates for them, notwithstanding the uncertainty that would exist until the first few cases exposed the contours of when and how they'd be liable. OTOH, from a PR perspective it might be difficult to remain intransigent. But in any event Section 230 Safe Harbor is a rather novel immunity and most other industries have no such protections, so it's not like it would be the end of the world. Heck, plenty of people worried about EARN IT also argue in other contexts (e.g. fake news culpability) for the removal of Section 230 protections altogether. Also, it's really not clear how EARN IT would effect end-to-end encryption. I can't see how it'd effect Signal, period. They have no real need for Section 230. Facebook might need to spin off WhatsApp (assuming it's not already separate), but creating complex corporate ownership structures to limit liability is well trodden ground. That said, half of the language in EARN IT is geared toward creating a fast-track legislative mechanism in the House and Senate that would circumvent debate and, as a practical matter, accountability. Perhaps it's possible that mechanism could also be used to sneak through broader encryption-related legislation.
- Reelin 6y ago
  > But in any event Section 230 Safe Harbor is a rather novel immunity and most other industries have no such protections, so it's not like it would be the end of the world. I have to disagree here. What other industry revolves around distributing user generated content in such unmanageable quantity, and for free? Without liability protection, who in their right mind would operate a site like Reddit without charging users a membership fee? > plenty of people worried about EARN IT also argue in other contexts (e.g. fake news culpability) for the removal of Section 230 protections altogether I seriously doubt that a well informed person concerned about the effect of EARN IT on Section 230 would turn around and speak favorably of stripping Section 230 protections for failing to moderate user content regarding current events. (Unless I've misunderstood you?) (On the other hand, the recent drama surrounding Twitter was because by adding their own annotations to certain posts they were arguably behaving as a publisher instead of as a mere host for user content.) > I can't see how it'd effect Signal, period. They have no real need for Section 230. Honest question - I have no idea how liability works for encrypted content. Even thought their user content is encrypted, could they be held liable under EARN IT if their platform was used for sexual exploitation of children? I'm assuming that strong end-to-end encryption with no backdoor wouldn't qualify as a "best practice" under that bill. More generally, I'm not clear to what extent intent is required in these cases. Consider pinning an IPFS object whose content is encrypted or operating a Tor exit node. Is plausible deniability alone enough to protect you from civil proceedings? What about criminal ones?
kabdib 6y ago
I actually read it. It's actually really terrible.

by jjcon 6y ago

raspyberr 6y ago

Tell me how anything can be done about encryption (especially E2E encryption) that won't be abused. US considered encryption arms less than 30 years ago. We're living in the best possible time for it. Genuine open-source end-to-end encryption, that can only be seen by your recipient. No one can do anything about it. In the current world where privacy feels like it's non-existent, you have these islands of hope and even these are being eroded. Yes, I agree you should always read first-hand rather than second-hand reports but is there literally anything the government would do that I would want them to do to the current state of encryption?

VLM 6y ago
"can only be seen by your recipient" Both endpoints are DRM'd and controlled and recorded by big brother, you don't have root on either although uncountable exploits and viruses do, and often at least one of the endpoints is big brother himself so obtaining logs will be quite easy.
- bjelkeman-again 6y ago
  But, isn’t the argument that access this way is cumbersome and only available economically to priority targets? Also, if you need you can run Linux as end points.
  - Reelin 6y ago
    Run Linux ... on a device whose CPU has an unauditable security coprocessor? A CPU whose microcode is implemented in encrypted firmware? A device whose physical hardware can't be meaningfully audited without state actor level resources? I don't really think such approaches are used or even viable currently. But if it ever were a concern, "run Linux" doesn't even begin to address it. (Anyway you can't run Linux if your endpoint is a phone with a locked bootloader.)
    - Mirioron 6y ago
      The only way that I can see this being actually safe is if you make the hardware to encrypt and decrypt the data yourself.

michaelmrose 6y ago

Lawmakers proposed a law that would allow them to eat babies. Since lawmaking is a process eventually this eventually morphs into a law that only allows the eating of teenagers and then only those who also have red hair or blue eyes. Without infinite time lots of people only know that the bill allows eating people and aren't entirely clear on the exact criteria of people allowed to be eaten. A process that starts in extremely bad faith is unlikely to be negotiated into something reasonable. The best solution is to keep threatening lawmakers who pass stuff like this with replacement in hopes that nothing lands because there is no universe in which they are capable of producing good legislation on a topic they know less than nothing about.

anticensor 6y ago
How is E2EE related to cannibalistic eating of humans?
- callalex 6y ago
  It’s called an Analogy. https://www.merriam-webster.com/dictionary/analogy https://www.merriam-webster.com/dictionary/analogy
cinquemb 6y ago
> The best solution is to keep threatening lawmakers who pass stuff like this with body bags and toe tags FTFY ;)
- michaelmrose 6y ago
  The problem of course is that every faction in American politics has lots of guns. Unless you want to be ruled by whomever can prevail thunderdome style in an all out war we need to keep solving things with voting and debate.
  - cinquemb 6y ago
    The way things are set up, one can only vote and debate for people who routinely get "persuaded" by K street when elected

rbecker 6y ago

> A ton of these claims are unsubstantiated if you look in the latest versions. Could you be more specific? And which claims remain valid?

wahern 6y ago

Which bill? The Lawful Access to Encrypted Data Act bill (https://www.judiciary.senate.gov/imo/media/doc/S.4051%20Lawful%20Access%20to%20Encrypted%20Data%20Act.pdf https://www.judiciary.senate.gov/imo/media/doc/S.4051%20Lawf...) is on its face every security engineer's worst nightmare. It explicitly mandates that large service providers and device manufacturers implement backdoors. Full stop. Not only would that suck for Apple and Signal, it would probably suck for AWS (i.e. AWS KMS), too, presuming AWS doesn't already provide those backdoors. I agree that there seems to be more hyperbole (slippery slope, parade of horribles hand wringing) surrounding the EARN IT bill (https://www.congress.gov/bill/116th-congress/senate-bill/3398/text https://www.congress.gov/bill/116th-congress/senate-bill/339...). It would make CDA Section 230 Safe Harbor protections contingent on complying with "best practices", but only for civil suits related to child sexual exploitation. In practice I assume this would mean the only exposure for, e.g., Facebook if they failed to comply with "best practices" would be suits from those victimized over the platform. Theoretically large social media platforms could probably absorb whatever minimal liability that creates for them, notwithstanding the uncertainty that would exist until the first few cases exposed the contours of when and how they'd be liable. OTOH, from a PR perspective it might be difficult to remain intransigent. But in any event Section 230 Safe Harbor is a rather novel immunity and most other industries have no such protections, so it's not like it would be the end of the world. Heck, plenty of people worried about EARN IT also argue in other contexts (e.g. fake news culpability) for the removal of Section 230 protections altogether. Also, it's really not clear how EARN IT would effect end-to-end encryption. I can't see how it'd effect Signal, period. They have no real need for Section 230. Facebook might need to spin off WhatsApp (assuming it's not already separate), but creating complex corporate ownership structures to limit liability is well trodden ground. That said, half of the language in EARN IT is geared toward creating a fast-track legislative mechanism in the House and Senate that would circumvent debate and, as a practical matter, accountability. Perhaps it's possible that mechanism could also be used to sneak through broader encryption-related legislation.

Reelin 6y ago
> But in any event Section 230 Safe Harbor is a rather novel immunity and most other industries have no such protections, so it's not like it would be the end of the world. I have to disagree here. What other industry revolves around distributing user generated content in such unmanageable quantity, and for free? Without liability protection, who in their right mind would operate a site like Reddit without charging users a membership fee? > plenty of people worried about EARN IT also argue in other contexts (e.g. fake news culpability) for the removal of Section 230 protections altogether I seriously doubt that a well informed person concerned about the effect of EARN IT on Section 230 would turn around and speak favorably of stripping Section 230 protections for failing to moderate user content regarding current events. (Unless I've misunderstood you?) (On the other hand, the recent drama surrounding Twitter was because by adding their own annotations to certain posts they were arguably behaving as a publisher instead of as a mere host for user content.) > I can't see how it'd effect Signal, period. They have no real need for Section 230. Honest question - I have no idea how liability works for encrypted content. Even thought their user content is encrypted, could they be held liable under EARN IT if their platform was used for sexual exploitation of children? I'm assuming that strong end-to-end encryption with no backdoor wouldn't qualify as a "best practice" under that bill. More generally, I'm not clear to what extent intent is required in these cases. Consider pinning an IPFS object whose content is encrypted or operating a Tor exit node. Is plausible deniability alone enough to protect you from civil proceedings? What about criminal ones?

kabdib 6y ago

I actually read it. It's actually really terrible.