15 ms·

Combating abuse without backdoors

208 points by Arathorn 6y ago

chignonpostyear 6y ago
What's the deal with the irritating "Click to rate this page" popup? It doesn't even go away when you click on a star.
- Arathorn 6y ago
  It's an attempt to get a handle on "does our documentation suck?"; we'll exclude it from the blog. It should go away when you click on it, but looks like there's a bug on some browser/tracker-blocker combos. Try to not let it distract from the fact that the governments of 2 billion people want to outlaw end-to-end encryption though...
  - vector_spaces 6y ago
    I've found the documentation to be excellent for developers and operators (maybe except for SDK documentation last I checked, but the source code is readable enough in that case). However to be blunt (and with the utmost respect for the work that you're doing) it is really, really poor when it comes to documenting client features, e.g. there's a poverty of "how-tos" for certain common things, which is especially crucial for nontechnical users. For example, just the other day I had a group jitsi call with everyone in my Matrix instance where I tried to onboard everyone on cross-signing. Most of the people in my community are non-technical and a couple barely understand what E2E encryption means. Unfortunately I didn't anticipate that the Element app would have significantly different menus between the Android and iOS apps, so I tried to consult the documentation... and couldn't find any whatsoever on cross-signing. I tried searching element.io, the `docs/` folders in each client's repo, and to be frank I ultimately gave up and turned it into a verification party I really think there needs to be more investment on this front -- as it stands, the onus is on operators to justify the overhead of E2E, and to figure out how to do XYZ on all the various clients from outdated blog posts, issue threads, and reading source code. Very rarely have I been able to find answers to questions in the actual documentation itself. Anyway, again, I appreciate the work that you're doing, and I'm confident this experience will improve given time. I'd love to help with it -- I've been building my own documentation as I go along, but not sure how to even get started contributing.
    - decentralisedog 6y ago
      So the good news here is we're working on "implementation guides" which are basically developer friendly documentation on how to do X rather than a raw technical spec. I don't recall if it's actually hosted anywhere just yet, but you can see the progress in https://github.com/matrix-org/matrix.org/tree/master/implementation-guides https://github.com/matrix-org/matrix.org/tree/master/impleme...
COGlory 6y ago
Presumably, the writing is on the wall. One of the driving forces of spinning up my own Matrix community for me and my friends is the Facebook wouldn't let us discuss firearms without heavy censorship. My fear with this is that it will turn into something like Reddit, where participating in one community automatically bans you from other communities, regardless of the content and context of your reputation. Especially when the predominant server is matrix.org. What, if any, measures are in place to prevent any one server from becoming overwhelmingly popular and then bullying everyone else? That could be detrimental to the discovery and growth of smaller communities that are viewed as controversial by bigger ones. If you associate with them, you risk being ostracized by other important communities, and barred from other important conversations. I think that's a net negative for the entire ecosystem. I see the necessity of this, and I appreciate the Matrix team's attempt to provide an alternate solution and avoid governmental oversight, but this is just going to delay the issue, because we all know this isn't about catching child predators. Governments want to break encryption because they are after power. A reputation system won't stop them for long. I'm very sad to see this development, and to me it seems like something far from what my understanding of the mission of Matrix was. I say all this with respect and gratitude for Matrix, which to me is one of the most important developments of the internet this century.
- Arathorn 6y ago
  This an excellent response, and thank you for writing it (and for considering Matrix so highly). I think the main reason why this isn't going to turn into Reddit is that the reputation is strictly relative, and hopefully we can set a precedent for proportional behaviour. So, while you will always have some set of people who think you shouldn't discuss firearms and assign folks in firearm communities negative reputation, hopefully that would never result in widespread bans or filtering. If a moderator got overenthusiastic and imposed a blanket ban, hopefully their community would rise up and vote with their feet (just as you would today if a rogue moderator got trigger-happy with /ban). Meanwhile, if someone got overenthusiastic with blanket filter rules (i.e. "automatically assign negative weight to content from users from these communities so it's hidden by default"), then individuals could and should override it by assigning their own filters. We've tried to model it after real life, for better or worse. If someone chooses to use the same identity for discussing both firearms and (say) cooking, then they may get shunned by some cookery folks. But most of the cook group won't care and ignore it. You might get unlucky and discover the head chef is anti-firearms and kicks you out, but frankly that sounds like a good reason to find a more broadminded cook group. You're right that a large server like Matrix.org could take an opinionated view and go and apply radical blanket bans for all sorts of stuff, and set a precedent that it's okay to throw your weight around. But a) we're not going to do that - for instance we haven't yet blocked any server from Matrix.org; b) the only blanket bans we're considering for Matrix.org at this time are against spam, child abuse, and folks conspiring to kill; c) we're pretty confident that if Matrix.org overstepped its bounds on moderation, the network would route around the damage anyway: there are something like 55,000 servers that we're aware of on the network, and we believe Matrix.org accounts for only about 20-30% of the traffic (and that includes IRC bridges etc). So folks would vote with their feet and shift server - especially once we have portable accounts. Finally, P2P Matrix will change the dynamic entirely on this - no more servers (by default) means that users will be entirely making their own choices on where to hang out and who to hang out with.
andioop 6y ago
so this sounds like they're saying "hey instead of undermining end to end encryption, implement a social credit system"
- Arathorn 6y ago
  no, "social credit system" sounds like China/HN/Reddit/Slashdot etc. This is more "hey instead of undermining end-to-end encryption, empower users to filter out content they don't want to see, using whatever metric floats their boat".
mirdaki 6y ago
I'm very excited to see this discussed! Even without pressure from government entities, I would certainly want some sort of way to prevent something like child abuse content from being uploaded to my server, so I'd love for a system like this to work well. 1. Would the system discussed have anyway to diminish "cancel culture" like attacks? For instance, if a user were to say something egregious like "Empire Strikes Back is bad", what is preventing especially enthusiastic fans from labeling them with having uploaded child abuse content. Presumably that would be a good way to get that user banned from most popular servers. Is there a way to "appeal" this is the moderator or server host is a bad actor? Is having a good enough reputation before an incident like that enough to not be blocked everywhere? 2. Is there a way we could test this outside of Matrix? It seems useful to social platforms, particularly other decentralized ones. If it could be done in a platform independent way, it could be a nice open source collaboration (granted, how people interact on different platforms might be enough to make that impossible to generalize effectively). I also ask, because this sort of thing is really dependent on how people interact, so "play testing" it might be beneficial to getting a more realistic design going early on. Even doing something low-tech might find some issues that should be addressed. Is there a room discussing this in particular? I'd be interested in participating.
- Arathorn 6y ago
  > 1. Would the system discussed have anyway to diminish "cancel culture" like attacks? I would differentiate between "cancel culture", where folks gang up and react disproportionately to a misdeed - versus a smear campaign where people try to weaponise the moderation system by spreading malicious reputation (e.g. your ESB example). The idea is that both could be solved by having an open ecosystem of relative reputation lists. If a trusted authority (e.g. iwf.org.uk) were to publish a vetted list of hashes of known bad content that you definitely don't want on your server, then you'd obviously expect them to review and verify entries to that list. If they got sloppy and let randoms try to smear each other by submitting ESB-haters to the list, then there would be a scandal and people would stop trusting that reputation list. Alternatively, if ESB-fans started framing ESB-haters with child abuse imagery, then obviously that's a problem for the cops rather than the moderation list verifiers. Alternatively, if some random vigilante decided to start publishing up a reputation feed of people they happen to think are are child abusers, and then started to stuff it with other randoms they happen not to like (whether that's ESB-haters), then the hope is that armed with appropriate visibility on the filters which they are applying, people would spot that this is a disreputable source of reputation asap and run a mile. For instance, you might have accidentally subscribed to the #child-abuse-vigilante reputation feed, and your Matrix client might say "btw, 98% of the rooms in this community have been filtered out by the #child-abuse-vigilante feed data". You might click on the link to check the names of the rooms which have disappeared, and if they turn out actually to have names like "ESB was overrated" then you might choose to dig further and then ring the alarm that #child-abuse-vigilante is not to be trusted, and unsub. You could also publish a reputation feed for reputation feeds (no, really). > 2. Is there a way we could test this outside of Matrix? Absolutely. There is nothing Matrix specific here, or even decentralisation-specific. We're just trying to prove it in Matrix because we have a relatively large community, containing a fairly representative mix of different actors, but we're not so big as to make it hard to experiment - and because this is frankly an existential threat to the long-term success of the project :) The room for discussing this is #matrix-reputation:matrix.org (although public convo is a bit sporadic; this should change as we spin up more experiments in the coming weeks/months however).
Hyolobrika 6y ago
I had an idea similar to this one some time ago. I called it "moderation feeds".
- Arathorn 6y ago
  the idea also pops up somewhat unexpectedly in Neal Stephenson's "Fall, or Dodge in Hell". (although we were thinking about it first :D)
  - core-questions 6y ago
    What a strange book. It's like two or three totally unrelated books mashed together. I felt like I was having a nice classic sci-fi read, then all of a sudden it's wild and insane speculation about KKK-redux fundamentalists, and then back into normal sci-fi, only to be replaced by what was ultimately a pretty puerile fantasy novel. Really not sure how to feel about it. Could have been a lot better.
    - Arathorn 6y ago
      :D it sticks in your head though... between Seveneves using Matrix-style decentralised communication as an (amazing) plot device, and Fall suddenly pursuing subject reputation feeds as a (completely dead end) plot device, it does make you wonder about living in a simulation. (And yes, the fantasy quest was a bit surprising, to say the least.)
- babolivier 6y ago
  The Informo folks also thought about something similar (though maybe not as flexible) a couple of years ago https://specs.informo.network/unstable/trust-management/ https://specs.informo.network/unstable/trust-management/
Idesmi 6y ago
Typo at “[…] European of Court of Justice to invalidate the Privacy Shield.” Change to “European Court of Justice to invalidate the Privacy Shield.”
- Arathorn 6y ago
  oops, fixed at https://github.com/matrix-org/matrix.org/commit/ae44fd66a71b088f7473bf2bbb96afa58b518ac1 https://github.com/matrix-org/matrix.org/commit/ae44fd66a71b... - thanks :)
deleted 6y ago
[deleted]
dsign 6y ago
> Finally: we are continuing to hire a dedicated Reputation Team to work full time on building this. This sucks. A group of friends and I have been running Matrix for a year and we would gladly like more money dedicated to bug-fixing. Having to hire somebody to introduce more bugs to placate some goons from backward governments is just sad.
- CameronNemo 6y ago
  Abuse is a real problem for the matrix network. I've seen spam and borderline CSAC on the network. Frankly I think this is a valuable addition. Although the 5 eyes should bankroll it if they are really so concerned about CSAC and terrorism.
  - theon144 6y ago
    CSAC?
    - notamy 6y ago
      Child Sexual Abuse Content or something along those lines, I imagine.
3np 6y ago
Something funny they don't even mention: > We call on technology companies to [...] enable law enforcement access to content in a readable and usable format where an authorisation is lawfully issued, is necessary and proportionate, and is subject to strong safeguards and oversight. Matrix.org is not a company and therefore not a target at this point.
- gostsamo 6y ago
  Not true. The attack would be against any service provider. The fact that currently they are eyeing whatsup and apple does not mean that they make the distinction between them and signal or telegram.
  - huhtenberg 6y ago
    Again - WhatsApp, Apple, Telegram and Signal _are_ indeed service providers. Matrix is not.
    - gostsamo 6y ago
      Again, matrix provide a server, matrix.org. Again, if e2e is outlawed, it would be illegal for them to even work on the code.
      - liotier 6y ago
        If e2e is outlawed, it would be illegal to operate the matrix.org server (which is one of a universe of federated Matrix servers) - but the code would still be legal. Also, peer-to-peer Matrix is in the works, with working prototypes - the client sort of embeds a server... Enforcing illegal e2e would require going after each user - lots of fun !
      - brokenmachine 6y ago
        If e2e is outlawed, how will https work?
- babolivier 6y ago
kernelbugs 6y ago
Very good rundown of why encryption backdoors are fundamentally flawed (and why governments should stop pushing for them). I'll be interested to see how the proposed reputation system rolls out. It sounds like a complex system to get right.
- ashleyn 6y ago
  It's the Clipper chip all over again. They never learn.
  - baybal2 6y ago
    I waiting to see somebody actually provoking any of the 5 eyes governments into exerting this power, and seeing how it works.
david_draco 6y ago
Perhaps the logical next step is slashdot-like karma that reduces the visibility of low reputation users. Slashdot allowed users to choose their thresholds and, IIRC, whether they wanted funny comments or not.
- pferde 6y ago
  This would either have to have miraculously intuitive UI, or it would have to be done not on user level, but rather on matrix server level, because otherwise regular users would never start really using it. My money would be on the latter. :)
- zeusflight 6y ago
  Reputation scores risk turning the rooms into an echo chamber due to karma mining. It's good for forming consensus, but bad for debates. This can be bad for some communities like FOSS groups where new users and people with fresh ideas frequent.
  - komali2 6y ago
    Matrix will apparently invent ui to warn you if your filters are creating an echo chamber but I have no idea how that would look or work. EDIT: Fucking obnoxious post throttling. I don't know why HN doesn't want me posting anymore, so I guess I'll just abuse the edit feature to get my voice heard. In reply to zuesflight: > What if the feed manipulation was per-user? My understanding from Matrix's blog post is that is half of the filtering equation. 1. Users and 2. Servers can filter 3. other users via reputation. It sounds like these filters will be inspectable, so, I would imagine that if you don't like how a server is filtering, you'd just not use it. I don't really have a strong understanding of Matrix (is it a protocol, a company?) so this is just me firing from the hip from the blog. I also think the filter "Merge" thing is all about making "multiple points of attack." None of this is implemented from what I understand, all they have now is a sort of binary banned/not banned list they share with mozilla. Very pie in the sky but if it works as they write that'd be cool!
    - zeusflight 6y ago
agentdrtran 6y ago
This is a very well written post and I'm happy Matrix is taking this seriously.
bob29 6y ago
“Without backdoors” wow, shots fired at Moxie “federation won’t work” Marlinspike’s secure honeypot Signal.
- uponcoffee 6y ago
  Could you elaborate on what's wronf with signal
  - shdfrdfhs 6y ago
    The problem with Signal is the savior complex of its creator, who insists he and only he can correctly implement secure messaging, and it can only be done if he's permitted to handle all your data himself.
    - awestroke 6y ago
      The clients are OSS. Does the protocol have any backdoor?
      - timpattinson 6y ago
        OSS /= no backdoors.
        ttsda 6y ago
        > Who cares if the server is not ? Well... if E2EE is properly implemented, you could be broadcasting your messages on twitter and you'd still be safe.
      - lucideer 6y ago
        I can't speak to the iOS client but the Android one is only technically OSS in that it bundles proprietary binary blobs by default.
      - arnoooooo 6y ago
        Who cares if the server is not ?
baq 6y ago
in systems where reputation has significant monetary value, how do you stop people from exchanging money for reputation? it's a serious problem which i've never seen solved when participants don't have trust established with each other, e.g. amazon reviews are completely off the rails, but HN karma works quite well. slashdot has metamoderation which i haven't seen implemented anywhere else - it seemed to work 10 years ago or so, but times were different then.
- inglor 6y ago
  HN reputation does not have any implications or monetary value - at least from a very early point. Amazon review scores have obvious monetary value.
  - YetAnotherNick 6y ago
    > HN reputation does not have any implications or monetary value I would buy a slot in HN ranked posts for greater than $0.
    - komali2 6y ago
      Ranked posts? I'm not aware of any positioning of hn threads or posts that has correlation with user reputation. Personally I never check user reputation either, and the only 2 I recognize by name are dang and the digital minister of Taiwan.
- TheRealPomax 6y ago
  That feels like you're asking about a different system, based on centralized authorities like HN or Reddit. Matrix is decentralized by design, similar to IRC, so you'd have to pay off a _lot_ of people to buy your way into every server's good side. Because no sane server is going to accept the trust list of any other server it interfaces with just because it happens to also be a Matrix instance.
tumetab1 6y ago
It's annoys me that both sides lie/are wrong in this. The statement' signatories [1] agree that having default E2EE (end to end encryption) on Facebook Messenger will stop around 12 million reports of child pornography per year. This is a lie/incorrect because recipients of such material can manually report it [2] and/or it's possible to make the detection tool work on end points, it's a fancy hash comparison algorithm [3]. The Matrix people respond to what they think "lawful access" is by saying that "lawful access " is a EE2E backdoor so they it's impossible to have "lawful access" and "E2EE". It's an assumption that "lawful access" is a third decryption key and it's possible to have E2EE and third party access to it as Facebook Messenger proves [2]. If all parties were honest the governments would say "we want regular police work to have a way to lawful access E2EE messages and while you're a it a backdoor for the intelligence agencies". The other side would have positions between "no to both" but most would say "no backdoor, OK to past encrypted messages for police investigations and intelligence agencies with transparency reports and oversight". [1] https://www.gov.uk/government/publications/international-statement-end-to-end-encryption-and-public-safety/international-statement-end-to-end-encryption-and-public-safety-accessible-version#signatories https://www.gov.uk/government/publications/international-sta... [2] https://www.facebook.com/help/messenger-app/android/498828660322839?rdrhc https://www.facebook.com/help/messenger-app/android/49882866... [3] https://en.wikipedia.org/wiki/PhotoDNA https://en.wikipedia.org/wiki/PhotoDNA
- robertlagrant 6y ago
  Having a button which people can use to forward a message (or forward it) - with a cryptographic guarantee of who it came from - to the authorities would be useful. E2EE preserved, and in fact utilised.
  - cyphar 6y ago
    Signal and other OTR-derived systems actually cannot cryptographically prove that someone sent a message (the recipient can forge the message because the message is authenticated via HMAC not a signature).
    - 6y ago
CivBase 6y ago
> We call on technology companies to [...] enable law enforcement access to content in a readable and usable format where an authorization is lawfully issued, is necessary and proportionate, and is subject to strong safeguards and oversight. I believe the age of centralized services will soon begin to die out. Users are increasingly frustrated with major tech companies who host these services and laws like this continue to erode their potential. I don't know if the crown will be passed on to the likes of Matrix and Mastodon or new decentralized platforms I haven't heard of. Regardless, I think we're approaching a breaking point with centralized services and it's only a matter of time.
- Karunamon 6y ago
  You've got a much more optimistic view than I do. That frustration is definitely there, but there needs to be a reasonable alternative for people to easily move to before you see any kind of exodus. Right now, one doesn't exist. These also-ran projects designed by and for geeks don't really count.
  - CivBase 6y ago
    Like I said, I don't know if the likes of Matrix and Mastodon will be our platforms of the future. However, they are blazing the trail. They demonstrate what is possible. There is a lot of churn in the world of online services. It's only a matter of time before someone else follows in the footsteps of Matrix and Mastodon, but figures out how to take it even further. Or maybe someone else will break through by following in their footsteps. Or maybe Matrix or Mastodon are just dark horses who haven't hit their stride yet. I don't know, but I do believe the future will be in decentralized services over centralized ones.
corrys 6y ago
This proposal is clear and thoughtful, I like it. However, I didn’t see an explanation of how this would help addressing abuse (or other illegal activity) directed at third parties - someone who is not participating in a particular group. E.g. a group that shares child pornography. It is obvious that the members themselves would not report it. Likewise, relying on reputation does not make sense - in fact, their reputation could be inflated by the satisfied members.
- komali2 6y ago
  I found that part lacking as well, but then I remembered that it's not the protocol's job to solve crime. As matrix indicated in their opening statement, to try to solve for the .1% could irrevocably damage the 99.9. It's not like law enforcement doesn't have options. I'll use cp as an example. Off the top of my head they could host honey pots and social engineer their way towards cp content creators, analyse cp media for artifacts that could lead them to a location. Legislators could create laws that throttle human trafficking by ending drug wars, opening borders, and providing universal social services. Etc. But to drag an algorithm into this is the wrong approach for the reasons matrix listed.
  - ricksharp 6y ago
    I agree, I think crime fighting requires tools that operate at the user level. So an infiltration bot: We have the technology today (gpt-3 level dialog) that could infiltrate criminal social networks, gather evidence, build credibility and power, and then help shut everything down. The system itself cannot provide this, but an ai-human actor could. Of course, this technology is scary: What I think is not a crime - like complaining about the government - is a crime in other places.
- lifty 6y ago
  They do touch on this point: "Meanwhile, communities which are entirely private and entirely encrypted typically still have touch-points with the rest of the world - and even then, the chances are extremely high that they will avoid any hypothetical backdoored servers. In short, investigating such communities requires traditional infiltration and surveillance by the authorities rather than an ineffective backdoor."
parliament32 6y ago
Isn't this very different from what they're requesting? >something that empowers users and administrators to identify and protect themselves from bad actors and >enable law enforcement access to content in a readable and usable format are completely different things, no? They're barely even related.
- Arathorn 6y ago
  The idea is is this: * Enabling LE to read encrypted content == backdoor * Backdoor == unviable, because it weakens encryption for everyone, and will be abused. * Therefore, you need a way to help everyone (including LE) navigate/filter/investigate/discover/block content out there. Subjective reputation feeds give a way of doing so.
  - parliament32 6y ago
    Maybe I'm missing something here, how does having a hashed lists of "bad" message IDs allow LE to navigate/investigate/discover content? From what I can see it only tells you there's something to block, and you can't even reverse it to "investigate" much of anything.
    - Arathorn 6y ago
      One approach could be to check public servers for "bad" content, and then use that as the entry point to investigate/infiltrate those communities.
auganov 6y ago
> Anyone who can determine the secret needed to break the encryption will gain full access Without collections just having the secret key[s] won't help you much. I don't like the idea of a backdoor as much as anybody else, but this notion that you merely have to have a key to access everything is strictly false. This may only be true specifically for systems that allow anybody (or some broad set of untrusted people) to see other people's encrypted data. For most architectures backdoored E2EE is still more secure than no encryption. And obviously if there was a backdoor people wouldn't use/design systems that allow for easy collections.
- cyphar 6y ago
  Reminder that the NSA is basically collecting all of the internet traffic it can get its hands on. They didn't build a data centre in the middle of the desert for the fun of it.
  - auganov 6y ago
    Well, that's part of the point. Governments have been doing mass collections for decades and a lot of that might be cleartext. As far as I know this has not lead to random hackers obtaining great access. So it's preposterous to claim that backdoored E2EE would universally enable that[0]. E2EE does in large part protect from governments and other powerful players and it should be okay to say that. Again, that said, if Facebook was to offer plaintext and backdoored E2EE messaging, the backdoored version would still be a strict improvement security wise. [0] as noted, with exception of some systems that might provide easy access to everybody's data by design.
    - mattnewton 6y ago
      Why would hackers need to hack the NSA's methods of tapping the internet to obtain communications sent in cleartext? If you are sending everything unencrypted there should be no expectation of secrecy. The problem is that we current do send high value information encrypted and this proposal wants to weaken that encryption; what happens to low value information freely sent unencrypted doesn't seem relevant to me.
eecc 6y ago
Not sure how this reputation system solves the e2e encryption backdoor problem, but I would definitely adopt a WOT-like reputation system for SSL certificates. The bundled-CA system is IB shambles and if it’s still standing, it’s only because of the deliberate ignorance of the general public.
kelnos 6y ago
I see quite a few open letters like this that I think mostly miss the point. From the perspectives of the governments in question, this isn't (solely) about terrorism or law enforcement. It's about control of their citizens. They use terrorism as the bogeyman to try to get people comfortable with the concept, but really, they just want dragnet surveillance over everyone, period. I think it's most useful to point out that banning or backdooring E2EE won't stop the terrorists, but it seems like the main thrust of these sorts of articles is about how backdoors are dangerous to everyone... which is exactly what these governments are ok with. And a disturbing number of people (outside of the HN crowd) are perfectly willing to give up their own privacy and freedom if it means catching the terrorists. I think a better approach to getting the public to be against these encroachments would be to drive home that backdoors and E2EE bans don't actually catch terrorists or human traffickers or child pornographers.
- cwkoss 6y ago
  I think the best approach may be a disingenuous one: Anyone advocating for encryption back doors is a pedophile. Encryption helps users keep their data private from others, including service providers and the government. DEEP STATE PEDOPHILES have infiltrated our government and want to have free reign to access pictures of you infant child in the bathtub for their disturbing desires. Pedophiles managing social media servers want to be able to snoop on the private media of anyone their sick desires are targeted at. They want to be able to blackmail your children who have taken selfies in the mirror into sending them more child pornography or even committing espionage against their own parents or families, consolidating power for the secret cabal of pedophiles at the top of our institutions. Say NO to pedophiles, keep encryption secure! Any politician who supports these measures should get the question, "Why do you support this legislation, are you a secret pedophile?"
  - triceratops 6y ago
    There's no need to resort to lies like that. It's better to stay away from the crazy conspiracy theories. Even the following is sufficient and true: "Imagine your child's calendar, real-time location, grades, medical history, selfies, search and video viewing history, chats with friends hackable by any predator. All of this is possible if we allow the government to force backdoors." Just keep hammering on that point to any politician or voter who supports encryption backdoors. Ask them why they want to make children less safe. Stop saying "you can't outlaw math" and "terrorists will use encryption anyway" - people either don't understand, or don't care.
xg15 6y ago
What a disappointing read. > What we really need is something that empowers users and administrators to identify and protect themselves from bad actors, without undermining privacy. What if we had a standard way to let users themselves build up and share their own views of whether other users, messages, rooms, servers etc. are obnoxious or not? > This forms a relative reputation system. As uncomfortable as it may be, one man’s terrorist is another man’s freedom fighter, and different jurisdictions have different laws - and it’s not up to the Matrix.org Foundation to play God and adjudicate. And as uncomfortable as it may be, Matrix.org is itself part of a value system, however much they would like to bask in moral relativism. Yes, adding backdoors to prevent bad actors is a flawed solution with lots of negative consequences. However, then we should think about ways to solve this problem that do not rely on ignoring half of the problem. The whole idea of "relative reputation" assumes that any problem on the internet is a matter of subjective opinion and will go away if I could just convincingly enough pretend that the problem doesn't exist: If someone annoys you on the internet, block them and pretend they aren't there and everything will be fine. We all know this is not how the world works. There are situations where a conversation between persons A and B is actively harming C, even though C is not part of that conversation at all - and where C has a legitimate interest in preventing A and B from communicating. Take cyberbullying for example (in addition to all the other examples usually given). In those cases, the whole point is that the victim is not part of the group. Nevertheless, the group is open to the public and may in fact gain high reputation and utility among those interest. This doesn't make it at all better for the victim. Is this really the hill you want to die on?
ArcVRArthur 6y ago
Perhaps now may be the appropriate time to begin transitioning my friend group on Matrix over to XMPP.
- Arathorn 6y ago
  /me solemnly adds you to his "people who'd prefer to use XMPP than filter out abuse with a reputation system" reputation list
est 6y ago
pardon me but this looks like a longer version of ban list with reasons? What if spammers just create really massive one-off accounts? A lot of computing power would be wasted on comparing billion rows of user ids. Another issue in MSC2313 is the {"reason": "undesirable behaviour"} is too short. What if a legitimate user is wrongfully banned? What's the appeal process? What if the un-ban didn't propagate into proper servers?

208 points by Arathorn 6y ago

chignonpostyear 6y ago

What's the deal with the irritating "Click to rate this page" popup? It doesn't even go away when you click on a star.

Arathorn 6y ago
It's an attempt to get a handle on "does our documentation suck?"; we'll exclude it from the blog. It should go away when you click on it, but looks like there's a bug on some browser/tracker-blocker combos. Try to not let it distract from the fact that the governments of 2 billion people want to outlaw end-to-end encryption though...
- vector_spaces 6y ago
  I've found the documentation to be excellent for developers and operators (maybe except for SDK documentation last I checked, but the source code is readable enough in that case). However to be blunt (and with the utmost respect for the work that you're doing) it is really, really poor when it comes to documenting client features, e.g. there's a poverty of "how-tos" for certain common things, which is especially crucial for nontechnical users. For example, just the other day I had a group jitsi call with everyone in my Matrix instance where I tried to onboard everyone on cross-signing. Most of the people in my community are non-technical and a couple barely understand what E2E encryption means. Unfortunately I didn't anticipate that the Element app would have significantly different menus between the Android and iOS apps, so I tried to consult the documentation... and couldn't find any whatsoever on cross-signing. I tried searching element.io, the `docs/` folders in each client's repo, and to be frank I ultimately gave up and turned it into a verification party I really think there needs to be more investment on this front -- as it stands, the onus is on operators to justify the overhead of E2E, and to figure out how to do XYZ on all the various clients from outdated blog posts, issue threads, and reading source code. Very rarely have I been able to find answers to questions in the actual documentation itself. Anyway, again, I appreciate the work that you're doing, and I'm confident this experience will improve given time. I'd love to help with it -- I've been building my own documentation as I go along, but not sure how to even get started contributing.
  - decentralisedog 6y ago
    So the good news here is we're working on "implementation guides" which are basically developer friendly documentation on how to do X rather than a raw technical spec. I don't recall if it's actually hosted anywhere just yet, but you can see the progress in https://github.com/matrix-org/matrix.org/tree/master/implementation-guides https://github.com/matrix-org/matrix.org/tree/master/impleme...

COGlory 6y ago

Presumably, the writing is on the wall. One of the driving forces of spinning up my own Matrix community for me and my friends is the Facebook wouldn't let us discuss firearms without heavy censorship. My fear with this is that it will turn into something like Reddit, where participating in one community automatically bans you from other communities, regardless of the content and context of your reputation. Especially when the predominant server is matrix.org. What, if any, measures are in place to prevent any one server from becoming overwhelmingly popular and then bullying everyone else? That could be detrimental to the discovery and growth of smaller communities that are viewed as controversial by bigger ones. If you associate with them, you risk being ostracized by other important communities, and barred from other important conversations. I think that's a net negative for the entire ecosystem. I see the necessity of this, and I appreciate the Matrix team's attempt to provide an alternate solution and avoid governmental oversight, but this is just going to delay the issue, because we all know this isn't about catching child predators. Governments want to break encryption because they are after power. A reputation system won't stop them for long. I'm very sad to see this development, and to me it seems like something far from what my understanding of the mission of Matrix was. I say all this with respect and gratitude for Matrix, which to me is one of the most important developments of the internet this century.

Arathorn 6y ago
This an excellent response, and thank you for writing it (and for considering Matrix so highly). I think the main reason why this isn't going to turn into Reddit is that the reputation is strictly relative, and hopefully we can set a precedent for proportional behaviour. So, while you will always have some set of people who think you shouldn't discuss firearms and assign folks in firearm communities negative reputation, hopefully that would never result in widespread bans or filtering. If a moderator got overenthusiastic and imposed a blanket ban, hopefully their community would rise up and vote with their feet (just as you would today if a rogue moderator got trigger-happy with /ban). Meanwhile, if someone got overenthusiastic with blanket filter rules (i.e. "automatically assign negative weight to content from users from these communities so it's hidden by default"), then individuals could and should override it by assigning their own filters. We've tried to model it after real life, for better or worse. If someone chooses to use the same identity for discussing both firearms and (say) cooking, then they may get shunned by some cookery folks. But most of the cook group won't care and ignore it. You might get unlucky and discover the head chef is anti-firearms and kicks you out, but frankly that sounds like a good reason to find a more broadminded cook group. You're right that a large server like Matrix.org could take an opinionated view and go and apply radical blanket bans for all sorts of stuff, and set a precedent that it's okay to throw your weight around. But a) we're not going to do that - for instance we haven't yet blocked any server from Matrix.org; b) the only blanket bans we're considering for Matrix.org at this time are against spam, child abuse, and folks conspiring to kill; c) we're pretty confident that if Matrix.org overstepped its bounds on moderation, the network would route around the damage anyway: there are something like 55,000 servers that we're aware of on the network, and we believe Matrix.org accounts for only about 20-30% of the traffic (and that includes IRC bridges etc). So folks would vote with their feet and shift server - especially once we have portable accounts. Finally, P2P Matrix will change the dynamic entirely on this - no more servers (by default) means that users will be entirely making their own choices on where to hang out and who to hang out with.

andioop 6y ago

so this sounds like they're saying "hey instead of undermining end to end encryption, implement a social credit system"

Arathorn 6y ago
no, "social credit system" sounds like China/HN/Reddit/Slashdot etc. This is more "hey instead of undermining end-to-end encryption, empower users to filter out content they don't want to see, using whatever metric floats their boat".

mirdaki 6y ago

I'm very excited to see this discussed! Even without pressure from government entities, I would certainly want some sort of way to prevent something like child abuse content from being uploaded to my server, so I'd love for a system like this to work well. 1. Would the system discussed have anyway to diminish "cancel culture" like attacks? For instance, if a user were to say something egregious like "Empire Strikes Back is bad", what is preventing especially enthusiastic fans from labeling them with having uploaded child abuse content. Presumably that would be a good way to get that user banned from most popular servers. Is there a way to "appeal" this is the moderator or server host is a bad actor? Is having a good enough reputation before an incident like that enough to not be blocked everywhere? 2. Is there a way we could test this outside of Matrix? It seems useful to social platforms, particularly other decentralized ones. If it could be done in a platform independent way, it could be a nice open source collaboration (granted, how people interact on different platforms might be enough to make that impossible to generalize effectively). I also ask, because this sort of thing is really dependent on how people interact, so "play testing" it might be beneficial to getting a more realistic design going early on. Even doing something low-tech might find some issues that should be addressed. Is there a room discussing this in particular? I'd be interested in participating.

Arathorn 6y ago
> 1. Would the system discussed have anyway to diminish "cancel culture" like attacks? I would differentiate between "cancel culture", where folks gang up and react disproportionately to a misdeed - versus a smear campaign where people try to weaponise the moderation system by spreading malicious reputation (e.g. your ESB example). The idea is that both could be solved by having an open ecosystem of relative reputation lists. If a trusted authority (e.g. iwf.org.uk) were to publish a vetted list of hashes of known bad content that you definitely don't want on your server, then you'd obviously expect them to review and verify entries to that list. If they got sloppy and let randoms try to smear each other by submitting ESB-haters to the list, then there would be a scandal and people would stop trusting that reputation list. Alternatively, if ESB-fans started framing ESB-haters with child abuse imagery, then obviously that's a problem for the cops rather than the moderation list verifiers. Alternatively, if some random vigilante decided to start publishing up a reputation feed of people they happen to think are are child abusers, and then started to stuff it with other randoms they happen not to like (whether that's ESB-haters), then the hope is that armed with appropriate visibility on the filters which they are applying, people would spot that this is a disreputable source of reputation asap and run a mile. For instance, you might have accidentally subscribed to the #child-abuse-vigilante reputation feed, and your Matrix client might say "btw, 98% of the rooms in this community have been filtered out by the #child-abuse-vigilante feed data". You might click on the link to check the names of the rooms which have disappeared, and if they turn out actually to have names like "ESB was overrated" then you might choose to dig further and then ring the alarm that #child-abuse-vigilante is not to be trusted, and unsub. You could also publish a reputation feed for reputation feeds (no, really). > 2. Is there a way we could test this outside of Matrix? Absolutely. There is nothing Matrix specific here, or even decentralisation-specific. We're just trying to prove it in Matrix because we have a relatively large community, containing a fairly representative mix of different actors, but we're not so big as to make it hard to experiment - and because this is frankly an existential threat to the long-term success of the project :) The room for discussing this is #matrix-reputation:matrix.org (although public convo is a bit sporadic; this should change as we spin up more experiments in the coming weeks/months however).

Hyolobrika 6y ago

I had an idea similar to this one some time ago. I called it "moderation feeds".

Arathorn 6y ago
the idea also pops up somewhat unexpectedly in Neal Stephenson's "Fall, or Dodge in Hell". (although we were thinking about it first :D)
- core-questions 6y ago
  What a strange book. It's like two or three totally unrelated books mashed together. I felt like I was having a nice classic sci-fi read, then all of a sudden it's wild and insane speculation about KKK-redux fundamentalists, and then back into normal sci-fi, only to be replaced by what was ultimately a pretty puerile fantasy novel. Really not sure how to feel about it. Could have been a lot better.
  - Arathorn 6y ago
    :D it sticks in your head though... between Seveneves using Matrix-style decentralised communication as an (amazing) plot device, and Fall suddenly pursuing subject reputation feeds as a (completely dead end) plot device, it does make you wonder about living in a simulation. (And yes, the fantasy quest was a bit surprising, to say the least.)
babolivier 6y ago
The Informo folks also thought about something similar (though maybe not as flexible) a couple of years ago https://specs.informo.network/unstable/trust-management/ https://specs.informo.network/unstable/trust-management/

Idesmi 6y ago

Typo at “[…] European of Court of Justice to invalidate the Privacy Shield.” Change to “European Court of Justice to invalidate the Privacy Shield.”

Arathorn 6y ago
oops, fixed at https://github.com/matrix-org/matrix.org/commit/ae44fd66a71b088f7473bf2bbb96afa58b518ac1 https://github.com/matrix-org/matrix.org/commit/ae44fd66a71b... - thanks :)

deleted 6y ago

[deleted]

dsign 6y ago

> Finally: we are continuing to hire a dedicated Reputation Team to work full time on building this. This sucks. A group of friends and I have been running Matrix for a year and we would gladly like more money dedicated to bug-fixing. Having to hire somebody to introduce more bugs to placate some goons from backward governments is just sad.

CameronNemo 6y ago
Abuse is a real problem for the matrix network. I've seen spam and borderline CSAC on the network. Frankly I think this is a valuable addition. Although the 5 eyes should bankroll it if they are really so concerned about CSAC and terrorism.
- theon144 6y ago
  CSAC?
  - notamy 6y ago
    Child Sexual Abuse Content or something along those lines, I imagine.

3np 6y ago

Something funny they don't even mention: > We call on technology companies to [...] enable law enforcement access to content in a readable and usable format where an authorisation is lawfully issued, is necessary and proportionate, and is subject to strong safeguards and oversight. Matrix.org is not a company and therefore not a target at this point.

gostsamo 6y ago
Not true. The attack would be against any service provider. The fact that currently they are eyeing whatsup and apple does not mean that they make the distinction between them and signal or telegram.
- huhtenberg 6y ago
  Again - WhatsApp, Apple, Telegram and Signal _are_ indeed service providers. Matrix is not.
  - gostsamo 6y ago
    Again, matrix provide a server, matrix.org. Again, if e2e is outlawed, it would be illegal for them to even work on the code.
    - liotier 6y ago
      If e2e is outlawed, it would be illegal to operate the matrix.org server (which is one of a universe of federated Matrix servers) - but the code would still be legal. Also, peer-to-peer Matrix is in the works, with working prototypes - the client sort of embeds a server... Enforcing illegal e2e would require going after each user - lots of fun !
    - brokenmachine 6y ago
      If e2e is outlawed, how will https work?
babolivier 6y ago

kernelbugs 6y ago

Very good rundown of why encryption backdoors are fundamentally flawed (and why governments should stop pushing for them). I'll be interested to see how the proposed reputation system rolls out. It sounds like a complex system to get right.

ashleyn 6y ago
It's the Clipper chip all over again. They never learn.
- baybal2 6y ago
  I waiting to see somebody actually provoking any of the 5 eyes governments into exerting this power, and seeing how it works.

david_draco 6y ago

Perhaps the logical next step is slashdot-like karma that reduces the visibility of low reputation users. Slashdot allowed users to choose their thresholds and, IIRC, whether they wanted funny comments or not.

pferde 6y ago
This would either have to have miraculously intuitive UI, or it would have to be done not on user level, but rather on matrix server level, because otherwise regular users would never start really using it. My money would be on the latter. :)
zeusflight 6y ago
Reputation scores risk turning the rooms into an echo chamber due to karma mining. It's good for forming consensus, but bad for debates. This can be bad for some communities like FOSS groups where new users and people with fresh ideas frequent.
- komali2 6y ago
  Matrix will apparently invent ui to warn you if your filters are creating an echo chamber but I have no idea how that would look or work. EDIT: Fucking obnoxious post throttling. I don't know why HN doesn't want me posting anymore, so I guess I'll just abuse the edit feature to get my voice heard. In reply to zuesflight: > What if the feed manipulation was per-user? My understanding from Matrix's blog post is that is half of the filtering equation. 1. Users and 2. Servers can filter 3. other users via reputation. It sounds like these filters will be inspectable, so, I would imagine that if you don't like how a server is filtering, you'd just not use it. I don't really have a strong understanding of Matrix (is it a protocol, a company?) so this is just me firing from the hip from the blog. I also think the filter "Merge" thing is all about making "multiple points of attack." None of this is implemented from what I understand, all they have now is a sort of binary banned/not banned list they share with mozilla. Very pie in the sky but if it works as they write that'd be cool!
  - zeusflight 6y ago

agentdrtran 6y ago

This is a very well written post and I'm happy Matrix is taking this seriously.

bob29 6y ago

“Without backdoors” wow, shots fired at Moxie “federation won’t work” Marlinspike’s secure honeypot Signal.

uponcoffee 6y ago
Could you elaborate on what's wronf with signal
- shdfrdfhs 6y ago
  The problem with Signal is the savior complex of its creator, who insists he and only he can correctly implement secure messaging, and it can only be done if he's permitted to handle all your data himself.
  - awestroke 6y ago
    The clients are OSS. Does the protocol have any backdoor?
    - timpattinson 6y ago
      OSS /= no backdoors.
      - ttsda 6y ago
        > Who cares if the server is not ? Well... if E2EE is properly implemented, you could be broadcasting your messages on twitter and you'd still be safe.
    - lucideer 6y ago
      I can't speak to the iOS client but the Android one is only technically OSS in that it bundles proprietary binary blobs by default.
    - arnoooooo 6y ago
      Who cares if the server is not ?

baq 6y ago

in systems where reputation has significant monetary value, how do you stop people from exchanging money for reputation? it's a serious problem which i've never seen solved when participants don't have trust established with each other, e.g. amazon reviews are completely off the rails, but HN karma works quite well. slashdot has metamoderation which i haven't seen implemented anywhere else - it seemed to work 10 years ago or so, but times were different then.

inglor 6y ago
HN reputation does not have any implications or monetary value - at least from a very early point. Amazon review scores have obvious monetary value.
- YetAnotherNick 6y ago
  > HN reputation does not have any implications or monetary value I would buy a slot in HN ranked posts for greater than $0.
  - komali2 6y ago
    Ranked posts? I'm not aware of any positioning of hn threads or posts that has correlation with user reputation. Personally I never check user reputation either, and the only 2 I recognize by name are dang and the digital minister of Taiwan.
TheRealPomax 6y ago
That feels like you're asking about a different system, based on centralized authorities like HN or Reddit. Matrix is decentralized by design, similar to IRC, so you'd have to pay off a _lot_ of people to buy your way into every server's good side. Because no sane server is going to accept the trust list of any other server it interfaces with just because it happens to also be a Matrix instance.

tumetab1 6y ago

It's annoys me that both sides lie/are wrong in this. The statement' signatories [1] agree that having default E2EE (end to end encryption) on Facebook Messenger will stop around 12 million reports of child pornography per year. This is a lie/incorrect because recipients of such material can manually report it [2] and/or it's possible to make the detection tool work on end points, it's a fancy hash comparison algorithm [3]. The Matrix people respond to what they think "lawful access" is by saying that "lawful access " is a EE2E backdoor so they it's impossible to have "lawful access" and "E2EE". It's an assumption that "lawful access" is a third decryption key and it's possible to have E2EE and third party access to it as Facebook Messenger proves [2]. If all parties were honest the governments would say "we want regular police work to have a way to lawful access E2EE messages and while you're a it a backdoor for the intelligence agencies". The other side would have positions between "no to both" but most would say "no backdoor, OK to past encrypted messages for police investigations and intelligence agencies with transparency reports and oversight". [1] https://www.gov.uk/government/publications/international-statement-end-to-end-encryption-and-public-safety/international-statement-end-to-end-encryption-and-public-safety-accessible-version#signatories https://www.gov.uk/government/publications/international-sta... [2] https://www.facebook.com/help/messenger-app/android/498828660322839?rdrhc https://www.facebook.com/help/messenger-app/android/49882866... [3] https://en.wikipedia.org/wiki/PhotoDNA https://en.wikipedia.org/wiki/PhotoDNA

robertlagrant 6y ago
Having a button which people can use to forward a message (or forward it) - with a cryptographic guarantee of who it came from - to the authorities would be useful. E2EE preserved, and in fact utilised.
- cyphar 6y ago
  Signal and other OTR-derived systems actually cannot cryptographically prove that someone sent a message (the recipient can forge the message because the message is authenticated via HMAC not a signature).
  - 6y ago

CivBase 6y ago

> We call on technology companies to [...] enable law enforcement access to content in a readable and usable format where an authorization is lawfully issued, is necessary and proportionate, and is subject to strong safeguards and oversight. I believe the age of centralized services will soon begin to die out. Users are increasingly frustrated with major tech companies who host these services and laws like this continue to erode their potential. I don't know if the crown will be passed on to the likes of Matrix and Mastodon or new decentralized platforms I haven't heard of. Regardless, I think we're approaching a breaking point with centralized services and it's only a matter of time.

Karunamon 6y ago
You've got a much more optimistic view than I do. That frustration is definitely there, but there needs to be a reasonable alternative for people to easily move to before you see any kind of exodus. Right now, one doesn't exist. These also-ran projects designed by and for geeks don't really count.
- CivBase 6y ago
  Like I said, I don't know if the likes of Matrix and Mastodon will be our platforms of the future. However, they are blazing the trail. They demonstrate what is possible. There is a lot of churn in the world of online services. It's only a matter of time before someone else follows in the footsteps of Matrix and Mastodon, but figures out how to take it even further. Or maybe someone else will break through by following in their footsteps. Or maybe Matrix or Mastodon are just dark horses who haven't hit their stride yet. I don't know, but I do believe the future will be in decentralized services over centralized ones.

corrys 6y ago

This proposal is clear and thoughtful, I like it. However, I didn’t see an explanation of how this would help addressing abuse (or other illegal activity) directed at third parties - someone who is not participating in a particular group. E.g. a group that shares child pornography. It is obvious that the members themselves would not report it. Likewise, relying on reputation does not make sense - in fact, their reputation could be inflated by the satisfied members.

komali2 6y ago
I found that part lacking as well, but then I remembered that it's not the protocol's job to solve crime. As matrix indicated in their opening statement, to try to solve for the .1% could irrevocably damage the 99.9. It's not like law enforcement doesn't have options. I'll use cp as an example. Off the top of my head they could host honey pots and social engineer their way towards cp content creators, analyse cp media for artifacts that could lead them to a location. Legislators could create laws that throttle human trafficking by ending drug wars, opening borders, and providing universal social services. Etc. But to drag an algorithm into this is the wrong approach for the reasons matrix listed.
- ricksharp 6y ago
  I agree, I think crime fighting requires tools that operate at the user level. So an infiltration bot: We have the technology today (gpt-3 level dialog) that could infiltrate criminal social networks, gather evidence, build credibility and power, and then help shut everything down. The system itself cannot provide this, but an ai-human actor could. Of course, this technology is scary: What I think is not a crime - like complaining about the government - is a crime in other places.
lifty 6y ago
They do touch on this point: "Meanwhile, communities which are entirely private and entirely encrypted typically still have touch-points with the rest of the world - and even then, the chances are extremely high that they will avoid any hypothetical backdoored servers. In short, investigating such communities requires traditional infiltration and surveillance by the authorities rather than an ineffective backdoor."

parliament32 6y ago

Isn't this very different from what they're requesting? >something that empowers users and administrators to identify and protect themselves from bad actors and >enable law enforcement access to content in a readable and usable format are completely different things, no? They're barely even related.

Arathorn 6y ago
The idea is is this: * Enabling LE to read encrypted content == backdoor * Backdoor == unviable, because it weakens encryption for everyone, and will be abused. * Therefore, you need a way to help everyone (including LE) navigate/filter/investigate/discover/block content out there. Subjective reputation feeds give a way of doing so.
- parliament32 6y ago
  Maybe I'm missing something here, how does having a hashed lists of "bad" message IDs allow LE to navigate/investigate/discover content? From what I can see it only tells you there's something to block, and you can't even reverse it to "investigate" much of anything.
  - Arathorn 6y ago
    One approach could be to check public servers for "bad" content, and then use that as the entry point to investigate/infiltrate those communities.

auganov 6y ago

> Anyone who can determine the secret needed to break the encryption will gain full access Without collections just having the secret key[s] won't help you much. I don't like the idea of a backdoor as much as anybody else, but this notion that you merely have to have a key to access everything is strictly false. This may only be true specifically for systems that allow anybody (or some broad set of untrusted people) to see other people's encrypted data. For most architectures backdoored E2EE is still more secure than no encryption. And obviously if there was a backdoor people wouldn't use/design systems that allow for easy collections.

cyphar 6y ago
Reminder that the NSA is basically collecting all of the internet traffic it can get its hands on. They didn't build a data centre in the middle of the desert for the fun of it.
- auganov 6y ago
  Well, that's part of the point. Governments have been doing mass collections for decades and a lot of that might be cleartext. As far as I know this has not lead to random hackers obtaining great access. So it's preposterous to claim that backdoored E2EE would universally enable that[0]. E2EE does in large part protect from governments and other powerful players and it should be okay to say that. Again, that said, if Facebook was to offer plaintext and backdoored E2EE messaging, the backdoored version would still be a strict improvement security wise. [0] as noted, with exception of some systems that might provide easy access to everybody's data by design.
  - mattnewton 6y ago
    Why would hackers need to hack the NSA's methods of tapping the internet to obtain communications sent in cleartext? If you are sending everything unencrypted there should be no expectation of secrecy. The problem is that we current do send high value information encrypted and this proposal wants to weaken that encryption; what happens to low value information freely sent unencrypted doesn't seem relevant to me.

eecc 6y ago

Not sure how this reputation system solves the e2e encryption backdoor problem, but I would definitely adopt a WOT-like reputation system for SSL certificates. The bundled-CA system is IB shambles and if it’s still standing, it’s only because of the deliberate ignorance of the general public.

kelnos 6y ago

I see quite a few open letters like this that I think mostly miss the point. From the perspectives of the governments in question, this isn't (solely) about terrorism or law enforcement. It's about control of their citizens. They use terrorism as the bogeyman to try to get people comfortable with the concept, but really, they just want dragnet surveillance over everyone, period. I think it's most useful to point out that banning or backdooring E2EE won't stop the terrorists, but it seems like the main thrust of these sorts of articles is about how backdoors are dangerous to everyone... which is exactly what these governments are ok with. And a disturbing number of people (outside of the HN crowd) are perfectly willing to give up their own privacy and freedom if it means catching the terrorists. I think a better approach to getting the public to be against these encroachments would be to drive home that backdoors and E2EE bans don't actually catch terrorists or human traffickers or child pornographers.

cwkoss 6y ago
I think the best approach may be a disingenuous one: Anyone advocating for encryption back doors is a pedophile. Encryption helps users keep their data private from others, including service providers and the government. DEEP STATE PEDOPHILES have infiltrated our government and want to have free reign to access pictures of you infant child in the bathtub for their disturbing desires. Pedophiles managing social media servers want to be able to snoop on the private media of anyone their sick desires are targeted at. They want to be able to blackmail your children who have taken selfies in the mirror into sending them more child pornography or even committing espionage against their own parents or families, consolidating power for the secret cabal of pedophiles at the top of our institutions. Say NO to pedophiles, keep encryption secure! Any politician who supports these measures should get the question, "Why do you support this legislation, are you a secret pedophile?"
- triceratops 6y ago
  There's no need to resort to lies like that. It's better to stay away from the crazy conspiracy theories. Even the following is sufficient and true: "Imagine your child's calendar, real-time location, grades, medical history, selfies, search and video viewing history, chats with friends hackable by any predator. All of this is possible if we allow the government to force backdoors." Just keep hammering on that point to any politician or voter who supports encryption backdoors. Ask them why they want to make children less safe. Stop saying "you can't outlaw math" and "terrorists will use encryption anyway" - people either don't understand, or don't care.

xg15 6y ago

What a disappointing read. > What we really need is something that empowers users and administrators to identify and protect themselves from bad actors, without undermining privacy. What if we had a standard way to let users themselves build up and share their own views of whether other users, messages, rooms, servers etc. are obnoxious or not? > This forms a relative reputation system. As uncomfortable as it may be, one man’s terrorist is another man’s freedom fighter, and different jurisdictions have different laws - and it’s not up to the Matrix.org Foundation to play God and adjudicate. And as uncomfortable as it may be, Matrix.org is itself part of a value system, however much they would like to bask in moral relativism. Yes, adding backdoors to prevent bad actors is a flawed solution with lots of negative consequences. However, then we should think about ways to solve this problem that do not rely on ignoring half of the problem. The whole idea of "relative reputation" assumes that any problem on the internet is a matter of subjective opinion and will go away if I could just convincingly enough pretend that the problem doesn't exist: If someone annoys you on the internet, block them and pretend they aren't there and everything will be fine. We all know this is not how the world works. There are situations where a conversation between persons A and B is actively harming C, even though C is not part of that conversation at all - and where C has a legitimate interest in preventing A and B from communicating. Take cyberbullying for example (in addition to all the other examples usually given). In those cases, the whole point is that the victim is not part of the group. Nevertheless, the group is open to the public and may in fact gain high reputation and utility among those interest. This doesn't make it at all better for the victim. Is this really the hill you want to die on?

ArcVRArthur 6y ago

Perhaps now may be the appropriate time to begin transitioning my friend group on Matrix over to XMPP.

Arathorn 6y ago
/me solemnly adds you to his "people who'd prefer to use XMPP than filter out abuse with a reputation system" reputation list

est 6y ago

pardon me but this looks like a longer version of ban list with reasons? What if spammers just create really massive one-off accounts? A lot of computing power would be wasted on comparing billion rows of user ids. Another issue in MSC2313 is the {"reason": "undesirable behaviour"} is too short. What if a legitimate user is wrongfully banned? What's the appeal process? What if the un-ban didn't propagate into proper servers?