4 ms·

If you can have wiretapping you don't have E2E encryption. So I think this would be a ban on E2E encryption, not on encryption in general of course but I think

If you can have wiretapping you don't have E2E encryption. So I think this would be a ban on E2E encryption, not on encryption in general of course but I think that should be self evident.

raverbashing 6y ago
If you're not the subject of the wiretapping, your connection will continue to use E2E, it's not complicated. Yes, wiretapped connections are not E2E while they're being monitored, obviously
- Toutouxc 6y ago
  Soo, how do you handle this on the client? If wiretapped, then dummy_encrypt(message) else encrypt(message) ? Or will they just dummy_encrypt anything and read the stuff that's "wiretapped" at the moment? Because that sounds way more probable.
- noir_lord 6y ago
  If it's E2E except when it's not then it's simply not. How do you assure that the people flipping the toggle are the 'good' guys. Given the way five eyes (and similar groups) have behaved particularly.
- jjuhl 6y ago
  If your connection can be tapped it is not end-to-end encrypted, obviously. If it is possible for anyone to tap into your communication it is not encrypted (properly). What you are saying makes no sense. Either the channel is encrypted and safe from being listened in on or it is not. You cannot have both.
ars 6y ago
You could permit only weak encryption, this would allow E2E, but still be wiretapped (although with difficultly). This also gets rid of the need for master keys or key escrow. (Don't shoot the messenger, this is a technical theoretical idea, not a policy suggestion.)
- hvis 6y ago
  So only use encryption that can be decrypted by anybody who really wants to? That sounds useful.
  - ars 6y ago
    If you make it cost $30,000 worth of computer time to decrypt, the vast majority of people would have privacy, yet the government could afford to tap important targets (and it would also block government fishing expeditions - they would be too expensive).
    - hvis 6y ago
      The government could, and any medium-sized corporation could as well. Ahoy, industrial espionage! Don't forget the Moore's law as well (even though it's taken a hit lately). Come next year, it will cost 15000, in another few years it's 7500, and some time after it will cost <1000. In the meantime, the encryption standard's complexity will be the same (because the legislation rarely moves that quickly). And also, please remember that the journalists and human rights activists use encryption to keep their correspondence concealed chiefly from the government. And there are other governments on this planet, not just US.
      - ars 6y ago
        > The government could, and any medium-sized corporation could as well. Ahoy, industrial espionage! It's not actually that easy to tap into internet communications. Even without encryption it would be a huge challenge to spy on someone. A government could obviously do it. A medium-sized corporation? Not likely. > because the legislation rarely moves that quickly Just legislate "encryption that takes no more than $80,000 to break, indexed for inflation", and it will auto adjust as computers get faster. (i.e. legislate the cost, not the key-strength.) > the journalists and human rights activists use encryption to keep their correspondence concealed chiefly from the government. And there are other governments on this planet, not just US. Those other governments can just outlaw encryption then entirely. My idea is specifically for governments that are gentle enough to allow normal people privacy. Authoritarian governments are not going to be limited by a law.

If you can have wiretapping you don't have E2E encryption. So I think this would be a ban on E2E encryption, not on encryption in general of course but I think that should be self evident.

raverbashing 6y ago

If you're not the subject of the wiretapping, your connection will continue to use E2E, it's not complicated. Yes, wiretapped connections are not E2E while they're being monitored, obviously

Toutouxc 6y ago
Soo, how do you handle this on the client? If wiretapped, then dummy_encrypt(message) else encrypt(message) ? Or will they just dummy_encrypt anything and read the stuff that's "wiretapped" at the moment? Because that sounds way more probable.
noir_lord 6y ago
If it's E2E except when it's not then it's simply not. How do you assure that the people flipping the toggle are the 'good' guys. Given the way five eyes (and similar groups) have behaved particularly.
jjuhl 6y ago
If your connection can be tapped it is not end-to-end encrypted, obviously. If it is possible for anyone to tap into your communication it is not encrypted (properly). What you are saying makes no sense. Either the channel is encrypted and safe from being listened in on or it is not. You cannot have both.

ars 6y ago

You could permit only weak encryption, this would allow E2E, but still be wiretapped (although with difficultly). This also gets rid of the need for master keys or key escrow. (Don't shoot the messenger, this is a technical theoretical idea, not a policy suggestion.)

hvis 6y ago
So only use encryption that can be decrypted by anybody who really wants to? That sounds useful.
- ars 6y ago
  If you make it cost $30,000 worth of computer time to decrypt, the vast majority of people would have privacy, yet the government could afford to tap important targets (and it would also block government fishing expeditions - they would be too expensive).
  - hvis 6y ago
    The government could, and any medium-sized corporation could as well. Ahoy, industrial espionage! Don't forget the Moore's law as well (even though it's taken a hit lately). Come next year, it will cost 15000, in another few years it's 7500, and some time after it will cost <1000. In the meantime, the encryption standard's complexity will be the same (because the legislation rarely moves that quickly). And also, please remember that the journalists and human rights activists use encryption to keep their correspondence concealed chiefly from the government. And there are other governments on this planet, not just US.
    - ars 6y ago
      > The government could, and any medium-sized corporation could as well. Ahoy, industrial espionage! It's not actually that easy to tap into internet communications. Even without encryption it would be a huge challenge to spy on someone. A government could obviously do it. A medium-sized corporation? Not likely. > because the legislation rarely moves that quickly Just legislate "encryption that takes no more than $80,000 to break, indexed for inflation", and it will auto adjust as computers get faster. (i.e. legislate the cost, not the key-strength.) > the journalists and human rights activists use encryption to keep their correspondence concealed chiefly from the government. And there are other governments on this planet, not just US. Those other governments can just outlaw encryption then entirely. My idea is specifically for governments that are gentle enough to allow normal people privacy. Authoritarian governments are not going to be limited by a law.