6 ms·

I see this as follows: 1. Terrorism and trafficking of children will win the moral high ground. 2. App stores will be forced locale by locale to conform to th

I see this as follows: 1. Terrorism and trafficking of children will win the moral high ground. 2. App stores will be forced locale by locale to conform to these policies. 3. Most people will not notice or care. 4. This will be used by N-Eyes and totalitarian governments to quash dissent. 5. Meanwhile the tech crowd will create alternate app distribution mechanisms allowing those who care to communicate securely. 6. Those secure methods will be used by people with the most to lose. (e.g. the drivers of point 1) Given this predictable series of events I see the primary question as: How do we prevent (4)? How can we make people secure by default again and make adoption easy in the face of app store capture.

throw0101a 6y ago
> 1. Terrorism and trafficking of children will win the moral high ground. Requisite: > The term was coined by Timothy C. May in 1988. May referred to "child pornographers, terrorists, drug dealers, etc."[2]. May used the phrase to express disdain for what he perceived as "Think of the children" argumentation by government officials and others seeking to justify limiting civilian use of cryptography tools. Connotations related to such argumentation continue to be attached to the phrase, and it is more commonly used by those who wish to deride various restrictions on Internet activity than by those who support such restrictions. * https://en.wikipedia.org/wiki/Four_Horsemen_of_the_Infocalypse https://en.wikipedia.org/wiki/Four_Horsemen_of_the_Infocalyp...
j0ba 6y ago
It's the infinite horse race. Black hats vs white hats. Neither holds the upper hand for long. I hope that if we ever reach a steady state, it will be unbreakable privacy.
- bob1029 6y ago
  Entropy always wins in the end.
- caf 6y ago
  "Red Queen's Race" is the term often used for that.
ohazi 6y ago
7. People in group 6 will be subject to increased abuse by authorities simply because they fall into this category regardless of whether other evidence suggests that they're a likely privacy advocate, political activist, or actual terrorist. 8. Privacy activists will leave group 6 by attrition, further reinforcing justification by authorities for 7.
- GekkePrutser 6y ago
  Exactly the point I was trying to make, but you worded it much better! Privacy only works well when everyone has it.
EGreg 6y ago
It all comes down to distribution. We need actual software like https://Matrix.org https://Matrix.org or https://qbix.com/platform https://qbix.com/platform to be good enough that people will install it. Like the Web Browser did killed AOL and MSN. Otherwise we will live with Facebook Google etc. and this is moot. But that is just the beginning. Secondly, we need open source hardware. We are nowhere close to competing with Apple and Android. But as we have seen over the last 20 years - there is a war on general purpose computing and the closed systems have started to win. Just today I read that Android doesn’t let you take a screenshot of your own phone. Third of all - the open distribution mechanisms you rely on today to not block you (eg web browsers) can be closed or ship updates with backdoors tomorrow to most users. Apple and Google together control most of the market. It isn’t hard to pressure them to do this. Apple blocked blockchain dapps being distributed on iOS, unless they are made by an Apple developer whose app they can revoke. Amazon can yank your movies and books out of your hands. Anything you think is secure (eg secure enclave) may not be. Trusted Computing Environments are made by two companies essentially. In fact, I am surprised that more “stuxnet” attacks arent done in nuclear reactors across various countries. As self driving cars get hooked up to the net or delivery drones become ubiquitous we may see massive vulnerabilities that can be exploited all at once. Not just by state actors but anyone. Really scary stuff. Sadly the same entities locking down the computing devices also start requiring uplinks to their servers and can push any updates. Regular people are at the mercy of corporations and the state. Unless open source companies step up and build a decentralized hardware distribution infrastructure, with multiple actors (like VOIP relaced centralized telephone switchboard operators) all these arguments are moot. There is a handful of tech companies whose arms need to be twisted and that’s all. PART II: To be honest ... I no longer think that end-to-end encryption is the right solution to human rights problems. If citizens are reduced to sneaking around and denying their activities to survive, their governmental system is way past due for fixing. This is like the “good slave owners” delaying the abolition of slavery. You’re solving the wrong problem. I believe that crypto is needed to secure decentralized byzantine fault tolerant systems like Ethereum etc. to be TRUSTED, not to hide information. Signatures, not encryption, if you will. If anything, it is the government who doesn’t want encryption to be broken (eg of copyrighted DVD content etc.) and there is an inherent contradiction since anyone who consumes unencrypted content can reshare it. What we really need is to decentralize the personal data in many places, and use zero-knowledge proofs for attestation, but that is different than encrypting and hiding information.
prof-dr-ir 6y ago
We are not at (2) yet. The EU is at least privacy-conscious - its parliament especially so. As an example, see the attention given to privacy here: https://www.politico.eu/wp-content/uploads/2020/09/SKM_C45820090717470-1_new.pdf https://www.politico.eu/wp-content/uploads/2020/09/SKM_C4582... In my view there is a good chance that (2) will not be EU law for the foreseeable future, although this does require some opposition work. I guess one can see it as education of the politicians (the commissioners in this case).
- gpderetta 6y ago
  And even if it passes parliament there is still a chance that it will squashed by the ECHR.
- petre 6y ago
  The EU takes a statist approach to privacy. Encryption is always a better protection to privacy than ever changing laws. EP members are either inexperienced when it comes to technology or serve a party or a lobby agenda. The only countries opposing for the sake of opposing are Hungary and Poland and their leaders would love encyption being backdoored as long as their secret services can pry at comms. Educate the Comissioners? The president of the Comission is an ex home secretary ie. a lady with a policing mindset just like Theresa May, only allegedly corrupt. Somehow her phones were wiped clean when required as evidence in a recent investigation. The irony of this legislation is that it could expose her own doings. https://www.google.com/amp/s/www.politico.eu/article/ursula-von-der-leyen-on-wiped-mobile-i-have-nothing-to-hide/amp/ https://www.google.com/amp/s/www.politico.eu/article/ursula-... The Comissioners were told to use Signal after Bezos' phone got trojaned through WhatsApp. Encryption is only good when it's for their own benefit.
deleted 6y ago
[deleted]
Andrew_nenakhov 6y ago
Terrorists and other criminals already have more than enough tools in their possession to exchange data absolutely without fear of their messages being compromised.
- jariel 6y ago
  So this is interesting, care to elaborate?
  - kmonsen 6y ago
    It is trivial to create an app using encryption to send messages between two users. On Android you can sideload so no need for app store. You can also solve this with a webpage, this way it can be used on all devices. The point is that creating a secure channel few users use is pretty trivial unless you outlaw crypto libraries. These laws can only take down apps/websites in mainstream use.
    - SiempreViernes 6y ago
      Sure, but you also need to recruit, and it's sort of hard to find new candidates if all you use is your super secret crypto app.
      - kmonsen 6y ago
        True, but when I worked on this recruiting was mostly an in person thing. For example for Muslim terrorists it was in a radical mosque. You can still radicalize with writings on the internet, they just need to make the first step in person.
      - crististm 6y ago
        Hmm - it doesn't work that way and you know it.
    - orblivion 6y ago
      Could they inspect traffic at the ISP level and come knocking if they can't decipher what you're transmitting?
inopinatus 6y ago
> How do we prevent (4) • By ensuring there is always an opposing power. • By maintaining democracy, by which I mean the tenet of electing governments from the citizenry as well as by the citizenry, and specifically rather than any of the oligarchical forms. • By maintaining the rule of law. The consequences being, if all encryption is backdoored, then any encryption used by politicians is by definition eavesdroppable by their opponents and enemies. Since all politicians thrive in a web of mendacity and confidences, they have a strong incentive for strong encryption, and will eventually terminate/abandon legislation that weakens it. Any politician that threatens otherwise is therefore a) grandstanding, and/or b) using the issue to leverage/negotiate something else. Corollaries: • Any government seriously implementing such a plan is operating as an oligarchy rather than a democracy, and will have plans to defend themselves from the surveillance imposed on the citizens. • The first instinct of every would-be oligarch is to undermine the machinery of democracy and compromise the rule of law. c.f. Utopia (Australia, 2014) Season 4 Episode 4 "Mission Creeps", and probably at least one Jim Hacker moment.
ptman 6y ago
Law enforcement clearly thinks it has a need for tools to combat terrorism and child trafficing. EDRi has prepared list of tools that don't need encryption to be broken: https://edri.org/files/encryption/workarounds_edriposition_20170912.pdf https://edri.org/files/encryption/workarounds_edriposition_2...
headshock1111 6y ago
I don't know, but it's an ugly snowballing effect and it's part of the reason why I became a free speech absolutist.
RosanaAnaDana 6y ago
Just to give #5 a shoutout: https://f-droid.org/ https://f-droid.org/
thw0rted 6y ago
#6 is the whole point. As is always the case with these fights, the fundamental fact is that the war is asymmetric. We have to be right all of the time, they have to be right once. We have to break all encryption everywhere forever, they have to find one non-backdoor'd solution. If you really hold the backdoor proponents' feet to the fire, they'll admit that yes, this is true, but at least with a backdoor you can catch some of the terrorists/child abusers/etc, some of the time (of course, you only get the dumb ones...), and we wouldn't want to let the perfect be the enemy of the good. But of course, saying you want to compromise all privacy in the developed world to catch a few dumb traffickers doesn't get votes.

throw0101a 6y ago

> 1. Terrorism and trafficking of children will win the moral high ground. Requisite: > The term was coined by Timothy C. May in 1988. May referred to "child pornographers, terrorists, drug dealers, etc."[2]. May used the phrase to express disdain for what he perceived as "Think of the children" argumentation by government officials and others seeking to justify limiting civilian use of cryptography tools. Connotations related to such argumentation continue to be attached to the phrase, and it is more commonly used by those who wish to deride various restrictions on Internet activity than by those who support such restrictions. * https://en.wikipedia.org/wiki/Four_Horsemen_of_the_Infocalypse https://en.wikipedia.org/wiki/Four_Horsemen_of_the_Infocalyp...

j0ba 6y ago

It's the infinite horse race. Black hats vs white hats. Neither holds the upper hand for long. I hope that if we ever reach a steady state, it will be unbreakable privacy.

bob1029 6y ago
Entropy always wins in the end.
caf 6y ago
"Red Queen's Race" is the term often used for that.

ohazi 6y ago

7. People in group 6 will be subject to increased abuse by authorities simply because they fall into this category regardless of whether other evidence suggests that they're a likely privacy advocate, political activist, or actual terrorist. 8. Privacy activists will leave group 6 by attrition, further reinforcing justification by authorities for 7.

GekkePrutser 6y ago
Exactly the point I was trying to make, but you worded it much better! Privacy only works well when everyone has it.

EGreg 6y ago

It all comes down to distribution. We need actual software like https://Matrix.org https://Matrix.org or https://qbix.com/platform https://qbix.com/platform to be good enough that people will install it. Like the Web Browser did killed AOL and MSN. Otherwise we will live with Facebook Google etc. and this is moot. But that is just the beginning. Secondly, we need open source hardware. We are nowhere close to competing with Apple and Android. But as we have seen over the last 20 years - there is a war on general purpose computing and the closed systems have started to win. Just today I read that Android doesn’t let you take a screenshot of your own phone. Third of all - the open distribution mechanisms you rely on today to not block you (eg web browsers) can be closed or ship updates with backdoors tomorrow to most users. Apple and Google together control most of the market. It isn’t hard to pressure them to do this. Apple blocked blockchain dapps being distributed on iOS, unless they are made by an Apple developer whose app they can revoke. Amazon can yank your movies and books out of your hands. Anything you think is secure (eg secure enclave) may not be. Trusted Computing Environments are made by two companies essentially. In fact, I am surprised that more “stuxnet” attacks arent done in nuclear reactors across various countries. As self driving cars get hooked up to the net or delivery drones become ubiquitous we may see massive vulnerabilities that can be exploited all at once. Not just by state actors but anyone. Really scary stuff. Sadly the same entities locking down the computing devices also start requiring uplinks to their servers and can push any updates. Regular people are at the mercy of corporations and the state. Unless open source companies step up and build a decentralized hardware distribution infrastructure, with multiple actors (like VOIP relaced centralized telephone switchboard operators) all these arguments are moot. There is a handful of tech companies whose arms need to be twisted and that’s all. PART II: To be honest ... I no longer think that end-to-end encryption is the right solution to human rights problems. If citizens are reduced to sneaking around and denying their activities to survive, their governmental system is way past due for fixing. This is like the “good slave owners” delaying the abolition of slavery. You’re solving the wrong problem. I believe that crypto is needed to secure decentralized byzantine fault tolerant systems like Ethereum etc. to be TRUSTED, not to hide information. Signatures, not encryption, if you will. If anything, it is the government who doesn’t want encryption to be broken (eg of copyrighted DVD content etc.) and there is an inherent contradiction since anyone who consumes unencrypted content can reshare it. What we really need is to decentralize the personal data in many places, and use zero-knowledge proofs for attestation, but that is different than encrypting and hiding information.

prof-dr-ir 6y ago

We are not at (2) yet. The EU is at least privacy-conscious - its parliament especially so. As an example, see the attention given to privacy here: https://www.politico.eu/wp-content/uploads/2020/09/SKM_C45820090717470-1_new.pdf https://www.politico.eu/wp-content/uploads/2020/09/SKM_C4582... In my view there is a good chance that (2) will not be EU law for the foreseeable future, although this does require some opposition work. I guess one can see it as education of the politicians (the commissioners in this case).

gpderetta 6y ago
And even if it passes parliament there is still a chance that it will squashed by the ECHR.
petre 6y ago
The EU takes a statist approach to privacy. Encryption is always a better protection to privacy than ever changing laws. EP members are either inexperienced when it comes to technology or serve a party or a lobby agenda. The only countries opposing for the sake of opposing are Hungary and Poland and their leaders would love encyption being backdoored as long as their secret services can pry at comms. Educate the Comissioners? The president of the Comission is an ex home secretary ie. a lady with a policing mindset just like Theresa May, only allegedly corrupt. Somehow her phones were wiped clean when required as evidence in a recent investigation. The irony of this legislation is that it could expose her own doings. https://www.google.com/amp/s/www.politico.eu/article/ursula-von-der-leyen-on-wiped-mobile-i-have-nothing-to-hide/amp/ https://www.google.com/amp/s/www.politico.eu/article/ursula-... The Comissioners were told to use Signal after Bezos' phone got trojaned through WhatsApp. Encryption is only good when it's for their own benefit.

deleted 6y ago

[deleted]

Andrew_nenakhov 6y ago

Terrorists and other criminals already have more than enough tools in their possession to exchange data absolutely without fear of their messages being compromised.

jariel 6y ago
So this is interesting, care to elaborate?
- kmonsen 6y ago
  It is trivial to create an app using encryption to send messages between two users. On Android you can sideload so no need for app store. You can also solve this with a webpage, this way it can be used on all devices. The point is that creating a secure channel few users use is pretty trivial unless you outlaw crypto libraries. These laws can only take down apps/websites in mainstream use.
  - SiempreViernes 6y ago
    Sure, but you also need to recruit, and it's sort of hard to find new candidates if all you use is your super secret crypto app.
    - kmonsen 6y ago
      True, but when I worked on this recruiting was mostly an in person thing. For example for Muslim terrorists it was in a radical mosque. You can still radicalize with writings on the internet, they just need to make the first step in person.
    - crististm 6y ago
      Hmm - it doesn't work that way and you know it.
  - orblivion 6y ago
    Could they inspect traffic at the ISP level and come knocking if they can't decipher what you're transmitting?

inopinatus 6y ago

> How do we prevent (4) • By ensuring there is always an opposing power. • By maintaining democracy, by which I mean the tenet of electing governments from the citizenry as well as by the citizenry, and specifically rather than any of the oligarchical forms. • By maintaining the rule of law. The consequences being, if all encryption is backdoored, then any encryption used by politicians is by definition eavesdroppable by their opponents and enemies. Since all politicians thrive in a web of mendacity and confidences, they have a strong incentive for strong encryption, and will eventually terminate/abandon legislation that weakens it. Any politician that threatens otherwise is therefore a) grandstanding, and/or b) using the issue to leverage/negotiate something else. Corollaries: • Any government seriously implementing such a plan is operating as an oligarchy rather than a democracy, and will have plans to defend themselves from the surveillance imposed on the citizens. • The first instinct of every would-be oligarch is to undermine the machinery of democracy and compromise the rule of law. c.f. Utopia (Australia, 2014) Season 4 Episode 4 "Mission Creeps", and probably at least one Jim Hacker moment.

ptman 6y ago

Law enforcement clearly thinks it has a need for tools to combat terrorism and child trafficing. EDRi has prepared list of tools that don't need encryption to be broken: https://edri.org/files/encryption/workarounds_edriposition_20170912.pdf https://edri.org/files/encryption/workarounds_edriposition_2...

headshock1111 6y ago

I don't know, but it's an ugly snowballing effect and it's part of the reason why I became a free speech absolutist.

RosanaAnaDana 6y ago

Just to give #5 a shoutout: https://f-droid.org/ https://f-droid.org/

thw0rted 6y ago

#6 is the whole point. As is always the case with these fights, the fundamental fact is that the war is asymmetric. We have to be right all of the time, they have to be right once. We have to break all encryption everywhere forever, they have to find one non-backdoor'd solution. If you really hold the backdoor proponents' feet to the fire, they'll admit that yes, this is true, but at least with a backdoor you can catch some of the terrorists/child abusers/etc, some of the time (of course, you only get the dumb ones...), and we wouldn't want to let the perfect be the enemy of the good. But of course, saying you want to compromise all privacy in the developed world to catch a few dumb traffickers doesn't get votes.