15 ms·

EU citizens’ rights are under threat from anti-encryption proposals

698 points by eddieoz 6y ago

eddieoz 6y ago
Put simply, the resolution is no different from the previous proposals which generated a wide backlash from privacy-conscious companies, civil society members, experts, and MEPs. The difference this time is that the Council has taken a more subtle approach and avoided explicitly using words like ‘ban’ or ‘backdoor.’ But make no mistake, this is the intention. It’s important that steps are taken now to prevent these proposals going too far and keep European’s rights to privacy intact.”
- bitcharmer 6y ago
  There were all too many efforts from EU to ban or at least limit encryption. They all get shot down for perfectly valid reasons only to come back after a few months in one form or another. This implies that: 1) there is a clear agenda among the political class to go against the will of the citizens despite the strong opposition to the idea 2) it will eventually succeed because they will hide the legislation in some obscure act of law anyway An example how shady EU council can be: "Acta was slipped through the European Council in an agriculture and fisheries meeting in December" https://www.wired.co.uk/article/acta-101 https://www.wired.co.uk/article/acta-101
  - prof-dr-ir 6y ago
    I do not (entirely) disagree with your comment, but I think it would be fair to add some counterweight to the evidence you provide for your point (2): Acta was ultimately rejected by the European Parliament.
    - bitcharmer 6y ago
      I never said ACTA was passed. Just provided example of tactics employed to sneak in laws that general public strongly opposes.
      - prof-dr-ir 6y ago
        Agreed. But your original point would be stronger if you could provide actual examples of passed EU legislation that was "snuck in".
mytailorisrich 6y ago
In society there are always competing rights and duties to be balanced. Rights very rarely absolute. In this case the right to privacy has to be balanced with the need in society for the law to be enforced and police investigations to be carried out. There are never been "end-to-end" unbreakable privacy. People have a right to privacy so their private communications are kept private but at the same time the police has always been able to access those communications should it be necessary and according to the law. Claiming that an 'intact' right to privacy means an absolute right to absolute privacy is simply not how it has ever been. Strong end-to-end encryption essentially means that the police cannot access communications ever, even if they get a warrant because they don't have a technical mean to do so. That's quite reasonably something that is deemed a problem. How do we deal with this?
- simonh 6y ago
  This is simply not true. Conversations on private premises have never been legitimate targets of surveillance, and it's not generally* been illegal to encode or encrypt mail or other private papers or communications. Mandatory back doors are an entirely novel and highly intrusive encroachment on civil liberties. Edited from "has never been"
  - rlpb 6y ago
    > ...it's never been illegal to encode or encrypt mail or other private papers or communications In what country? France, for example, used to restrict the use of strong encryption. Example summary: http://www.opengroup.org/security/meetings/apr98/French-Encryption-Regulation-rev.htm http://www.opengroup.org/security/meetings/apr98/French-Encr...
    - fogihujy 6y ago
      This seems to be about hardware/software that performs encryption? I've yet to see any modern democratic government prevent someone from using a one-time pad, a piece of paper and a pencil to encrypt a message.
    - deleted 6y ago
jgalt212 6y ago
It's like trust the govt, but not Google. I don't trust either.
bondarchuk 6y ago
I live in the Netherlands. National election is coming in march. What would be the best way to do something about this as a voter?
- pmlnr 6y ago
  Find out which party makes sense to you. In the UK, there are usually "tests" where you answer questions based on what you think, and it'll show you to what percent you agree with which party. If I'd have to guess, the Pirate Party probably supports encryption.
- krageon 6y ago
  Given that the current political climate is "lie until you get elected", it doesn't matter. Maybe vote for someone you like personally. Hopefully they have lied about things you can live with.
  - ako 6y ago
    How do you determine if it is lying, or just inability to achieve your goals without compromise? It's easy to state what you want, but to achieve it when you have to collaborate with many others that have other priorities and opinions usually results in a compromise. That's not lying, that's just reality.
    - krageon 6y ago
      If every time there is compromise the opposite of what is promised is achieved (or at the very least nothing at all), then continuing to make those promises is lying.
- Vinnl 6y ago
  Generally, I believe Dutch representatives in the EU have been doing their thing when it comes to arguing against encryption, so it probably needn't play a major role in your deliberations. It might be that a 2021 edition of this website is going to be launched again though, if you want to make sure: https://www.privacystemwijzer.nl/ https://www.privacystemwijzer.nl/ (And otherwise the 2019 edition might already give you enough of an idea.)
Daniel_sk 6y ago
They will never stop. It's the EU salami tactics, they proceed "slice by slice" until you realize it and then it's usually too late. I wish they would devote so much time to actual problems and make EU again a big leader (e.g. look at the speed we are getting vaccines now).
- ginko 6y ago
  This isn't 'the EU'. It's the Council, i.e. the national governments.
  - baxtr 6y ago
    How do you define the EU exactly?
    - ginko 6y ago
      The EU is a union of countries. It's the entire body including all its citizens. There's several governing bodies within the EU and people should understand the political process within it and be specific. How often do you see Americans blaming the USA for some new legislation?
      - soco 6y ago
        I have the feeling that some EU citizens aren't exactly aware that THEY are the EU, and listen instead to antagonizing outsider stories (Sputnik, whatever you name it). There were EU elections last year and the measures taken today are drafted by those people elected one year ago. Same for the council members - they were voted in the respective national elections. Next time folks pay better attention when you vote. Or whether you vote.
        fogihujy 6y ago
        The resolution was made by the EU Council, not the parliament. The EU Council is not voted upon as such, and it consists of the heads of state/government from all member states. Once this reaches the parliament, on the other hand, there will be a lot of concerned citizens contacting members of parliament in order to voice their opinion.
coldcode 6y ago
I always say if politicians want to ban encryption being absolute (by making it insecure): you first. Lets see how well it works by implementing encraption in your systems and email and seeing if your backdoor deals and illegal activity winds up in the public eye for all to see.
- teekert 6y ago
  Indeed! Meanwhile our government (the Netherlands) tells their employees to use Signal. Good luck telling your forces in the Middle East: "Please use this app that has breakable encryption, but it's not breakable by the bad guys, at least, we are 98% certain they can't break it. Also, we're pretty sure the master key never leaked. Yeah we know how that went for the New York subway but we are better. It's fine, don't whine, even if they break the encryption, they don't understand your Dutch conversations with your loved ones anyway. I mean, what have we got to hide anyway."
  - nalekberov 6y ago
    When I first visited the Netherlands in 2017 I observed public transportation was transitioning to plastic card only payments. That was my first impression about the country in privacy context, not being able to use cash is a big attack on privacy.
    - teekert 6y ago
      Yeah there is that wish to go away from cash but we also had this: [0, from 2016]. I hope we will have more privacy oriented fintech companies soon, indeed it may swing the wrong way. It depends a bit on the ruling parties (we have many and they have to form a coalition.) [0] https://www.theregister.com/2016/01/04/dutch_government_says_no_to_backdoors/ https://www.theregister.com/2016/01/04/dutch_government_says...
      - nalekberov 6y ago
        > privacy oriented fintech Can you elaborate on that term? We are talking here about digital payments, right? (where usually more than 3 parties involved in this process) How are you gonna make sure the whole transaction is not traceable back to you?
raverbashing 6y ago
This discussion is tiring. That initial resolution was overblown as well. > However, the resolution makes a fundamental misunderstanding: encryption is an absolute. Data is either encrypted or it isn’t; users have privacy, or they don’t. Well, but as always, it isn't. Or are they encrypting all customer data with the same key? Are provisions in the US good enough? But then you have the NSA, etc. Privacy is a right on the legal sense. Should anything be unaccesible to law? (in the legal and in the technological sense, but they're two separate issues). This is more of an ethical question than a legal/technological one. But back to the initial statement: no phone or system is 100% secure. A "backdoor" implies a secret (to both user and provider) extraction of the data. Now, a judicially authorized/vetted extraction of data of a specific customer/timeframe is a different thing (even better, make it forward/backward secret). Sure, it is alarming and certainly ethically debatable. But it is not "a backdoor"
- MauranKilom 6y ago
  > A "backdoor" implies a secret (to both user and provider) extraction of the data. Now, a judicially authorized/vetted extraction of data of a specific customer/timeframe is a different thing (even better, make it forward/backward secret). Sure, it is alarming and certainly ethically debatable. But it is not "a backdoor" And how do you implement one without the other?
  - raverbashing 6y ago
    I don't see what you mean. The first one is much easier than the second one (and the second one does not need to be implemented like the first one). Remember, if you have access to the server or the end client you can do either one. That's why the legality supersedes the technology, because the technology is not perfect.
noarchy 6y ago
That this kind of thing is on the table shows how short our memories are. After the Snowden revelations (among others), now governments expect us to believe they have pure intentions when it comes to breaking encryption?
- laurent92 6y ago
  Those stories land on the table when we’ve already lost. We have the entire state apparatus weighing all its might in favor of one side, and we’re trying to collect citizen’s opinions to show that what the EU does isn’t derived from power voluntarily granted by the peons. Sorry, by the « voting citizen ».
tsjq 6y ago
is this similar to the Australian encryption rules that was imposed in the recent years ?
NiceWayToDoIT 6y ago
So, it is very hard not to react on this. What does this means for banks? For any hacker worldwide? For any foreign government agency which is not our? What does it mean for any type of communication that by default has to have secure communication? What are the exactly "ends"? Encryption between car and key, between airplane and tower? And if this is only between two persons, who will enforce this? Criminals will continue to use it, so who is the target here exactly?
- NiceWayToDoIT 6y ago
  I am more and more certain, with the political ideas like these, I will welcome our AI overloads.
- dane-pgp 6y ago
  > What are the exactly "ends"? You're right, they don't care about you talking securely to your bank or any other company that they can trust to keep logs of the plaintext. It might be less disingenuous for governments to say that they are actually against Citizen-to-Citizen encryption.
indymike 6y ago
When I see government trying to backdoor or key-escrow encryption, it reminds me that it wasn't so long ago (1800s) that many governments tried to use law to set the value of 𝛑.
- logicchains 6y ago
  To be fair, if they'd actually somehow achieved that (changing it to something nice and round like 3, or 10), it would have made mental maths a lot easier.
BuildTheRobots 6y ago
Even if you believe it's possible to have secure communications with the government having key escrow (it's not), protection from the government is valid. Yesterday was Holocaust memorial day. It's still well within living memory when a legitimately elected government tried to wipe out vast swathes of their populous because they had the audacity to be born into the wrong religion, sexual orientation, disabilities or political views. People like Willem Arondeus are quite rightly seen as heroes. Can you imagine how much different things would have been if the Nazis were able to get not just everyone's (semi) public facebook posts but all of their private messages as well and use that for targeting of undesirables? As a more recent example, the Rwandan Genocide was massively helped by the fact your national ID card identified your ethnicity. Whilst it's easy to say our current government would never do such a thing, we find ourselves living in a time when the far right is on the rise again and the idea that they would get elected is not beyond imagination. edit: facebook is obviously the wrong example to use here, but there's a difference between someone being able to get a legally issued court order to see stored communications on a platform, or even what data I have on my device and being able to decrypt any communications as it transits over a wire, so I feel the point still stands.
- KMag 6y ago
  Don't forget that there's reasonable evidence that the FBI (or one or more rogue FBI agents) tried blackmailing Dr. Martin Luther King, Jr. into committing suicide.[0] Can you imagine if they had a magic button that would instantly open and read all of Dr. King's letters and phone calls? I don't think he would have committed suicide, but they really could and would have smeared him in the press and wrapped him up for years standing trial for one tiny infraction after another. Did they ever figure out who turned on the lawful intercept capability on Greek phone switches to illegally wiretap Grook politicians? (I think it was Greece, in the early-to-mid 2000s.) Edit: it looks like the NSA[1], but I remember reading speculation that it was organized criminals. [0] https://en.wikipedia.org/wiki/COINTELPRO https://en.wikipedia.org/wiki/COINTELPRO [1] https://en.wikipedia.org/wiki/Greek_wiretapping_case_2004%E2%80%9305 https://en.wikipedia.org/wiki/Greek_wiretapping_case_2004%E2...
aboringusername 6y ago
SSdtIG5vdCBzdXJlIHdoeSB0aGlzIGlzIGV4YWN0bHkgYW4gaXNzdWUuIElmIHlvdSdyZSBnZW 5lcmF0aW5nIGRhdGEgaW4gZW5nbGlzaCBvciBhIGxhbmd1YWdlIHVuZGVyc3Rvb2QgYnkgb3Ro ZXIgaHVtYW5zIChvciB0cmFuc2xhdGFibGUgYnkgb3RoZXIgaHVtYW5zKSB0aGVuIHlvdXIgZG F0YSBpcyBhdCByaXNrIG9mIGJlaW5nIGludGVyY2VwdGVkLgoKV2hldGhlciBkaWdpdGFsIG9y IGFuYWxvZ3VlLCB0aGUgYmVzdCBpZGVhIGlzIHRvIG1ha2UgYSBzeXN0ZW0gb25seSB5b3UgYW 5kIHlvdXIgaW50ZW5kZWQgcGFydHkga25vd3MuIEluc3RlYWQgb2Ygc2VuZGluZyBnZW8gbG9j YXRpb24gYXMgbnVtYmVycywgZW5jcnlwdCBpdCBmaXJzdCwgdXNpbmcgYSBrZXkgeW91IGNhbi BiZSBzdXJlIGlzIGFzIHByaXZhdGUgYXMgcG9zc2libGUsIGFuZCBkbyBub3QgdXNlICJwbGFp biB0ZXh0Ii4KCkFueSBkYXRhIHlvdSBnZW5lcmF0ZSwgZXZlbiBvcmFsbHksIHRoYXQgaXNuJ3 QgImVuY3J5cHRlZCIgeW91cnNlbGYgY2FuIGJlIHVzZWQgYXMgZXZpZGVuY2UgYWdhaW5zdCB5 b3UuCgoyMDN1dWlvd2VmbmJ3OXJoMzg5NHI1aHk4OTM1aHVyODlvMzQKCl4gdGhhdCBtaWdodC BiZSBnaWJiZXJpc2gsIG9yIGFuIGluc3RydWN0aW9uIHRvIHNvbWVvbmUgc29tZXdoZXJlIGlu IHRoZSB3b3JsZCB0aGV5IGNhbiBkZWNpcGhlci4KCldlIG11c3QgYXNzdW1lIGFsbCBkYXRhIG NhbiBiZSBpbnRlcmNlcHRlZCwgaXMgYmVpbmcgaW50ZXJjZXB0ZWQgYW5kIHRvIG1ha2Ugc3lzdGVtcyBhZ2FpbnN0IHRoaXMuIA==
- Kelamir 6y ago
  I agree. For example, there's the app Oversec for Android that works with most messengers and allows to send and decrypt sent messages, it stays on top of the chat app.
- dang 6y ago
  I had to add some newlines to your text because it was borking the page layout. Sorry, it's our bug.
- rsync 6y ago
  This is poignant ... A properly encrypted string is indistinguishable from a random string. A random string, of course, cannot be decrypted and you cannot know a passphrase for it. Is there a possible, conceivable future wherein writing or speaking a random string becomes illegal ? Here's one: 28ac5ef41de3909dee5e15194ac8712245b958ae6a690295139bc7b6c44e25ef
mark_l_watson 6y ago
I use ProtonMail as my daily driver for email. I believe that encrypted content with no back door keys, but having who is communicating with who, is a good compromise. I understand why intelligence agencies might need, with court authorization, to know who is communicating with each other. But, content should be absolutely private.
- mytailorisrich 6y ago
  > But, content should be absolutely private. Content has never been absolutely private and has only become so with widespread end-to-end encryption. This is the crux of the problem and what governments and law enforcement are uncomfortable with.
- raverbashing 6y ago
  That sounds like a good compromise and the kind of discussion that people should be having.
- Nasrudith 6y ago
  It would be a good compromise alright - in the sense of a blackmailed offical being very compromised. Anonymous speech is important to a free society - the secret ballot recognizes this fact well. The intelligence agencies don't even need to exist. They exist to serve us not the other way around - if they forget it the right thing to do is to give them the old yeller treatment because they will have become a menace to all.
DethNinja 6y ago
Government’s attack on its own citizens are getting to a ridiculous level, this ban against encryption is obviously disliked by 99% of the population and will affect them adversely. Government is showing that they don’t care about well being of their citizens by continuously pursuing these type of proposals. I think people in society should drop the civil contract all together, obviously government has devolved into a tribal state where they do everything in their might to protect a select few, hence people will need to drop their contract with the current one and build a new one.
- simonh 6y ago
  You're going to find it difficult to engage with the other side in a debate if you have absolutely no idea why the disagree with you. Or worse completely misunderstand their reasoning. The purpose of these intrusions on E2E encryption is to fight crime and terrorism. It is misconceived and counterproductive, yes, but these people really don't intend to attack citizens in general. They're just woefully ill informed. The way to fight this is to inform them.
  - smeej 6y ago
    I miss the time in my life where I could still believe this. The overwhelming majority of people in prison, who have had existing laws enforced against them aren't violent, even though that's what the laws they "broke" claimed to be trying to prevent when they were passed too. "Crime" is in the eye of the powerful. "Stopping criminals" sounds fine until you realize who they consider "criminals" and how capricious that is.
- smeej 6y ago
  I'd take this a step further: Let's stop pretending there's some sort of "contract" in the first place. If you weren't told the terms, if you weren't given the option to negotiate, if you weren't even informed that you were party to the contract until after you were ostensibly bound to it, it isn't a contract. It's a diktat. You are subject to it, not party to it. Consent matters. Always and everywhere, consent matters. It doesn't just matter in the abstract. It matters in each particular. Consenting to chip in to build a road shouldn't be assumed to be consent to chip in to start a war. There is no "social contract." There's just subjection of people to power.
kavi87 6y ago
How would you even do that ? I doubt any criminal organization just trust the platform for encrypting their data, they do it themselves using well known algorithms that have no backdoors. People who seriously want to encrypt will always be able to do it, you can hide data in pictures, files whatever and have a custom algorithm to reassemble it if you want. The only one who will lose is the user who do not really care, being now more weak to man in the middle attack. That is the majority with data that cause no threat.
mncharity 6y ago
A recent policy memo[1], while variously problematic, did mention end-to-end encryption, as a tool to mitigate risks of US folks using Chinese platforms, in its envisioned environment of an economic-bloc cold war. > Require Chinese companies to adhere to specific technical requirements [...] Technical Restrictions [...] End-to-end encryption: Mandating the use of open source encryption protocols that limits the service provider’s access to user data. This eliminates the ability for the Chinese government to access the encrypted data. Might it now be useful to add this to the political argument for privacy? Opposition to encryption as support for Chinese government intelligence gathering. [1] https://news.ycombinator.com/item?id=25918462 https://news.ycombinator.com/item?id=25918462
dalbasal 6y ago
The failure (our failure) to make the ideals and ideas of freedom in the digital age accessible and present in politics is a disaster. FOSS ideas, open culture ideas. What the world wide web actual is... It's not even that they disagree, they aren't even aware. We spent decades fiddling arguments with one another while events just took their course. Politicians don't understand or care about any of these ideas. The public doesn't either. When "something must be done" about this or that... because digital culture progresses to some point, the deep well of ideas that dominated web culture have zero impact. Ultimately, the encryption argument is being had between spooks and tech monopolies. Politicians are bystanders. There is no "freedom of speech" equivalent, no idea of the current technological age to guide them. No flag for the public to rally to. The right to privacy is great, but we can't just keep arguing by analogy. We need modern age thinking to define this for modern circumstances.
- swiley 6y ago
  We have email with autocrypt to rally to. Abandon the smart phone crap and anything with a large organization attached to it.
  - fsflover 6y ago
    > Abandon the smart phone crap https://puri.sm/products/librem-5 https://puri.sm/products/librem-5
    - Abishek_Muthian 6y ago
      More, Repairable smartphones, with various choices for operating systems from brands which doesn't seem to exhibit hypocrisy when it comes their values - https://www.fairphone.com/en/ https://www.fairphone.com/en/ https://www.pine64.org/pinephone/ https://www.pine64.org/pinephone/ https://www.shiftphones.com/en/ https://www.shiftphones.com/en/ https://myteracube.com/ https://myteracube.com/ But when the parent said, > Abandon the smart phone crap It may not just be about open hardware/OS/Apps for smartphone but the hold the carrier has on the customer and therein privacy issues. This is a hard problem to solve because cellular services are oligopolies or even monopolies and amplified by lack of open modem/radio hardware. So ditching smartphones for a portable computer might be even a good option[1]. [1]https://news.ycombinator.com/item?id=25917178 https://news.ycombinator.com/item?id=25917178
prof-dr-ir 6y ago
I highly recommend reading the actual resolution at [0]. It is short and clearly written, a pdf of a few pages. As Protonmail admits, "it's not explicitly stated in the resolution" that it "seek[s] to allow law enforcement access to encrypted platforms via backdoors". Protonmail argues, however, that this "is widely understood" to be its aim. I am disappointed that Protonmail provides no evidence that this is really the underlying purpose of the resolution. (They do point out that previous proposals did contain such wording, but this in my view is insufficient - the explicit removal of such words can be called progress, after all!) So what am I missing? Can someone here maybe provide evidence that this is really the actual intent of the resolution? [0] https://www.consilium.europa.eu/en/press/press-releases/2020/12/14/encryption-council-adopts-resolution-on-security-through-encryption-and-security-despite-encryption/ https://www.consilium.europa.eu/en/press/press-releases/2020...
- dalbasal 6y ago
  >> disappointed that Protonmail provides no evidence that this is really the underlying purpose of the proposal Be a little generous. This is a blog post, and this is the middle of a debate that's been happening for years. That backdoors are actually what this resolves to is not a controversial position, except that advocates are trying to avoid these terms. In any case, it has been discussed heavily. Not every blog post needs to go through the motions. Meanwhile, for evidence you can read the resolution yourself and make up your mind... It is linked in the first paragraph. It's short, but here's a paraphrase: [1] We love encryption, human rights and all that kind of stuff. [2] Lots of people use encryption. For really important stuff, we even make them use encryption. [3] BUT(!) Criminals also use encryption. This makes it hard for police to read their DMs even though they're just trying doing their job... [4] We want to keep encryption, but make it so police can read criminal's DMs. [5] Big Tech needs to do this. [6] Regulation something something [7] More words, no discernible meaning. Point 4 is the disingenuous point the post is referring to. You are disappointed in a blog post that doesn't cover everything. How about being disappointed in the Council of The European Union's formal resolution demanding something that they know to be impossible. It's not even just technically impossible. It is logically impossible. This is not the first version, as the blog post mentions. Earlier version were unpopular because banning encryption seems like a bad idea. Even politicians seems to have noticed that. This version is demanding a ban on encryption, but also demanding that whatever weaker alternative is implemented still be called encryption so people aren't worried. Honestly, this is hideous. Whatever the merit of their arguments, this is not the way. Everything here is subtext. Nothing is stated plainly. About 40% of the text is "reassuring you that this isn't exactly what it sounds like." Quite literally Orwellian. Like the top comment says. Let's start with them. All members who have signed this resolution can beta test whatever "encryption that only police can break" means. We can all look forward to reading their emails.
_Understated_ 6y ago
Ok, a bit of a hijack here but it's looking like encryption is going to be backdoored! All govs seem to be gunning for it. So, what is the solution? Having my own public/private keys that I sign everything with?
patal 6y ago
> guaranteeing the powers of law enforcement and the judiciary to operate on the same terms as in the offline world Have there ever been prohibitions about which encryption I can use on paper letters?
justapassenger 6y ago
EU: “big tech is stealing your data. Don’t worry, we’ll fight for your rights and protect you “ Also EU: “big tech is encrypting your data, so we cannot look at it when we feel like it. Don’t worry, we’ll make it open, so we can check on you“ Out of those two, I’m much more comfortable with big tech having control over my data. Sure, they’ll use it to make more money, but they won’t use it to put me in jail.
- dalbasal 6y ago
  Lets not choose between evils. These aren't really overlapping anyway. If big tech has access to the data, then authorities can demand it anyway. In any case, this isn't just about using your data to make more money anymore. It's becoming increasingly about power, so it's barely even two seperate evils. Also, government(s) are a customer for the data that big tech is "stealing."
  - justapassenger 6y ago
    In real world you often have to choose between evils. It's utopian slippery slope, yes, but in a current world I prefer to give big corps more power over my data than governments.
    - dalbasal 6y ago
      In current reality, these are not oppositional in any way. In fact, it's easier to stand on the right (or wrong) side of both. If big tech have access to our data, it's insecure and authorities will have access too. If encryption is banned, our data will be more insecure and both will have more access. There really is no need to choose.
toolslive 6y ago
what if you combine encryption with steganography? How can they even prove you have been using encryption ?
blacklight 6y ago
I've been a cypher geek for ages. I've used Signal before it was popular, PGP emails even when they were no longer popular, I've been an early enthusiastic supporter of ProtonMail, I was outraged by many of the decisions taken by the US government to break the right to encryption (and, most of all, harm the security of users through backdoors), and I'm alarmed now that the EU seems willing to follow a similar path. But I also try to walk in politicians' shoes. Security agencies have the right to monitor the traffic linked to activities that pose a threat to public security. And there's no way of saying "open a backdoor only for the bad guys". Just like a knife can be used both to cut an avocado and murder your wife, E2E encryption can be used both to guarantee freedom of speech in authoritarian regimes or protect intellectual property and PIIs, and to guarantee an un-monitored tool for the communications of terrorist organizations. So far the position of the tech community has largely been "our job is just to provide the tools, not to predict nor oversee the perils that they pose". And politicians are rightly frustrated with this approach. And frustration at some point inevitably turns into bad legislation, often done without consulting a tech community that has been deaf to their use-case for decades. Is it possible to build a tool or a technology that guarantees privacy while providing tools for investigators, without opening backdoors and without compromising legitimate use cases? I know, it's a hard question, it's not how E2E encryption was designed, but I have the impression that in all these years we haven't even tried and sit around a whiteboard to brainstorm some ideas, and we are simply shouting "but privacy...!" whenever a politician tries to boldly (and often clumsily) break the wall between them and us and implement legislation to regulate our lack of action.
- hellogamers 6y ago
  >Is it possible to build a tool or a technology that guarantees privacy while providing tools for investigators, without opening backdoors and without compromising legitimate use cases? No. The answer is in the question. You can't have privacy if a third party can read your messages. You don't need to be a "cypher geek" to understand this. >I know, it's a hard question It's not.
Proven 6y ago
People in the EU aren't citizens if the EU but if their country. As always, they are threatened by the EU government. Leave the EU, lessen the problem!

698 points by eddieoz 6y ago

Put simply, the resolution is no different from the previous proposals which generated a wide backlash from privacy-conscious companies, civil society members, experts, and MEPs. The difference this time is that the Council has taken a more subtle approach and avoided explicitly using words like ‘ban’ or ‘backdoor.’ But make no mistake, this is the intention. It’s important that steps are taken now to prevent these proposals going too far and keep European’s rights to privacy intact.”

bitcharmer 6y ago
There were all too many efforts from EU to ban or at least limit encryption. They all get shot down for perfectly valid reasons only to come back after a few months in one form or another. This implies that: 1) there is a clear agenda among the political class to go against the will of the citizens despite the strong opposition to the idea 2) it will eventually succeed because they will hide the legislation in some obscure act of law anyway An example how shady EU council can be: "Acta was slipped through the European Council in an agriculture and fisheries meeting in December" https://www.wired.co.uk/article/acta-101 https://www.wired.co.uk/article/acta-101
- prof-dr-ir 6y ago
  I do not (entirely) disagree with your comment, but I think it would be fair to add some counterweight to the evidence you provide for your point (2): Acta was ultimately rejected by the European Parliament.
  - bitcharmer 6y ago
    I never said ACTA was passed. Just provided example of tactics employed to sneak in laws that general public strongly opposes.
    - prof-dr-ir 6y ago
      Agreed. But your original point would be stronger if you could provide actual examples of passed EU legislation that was "snuck in".

mytailorisrich 6y ago

In society there are always competing rights and duties to be balanced. Rights very rarely absolute. In this case the right to privacy has to be balanced with the need in society for the law to be enforced and police investigations to be carried out. There are never been "end-to-end" unbreakable privacy. People have a right to privacy so their private communications are kept private but at the same time the police has always been able to access those communications should it be necessary and according to the law. Claiming that an 'intact' right to privacy means an absolute right to absolute privacy is simply not how it has ever been. Strong end-to-end encryption essentially means that the police cannot access communications ever, even if they get a warrant because they don't have a technical mean to do so. That's quite reasonably something that is deemed a problem. How do we deal with this?

simonh 6y ago
This is simply not true. Conversations on private premises have never been legitimate targets of surveillance, and it's not generally* been illegal to encode or encrypt mail or other private papers or communications. Mandatory back doors are an entirely novel and highly intrusive encroachment on civil liberties. Edited from "has never been"
- rlpb 6y ago
  > ...it's never been illegal to encode or encrypt mail or other private papers or communications In what country? France, for example, used to restrict the use of strong encryption. Example summary: http://www.opengroup.org/security/meetings/apr98/French-Encryption-Regulation-rev.htm http://www.opengroup.org/security/meetings/apr98/French-Encr...
  - fogihujy 6y ago
    This seems to be about hardware/software that performs encryption? I've yet to see any modern democratic government prevent someone from using a one-time pad, a piece of paper and a pencil to encrypt a message.
  - deleted 6y ago

jgalt212 6y ago

It's like trust the govt, but not Google. I don't trust either.

bondarchuk 6y ago

I live in the Netherlands. National election is coming in march. What would be the best way to do something about this as a voter?

pmlnr 6y ago
Find out which party makes sense to you. In the UK, there are usually "tests" where you answer questions based on what you think, and it'll show you to what percent you agree with which party. If I'd have to guess, the Pirate Party probably supports encryption.
krageon 6y ago
Given that the current political climate is "lie until you get elected", it doesn't matter. Maybe vote for someone you like personally. Hopefully they have lied about things you can live with.
- ako 6y ago
  How do you determine if it is lying, or just inability to achieve your goals without compromise? It's easy to state what you want, but to achieve it when you have to collaborate with many others that have other priorities and opinions usually results in a compromise. That's not lying, that's just reality.
  - krageon 6y ago
    If every time there is compromise the opposite of what is promised is achieved (or at the very least nothing at all), then continuing to make those promises is lying.
Vinnl 6y ago
Generally, I believe Dutch representatives in the EU have been doing their thing when it comes to arguing against encryption, so it probably needn't play a major role in your deliberations. It might be that a 2021 edition of this website is going to be launched again though, if you want to make sure: https://www.privacystemwijzer.nl/ https://www.privacystemwijzer.nl/ (And otherwise the 2019 edition might already give you enough of an idea.)

Daniel_sk 6y ago

They will never stop. It's the EU salami tactics, they proceed "slice by slice" until you realize it and then it's usually too late. I wish they would devote so much time to actual problems and make EU again a big leader (e.g. look at the speed we are getting vaccines now).

ginko 6y ago
This isn't 'the EU'. It's the Council, i.e. the national governments.
- baxtr 6y ago
  How do you define the EU exactly?
  - ginko 6y ago
    The EU is a union of countries. It's the entire body including all its citizens. There's several governing bodies within the EU and people should understand the political process within it and be specific. How often do you see Americans blaming the USA for some new legislation?
    - soco 6y ago
      I have the feeling that some EU citizens aren't exactly aware that THEY are the EU, and listen instead to antagonizing outsider stories (Sputnik, whatever you name it). There were EU elections last year and the measures taken today are drafted by those people elected one year ago. Same for the council members - they were voted in the respective national elections. Next time folks pay better attention when you vote. Or whether you vote.
      - fogihujy 6y ago
        The resolution was made by the EU Council, not the parliament. The EU Council is not voted upon as such, and it consists of the heads of state/government from all member states. Once this reaches the parliament, on the other hand, there will be a lot of concerned citizens contacting members of parliament in order to voice their opinion.

coldcode 6y ago

I always say if politicians want to ban encryption being absolute (by making it insecure): you first. Lets see how well it works by implementing encraption in your systems and email and seeing if your backdoor deals and illegal activity winds up in the public eye for all to see.

teekert 6y ago
Indeed! Meanwhile our government (the Netherlands) tells their employees to use Signal. Good luck telling your forces in the Middle East: "Please use this app that has breakable encryption, but it's not breakable by the bad guys, at least, we are 98% certain they can't break it. Also, we're pretty sure the master key never leaked. Yeah we know how that went for the New York subway but we are better. It's fine, don't whine, even if they break the encryption, they don't understand your Dutch conversations with your loved ones anyway. I mean, what have we got to hide anyway."
- nalekberov 6y ago
  When I first visited the Netherlands in 2017 I observed public transportation was transitioning to plastic card only payments. That was my first impression about the country in privacy context, not being able to use cash is a big attack on privacy.
  - teekert 6y ago
    Yeah there is that wish to go away from cash but we also had this: [0, from 2016]. I hope we will have more privacy oriented fintech companies soon, indeed it may swing the wrong way. It depends a bit on the ruling parties (we have many and they have to form a coalition.) [0] https://www.theregister.com/2016/01/04/dutch_government_says_no_to_backdoors/ https://www.theregister.com/2016/01/04/dutch_government_says...
    - nalekberov 6y ago
      > privacy oriented fintech Can you elaborate on that term? We are talking here about digital payments, right? (where usually more than 3 parties involved in this process) How are you gonna make sure the whole transaction is not traceable back to you?

raverbashing 6y ago

This discussion is tiring. That initial resolution was overblown as well. > However, the resolution makes a fundamental misunderstanding: encryption is an absolute. Data is either encrypted or it isn’t; users have privacy, or they don’t. Well, but as always, it isn't. Or are they encrypting all customer data with the same key? Are provisions in the US good enough? But then you have the NSA, etc. Privacy is a right on the legal sense. Should anything be unaccesible to law? (in the legal and in the technological sense, but they're two separate issues). This is more of an ethical question than a legal/technological one. But back to the initial statement: no phone or system is 100% secure. A "backdoor" implies a secret (to both user and provider) extraction of the data. Now, a judicially authorized/vetted extraction of data of a specific customer/timeframe is a different thing (even better, make it forward/backward secret). Sure, it is alarming and certainly ethically debatable. But it is not "a backdoor"

MauranKilom 6y ago
> A "backdoor" implies a secret (to both user and provider) extraction of the data. Now, a judicially authorized/vetted extraction of data of a specific customer/timeframe is a different thing (even better, make it forward/backward secret). Sure, it is alarming and certainly ethically debatable. But it is not "a backdoor" And how do you implement one without the other?
- raverbashing 6y ago
  I don't see what you mean. The first one is much easier than the second one (and the second one does not need to be implemented like the first one). Remember, if you have access to the server or the end client you can do either one. That's why the legality supersedes the technology, because the technology is not perfect.

noarchy 6y ago

That this kind of thing is on the table shows how short our memories are. After the Snowden revelations (among others), now governments expect us to believe they have pure intentions when it comes to breaking encryption?

laurent92 6y ago
Those stories land on the table when we’ve already lost. We have the entire state apparatus weighing all its might in favor of one side, and we’re trying to collect citizen’s opinions to show that what the EU does isn’t derived from power voluntarily granted by the peons. Sorry, by the « voting citizen ».

tsjq 6y ago

is this similar to the Australian encryption rules that was imposed in the recent years ?

NiceWayToDoIT 6y ago

So, it is very hard not to react on this. What does this means for banks? For any hacker worldwide? For any foreign government agency which is not our? What does it mean for any type of communication that by default has to have secure communication? What are the exactly "ends"? Encryption between car and key, between airplane and tower? And if this is only between two persons, who will enforce this? Criminals will continue to use it, so who is the target here exactly?

NiceWayToDoIT 6y ago
I am more and more certain, with the political ideas like these, I will welcome our AI overloads.
dane-pgp 6y ago
> What are the exactly "ends"? You're right, they don't care about you talking securely to your bank or any other company that they can trust to keep logs of the plaintext. It might be less disingenuous for governments to say that they are actually against Citizen-to-Citizen encryption.

indymike 6y ago

When I see government trying to backdoor or key-escrow encryption, it reminds me that it wasn't so long ago (1800s) that many governments tried to use law to set the value of 𝛑.

logicchains 6y ago
To be fair, if they'd actually somehow achieved that (changing it to something nice and round like 3, or 10), it would have made mental maths a lot easier.

BuildTheRobots 6y ago

Even if you believe it's possible to have secure communications with the government having key escrow (it's not), protection from the government is valid. Yesterday was Holocaust memorial day. It's still well within living memory when a legitimately elected government tried to wipe out vast swathes of their populous because they had the audacity to be born into the wrong religion, sexual orientation, disabilities or political views. People like Willem Arondeus are quite rightly seen as heroes. Can you imagine how much different things would have been if the Nazis were able to get not just everyone's (semi) public facebook posts but all of their private messages as well and use that for targeting of undesirables? As a more recent example, the Rwandan Genocide was massively helped by the fact your national ID card identified your ethnicity. Whilst it's easy to say our current government would never do such a thing, we find ourselves living in a time when the far right is on the rise again and the idea that they would get elected is not beyond imagination. edit: facebook is obviously the wrong example to use here, but there's a difference between someone being able to get a legally issued court order to see stored communications on a platform, or even what data I have on my device and being able to decrypt any communications as it transits over a wire, so I feel the point still stands.

KMag 6y ago
Don't forget that there's reasonable evidence that the FBI (or one or more rogue FBI agents) tried blackmailing Dr. Martin Luther King, Jr. into committing suicide.[0] Can you imagine if they had a magic button that would instantly open and read all of Dr. King's letters and phone calls? I don't think he would have committed suicide, but they really could and would have smeared him in the press and wrapped him up for years standing trial for one tiny infraction after another. Did they ever figure out who turned on the lawful intercept capability on Greek phone switches to illegally wiretap Grook politicians? (I think it was Greece, in the early-to-mid 2000s.) Edit: it looks like the NSA[1], but I remember reading speculation that it was organized criminals. [0] https://en.wikipedia.org/wiki/COINTELPRO https://en.wikipedia.org/wiki/COINTELPRO [1] https://en.wikipedia.org/wiki/Greek_wiretapping_case_2004%E2%80%9305 https://en.wikipedia.org/wiki/Greek_wiretapping_case_2004%E2...

aboringusername 6y ago

SSdtIG5vdCBzdXJlIHdoeSB0aGlzIGlzIGV4YWN0bHkgYW4gaXNzdWUuIElmIHlvdSdyZSBnZW 5lcmF0aW5nIGRhdGEgaW4gZW5nbGlzaCBvciBhIGxhbmd1YWdlIHVuZGVyc3Rvb2QgYnkgb3Ro ZXIgaHVtYW5zIChvciB0cmFuc2xhdGFibGUgYnkgb3RoZXIgaHVtYW5zKSB0aGVuIHlvdXIgZG F0YSBpcyBhdCByaXNrIG9mIGJlaW5nIGludGVyY2VwdGVkLgoKV2hldGhlciBkaWdpdGFsIG9y IGFuYWxvZ3VlLCB0aGUgYmVzdCBpZGVhIGlzIHRvIG1ha2UgYSBzeXN0ZW0gb25seSB5b3UgYW 5kIHlvdXIgaW50ZW5kZWQgcGFydHkga25vd3MuIEluc3RlYWQgb2Ygc2VuZGluZyBnZW8gbG9j YXRpb24gYXMgbnVtYmVycywgZW5jcnlwdCBpdCBmaXJzdCwgdXNpbmcgYSBrZXkgeW91IGNhbi BiZSBzdXJlIGlzIGFzIHByaXZhdGUgYXMgcG9zc2libGUsIGFuZCBkbyBub3QgdXNlICJwbGFp biB0ZXh0Ii4KCkFueSBkYXRhIHlvdSBnZW5lcmF0ZSwgZXZlbiBvcmFsbHksIHRoYXQgaXNuJ3 QgImVuY3J5cHRlZCIgeW91cnNlbGYgY2FuIGJlIHVzZWQgYXMgZXZpZGVuY2UgYWdhaW5zdCB5 b3UuCgoyMDN1dWlvd2VmbmJ3OXJoMzg5NHI1aHk4OTM1aHVyODlvMzQKCl4gdGhhdCBtaWdodC BiZSBnaWJiZXJpc2gsIG9yIGFuIGluc3RydWN0aW9uIHRvIHNvbWVvbmUgc29tZXdoZXJlIGlu IHRoZSB3b3JsZCB0aGV5IGNhbiBkZWNpcGhlci4KCldlIG11c3QgYXNzdW1lIGFsbCBkYXRhIG NhbiBiZSBpbnRlcmNlcHRlZCwgaXMgYmVpbmcgaW50ZXJjZXB0ZWQgYW5kIHRvIG1ha2Ugc3lzdGVtcyBhZ2FpbnN0IHRoaXMuIA==

Kelamir 6y ago
I agree. For example, there's the app Oversec for Android that works with most messengers and allows to send and decrypt sent messages, it stays on top of the chat app.
dang 6y ago
I had to add some newlines to your text because it was borking the page layout. Sorry, it's our bug.
rsync 6y ago
This is poignant ... A properly encrypted string is indistinguishable from a random string. A random string, of course, cannot be decrypted and you cannot know a passphrase for it. Is there a possible, conceivable future wherein writing or speaking a random string becomes illegal ? Here's one: 28ac5ef41de3909dee5e15194ac8712245b958ae6a690295139bc7b6c44e25ef

mark_l_watson 6y ago

I use ProtonMail as my daily driver for email. I believe that encrypted content with no back door keys, but having who is communicating with who, is a good compromise. I understand why intelligence agencies might need, with court authorization, to know who is communicating with each other. But, content should be absolutely private.

mytailorisrich 6y ago
> But, content should be absolutely private. Content has never been absolutely private and has only become so with widespread end-to-end encryption. This is the crux of the problem and what governments and law enforcement are uncomfortable with.
raverbashing 6y ago
That sounds like a good compromise and the kind of discussion that people should be having.
Nasrudith 6y ago
It would be a good compromise alright - in the sense of a blackmailed offical being very compromised. Anonymous speech is important to a free society - the secret ballot recognizes this fact well. The intelligence agencies don't even need to exist. They exist to serve us not the other way around - if they forget it the right thing to do is to give them the old yeller treatment because they will have become a menace to all.

DethNinja 6y ago

Government’s attack on its own citizens are getting to a ridiculous level, this ban against encryption is obviously disliked by 99% of the population and will affect them adversely. Government is showing that they don’t care about well being of their citizens by continuously pursuing these type of proposals. I think people in society should drop the civil contract all together, obviously government has devolved into a tribal state where they do everything in their might to protect a select few, hence people will need to drop their contract with the current one and build a new one.

simonh 6y ago
You're going to find it difficult to engage with the other side in a debate if you have absolutely no idea why the disagree with you. Or worse completely misunderstand their reasoning. The purpose of these intrusions on E2E encryption is to fight crime and terrorism. It is misconceived and counterproductive, yes, but these people really don't intend to attack citizens in general. They're just woefully ill informed. The way to fight this is to inform them.
- smeej 6y ago
  I miss the time in my life where I could still believe this. The overwhelming majority of people in prison, who have had existing laws enforced against them aren't violent, even though that's what the laws they "broke" claimed to be trying to prevent when they were passed too. "Crime" is in the eye of the powerful. "Stopping criminals" sounds fine until you realize who they consider "criminals" and how capricious that is.
smeej 6y ago
I'd take this a step further: Let's stop pretending there's some sort of "contract" in the first place. If you weren't told the terms, if you weren't given the option to negotiate, if you weren't even informed that you were party to the contract until after you were ostensibly bound to it, it isn't a contract. It's a diktat. You are subject to it, not party to it. Consent matters. Always and everywhere, consent matters. It doesn't just matter in the abstract. It matters in each particular. Consenting to chip in to build a road shouldn't be assumed to be consent to chip in to start a war. There is no "social contract." There's just subjection of people to power.

kavi87 6y ago

How would you even do that ? I doubt any criminal organization just trust the platform for encrypting their data, they do it themselves using well known algorithms that have no backdoors. People who seriously want to encrypt will always be able to do it, you can hide data in pictures, files whatever and have a custom algorithm to reassemble it if you want. The only one who will lose is the user who do not really care, being now more weak to man in the middle attack. That is the majority with data that cause no threat.

mncharity 6y ago

A recent policy memo[1], while variously problematic, did mention end-to-end encryption, as a tool to mitigate risks of US folks using Chinese platforms, in its envisioned environment of an economic-bloc cold war. > Require Chinese companies to adhere to specific technical requirements [...] Technical Restrictions [...] End-to-end encryption: Mandating the use of open source encryption protocols that limits the service provider’s access to user data. This eliminates the ability for the Chinese government to access the encrypted data. Might it now be useful to add this to the political argument for privacy? Opposition to encryption as support for Chinese government intelligence gathering. [1] https://news.ycombinator.com/item?id=25918462 https://news.ycombinator.com/item?id=25918462

dalbasal 6y ago

The failure (our failure) to make the ideals and ideas of freedom in the digital age accessible and present in politics is a disaster. FOSS ideas, open culture ideas. What the world wide web actual is... It's not even that they disagree, they aren't even aware. We spent decades fiddling arguments with one another while events just took their course. Politicians don't understand or care about any of these ideas. The public doesn't either. When "something must be done" about this or that... because digital culture progresses to some point, the deep well of ideas that dominated web culture have zero impact. Ultimately, the encryption argument is being had between spooks and tech monopolies. Politicians are bystanders. There is no "freedom of speech" equivalent, no idea of the current technological age to guide them. No flag for the public to rally to. The right to privacy is great, but we can't just keep arguing by analogy. We need modern age thinking to define this for modern circumstances.

swiley 6y ago
We have email with autocrypt to rally to. Abandon the smart phone crap and anything with a large organization attached to it.
- fsflover 6y ago
  > Abandon the smart phone crap https://puri.sm/products/librem-5 https://puri.sm/products/librem-5
  - Abishek_Muthian 6y ago
    More, Repairable smartphones, with various choices for operating systems from brands which doesn't seem to exhibit hypocrisy when it comes their values - https://www.fairphone.com/en/ https://www.fairphone.com/en/ https://www.pine64.org/pinephone/ https://www.pine64.org/pinephone/ https://www.shiftphones.com/en/ https://www.shiftphones.com/en/ https://myteracube.com/ https://myteracube.com/ But when the parent said, > Abandon the smart phone crap It may not just be about open hardware/OS/Apps for smartphone but the hold the carrier has on the customer and therein privacy issues. This is a hard problem to solve because cellular services are oligopolies or even monopolies and amplified by lack of open modem/radio hardware. So ditching smartphones for a portable computer might be even a good option[1]. [1]https://news.ycombinator.com/item?id=25917178 https://news.ycombinator.com/item?id=25917178

prof-dr-ir 6y ago

I highly recommend reading the actual resolution at [0]. It is short and clearly written, a pdf of a few pages. As Protonmail admits, "it's not explicitly stated in the resolution" that it "seek[s] to allow law enforcement access to encrypted platforms via backdoors". Protonmail argues, however, that this "is widely understood" to be its aim. I am disappointed that Protonmail provides no evidence that this is really the underlying purpose of the resolution. (They do point out that previous proposals did contain such wording, but this in my view is insufficient - the explicit removal of such words can be called progress, after all!) So what am I missing? Can someone here maybe provide evidence that this is really the actual intent of the resolution? [0] https://www.consilium.europa.eu/en/press/press-releases/2020/12/14/encryption-council-adopts-resolution-on-security-through-encryption-and-security-despite-encryption/ https://www.consilium.europa.eu/en/press/press-releases/2020...

dalbasal 6y ago
>> disappointed that Protonmail provides no evidence that this is really the underlying purpose of the proposal Be a little generous. This is a blog post, and this is the middle of a debate that's been happening for years. That backdoors are actually what this resolves to is not a controversial position, except that advocates are trying to avoid these terms. In any case, it has been discussed heavily. Not every blog post needs to go through the motions. Meanwhile, for evidence you can read the resolution yourself and make up your mind... It is linked in the first paragraph. It's short, but here's a paraphrase: [1] We love encryption, human rights and all that kind of stuff. [2] Lots of people use encryption. For really important stuff, we even make them use encryption. [3] BUT(!) Criminals also use encryption. This makes it hard for police to read their DMs even though they're just trying doing their job... [4] We want to keep encryption, but make it so police can read criminal's DMs. [5] Big Tech needs to do this. [6] Regulation something something [7] More words, no discernible meaning. Point 4 is the disingenuous point the post is referring to. You are disappointed in a blog post that doesn't cover everything. How about being disappointed in the Council of The European Union's formal resolution demanding something that they know to be impossible. It's not even just technically impossible. It is logically impossible. This is not the first version, as the blog post mentions. Earlier version were unpopular because banning encryption seems like a bad idea. Even politicians seems to have noticed that. This version is demanding a ban on encryption, but also demanding that whatever weaker alternative is implemented still be called encryption so people aren't worried. Honestly, this is hideous. Whatever the merit of their arguments, this is not the way. Everything here is subtext. Nothing is stated plainly. About 40% of the text is "reassuring you that this isn't exactly what it sounds like." Quite literally Orwellian. Like the top comment says. Let's start with them. All members who have signed this resolution can beta test whatever "encryption that only police can break" means. We can all look forward to reading their emails.

_Understated_ 6y ago

Ok, a bit of a hijack here but it's looking like encryption is going to be backdoored! All govs seem to be gunning for it. So, what is the solution? Having my own public/private keys that I sign everything with?

patal 6y ago

> guaranteeing the powers of law enforcement and the judiciary to operate on the same terms as in the offline world Have there ever been prohibitions about which encryption I can use on paper letters?

justapassenger 6y ago

EU: “big tech is stealing your data. Don’t worry, we’ll fight for your rights and protect you “ Also EU: “big tech is encrypting your data, so we cannot look at it when we feel like it. Don’t worry, we’ll make it open, so we can check on you“ Out of those two, I’m much more comfortable with big tech having control over my data. Sure, they’ll use it to make more money, but they won’t use it to put me in jail.

dalbasal 6y ago
Lets not choose between evils. These aren't really overlapping anyway. If big tech has access to the data, then authorities can demand it anyway. In any case, this isn't just about using your data to make more money anymore. It's becoming increasingly about power, so it's barely even two seperate evils. Also, government(s) are a customer for the data that big tech is "stealing."
- justapassenger 6y ago
  In real world you often have to choose between evils. It's utopian slippery slope, yes, but in a current world I prefer to give big corps more power over my data than governments.
  - dalbasal 6y ago
    In current reality, these are not oppositional in any way. In fact, it's easier to stand on the right (or wrong) side of both. If big tech have access to our data, it's insecure and authorities will have access too. If encryption is banned, our data will be more insecure and both will have more access. There really is no need to choose.

toolslive 6y ago

what if you combine encryption with steganography? How can they even prove you have been using encryption ?

blacklight 6y ago

I've been a cypher geek for ages. I've used Signal before it was popular, PGP emails even when they were no longer popular, I've been an early enthusiastic supporter of ProtonMail, I was outraged by many of the decisions taken by the US government to break the right to encryption (and, most of all, harm the security of users through backdoors), and I'm alarmed now that the EU seems willing to follow a similar path. But I also try to walk in politicians' shoes. Security agencies have the right to monitor the traffic linked to activities that pose a threat to public security. And there's no way of saying "open a backdoor only for the bad guys". Just like a knife can be used both to cut an avocado and murder your wife, E2E encryption can be used both to guarantee freedom of speech in authoritarian regimes or protect intellectual property and PIIs, and to guarantee an un-monitored tool for the communications of terrorist organizations. So far the position of the tech community has largely been "our job is just to provide the tools, not to predict nor oversee the perils that they pose". And politicians are rightly frustrated with this approach. And frustration at some point inevitably turns into bad legislation, often done without consulting a tech community that has been deaf to their use-case for decades. Is it possible to build a tool or a technology that guarantees privacy while providing tools for investigators, without opening backdoors and without compromising legitimate use cases? I know, it's a hard question, it's not how E2E encryption was designed, but I have the impression that in all these years we haven't even tried and sit around a whiteboard to brainstorm some ideas, and we are simply shouting "but privacy...!" whenever a politician tries to boldly (and often clumsily) break the wall between them and us and implement legislation to regulate our lack of action.

hellogamers 6y ago
>Is it possible to build a tool or a technology that guarantees privacy while providing tools for investigators, without opening backdoors and without compromising legitimate use cases? No. The answer is in the question. You can't have privacy if a third party can read your messages. You don't need to be a "cypher geek" to understand this. >I know, it's a hard question It's not.

Proven 6y ago

People in the EU aren't citizens if the EU but if their country. As always, they are threatened by the EU government. Leave the EU, lessen the problem!