3 ms·

>I seem to lean quite far on the freedom side of most arguments, but I do acknowledge there are times when action may need to be taken in the interest of the pu

by slg 5y ago

>I seem to lean quite far on the freedom side of most arguments, but I do acknowledge there are times when action may need to be taken in the interest of the public. My objection is that I neither want it to be impossible to take action or for a foreign company to unilaterally decide what action to take. >What we need in situations like this is a legal process. If one doesn't exist, it's not for companies to start deciding what information the public should have access to and what is "harmful", but for democratic countries to pass laws with the consent of their local electorates to decide what legal protections and processes need to be put in place. What is interesting is that I wouldn't even have to change a single word here and I can equally apply this reasoning to encryption. It is almost always unpopular on HN to suggest that universal end-to-end encryption might not be a great idea or that encryption backdoors are something that need to be seriously discussed, but those opinions are born out of the same underlying logic. Free speech is good, but no society wants universal free speech since there are legitimately evil people who will use their speech for malicious means. Same is true about encryption. Why are we ok with removing revenge porn from Google results but need to just accept that we are allowing child porn to be shared via easily encrypted channels?

avianlyric 5y ago
The difference is that strong encryption is an all or nothing proposition. You either have strong encryption that works in all scenarios, both good and ill, or you have weak encryption that protects nothing. There unfortunately is no middle ground, and plenty of people and governments have tried. Selective censorship by central authorities can be granular, choosing to create a legal process for selective censorship doesn’t suddenly allow any person on the internet to potentially censor any thing they want. Weak encryption however allows anyone, anywhere, with enough effort to break all encryption everywhere, and do so without without detection or needing to expose themselves via a legal system. Also there aren’t “central encryption authorities” that all encryption passes through. Anyone can implement modern crypto wherever, so banning it makes no sense. It’s like trying to ban the concept of Pi.
- slg 5y ago
  >You either have strong encryption that works in all scenarios, both good and ill, or you have weak encryption that protects nothing. There unfortunately is no middle ground, and plenty of people and governments have tried. This is always stated as a universal truth of the technology, but this mostly seems like a people and organizational problem. We already have encryption algorithms that can encrypt content for decryption by multiple optional keys. Why couldn't we fragment and distribute one set of those keys among multiple legal entities? That would require coordination and agreement to decrypt anything. That wouldn't be a true backdoor anymore than the original key is a backdoor, it would simply be overhead on the existing encrypted content to allow it to be decrypted by multiple keys. >Also there aren’t “central encryption authorities” that all encryption passes through. Anyone can implement modern crypto wherever, so banning it makes no sense. It’s like trying to ban the concept of Pi. This is true, but defaults matter. If the US makes a law regarding encryption, Google, Apple, Amazon, Microsoft, Facebook, etc are all going to follow it. You still might be able to roll your own encryption, but the people who do that will be a tiny share of overall communication. Laws like this aren't meant to completely stop something. Putting in financial regulations to crack down on money laundering doesn't stop money laundering. The goal is to make it more difficult and prevent the most egregious cases.
  - kortilla 5y ago
    > Why couldn't we fragment and distribute one set of those keys among multiple legal entities? Because crypto is implemented in software and it’s trivial to remove the part that encrypts for the government’s key.
    - slg 5y ago
      You completely ignored the last paragraph of my comment where I addressed this type of concern.
      - gjs278 5y ago
        stop posting. you’re wrong and your idea sucks. there’s nothing else to say.
kypro 5y ago
Personally I'm not convinced the rewards outweigh the risks in regards to encryption, at least not at this moment in time. But again, I'd much rather issues like these were debated democratically than some tech company deciding one day that they need to view my private messages to "protect the children". But to your point, if the sharing of child porn or other illegal content ever got so bad that something urgently needed to be done I would personally be open to limiting the use E2EE (if there truly was no better option) and I'd assume most people here would agree, although I would argue in many cases it's E2EE that prevents you from becoming a victim of things like revenge porn in the first place.
- slg 5y ago
  >I'd much rather issues like these were debated democratically than some tech company deciding one day that they need to view my private messages to "protect the children". I agree with your general point except most people in the tech community are not willing to even have these debates. It is often treated as an issue with a single right answer and that encryption can never be compromised. Removing ourselves from the debate is only going to end up with the decision being made without our input.
- int_19h 5y ago
  The thing about E2EE is that it's not something that you can meaningfully ban in a non-totalitarian society. RSA boils down to one fairly simple formula, for example, or a Perl one-liner. People who really need it will figure it out. Besides, there would be quite a few people who'd be actively circumventing any such law if it were enacted, e.g. by hosting the apps in other jurisdictions. And I think that's a good thing! There should be fundamental limits on the power of governance, regardless of how democratic said governance is; and democracies can be no less abusive than other forms when it comes to minorities etc. Or even majorities, when established public mores essentially require widespread hypocrisy - the Prohibition comes to mind. "Think of the children" (or terrorists, or whatever is the go-to political excuse at any particular moment) is not a valid exception.
version_five 5y ago
Huh? The google example is about content being available in public, essentially the equivalent of someone posting dirty / embarrassing pictures in a public square and needing there to be a way to take them down. That sounds pretty reasonable. The encryption example is about being able to intercept private communication (never mind outlawing math) because someone could use that private communication for something illegal. The two examples have nothing to do with each other IMO.

by slg 5y ago

avianlyric 5y ago

The difference is that strong encryption is an all or nothing proposition. You either have strong encryption that works in all scenarios, both good and ill, or you have weak encryption that protects nothing. There unfortunately is no middle ground, and plenty of people and governments have tried. Selective censorship by central authorities can be granular, choosing to create a legal process for selective censorship doesn’t suddenly allow any person on the internet to potentially censor any thing they want. Weak encryption however allows anyone, anywhere, with enough effort to break all encryption everywhere, and do so without without detection or needing to expose themselves via a legal system. Also there aren’t “central encryption authorities” that all encryption passes through. Anyone can implement modern crypto wherever, so banning it makes no sense. It’s like trying to ban the concept of Pi.

slg 5y ago
>You either have strong encryption that works in all scenarios, both good and ill, or you have weak encryption that protects nothing. There unfortunately is no middle ground, and plenty of people and governments have tried. This is always stated as a universal truth of the technology, but this mostly seems like a people and organizational problem. We already have encryption algorithms that can encrypt content for decryption by multiple optional keys. Why couldn't we fragment and distribute one set of those keys among multiple legal entities? That would require coordination and agreement to decrypt anything. That wouldn't be a true backdoor anymore than the original key is a backdoor, it would simply be overhead on the existing encrypted content to allow it to be decrypted by multiple keys. >Also there aren’t “central encryption authorities” that all encryption passes through. Anyone can implement modern crypto wherever, so banning it makes no sense. It’s like trying to ban the concept of Pi. This is true, but defaults matter. If the US makes a law regarding encryption, Google, Apple, Amazon, Microsoft, Facebook, etc are all going to follow it. You still might be able to roll your own encryption, but the people who do that will be a tiny share of overall communication. Laws like this aren't meant to completely stop something. Putting in financial regulations to crack down on money laundering doesn't stop money laundering. The goal is to make it more difficult and prevent the most egregious cases.
- kortilla 5y ago
  > Why couldn't we fragment and distribute one set of those keys among multiple legal entities? Because crypto is implemented in software and it’s trivial to remove the part that encrypts for the government’s key.
  - slg 5y ago
    You completely ignored the last paragraph of my comment where I addressed this type of concern.
    - gjs278 5y ago
      stop posting. you’re wrong and your idea sucks. there’s nothing else to say.

kypro 5y ago

Personally I'm not convinced the rewards outweigh the risks in regards to encryption, at least not at this moment in time. But again, I'd much rather issues like these were debated democratically than some tech company deciding one day that they need to view my private messages to "protect the children". But to your point, if the sharing of child porn or other illegal content ever got so bad that something urgently needed to be done I would personally be open to limiting the use E2EE (if there truly was no better option) and I'd assume most people here would agree, although I would argue in many cases it's E2EE that prevents you from becoming a victim of things like revenge porn in the first place.

slg 5y ago
>I'd much rather issues like these were debated democratically than some tech company deciding one day that they need to view my private messages to "protect the children". I agree with your general point except most people in the tech community are not willing to even have these debates. It is often treated as an issue with a single right answer and that encryption can never be compromised. Removing ourselves from the debate is only going to end up with the decision being made without our input.
int_19h 5y ago
The thing about E2EE is that it's not something that you can meaningfully ban in a non-totalitarian society. RSA boils down to one fairly simple formula, for example, or a Perl one-liner. People who really need it will figure it out. Besides, there would be quite a few people who'd be actively circumventing any such law if it were enacted, e.g. by hosting the apps in other jurisdictions. And I think that's a good thing! There should be fundamental limits on the power of governance, regardless of how democratic said governance is; and democracies can be no less abusive than other forms when it comes to minorities etc. Or even majorities, when established public mores essentially require widespread hypocrisy - the Prohibition comes to mind. "Think of the children" (or terrorists, or whatever is the go-to political excuse at any particular moment) is not a valid exception.

version_five 5y ago

Huh? The google example is about content being available in public, essentially the equivalent of someone posting dirty / embarrassing pictures in a public square and needing there to be a way to take them down. That sounds pretty reasonable. The encryption example is about being able to intercept private communication (never mind outlawing math) because someone could use that private communication for something illegal. The two examples have nothing to do with each other IMO.