5 ms·

> Securely encrypted communication is at risk. Up to now, encrypted messages cannot be searched by the algorithms. To change that back doors would need to be bu

> Securely encrypted communication is at risk. Up to now, encrypted messages cannot be searched by the algorithms. To change that back doors would need to be built in to messaging software. As soon as that happens, this security loophole can be exploited by anyone with the technical means needed, for example by foreign intelligence services and criminals. Private communications, business secrets and sensitive government information would be exposed. Secure encryption is needed to protect minorities, LGBTQI people, democratic activists, journalists, etc. So if I understand correctly, this will be the end of E2E encryption? That would probably be the stupidest decision of the century. Governments are always lagging behind in terms of 'cyber' security, so my guess is that it will only be a matter of time before we can expect data leaks from widely used private chat services.

Tepix 5y ago
No. It will mean that criminals can protect their communications better than law-abiding citizens.
- woudsma 5y ago
  That's the weakest of arguments. I don't trust that governments _can_ protect my data better than us nerds. If there is a backdoor, it will only be a matter of time before the criminals get access to it. It would be the holy grail of data. If I were a foreign regime with bad intentions, I would put a lot of resources into getting access to those chats. You could probably ruin anybody's life with access to their personal chats by extorting them, etc. It's going to create a whole new criminal sector. People sifting through other people's personal lives. I'm not implying that these people may have committed an offence, there are many things I don't want anyone else to see other than the person I'm sending the message to. The "law-abiding citizen" / "Only criminals have something to hide" argument is complete bullshit. With access to personal chats you can ruin careers, families, relationships, etc, etc. And what can happen, will -most likely- happen. E2EE prevents that. Edit: Sorry, I misread the parent comment!
  - tortasaur 5y ago
    You misread the parent comment. It didn't say the government could protect data well.
  - hhfss 5y ago
    I'm not sure you understand the argument you're replying to. The grandparent is saying "if you ban E2EE only criminals will have E2EE" It's a variation on "if you ban guns only criminals will have them."
    - SiempreViernes 5y ago
      I think it's a funny argument to make after months of stories about how criminals have extra wide backdoors in their crypto. I guess nobody here saw them?
    - marcus_holmes 5y ago
      > It's a variation on "if you ban guns only criminals will have them." Most countries have banned guns and there are way less problems with guns than those countries that haven't banned guns. Is this an argument for or against the EU proposal?
      - eitland 5y ago
        This is utterly wrong in more than one way: First, "most countries have banned guns": Here, from worldpopulationreview.com is a list of countries that has kind of banned guns (at least made them hard to get): """ Today, we’ll focus on the nations around the world where restrictive policies are in place that make it illegal or extremely difficult for ordinary citizens to own a gun. Those nations are: China - Restricted Eritrea – Banned India – Restricted Indonesia – Restricted Iran – Restricted Japan – Restricted Lebanon – Restricted Malaysia – Restricted North Korea – Banned Singapore – Restricted Taiwan – Restricted Venezuela – Restricted Vietnam – Restricted """ ...and yes by the way, while some of these are OK like Japan and Taiwan you are in some interesting company if your country joins that list. Secondly: "there are way less problems with guns than those countries that haven't banned guns." I give you Norway, Switzerland and Austria as a start. Probably Finland and a number of others as well: All these have and have had loads of actual assault rifles (G3-s, HK416 etc, not semiautomatic AR-15s) complete with non trivial amounts of ammo around in private homes. Yet I'd rather live in any of those instead of any of the ones on the list above. So clearly something else is at play.
- HWR_14 5y ago
  Of the various objections, many of which I agree with, this one is nonsense. If a communications can not be scanned because of E2E encryption, and if E2E encryption is banned, that's evidence of a crime all on it's own. That would have to be a pretty dumb criminal.
  - Tepix 5y ago
    Just because you are using E2E you don't have to make it blatantly obvious. Backdoored E2E (with an added government decryption key) will look just like proper E2E until you attempt to decrypt it. You can also put your secure E2E communications inside backdoored E2E communications. The possibilities are endless.
    - HWR_14 5y ago
      Right, until you analyze it, it won't look encrypted. But pretending or wrapping it in backdoored E2E doesn't change that. If I labeled it "plain text" it also wouldn't look encrypted until the results are analyzed. If the authorities want to read it (either as an individual message or scanning all messages) either they can or you're a criminal. The only difference your "hiding" has is how many CPU cycles it takes them to check.
      - Tepix 5y ago
        It's not black and white. I'm sure you've heard about steganography.
oytis 5y ago
> So if I understand correctly, this will be the end of E2E encryption? No, that is not what the law is about. Nobody in the EU is about to prohibit encryption, in fact some projects rely on it (https://en.wikipedia.org/wiki/EIDAS https://en.wikipedia.org/wiki/EIDAS). The law lifts the prohibition to service providers to indiscriminately scan messages for the specific purpose of scanning for dangerous content. The idea that service providers will not be able to provide E2E encryption is speculative, some people just assume it will follow. In any case relying on proprietary software for secure communication is not a good idea anyway, and you can still do E2E encryption yourself with open source software, nobody is going to come for you if you do. I don't support this law by the way, I think that privacy regulation is a good thing, and it is not a good reason to weaken it.
FabHK 5y ago
(17b) End-to-end encryption is an important tool to guarantee secure and confidential communications of users, including those of children. Any weakening of encryption could potentially be abused by malicious third parties. Nothing in this Regulation should therefore be interpreted as prohibiting or weakening end-to-end encryption. https://www.patrick-breyer.de/wp-content/uploads/2021/05/202105_Chatcontrol_Trilogue_Agreement.pdf https://www.patrick-breyer.de/wp-content/uploads/2021/05/202...

Tepix 5y ago

No. It will mean that criminals can protect their communications better than law-abiding citizens.

woudsma 5y ago
That's the weakest of arguments. I don't trust that governments _can_ protect my data better than us nerds. If there is a backdoor, it will only be a matter of time before the criminals get access to it. It would be the holy grail of data. If I were a foreign regime with bad intentions, I would put a lot of resources into getting access to those chats. You could probably ruin anybody's life with access to their personal chats by extorting them, etc. It's going to create a whole new criminal sector. People sifting through other people's personal lives. I'm not implying that these people may have committed an offence, there are many things I don't want anyone else to see other than the person I'm sending the message to. The "law-abiding citizen" / "Only criminals have something to hide" argument is complete bullshit. With access to personal chats you can ruin careers, families, relationships, etc, etc. And what can happen, will -most likely- happen. E2EE prevents that. Edit: Sorry, I misread the parent comment!
- tortasaur 5y ago
  You misread the parent comment. It didn't say the government could protect data well.
- hhfss 5y ago
  I'm not sure you understand the argument you're replying to. The grandparent is saying "if you ban E2EE only criminals will have E2EE" It's a variation on "if you ban guns only criminals will have them."
  - SiempreViernes 5y ago
    I think it's a funny argument to make after months of stories about how criminals have extra wide backdoors in their crypto. I guess nobody here saw them?
  - marcus_holmes 5y ago
    > It's a variation on "if you ban guns only criminals will have them." Most countries have banned guns and there are way less problems with guns than those countries that haven't banned guns. Is this an argument for or against the EU proposal?
    - eitland 5y ago
      This is utterly wrong in more than one way: First, "most countries have banned guns": Here, from worldpopulationreview.com is a list of countries that has kind of banned guns (at least made them hard to get): """ Today, we’ll focus on the nations around the world where restrictive policies are in place that make it illegal or extremely difficult for ordinary citizens to own a gun. Those nations are: China - Restricted Eritrea – Banned India – Restricted Indonesia – Restricted Iran – Restricted Japan – Restricted Lebanon – Restricted Malaysia – Restricted North Korea – Banned Singapore – Restricted Taiwan – Restricted Venezuela – Restricted Vietnam – Restricted """ ...and yes by the way, while some of these are OK like Japan and Taiwan you are in some interesting company if your country joins that list. Secondly: "there are way less problems with guns than those countries that haven't banned guns." I give you Norway, Switzerland and Austria as a start. Probably Finland and a number of others as well: All these have and have had loads of actual assault rifles (G3-s, HK416 etc, not semiautomatic AR-15s) complete with non trivial amounts of ammo around in private homes. Yet I'd rather live in any of those instead of any of the ones on the list above. So clearly something else is at play.
HWR_14 5y ago
Of the various objections, many of which I agree with, this one is nonsense. If a communications can not be scanned because of E2E encryption, and if E2E encryption is banned, that's evidence of a crime all on it's own. That would have to be a pretty dumb criminal.
- Tepix 5y ago
  Just because you are using E2E you don't have to make it blatantly obvious. Backdoored E2E (with an added government decryption key) will look just like proper E2E until you attempt to decrypt it. You can also put your secure E2E communications inside backdoored E2E communications. The possibilities are endless.
  - HWR_14 5y ago
    Right, until you analyze it, it won't look encrypted. But pretending or wrapping it in backdoored E2E doesn't change that. If I labeled it "plain text" it also wouldn't look encrypted until the results are analyzed. If the authorities want to read it (either as an individual message or scanning all messages) either they can or you're a criminal. The only difference your "hiding" has is how many CPU cycles it takes them to check.
    - Tepix 5y ago
      It's not black and white. I'm sure you've heard about steganography.

oytis 5y ago

> So if I understand correctly, this will be the end of E2E encryption? No, that is not what the law is about. Nobody in the EU is about to prohibit encryption, in fact some projects rely on it (https://en.wikipedia.org/wiki/EIDAS https://en.wikipedia.org/wiki/EIDAS). The law lifts the prohibition to service providers to indiscriminately scan messages for the specific purpose of scanning for dangerous content. The idea that service providers will not be able to provide E2E encryption is speculative, some people just assume it will follow. In any case relying on proprietary software for secure communication is not a good idea anyway, and you can still do E2E encryption yourself with open source software, nobody is going to come for you if you do. I don't support this law by the way, I think that privacy regulation is a good thing, and it is not a good reason to weaken it.

FabHK 5y ago

(17b) End-to-end encryption is an important tool to guarantee secure and confidential communications of users, including those of children. Any weakening of encryption could potentially be abused by malicious third parties. Nothing in this Regulation should therefore be interpreted as prohibiting or weakening end-to-end encryption. https://www.patrick-breyer.de/wp-content/uploads/2021/05/202105_Chatcontrol_Trilogue_Agreement.pdf https://www.patrick-breyer.de/wp-content/uploads/2021/05/202...