4 ms·

Without end-to-end encryption, one doesn't need to break into anyones servers. Thats sort of the point. Without encryption, you are weak at every packet, whic

Without end-to-end encryption, one doesn't need to break into anyones servers. Thats sort of the point. Without encryption, you are weak at every packet, which can be intercepted anywhere between you and Facebooks servers.

owlbite 5y ago
End-to-end encryption != no encryption. It's seems they're quite happy as long as authorized parties (adtech, intelligence agencies, etc) can man-in-the-middle the thing. Of course, tech companies never get breached and are exceptionally good at protecting our emails, passwords, credit reference data, and sensitive internal emails of political parties and campaigns, so there's clearly no risk whatsoever of your messages getting published on the internet in the future.
socksy 5y ago
No end-to-end encryption does not mean no encryption. For example, Telegram does not use end-to-end encryption by default, however they encrypt all the messages with keys distributed across their servers. Anyone inspecting the packets won't be able to understand what's going on, but Telegram are able to read all your messages.
- tomxor 5y ago
  This is a good point. Actually on closer inspection they don't even particularly care about E2E encryption, and here I was thinking this was snooper's charter v2: > We are not opposed to end-to-encryption in principle and fully support the importance of strong user privacy. Instead, our campaign is calling for social media companies to work with us to find a solution that protects privacy, without putting children at even greater risk. So we missed the point. This is a campaign to protect kids from shitty parenting, aa, I mean the social networks... so that they can be safely indoctrinated by social media without needing to encourage a responsible society. In all seriousness, the larger risk here then is not necessarily criminal activity from data leaks (though that's still a real possibility with a gov backdoor) - the greater risk is deeper government mass surveillance built directly into the most popular social media networks.
mgoetzke 5y ago
I don't think they argue against all encryption (Do they?). Basically everything would become an encrypted group chat (Double Ratchet etc) where the 3rd party is the provider which can optionally encrypt/secure access. That would ensure the provider is the only one with a backdoor for some time until access to previous messages are lost. Similar to loosing decryption keys for GDPR compliance. Access to the keys would require a court order. Nonetheless authoritarian governments could and would misuse this. It should at least be required to have an international court order. Still very difficult.
rocqua 5y ago
The result of these campaigns if successful, would likely be key-escrow rather than banning encryption. With that the risk of criminal abuse is negligible. Instead the risks are added complexity creating opportunities for bugs, and having to trust everyone with decryption access to not abuse that. It is possible to control that access technologically. For example, by requiring two separate keyholders (or in general N ot of M) keyholders before being able to decrypt any messages. Those downsides matter, but they are scary for abuse by governments, nation state adversaries, and NSA type hackers. The downsides do not make criminals more scary.
- danShumway 5y ago
  > The downsides do not make criminals more scary. Eh, I'm not sure. Assuming that the government keys never get leaked (which is possible even with the key-split method you propose). And assuming that the local municipal police departments and groups given access to those keys never get hacked. And assuming that products never get restricted to less-secure schemes as the technical world evolves around them. Maybe the UK has a better track record on this, but off the top of my head a lot of the key-escrow systems I've seen in the US are quite bad. We have systems for TSA locks, fireperson access to locked buildings, etc... many of those systems are not secure, they just don't get abused very often because the prizes for doing so aren't large enough. Key-escrow systems are less risky in terms of criminal activity than just banning full E2E encryption entirely, but I don't think I agree that 'less risky' is the same as 'safe'.

owlbite 5y ago

End-to-end encryption != no encryption. It's seems they're quite happy as long as authorized parties (adtech, intelligence agencies, etc) can man-in-the-middle the thing. Of course, tech companies never get breached and are exceptionally good at protecting our emails, passwords, credit reference data, and sensitive internal emails of political parties and campaigns, so there's clearly no risk whatsoever of your messages getting published on the internet in the future.

socksy 5y ago

No end-to-end encryption does not mean no encryption. For example, Telegram does not use end-to-end encryption by default, however they encrypt all the messages with keys distributed across their servers. Anyone inspecting the packets won't be able to understand what's going on, but Telegram are able to read all your messages.

tomxor 5y ago
This is a good point. Actually on closer inspection they don't even particularly care about E2E encryption, and here I was thinking this was snooper's charter v2: > We are not opposed to end-to-encryption in principle and fully support the importance of strong user privacy. Instead, our campaign is calling for social media companies to work with us to find a solution that protects privacy, without putting children at even greater risk. So we missed the point. This is a campaign to protect kids from shitty parenting, aa, I mean the social networks... so that they can be safely indoctrinated by social media without needing to encourage a responsible society. In all seriousness, the larger risk here then is not necessarily criminal activity from data leaks (though that's still a real possibility with a gov backdoor) - the greater risk is deeper government mass surveillance built directly into the most popular social media networks.

mgoetzke 5y ago

I don't think they argue against all encryption (Do they?). Basically everything would become an encrypted group chat (Double Ratchet etc) where the 3rd party is the provider which can optionally encrypt/secure access. That would ensure the provider is the only one with a backdoor for some time until access to previous messages are lost. Similar to loosing decryption keys for GDPR compliance. Access to the keys would require a court order. Nonetheless authoritarian governments could and would misuse this. It should at least be required to have an international court order. Still very difficult.

rocqua 5y ago

The result of these campaigns if successful, would likely be key-escrow rather than banning encryption. With that the risk of criminal abuse is negligible. Instead the risks are added complexity creating opportunities for bugs, and having to trust everyone with decryption access to not abuse that. It is possible to control that access technologically. For example, by requiring two separate keyholders (or in general N ot of M) keyholders before being able to decrypt any messages. Those downsides matter, but they are scary for abuse by governments, nation state adversaries, and NSA type hackers. The downsides do not make criminals more scary.

danShumway 5y ago
> The downsides do not make criminals more scary. Eh, I'm not sure. Assuming that the government keys never get leaked (which is possible even with the key-split method you propose). And assuming that the local municipal police departments and groups given access to those keys never get hacked. And assuming that products never get restricted to less-secure schemes as the technical world evolves around them. Maybe the UK has a better track record on this, but off the top of my head a lot of the key-escrow systems I've seen in the US are quite bad. We have systems for TSA locks, fireperson access to locked buildings, etc... many of those systems are not secure, they just don't get abused very often because the prizes for doing so aren't large enough. Key-escrow systems are less risky in terms of criminal activity than just banning full E2E encryption entirely, but I don't think I agree that 'less risky' is the same as 'safe'.