2 ms·

> I wish people would argue in good faith in these types of discussions about responsible use of encryption. You are assuming people are not arguing in good fa

> I wish people would argue in good faith in these types of discussions about responsible use of encryption. You are assuming people are not arguing in good faith. That is, in itself, a kind of bad-faith arguing, suggesting that people who disagree with you simply don't understand and would change their minds if they did. In good faith, and with understanding and acceptance of potential consequences, I will continue to say that using encryption is always responsible, the responsible use of encryption is "yes, always", and any two or more (or one or more) people have the right to keep communications exclusively and nigh-unbreakably between themselves. My answer to that will not change, regardless of the people communicating or the content of the communication. If you want the contents of that communication, get it from one of the people communicating. > No one is arguing that we should remove E2EE between you and your bank. Many people are arguing that; I've seen people say that it wouldn't matter for the purposes of securing financial transactions if the government has access.

charcircuit 5y ago
>Many people are arguing that By removing encryption you leave the connection open to man in the middle attacks. That is something neither side wants. >securing financial transactions if the government has access This is just adding another person (end) who can decrypt the message. It's still E2EE. >You are assuming people are not arguing in good faith They are at least arguing from a point of misunderstanding what the other side wants or what is possible to satisfy the other side's needs. There exist plenty of people who think that allowing the government to decrypt messages between two people using a chat app when they have a warrant would require a plaintext copy of the message stored on the chat app's company's servers.
- JoshTriplett 5y ago
  > By removing encryption People regularly suggest breaking the encryption between you and your bank, not removing it. Breaking it is worse, because it lets people think they're getting the expected properties of encryption but they're not. (Also, I get the impression that there's a certain subset of one side who would unthinkingly say "sure, remove it, if that's the price we'd have to pay to get rid of XYZ".) In general, it's not societally feasible to have real encryption that's only usable for certain purposes, and fake encryption with backdoors that's usable for other purposes. There's no "special web" that's only used by banks and "important things", and that's a good thing. As far as I can tell, most of the people suggesting backdoored encryption are suggesting that banks and the rest of the web would use it too. > This is just adding another person (end) who can decrypt the message. It's still E2EE. You know exactly what people are expecting when they say "end to end encryption", and it is emphatically not that. If you'd like to argue in good faith, don't try to redefine terms other people are using in good faith, or make people use contract-level precision to define them adversarially. People should not have to explicitly say "end to end with only the ends that are mutually desired by both parties" and a dozen other caveats just to guard against such misinterpretations. > They are at least arguing from a point of misunderstanding what the other side wants or what is possible to satisfy the other side's needs. That's still giving too little credit to what you see as "the other side". Even if there's no plaintext sitting around on a server, and even if the backdoor doesn't inevitably have its keys misused or stolen, and even if all the theoretically possible but unlikely things that proponents of backdoors would like to suggest are true, I am still arguing that people can and should use real encryption without backdoors, and have actually private communication as they see fit. > what is possible to satisfy the other side's needs It's appropriate to use any and all valid counterarguments to dismantle an argument at every layer, not just the weakest set of counterarguments that might possibly refute the other side. That includes the "this won't actually solve the problems you wish it would solve" considerations, and the practical implementation considerations, and the requirements-based considerations, all of which apply independently. All of those arguments are important, and different arguments may convince different people. But it's absolutely possible to argue purely at a requirements level, in terms of what's possible to satisfy the other side's needs. That alone is sufficient to show that the two sides don't have common ground. It seems like the fundamental crux of the argument from "the other side" demands some form of backdoor mechanism that provides third-party access to otherwise private communications, and won't settle for anything less. Regardless of implementation considerations, and regardless of what you might think that would prevent, anything satisfying that property is unacceptable. If there something other than that, some lesser thing that does not compromise private communication and the use of real encryption, that would satisfy "the other side", then that'd be incredibly valuable to know, but I've seen no evidence of people on "the other side" accepting anything less, only evidence of people being talked out of this demand and people not yet talked out of this demand. Conversely, I'm happy to get down to the crux of my own position, at a "what is possible" level: actual private communication, with no backdoors, no less than that will suffice. Private communication and real functioning encryption is a massive societal good. People arguing in good faith aren't ignoring the bad things the other side presents (apart from refuting whether backdoors would actually help), they're just saying "nope, even if that were true that doesn't outweigh the massive societal good".

charcircuit 5y ago

>Many people are arguing that By removing encryption you leave the connection open to man in the middle attacks. That is something neither side wants. >securing financial transactions if the government has access This is just adding another person (end) who can decrypt the message. It's still E2EE. >You are assuming people are not arguing in good faith They are at least arguing from a point of misunderstanding what the other side wants or what is possible to satisfy the other side's needs. There exist plenty of people who think that allowing the government to decrypt messages between two people using a chat app when they have a warrant would require a plaintext copy of the message stored on the chat app's company's servers.

JoshTriplett 5y ago
> By removing encryption People regularly suggest breaking the encryption between you and your bank, not removing it. Breaking it is worse, because it lets people think they're getting the expected properties of encryption but they're not. (Also, I get the impression that there's a certain subset of one side who would unthinkingly say "sure, remove it, if that's the price we'd have to pay to get rid of XYZ".) In general, it's not societally feasible to have real encryption that's only usable for certain purposes, and fake encryption with backdoors that's usable for other purposes. There's no "special web" that's only used by banks and "important things", and that's a good thing. As far as I can tell, most of the people suggesting backdoored encryption are suggesting that banks and the rest of the web would use it too. > This is just adding another person (end) who can decrypt the message. It's still E2EE. You know exactly what people are expecting when they say "end to end encryption", and it is emphatically not that. If you'd like to argue in good faith, don't try to redefine terms other people are using in good faith, or make people use contract-level precision to define them adversarially. People should not have to explicitly say "end to end with only the ends that are mutually desired by both parties" and a dozen other caveats just to guard against such misinterpretations. > They are at least arguing from a point of misunderstanding what the other side wants or what is possible to satisfy the other side's needs. That's still giving too little credit to what you see as "the other side". Even if there's no plaintext sitting around on a server, and even if the backdoor doesn't inevitably have its keys misused or stolen, and even if all the theoretically possible but unlikely things that proponents of backdoors would like to suggest are true, I am still arguing that people can and should use real encryption without backdoors, and have actually private communication as they see fit. > what is possible to satisfy the other side's needs It's appropriate to use any and all valid counterarguments to dismantle an argument at every layer, not just the weakest set of counterarguments that might possibly refute the other side. That includes the "this won't actually solve the problems you wish it would solve" considerations, and the practical implementation considerations, and the requirements-based considerations, all of which apply independently. All of those arguments are important, and different arguments may convince different people. But it's absolutely possible to argue purely at a requirements level, in terms of what's possible to satisfy the other side's needs. That alone is sufficient to show that the two sides don't have common ground. It seems like the fundamental crux of the argument from "the other side" demands some form of backdoor mechanism that provides third-party access to otherwise private communications, and won't settle for anything less. Regardless of implementation considerations, and regardless of what you might think that would prevent, anything satisfying that property is unacceptable. If there something other than that, some lesser thing that does not compromise private communication and the use of real encryption, that would satisfy "the other side", then that'd be incredibly valuable to know, but I've seen no evidence of people on "the other side" accepting anything less, only evidence of people being talked out of this demand and people not yet talked out of this demand. Conversely, I'm happy to get down to the crux of my own position, at a "what is possible" level: actual private communication, with no backdoors, no less than that will suffice. Private communication and real functioning encryption is a massive societal good. People arguing in good faith aren't ignoring the bad things the other side presents (apart from refuting whether backdoors would actually help), they're just saying "nope, even if that were true that doesn't outweigh the massive societal good".