7 ms·

The coming war on end-to-end encryption

145 points by EGreg 4y ago

cracked-behem 4y ago
Nice! I worked on something that seems similar to this (https://redact.ws https://redact.ws). Unfortunately there are a lot of challenges with adoption that seem difficult to overcome. One of the big challenges is that most people do not understand the nuances of privacy and encryption, and they aren't willing to jump through hoops to protect their data.
- pcthrowaway 4y ago
  This is fascinating, I was thinking about doing something in a similar space. Does past tense "worked" mean you're not still working on it?
  - cracked-behem 4y ago
    Not actively. It's open source so feel free to poke around our code and docs, and you can find a contact form on the site as well if you want to chat.
- EGreg 4y ago
  I like the intent of this! My main question is, how do we know redact.ws won't suddenly serve different Javascript one day, to certain clients, which send unencrypted payloads somewhere?
  - cracked-behem 4y ago
    The redact server is an open source application that runs locally on the client.
    - EGreg 4y ago
      How does a server run on the client? It runs on localhost! Right? It can show the user their own info back to them in iframes?
      - pcthrowaway 4y ago
        I'm not the creator of redact, but it sounds like you're under the impression that the iframe src is redact.ws in which case I'd understand your concern. My assumption is that the iframe src would be the local redact server, which would keep things as secure as the package the user installed (though there could be compromises at the network level I suppose)
        cracked-behem 4y ago
        Exactly. This section on the website should explain it with some more detail: https://redact.ws/how-it-works#client https://redact.ws/how-it-works#client
WorldPeas 4y ago
This would be really great if there were an integration for dart/flutter. The fact that the API is implemented with such elderly stacks is kind of concerning
- EGreg 4y ago
  That’s an interesting point. I’m the chief architect of the company so I can speak to this, and happy to discuss / explore alternatives. But keep in mind we don’t have deep pockets, it took me 10 years of scraping by and paying my developers who have their families to support, just to get this far! (If you like mwhat we do and you’re thinking of supporting us with $100 or more, feel free here: https://wefunder.com/Qbix https://wefunder.com/Qbix) Wordpress powers 40% of all websites in the world. It’s written in PHP. Facebook has chosen PHP as well and has helped PHP to new heights of performance. PHP 8 with Swoole or simply AmPHP now outperforms Node.js for instance, in terms of efficiency. But plain old PHP code through php-fpm with enough instances can approach 50% of that with no custom coding. PHP is the most widely deployed runtime for Web2 hosting, and EVM is the most widely deployed runtime for Web3 smart contracts. We always strived to target the most widely supported platforms, so people could find many hosts, or set up their own easily. We will be carefully building out https://qbix.com/ecosystem https://qbix.com/ecosystem to support hosting in a variety of environments, including with poor and nonexistent internet on commodity computers and wifi mesh networks. We work with groups that range from the Rohingya Project to the Forward Party. We often need high-speed low-latency multimedia to be available locally, eg for educational purposes or planning a dinner. So why not go with a rock-solid, tried and true platform, and maintain backward compatibility? We purposely avoid even the latest ECMAScript or PHP 8 syntax, to make sure that Qbix can run anywhere, same as Wordpress. PS: Just like Discourse (another open source project we have integrated with and whose community we are friends with) our entire platform can be used as a headless REST API, so nothing is stopping you from building a front end for it in Flutter or React Native or the newest kid on the block: MAUI from Microsoft. We bet the company on HTML like Zuckerberg did in 2014 and we stuck with it. You don’t need to even install an app these days — just go to a site like https://intercoin.app https://intercoin.app or https://yang2020.app https://yang2020.app and use it. Put it on your home screen to get notifications in iOS 16. Use a ContactPicker to invite friends privately. Having said that, we do support Cordova natively out of the box. Sometimes the old ways are best :)
EGreg 4y ago
If anyone is wondering what a solution can look like, which can strike a balance between privacy and social good, the end of the article links to another one: https://community.qbix.com/t/balancing-privacy-and-accountability/215 https://community.qbix.com/t/balancing-privacy-and-accountab...
UpToTheSky 4y ago
Is the world becoming more and more Orwellian? Is this a long term trend? It got pretty much unnoticed on HN, that Europe recently voted to make all crypto payments illegal unless the seller collects the personal data of the buyer. Independent of the amount. So there will be a track record of everything bought via crypto. Is it only a matter of time until cash is going away globally, and states have access to everything their people buy? Regarding end-2-end encryption: It does not prevent a government from reading your messages anyhow. They could instruct Meta (or whichever company is in control of the app you use) to send them the the messages you write directly from your phone. Or from the phone of the receiver. Or to send them the private key from your phone. They could also ask Apple or Google to do so, since those have acceess to everything on your phone.
- notch898c 4y ago
  [flagged]
  - nomel 4y ago
    I think it would be much more likely that a startup comes along and makes the transaction tracking efficient, like with a trusted payment app, than finding some way around Orwellian government motives.
  - JPws_Prntr_Fngr 4y ago
    Sufficiently advanced satire? Or genuine proposal? Either way, I like it.
    - notch898c 4y ago
      [flagged]
- normaler 4y ago
  If I buy crypto and posess it in my own wallet afterwards I can usw it however. Atleast with monero.
Karellen 4y ago
The thing I don't get is... won't bans on end-to-end encryption ban https? If I go to a website and ask for a web page over https, isn't the request and response between my device and the web server, an end-to-end encrypted message? Because the endpoints are my device and the web server. If I can't send my credit card details to a payment provider over an end-to-end encrypted channel, doesn't all commerce on the web just fall apart? How can a ban on end-to-end encrypted communication even fucking work?
- evronm 4y ago
  Really short answer: They want back doors to all this stuff, including your cc info. As long as only the "good guys have" this ability, what could go wrong?
- EGreg 4y ago
  Well, HTTPS is not end-to-end. That latter term is reserved for encryption that encrypts the messages between clients so servers can’t parse them. When you have a centralized system like ICANN DNS, the governments know which IP addresses the domain points to. They can go and serve them National Security Letters or shake them down to install secret backdoors. WhatsApp and Facebook can lie to you that they’re end-to-end encrypted. There is nothing stopping them from shipping custom updates. In facg they’ve been caught red-handed spying on both your video and audio. The only way you can be SURE an app isnt lying to you is with open source software, then you only have to trust the OS and browser (the Trusted Computing Base). (That is why I am a big fan of blockchain-based smart contaracts. But blockchains are slow, so the next best thing is hosting your business logic using open source software on servers you control.) Why do so many people trust Big Tech? Simple. We have no other choice! Where are the VIABLE AND USER FRIENDLY open source alternatives to Facebook, Twitter, Telegram backends? No one seems to have built anything better or more efficient than, say, Mastodon. Except us. It was a labor of love and cost me a million dollars to date: https://github.com/Qbix/Platform https://github.com/Qbix/Platform PS: If you play with it for a afternoon, post your experience or email me. I would be thrilled to hear about your experience, good or bad. And of course use it for anything you want. I would be very happy to be proven wrong and see some more competitors being mentioned here, but if you do, make an honest assessment of how they compare! People need alternatives to the closed walled gardens, but having all these features working and up-to-date with browser tech is extremely hard: https://qbix.com/features.pdf https://qbix.com/features.pdf
webdoodle 4y ago
The coming war? It's been a protracted war since the 1980's. The NSA and the FBI have been hazing, threatening, infiltrating, and backdooring end-to-end encryption since the early days of PGP.
- ranger_danger 4y ago
  > backdooring Name one attempt besides Dual_EC_DRBG. Also could you explain why that one took NIST 8 years to say "don't use it".
  - LinuxBender 4y ago
    There are already legal backdoors not actually referred to as that legally and they are used by corporations to meet their regulatory requirements for things like DLP. Google for example supports this. HTTPS doesn't even matter, their site supports DLP appliances logging in and intercepting all corporate interactions on the platform. The same capabilities exist for non corporate but that is used by law enforcement. This exists on all major platforms. This would play into E2EE if the servers create and manage the client E2EE keys which I believe is the case currently on all platforms that support E2EE. I am told that implementing client side libraries like OTR is too hard or too much friction. So what I am saying is that encryption need not be compromised when all corporations willingly create lawful intercept and DLP API's. To get more information on this have your company reach out to each platform for DLP integrations.
    - ranger_danger 4y ago
      What does this have to do with anything?
atomicbeanie 4y ago
Any dumbing down of end-to-end encryption will hand Russia and China nuclear powered hacking tools for our economy, infrastructure and digital integrity. With near peer wars ongoing, I would relegate this stuff to a noise filter. The US DoD cannot afford encryption to be dumbed down. And they seem to understand that. These initiatives will always exist because there will always be people that do not understand what encryption is and what it provides. But lots of smart people understand the consequences would be catastrophic, and rapid. We cannot eliminate dumb politically-motivated ideas.
EGreg 4y ago
Author here. Happy to see this went viral. I have spent 12 years and 1 million dollars to date (no exaggeration, I worked jobs, architected trained / paid my developer team for years, we are now good friends) on a project to hopefully help people get a viable alternative to the Big Tech, and have choice where to host the infrastructure they typically expect from Facebook, Twitter, Telegram etc. It’s open source and it’s the only way you can make it expensive to backdoor everyone in bulk, or shut down a platform altogether: https://github.com/Qbix/Platform https://github.com/Qbix/Platform If you spend an afternoon playing with, I think you’ll feel like you’re discovering superpowers (like Batman or Iron man or something). It’s free to use. We’re launching https://qbix.com/ecosystem https://qbix.com/ecosystem soon, with courses and certification so anyone who wants to learn, click on my profile and email me. Here is the philosophy behind why we built it: https://qbix.com/blog/2021/01/15/open-source-communities/ https://qbix.com/blog/2021/01/15/open-source-communities/ And if you like what we do and you’re thinking of supporting us with $100 or more, feel free to do it here… November 5 we are launching, until then you can voluntarily put a “no-obligation” contribution: https://wefunder.com/Qbix https://wefunder.com/Qbix
lisper 4y ago
Eight years ago I took a whack at building a fully open source end-to-end encryption system. This is what I came up with at the time: https://github.com/Spark-Innovations/SC4 https://github.com/Spark-Innovations/SC4 It's a bit dated at this point. It doesn't have a ratchet. I did implement one, but never got around to integrating it: https://github.com/rongarret/ratchet-js https://github.com/rongarret/ratchet-js I also had an MVP iOS app which was never launched. The reason I gave up on the project was that no one seemed to be interested. I spent several years looking for customers and collaborators and basically found nothing. The conclusion I came to is that a lot of people complain about the impending end of E2EE but very few people are actually willing to do anything about it except whine.
- bdominy 4y ago
  I agree that people generally don't concern themselves too much with how their information is protected. Most people simply assume that it already is or that they can't really do much about it without giving up a lot of convenience. However, I have noticed in specific cases, people do pay attention. In my case, I'm protecting contact information while sharing with others and most people think it is a great use of e2ee.
- rt4mn 4y ago
  > The conclusion I came to is that a lot of people complain about the impending end of E2EE but very few people are actually willing to do anything about it except whine. The connection between E2EE and privacy is to ephemeral to make that kind of judgment. If you live in the united states or similar country with a strong rule of law, the idea of paying for or using a specific E2EE app is functionally like asking somone to pay for free speech. And even if it was more clear, privacy is like free speech in that you cant really measure enthusiasm for it in that way. Free speech and privacy are fundimental values that people dont want to pay for (for good reason!). But that does not mean they dont care. People really do care about these things. And many many people will change how they vote and how they engage in civic action based on these principals. But asking someone to change how they live/communicate with others requires more then an intelectual "which party / candidate should I vote for?" kind of thing. For most people you need emotional investment for someone to overcome switching costs based on nothing but ethical / political principal. As long as the harm to losing these core rights remains abstract you wont be to measure how much they care with metrics like that. Its a value that is too ephemeral and disconnected from day-to-day life to measure with a stick like "who will use this app". But people can and do donate to groups like the EFF, and vote with their actual votes on this stuff. People really do care. Just like how people really do care about honesty, free speech, candor, trust, and other values of that sort. its just, you know, hard to measure.
anthk 4y ago
-Delayed personal comms: EMail+GPG -Realtime chat: Tox. You have it for Android at F-droid and Qtox for PC/Linux/Mac. -Delayed 1-to-many comms: NNTP+I2PD -Realtime, 1-to-many comms: IRC+I2PD
musicale 4y ago
How is this coming war on e2e encryption different from similar wars since the 1990s? [1,2] [1] "Doomed to repeat history? Lessons from the Crypto Wars of the 1990s", https://www.jstor.org/stable/resrep10502 https://www.jstor.org/stable/resrep10502 [2] https://en.wikipedia.org/wiki/Crypto_Wars https://en.wikipedia.org/wiki/Crypto_Wars

145 points by EGreg 4y ago

Nice! I worked on something that seems similar to this (https://redact.ws https://redact.ws). Unfortunately there are a lot of challenges with adoption that seem difficult to overcome. One of the big challenges is that most people do not understand the nuances of privacy and encryption, and they aren't willing to jump through hoops to protect their data.

pcthrowaway 4y ago
This is fascinating, I was thinking about doing something in a similar space. Does past tense "worked" mean you're not still working on it?
- cracked-behem 4y ago
  Not actively. It's open source so feel free to poke around our code and docs, and you can find a contact form on the site as well if you want to chat.
EGreg 4y ago
I like the intent of this! My main question is, how do we know redact.ws won't suddenly serve different Javascript one day, to certain clients, which send unencrypted payloads somewhere?
- cracked-behem 4y ago
  The redact server is an open source application that runs locally on the client.
  - EGreg 4y ago
    How does a server run on the client? It runs on localhost! Right? It can show the user their own info back to them in iframes?
    - pcthrowaway 4y ago
      I'm not the creator of redact, but it sounds like you're under the impression that the iframe src is redact.ws in which case I'd understand your concern. My assumption is that the iframe src would be the local redact server, which would keep things as secure as the package the user installed (though there could be compromises at the network level I suppose)
      - cracked-behem 4y ago
        Exactly. This section on the website should explain it with some more detail: https://redact.ws/how-it-works#client https://redact.ws/how-it-works#client

WorldPeas 4y ago

This would be really great if there were an integration for dart/flutter. The fact that the API is implemented with such elderly stacks is kind of concerning

EGreg 4y ago
That’s an interesting point. I’m the chief architect of the company so I can speak to this, and happy to discuss / explore alternatives. But keep in mind we don’t have deep pockets, it took me 10 years of scraping by and paying my developers who have their families to support, just to get this far! (If you like mwhat we do and you’re thinking of supporting us with $100 or more, feel free here: https://wefunder.com/Qbix https://wefunder.com/Qbix) Wordpress powers 40% of all websites in the world. It’s written in PHP. Facebook has chosen PHP as well and has helped PHP to new heights of performance. PHP 8 with Swoole or simply AmPHP now outperforms Node.js for instance, in terms of efficiency. But plain old PHP code through php-fpm with enough instances can approach 50% of that with no custom coding. PHP is the most widely deployed runtime for Web2 hosting, and EVM is the most widely deployed runtime for Web3 smart contracts. We always strived to target the most widely supported platforms, so people could find many hosts, or set up their own easily. We will be carefully building out https://qbix.com/ecosystem https://qbix.com/ecosystem to support hosting in a variety of environments, including with poor and nonexistent internet on commodity computers and wifi mesh networks. We work with groups that range from the Rohingya Project to the Forward Party. We often need high-speed low-latency multimedia to be available locally, eg for educational purposes or planning a dinner. So why not go with a rock-solid, tried and true platform, and maintain backward compatibility? We purposely avoid even the latest ECMAScript or PHP 8 syntax, to make sure that Qbix can run anywhere, same as Wordpress. PS: Just like Discourse (another open source project we have integrated with and whose community we are friends with) our entire platform can be used as a headless REST API, so nothing is stopping you from building a front end for it in Flutter or React Native or the newest kid on the block: MAUI from Microsoft. We bet the company on HTML like Zuckerberg did in 2014 and we stuck with it. You don’t need to even install an app these days — just go to a site like https://intercoin.app https://intercoin.app or https://yang2020.app https://yang2020.app and use it. Put it on your home screen to get notifications in iOS 16. Use a ContactPicker to invite friends privately. Having said that, we do support Cordova natively out of the box. Sometimes the old ways are best :)

EGreg 4y ago

If anyone is wondering what a solution can look like, which can strike a balance between privacy and social good, the end of the article links to another one: https://community.qbix.com/t/balancing-privacy-and-accountability/215 https://community.qbix.com/t/balancing-privacy-and-accountab...

UpToTheSky 4y ago

Is the world becoming more and more Orwellian? Is this a long term trend? It got pretty much unnoticed on HN, that Europe recently voted to make all crypto payments illegal unless the seller collects the personal data of the buyer. Independent of the amount. So there will be a track record of everything bought via crypto. Is it only a matter of time until cash is going away globally, and states have access to everything their people buy? Regarding end-2-end encryption: It does not prevent a government from reading your messages anyhow. They could instruct Meta (or whichever company is in control of the app you use) to send them the the messages you write directly from your phone. Or from the phone of the receiver. Or to send them the private key from your phone. They could also ask Apple or Google to do so, since those have acceess to everything on your phone.

notch898c 4y ago
[flagged]
- nomel 4y ago
  I think it would be much more likely that a startup comes along and makes the transaction tracking efficient, like with a trusted payment app, than finding some way around Orwellian government motives.
- JPws_Prntr_Fngr 4y ago
  Sufficiently advanced satire? Or genuine proposal? Either way, I like it.
  - notch898c 4y ago
    [flagged]
normaler 4y ago
If I buy crypto and posess it in my own wallet afterwards I can usw it however. Atleast with monero.

Karellen 4y ago

The thing I don't get is... won't bans on end-to-end encryption ban https? If I go to a website and ask for a web page over https, isn't the request and response between my device and the web server, an end-to-end encrypted message? Because the endpoints are my device and the web server. If I can't send my credit card details to a payment provider over an end-to-end encrypted channel, doesn't all commerce on the web just fall apart? How can a ban on end-to-end encrypted communication even fucking work?

evronm 4y ago
Really short answer: They want back doors to all this stuff, including your cc info. As long as only the "good guys have" this ability, what could go wrong?
EGreg 4y ago
Well, HTTPS is not end-to-end. That latter term is reserved for encryption that encrypts the messages between clients so servers can’t parse them. When you have a centralized system like ICANN DNS, the governments know which IP addresses the domain points to. They can go and serve them National Security Letters or shake them down to install secret backdoors. WhatsApp and Facebook can lie to you that they’re end-to-end encrypted. There is nothing stopping them from shipping custom updates. In facg they’ve been caught red-handed spying on both your video and audio. The only way you can be SURE an app isnt lying to you is with open source software, then you only have to trust the OS and browser (the Trusted Computing Base). (That is why I am a big fan of blockchain-based smart contaracts. But blockchains are slow, so the next best thing is hosting your business logic using open source software on servers you control.) Why do so many people trust Big Tech? Simple. We have no other choice! Where are the VIABLE AND USER FRIENDLY open source alternatives to Facebook, Twitter, Telegram backends? No one seems to have built anything better or more efficient than, say, Mastodon. Except us. It was a labor of love and cost me a million dollars to date: https://github.com/Qbix/Platform https://github.com/Qbix/Platform PS: If you play with it for a afternoon, post your experience or email me. I would be thrilled to hear about your experience, good or bad. And of course use it for anything you want. I would be very happy to be proven wrong and see some more competitors being mentioned here, but if you do, make an honest assessment of how they compare! People need alternatives to the closed walled gardens, but having all these features working and up-to-date with browser tech is extremely hard: https://qbix.com/features.pdf https://qbix.com/features.pdf

webdoodle 4y ago

The coming war? It's been a protracted war since the 1980's. The NSA and the FBI have been hazing, threatening, infiltrating, and backdooring end-to-end encryption since the early days of PGP.

ranger_danger 4y ago
> backdooring Name one attempt besides Dual_EC_DRBG. Also could you explain why that one took NIST 8 years to say "don't use it".
- LinuxBender 4y ago
  There are already legal backdoors not actually referred to as that legally and they are used by corporations to meet their regulatory requirements for things like DLP. Google for example supports this. HTTPS doesn't even matter, their site supports DLP appliances logging in and intercepting all corporate interactions on the platform. The same capabilities exist for non corporate but that is used by law enforcement. This exists on all major platforms. This would play into E2EE if the servers create and manage the client E2EE keys which I believe is the case currently on all platforms that support E2EE. I am told that implementing client side libraries like OTR is too hard or too much friction. So what I am saying is that encryption need not be compromised when all corporations willingly create lawful intercept and DLP API's. To get more information on this have your company reach out to each platform for DLP integrations.
  - ranger_danger 4y ago
    What does this have to do with anything?

atomicbeanie 4y ago

Any dumbing down of end-to-end encryption will hand Russia and China nuclear powered hacking tools for our economy, infrastructure and digital integrity. With near peer wars ongoing, I would relegate this stuff to a noise filter. The US DoD cannot afford encryption to be dumbed down. And they seem to understand that. These initiatives will always exist because there will always be people that do not understand what encryption is and what it provides. But lots of smart people understand the consequences would be catastrophic, and rapid. We cannot eliminate dumb politically-motivated ideas.

EGreg 4y ago

Author here. Happy to see this went viral. I have spent 12 years and 1 million dollars to date (no exaggeration, I worked jobs, architected trained / paid my developer team for years, we are now good friends) on a project to hopefully help people get a viable alternative to the Big Tech, and have choice where to host the infrastructure they typically expect from Facebook, Twitter, Telegram etc. It’s open source and it’s the only way you can make it expensive to backdoor everyone in bulk, or shut down a platform altogether: https://github.com/Qbix/Platform https://github.com/Qbix/Platform If you spend an afternoon playing with, I think you’ll feel like you’re discovering superpowers (like Batman or Iron man or something). It’s free to use. We’re launching https://qbix.com/ecosystem https://qbix.com/ecosystem soon, with courses and certification so anyone who wants to learn, click on my profile and email me. Here is the philosophy behind why we built it: https://qbix.com/blog/2021/01/15/open-source-communities/ https://qbix.com/blog/2021/01/15/open-source-communities/ And if you like what we do and you’re thinking of supporting us with $100 or more, feel free to do it here… November 5 we are launching, until then you can voluntarily put a “no-obligation” contribution: https://wefunder.com/Qbix https://wefunder.com/Qbix

lisper 4y ago

Eight years ago I took a whack at building a fully open source end-to-end encryption system. This is what I came up with at the time: https://github.com/Spark-Innovations/SC4 https://github.com/Spark-Innovations/SC4 It's a bit dated at this point. It doesn't have a ratchet. I did implement one, but never got around to integrating it: https://github.com/rongarret/ratchet-js https://github.com/rongarret/ratchet-js I also had an MVP iOS app which was never launched. The reason I gave up on the project was that no one seemed to be interested. I spent several years looking for customers and collaborators and basically found nothing. The conclusion I came to is that a lot of people complain about the impending end of E2EE but very few people are actually willing to do anything about it except whine.

bdominy 4y ago
I agree that people generally don't concern themselves too much with how their information is protected. Most people simply assume that it already is or that they can't really do much about it without giving up a lot of convenience. However, I have noticed in specific cases, people do pay attention. In my case, I'm protecting contact information while sharing with others and most people think it is a great use of e2ee.
rt4mn 4y ago
> The conclusion I came to is that a lot of people complain about the impending end of E2EE but very few people are actually willing to do anything about it except whine. The connection between E2EE and privacy is to ephemeral to make that kind of judgment. If you live in the united states or similar country with a strong rule of law, the idea of paying for or using a specific E2EE app is functionally like asking somone to pay for free speech. And even if it was more clear, privacy is like free speech in that you cant really measure enthusiasm for it in that way. Free speech and privacy are fundimental values that people dont want to pay for (for good reason!). But that does not mean they dont care. People really do care about these things. And many many people will change how they vote and how they engage in civic action based on these principals. But asking someone to change how they live/communicate with others requires more then an intelectual "which party / candidate should I vote for?" kind of thing. For most people you need emotional investment for someone to overcome switching costs based on nothing but ethical / political principal. As long as the harm to losing these core rights remains abstract you wont be to measure how much they care with metrics like that. Its a value that is too ephemeral and disconnected from day-to-day life to measure with a stick like "who will use this app". But people can and do donate to groups like the EFF, and vote with their actual votes on this stuff. People really do care. Just like how people really do care about honesty, free speech, candor, trust, and other values of that sort. its just, you know, hard to measure.

anthk 4y ago

-Delayed personal comms: EMail+GPG -Realtime chat: Tox. You have it for Android at F-droid and Qtox for PC/Linux/Mac. -Delayed 1-to-many comms: NNTP+I2PD -Realtime, 1-to-many comms: IRC+I2PD

musicale 4y ago

How is this coming war on e2e encryption different from similar wars since the 1990s? [1,2] [1] "Doomed to repeat history? Lessons from the Crypto Wars of the 1990s", https://www.jstor.org/stable/resrep10502 https://www.jstor.org/stable/resrep10502 [2] https://en.wikipedia.org/wiki/Crypto_Wars https://en.wikipedia.org/wiki/Crypto_Wars