3 ms·

> criminals are using E2EE communication systems to share sexual abuse material Blah blah blah, the same old argument given by the "think of the children" peop

> criminals are using E2EE communication systems to share sexual abuse material Blah blah blah, the same old argument given by the "think of the children" people. There are many ways to counter that old chestnut, but really, we only need to remember the most basic fundamental facts: 1) Encryption is mathematics 2) Criminals are criminals Can you ban mathematics ? No. Can you stop criminals being criminals ? No. So, let's imagine you are able to successfully backdoor E2EE globally, on all devices and all platforms. Sure, the "think of the children" people will rejoice and start singing "Hallelujah". And the governments will rub their hands with glee with all the new data they have access to. But the criminals ? Do you honestly think they'll think "oh no, game over" ? No of course not. They'll pay some cryptographer in need of some money to develop a new E2EE tool and carry on. Business as usual.

ben_w 3y ago
> But the criminals ? Do you honestly think they'll think "oh no, game over" ? > No of course not. They'll pay some cryptographer in need of some money to develop a new E2EE tool and carry on. Business as usual. I used to think this, I changed my mind: just as it's difficult to do security correctly even when it's a legal requirement, only the most competent criminal organisations will do this correctly. Unfortunately, the other issue: > And the governments will rub their hands with glee with all the new data they have access to. Is 100% still the case, and almost impossible to get anyone to care about.
- Moldoteck 3y ago
  they can just use/switch to unpatched devices with some opensource e2ee without big effort. Result? Criminals will continue doing criminal stuff, rest of the planet will be under surveillance system that can be altered at govt/company's will without your knowledge to either target specific ppl(from govt) or target groups of ppl(for 'relevant' ads)
  - ben_w 3y ago
    > they can just use/switch to unpatched devices with some opensource e2ee without big effort. Assuming no new zero-days, and that they were even doing best practices in the first place. How many legit companies do best practices?
    - Moldoteck 3y ago
      zero days are irrelevant imo, zero days are for targeted attacks(assuming it's from gov), exploiting all zerodays for all devices is not that productive, csam scan on the other hand can handle both untargeted and targeted surveilance: untargeted by spotting bad actors from a generic csam list, targeted - by adding to that list target's face/specific things to locate it and monitor it. That's the point, bad actors can circumvent the system if they feel threatened, but system can be exploited by gov/companies once rolled out globally to target any user, so we get something that may be not that effective against bad actors but poses great risk to be misused by gov/company in their own interests without users knowing. I've seen how an authoritarian gov in my country is targeting ppl bc they are uncomfortable for the system and this algorithm opens another potential vector of attack.
      - ben_w 3y ago
        I don't buy your argument, but as for: > I've seen how an authoritarian gov in my country is targeting ppl bc they are uncomfortable for the system and this algorithm opens another potential vector of attack. As per my last sentence in my initial comment in this chain: -- > And the governments will rub their hands with glee with all the new data they have access to. Is 100% still the case, and almost impossible to get anyone to care about.
- traceroute66 3y ago
  > only the most competent criminal organisations will do this correctly. All it takes is for one criminal to write a one-page guide to using GPG and circulate it to the group .... I know I mentioned paying a cryptographer earlier, but in reality downloading and using GPG is a crude and effective way of defeating an E2EE backdoor. Are the GPG devs going to backdoor GPG to satisfy governments ? Probably not.
  - ben_w 3y ago
    > All it takes is for one criminal to write a one-page guide to using GPG and circulate it to the group If cybersecurity was that easy, we wouldn't have so many examples of businesses getting it wrong. Just because everyone here can follow instructions like that, doesn't make it common knowledge for anyone else.
    - newscracker 3y ago
      > If cybersecurity was that easy, we wouldn't have so many examples of businesses getting it wrong. I can only partially agree with this point. Businesses getting cybersecurity wrong has almost no material and significant consequences. At best, they get a tiny slap on the wrist or asked to answer some questions. Nobody in said businesses goes to jail for it or personally pays any fines. Compare that to criminals who have a lot more to lose if they get caught — jail time, fines they have to pay, not having freedom for quite sometime, life not being the same after they’ve served their sentence, and more. Businesses have it extremely easy compared to this. No wonder cybersecurity is so poor among all businesses, including very large ones (like Microsoft, as a recent example).
      - ben_w 3y ago
        > jail time, fines they have to pay Fear of these is the reason for the (maliciously compliant) GDPR popups, and that despite discussion about extra-territoriality and relativity limited capacity-to-websites ratio. The law and threats of punishment are clearly not hugely significant to anyone involved in the specific topic of this thread regardless; in the UK at least, it's the kind of thing where if someone is lynched for it, the vigilantes have to be extremely stupid (like attacking a paediatrician because they can't tell the difference, which happened) to not get public sympathy.
danaris 3y ago
> Can you stop criminals being criminals ? No. [Citation needed] This mindset—that assigns people into immutable categories, "criminal" and "not criminal"—is actually one of the biggest things that needs to change. We absolutely can stop criminals from being criminals. We just can't do so by pointing at them and saying "Stop! Bad!" We have to change the incentives, remove the reasons they became criminal in the first place (usually poverty), and make it easier, safer, and more acceptable to go from being a criminal to being a not-criminal again.

ben_w 3y ago

> But the criminals ? Do you honestly think they'll think "oh no, game over" ? > No of course not. They'll pay some cryptographer in need of some money to develop a new E2EE tool and carry on. Business as usual. I used to think this, I changed my mind: just as it's difficult to do security correctly even when it's a legal requirement, only the most competent criminal organisations will do this correctly. Unfortunately, the other issue: > And the governments will rub their hands with glee with all the new data they have access to. Is 100% still the case, and almost impossible to get anyone to care about.

Moldoteck 3y ago
they can just use/switch to unpatched devices with some opensource e2ee without big effort. Result? Criminals will continue doing criminal stuff, rest of the planet will be under surveillance system that can be altered at govt/company's will without your knowledge to either target specific ppl(from govt) or target groups of ppl(for 'relevant' ads)
- ben_w 3y ago
  > they can just use/switch to unpatched devices with some opensource e2ee without big effort. Assuming no new zero-days, and that they were even doing best practices in the first place. How many legit companies do best practices?
  - Moldoteck 3y ago
    zero days are irrelevant imo, zero days are for targeted attacks(assuming it's from gov), exploiting all zerodays for all devices is not that productive, csam scan on the other hand can handle both untargeted and targeted surveilance: untargeted by spotting bad actors from a generic csam list, targeted - by adding to that list target's face/specific things to locate it and monitor it. That's the point, bad actors can circumvent the system if they feel threatened, but system can be exploited by gov/companies once rolled out globally to target any user, so we get something that may be not that effective against bad actors but poses great risk to be misused by gov/company in their own interests without users knowing. I've seen how an authoritarian gov in my country is targeting ppl bc they are uncomfortable for the system and this algorithm opens another potential vector of attack.
    - ben_w 3y ago
      I don't buy your argument, but as for: > I've seen how an authoritarian gov in my country is targeting ppl bc they are uncomfortable for the system and this algorithm opens another potential vector of attack. As per my last sentence in my initial comment in this chain: -- > And the governments will rub their hands with glee with all the new data they have access to. Is 100% still the case, and almost impossible to get anyone to care about.
traceroute66 3y ago
> only the most competent criminal organisations will do this correctly. All it takes is for one criminal to write a one-page guide to using GPG and circulate it to the group .... I know I mentioned paying a cryptographer earlier, but in reality downloading and using GPG is a crude and effective way of defeating an E2EE backdoor. Are the GPG devs going to backdoor GPG to satisfy governments ? Probably not.
- ben_w 3y ago
  > All it takes is for one criminal to write a one-page guide to using GPG and circulate it to the group If cybersecurity was that easy, we wouldn't have so many examples of businesses getting it wrong. Just because everyone here can follow instructions like that, doesn't make it common knowledge for anyone else.
  - newscracker 3y ago
    > If cybersecurity was that easy, we wouldn't have so many examples of businesses getting it wrong. I can only partially agree with this point. Businesses getting cybersecurity wrong has almost no material and significant consequences. At best, they get a tiny slap on the wrist or asked to answer some questions. Nobody in said businesses goes to jail for it or personally pays any fines. Compare that to criminals who have a lot more to lose if they get caught — jail time, fines they have to pay, not having freedom for quite sometime, life not being the same after they’ve served their sentence, and more. Businesses have it extremely easy compared to this. No wonder cybersecurity is so poor among all businesses, including very large ones (like Microsoft, as a recent example).
    - ben_w 3y ago
      > jail time, fines they have to pay Fear of these is the reason for the (maliciously compliant) GDPR popups, and that despite discussion about extra-territoriality and relativity limited capacity-to-websites ratio. The law and threats of punishment are clearly not hugely significant to anyone involved in the specific topic of this thread regardless; in the UK at least, it's the kind of thing where if someone is lynched for it, the vigilantes have to be extremely stupid (like attacking a paediatrician because they can't tell the difference, which happened) to not get public sympathy.

danaris 3y ago

> Can you stop criminals being criminals ? No. [Citation needed] This mindset—that assigns people into immutable categories, "criminal" and "not criminal"—is actually one of the biggest things that needs to change. We absolutely can stop criminals from being criminals. We just can't do so by pointing at them and saying "Stop! Bad!" We have to change the incentives, remove the reasons they became criminal in the first place (usually poverty), and make it easier, safer, and more acceptable to go from being a criminal to being a not-criminal again.