5 ms·

Because client-side scanning is not going to work, and no one wants to government issued black box binary to send their conversations and photos to unnamed poli

Because client-side scanning is not going to work, and no one wants to government issued black box binary to send their conversations and photos to unnamed police person randomly, the non-compliance is the only way. People just start to use chat programs in the EU that do not comply. This would be Signal, Telegram, others. The EU can fine and fight with Meta/WhatsApp, Apple, others, but that’s about it. The EU bureaucrats do not have power to magically insert spyware in our devices as long as we can install our own software. … which of course means we know what’s going to come next.

miohtama 3y ago
Also do not miss the recent good article about the US software development companies who are behind the lobbying of client-side scanning, how is this madness is being funded and by whom. https://balkaninsight.com/2023/09/25/who-benefits-inside-the-eus-fight-over-scanning-for-child-sex-content/ https://balkaninsight.com/2023/09/25/who-benefits-inside-the...
- robertlagrant 3y ago
  Thanks - interesting. Phrases like this are eternally surprising: > The same month, UK officials privately admitted to tech companies that there is no existing technology able to scan end-to-end encrypted messages without undermining users’ privacy It's as though this is a secret that UK officials knew. Everyone technically minded knows this; it's a battle between those who regulate (the difficulty of whose job generally stops at "write down the rule and fine people if they don't do it") and those who know about current fundamental limitations.
  - seanhunter 3y ago
    Remember this is the same UK government that at one stage back in 2020 was proposing that there could be borderless customs enforcement between Ireland and Northern Ireland (part of the uk) "using drones". Because everyone knows drones do that. I don't think they consider themselves limited by things technology is actually capable of when talking about what they are going to get technology to do.
- uconnectlol 3y ago
  cloudflare also comes to mind, as they proudly do whatever they can in their power to check off that CSAM box as long as it makes them money somehow.
Sayrus 3y ago
And by next you mean in parallel. Spinning E2E encryption as a tool used only by bad actors is very common and pushing browsers to implement governments managed blacklists seems quite in progress. Banning VPNs from social networks (and more) was even suggested in France but quickly removed due to backlash.
pmontra 3y ago
Governments will mandate by law that the OS do client side scanning by peeping inside the app directories. Apple, Google, Microsoft will comply and realistically, which phones and computers are we going to use if we don't buy from them? Desktop Linux might become illegal.
- miohtama 3y ago
  Yes, the EU is already working to make this illegal https://mullvad.net/en/blog/2023/2/1/eu-chat-control-law-will-ban-open-source-operating-systems/ https://mullvad.net/en/blog/2023/2/1/eu-chat-control-law-wil... The best bet is Android fork based on Android open source distribution, without Google.
- SV_BubbleTime 3y ago
  Right. Per program makes people use different programs. Per OS, ok, maybe people will use a different OS (finally! Year of the Linux desktop!) … ok, we’ll just roll it into the three companies making GPUs. Driver binary side scanning. Maybe hardware frame buffer scanning? All is this is framed around children, but you are an absolute clown if you think that is truly the end goal. It’s always “for the children”.
OfSanguineFire 3y ago
Signal advises its users to install the app from the Play Store. While you can still get the .apk from Signal’s website, the developers warn against that. The EU can definitely exert pressure against what is hosted on the Play Store. Telegram famously lacks end-to-end encryption (unless you intentionally use its private-chat feature, which few people do) and shouldn’t be mentioned in the same context as Signal.
- kzrdude 3y ago
  If you enable private chat, you don't get notifications for new messages, that way the feature is self defeating, it seems to me at least. (Something could also have gone wrong?)
  - CuriousCosmic 3y ago
    Notifications generally go through Google Firebase so by not running private messages through firebase they avoid potential leaks. At least that's my guess
    - kzrdude 3y ago
      That sounds pretty bad, a cloud service needs to see all notifications?
      - miohtama 3y ago
        A good question. I am not sure if notifications on iOS, Android, Google Chrome or Firefox are end-to-end encrypted.
        nickphx 3y ago
        You can send whatever values you desire as long as your service worker handles it.
      - kube-system 3y ago
deleted 3y ago
[deleted]
jacksnipe 3y ago
At the moment, it is perfectly possible for e2ee to be compliant.
reisse 3y ago
> The EU bureaucrats do not have power to magically insert spyware in our devices as long as we can install our own software. EU bureaucrats have power to force ISPs to block connections to the messengers that would not comply, Chinese-style. They already do block websites they don't like - e. g. in Cyprus local provider CYTA shown me "access blocked due to EU comission regulation #whatever" for most of the Russian media sites.
JopV 3y ago
The EU is trying to make it mandatory to allow sideloading. This is bad, but also the opposite of what you are saying.
deleted 3y ago
[deleted]

miohtama 3y ago

Also do not miss the recent good article about the US software development companies who are behind the lobbying of client-side scanning, how is this madness is being funded and by whom. https://balkaninsight.com/2023/09/25/who-benefits-inside-the-eus-fight-over-scanning-for-child-sex-content/ https://balkaninsight.com/2023/09/25/who-benefits-inside-the...

robertlagrant 3y ago
Thanks - interesting. Phrases like this are eternally surprising: > The same month, UK officials privately admitted to tech companies that there is no existing technology able to scan end-to-end encrypted messages without undermining users’ privacy It's as though this is a secret that UK officials knew. Everyone technically minded knows this; it's a battle between those who regulate (the difficulty of whose job generally stops at "write down the rule and fine people if they don't do it") and those who know about current fundamental limitations.
- seanhunter 3y ago
  Remember this is the same UK government that at one stage back in 2020 was proposing that there could be borderless customs enforcement between Ireland and Northern Ireland (part of the uk) "using drones". Because everyone knows drones do that. I don't think they consider themselves limited by things technology is actually capable of when talking about what they are going to get technology to do.
uconnectlol 3y ago
cloudflare also comes to mind, as they proudly do whatever they can in their power to check off that CSAM box as long as it makes them money somehow.

Sayrus 3y ago

And by next you mean in parallel. Spinning E2E encryption as a tool used only by bad actors is very common and pushing browsers to implement governments managed blacklists seems quite in progress. Banning VPNs from social networks (and more) was even suggested in France but quickly removed due to backlash.

pmontra 3y ago

Governments will mandate by law that the OS do client side scanning by peeping inside the app directories. Apple, Google, Microsoft will comply and realistically, which phones and computers are we going to use if we don't buy from them? Desktop Linux might become illegal.

miohtama 3y ago
Yes, the EU is already working to make this illegal https://mullvad.net/en/blog/2023/2/1/eu-chat-control-law-will-ban-open-source-operating-systems/ https://mullvad.net/en/blog/2023/2/1/eu-chat-control-law-wil... The best bet is Android fork based on Android open source distribution, without Google.
SV_BubbleTime 3y ago
Right. Per program makes people use different programs. Per OS, ok, maybe people will use a different OS (finally! Year of the Linux desktop!) … ok, we’ll just roll it into the three companies making GPUs. Driver binary side scanning. Maybe hardware frame buffer scanning? All is this is framed around children, but you are an absolute clown if you think that is truly the end goal. It’s always “for the children”.

OfSanguineFire 3y ago

Signal advises its users to install the app from the Play Store. While you can still get the .apk from Signal’s website, the developers warn against that. The EU can definitely exert pressure against what is hosted on the Play Store. Telegram famously lacks end-to-end encryption (unless you intentionally use its private-chat feature, which few people do) and shouldn’t be mentioned in the same context as Signal.

kzrdude 3y ago
If you enable private chat, you don't get notifications for new messages, that way the feature is self defeating, it seems to me at least. (Something could also have gone wrong?)
- CuriousCosmic 3y ago
  Notifications generally go through Google Firebase so by not running private messages through firebase they avoid potential leaks. At least that's my guess
  - kzrdude 3y ago
    That sounds pretty bad, a cloud service needs to see all notifications?
    - miohtama 3y ago
      A good question. I am not sure if notifications on iOS, Android, Google Chrome or Firefox are end-to-end encrypted.
      - nickphx 3y ago
        You can send whatever values you desire as long as your service worker handles it.
    - kube-system 3y ago

deleted 3y ago

[deleted]

jacksnipe 3y ago

At the moment, it is perfectly possible for e2ee to be compliant.

reisse 3y ago

> The EU bureaucrats do not have power to magically insert spyware in our devices as long as we can install our own software. EU bureaucrats have power to force ISPs to block connections to the messengers that would not comply, Chinese-style. They already do block websites they don't like - e. g. in Cyprus local provider CYTA shown me "access blocked due to EU comission regulation #whatever" for most of the Russian media sites.

JopV 3y ago

The EU is trying to make it mandatory to allow sideloading. This is bad, but also the opposite of what you are saying.

deleted 3y ago

[deleted]