6 ms·

Global Encryption Day: Encryption's Critical Role in Safeguarding Human Rights

195 points by gslin 3y ago

markx2 3y ago
But think of the children!! 'Technology companies currently use encryption positively to keep your bank transactions and online purchases safe and secure. Encryption has many other uses throughout everyday life, but some social media companies such as Meta are proposing to implement or already have implemented E2EE in private messaging spaces. E2EE overrides current controls in place that help to keep children safe and potentially poses a huge risk." https://www.gov.uk/government/publications/end-to-end-encryption-and-child-safety/end-to-end-encryption-and-child-safety https://www.gov.uk/government/publications/end-to-end-encryp...
- deleted 3y ago
  [deleted]
- nonrandomstring 3y ago
  > E2EE overrides current controls in place There are no controls in place. This line is becoming quite a pattern in UK (Tory) government rhetoric. They forcefully state wishful thinking as if it were a fact. There are no controls because there is no possibility of controls, as a matter of mathematics. But by exploiting ignorance, the tories managed to beast parliament into an intractable "just imagine if..." clause in the Online Safety Bill... a law that provisionally exists if and only if the impossible becomes possible. And then they sit back, fold their arms and call those "controls". Controls must be effective, otherwise they're just buttons for show, that aren't wired to anything. The reason nation states are losing ground to BigTech is because they are using 18th century power politics to fight 21st century logic. I do wish my government would go take some basic CS and cryptography classes.
  - deleted 3y ago
    [deleted]
  - XorNot 3y ago
    The better answer though is that it's a misdirect: they're pointing at encryption as the bad guy, the one thing which takes place solely in the digital space and is activity-agnostic - nothing which happens with encrypted bits, by itself, can do anything in the real world. "Pedophiles and terrorists" on the other hand, have to do a lot of things in the physical world in order to actually be pedophiles and terrorists. And the vast majority of work taking them down is infiltration - which is to say, nobody breaks encryption, they break trust - which is much easier, and has side-benefits like "generating actual evidence".
    - BLKNSLVR 3y ago
      This "real world" link is missed (intentionally by politicians) by a majority of people because the Internet has become "the great solution". It scales, we can stay seated at our desks and still (claim to) solve crime. Electronic communications are merely 'theory' to the physical world's 'reality'. It's like the phrase "no plan survives contact with the enemy". The Internet only contains the symptoms. If you want to know where there are real problems that need solving in this arena, speak to some teachers - but no, children's services remain under-funded and under-staffed whilst we spend more and more on internet surveillance. Social problems can not be solved by technology legislation.
  - schoen 3y ago
    > There are no controls because there is no possibility of controls, as a matter of mathematics. This is kind of true because, for example, the one-time pad is information-theoretically secure, and anyone could choose to use a one-time pad with anyone else given prior arrangements. Or anyone could choose to use RSA for confidentiality with anyone else given a mutual desire to communicate confidentially and an authentic but not confidential channel. However, there's nothing mathematically stopping a government from punishing people who are observed to follow a protocol to create a confidential channel. Although Eben Moglen has argued that the right to speak PGP is the right to speak Navajo, a government could conceivably choose to punish people for speaking a foreign language. One might wish (I would certainly wish) that people would be extremely upset by this, but I guess it wouldn't contravene mathematics. In fact, there are some historic cases where populations were subject to official military censorship in wartime, which included overt government review of some of their communications, and possibly a prohibition on the use of "codes", and sometimes restrictions on the use of foreign languages. One might again wish that this would be both much less acceptable and much less feasible now than in the past, but it's not completely impossible.
    - nonrandomstring 3y ago
      > there are some historic cases where populations were subject to official military censorship in wartime, That's fine, and those may have been legitimate needs at the time. Overcoming the Nazis meant stilling loose lips. But are we at war? I mean officially according to UN declarations? And if we are not at war, or in an official state of emergency and official censorship re-emerges we need a rethink. So long as decent people acknowledge that we are under illegitimate censorship accordant with a tyrannical/fascist regime, then they must reposition with respect to resistance and toppling that regime. What's problematic for me (and everybody else here I think) is the double-think - a widespread belief that we remain in a liberal democracy while in reality de-facto censorship has snuck in.
  - barrysteve 3y ago
    Nation States are one of Big Tech's best customers. Nation States love to give legal and regulatory incentives as 'guidelines'. It's the average joe that loses. The only way out is privacy from both nations and corporations. If another person knows your technology exists, it will be inexorably wrenched from your hands and controlled by the biggest bully in town. We see it every single day.
bdominy 3y ago
"By offering end-to-end encryption they can give power back to the users and simultaneously simplify their regulatory burden." This is exactly why I use e2ee in my app. I sleep better knowing that the keys to the castle are not solely in my hands, but rather with each user. They will always have a say in how their data is used because they ultimately control access.
Metus 3y ago
One of the largest holes in encrypted communication is still the fact that the vast majority of email is still neither digitally signed, nor encrypted. And even if they are, the usual schemes do not encrypt the subject line. I wish there was something like Let's encrypt but for email. Just make it trivial to sign and encrypt your mail. Also, mail clients should give a huge warning for unencrypted and/or unsigned mail, just like browsers do with web sites. Right now, at least on Outlook for macOS, you only get a happy green padlock on signed email, if you ever receive one.
- alwayslikethis 3y ago
  I agree with the sentiment, but I question how useful this would really be. Most people nowadays unfortunately use web clients, so the keys are going to have to be stored somewhere else, since backing up a browser's local storage is no easy task. If you don't have sole access to keys, but rather the keys are controlled by the same entities that control your email, I don't think there will be any benefit.
  - Metus 3y ago
    I have similar doubts as well. Especially considering that digital signatures and encryption do not protect against impersonation attacks, like phishing via facebok.com or other similar sounding domains, in either the case of websites or email. But without widespread use you don't even have the option.
  - americanriver 3y ago
    There are plenty of email users on IMAP, and they use web mail to host mail storage. The IMAP clients can do S/MIME (or PGP I suppose). The bigger problem is trustworthy user discovery service i.e. a directory to exchange public keys. This exists at an enterprise level (active directory) but not globally.
    - 3c6bYDXLMj 3y ago
      Usually anyone that buys into the viability of PGP email will also tell me with a straight face that the MIT keyserver is completely appropriate for civilians.
hgjjugtyh 3y ago
[flagged]
hgjjugtyh 3y ago
[flagged]
controversiview 3y ago
And for hiding the activities of pedophiles and terrorists. Encryption isn't solely beneficial to human rights, it enables considerable harm to be shielded from scrutiny. There has to be a balance with the extent to which applications of encryption are permitted in society.
- haolez 3y ago
  Without encryption, the pedophiles and terrorists have access to your communication as well. Not a very bright world.
- techbrovanguard 3y ago
  you aren’t very bright, are you?
  - sampli 3y ago
    Based on their username, I assume they play devils advocate
- BLKNSLVR 3y ago
  Cars, guns, knives, sharp sticks, rocks, language, religion, belief, opinion, cigarettes, sugar, bad parenting, divorce, marriage. Ban 'em all! Humanity's evils pre-date technology, therefore banning technology will not remove them. I'd also go on to say that many of the examples I've listed above have more to do with the creation of both terrorists and pedophiles, by a very wide margin, than encryption. Problems that are hard to solve inevitably have scapegoat solutions thrown at them.
  - userbinator 3y ago
    Ban 'em all! Sadly, I have already observed that exact opinion strongly advocated for on here for several of the things on that list.
- tjpnz 3y ago
  Without encryption pedophiles have access to your family photos. One innocent photograph of a toddler bathing could become the gratification of a sex criminal.
wbl 3y ago
Shouldn't global encryption day be on April 18?
userbinator 3y ago
Given encryption's increasingly critical role in taking control away from users, I've become more skeptical of such proclamations in the past few years. Governments are against encryption, because it takes power away from them. Yet on the other side, there's Big Tech who will use encryption for things like Secure Boot and continued locking-down of "devices" (they don't even want you to think it's a general-purpose computer) against users, ostensibly for "security". Thus I believe their reasons to oppose the government's opposition to encryption are not truly in the interests of the users, but because it gives them the power instead. Encryption is classified as a munition, because that's what it fundmentally is; everyone would probably agree that it's better to have a gun yourself, instead of one pointed at you. I don't know of a simple solution to this problem. I'm just offering a critical alternative viewpoint to the "encryption = good" and "encryption = bad" sides.

195 points by gslin 3y ago

But think of the children!! 'Technology companies currently use encryption positively to keep your bank transactions and online purchases safe and secure. Encryption has many other uses throughout everyday life, but some social media companies such as Meta are proposing to implement or already have implemented E2EE in private messaging spaces. E2EE overrides current controls in place that help to keep children safe and potentially poses a huge risk." https://www.gov.uk/government/publications/end-to-end-encryption-and-child-safety/end-to-end-encryption-and-child-safety https://www.gov.uk/government/publications/end-to-end-encryp...

deleted 3y ago
[deleted]
nonrandomstring 3y ago
> E2EE overrides current controls in place There are no controls in place. This line is becoming quite a pattern in UK (Tory) government rhetoric. They forcefully state wishful thinking as if it were a fact. There are no controls because there is no possibility of controls, as a matter of mathematics. But by exploiting ignorance, the tories managed to beast parliament into an intractable "just imagine if..." clause in the Online Safety Bill... a law that provisionally exists if and only if the impossible becomes possible. And then they sit back, fold their arms and call those "controls". Controls must be effective, otherwise they're just buttons for show, that aren't wired to anything. The reason nation states are losing ground to BigTech is because they are using 18th century power politics to fight 21st century logic. I do wish my government would go take some basic CS and cryptography classes.
- deleted 3y ago
  [deleted]
- XorNot 3y ago
  The better answer though is that it's a misdirect: they're pointing at encryption as the bad guy, the one thing which takes place solely in the digital space and is activity-agnostic - nothing which happens with encrypted bits, by itself, can do anything in the real world. "Pedophiles and terrorists" on the other hand, have to do a lot of things in the physical world in order to actually be pedophiles and terrorists. And the vast majority of work taking them down is infiltration - which is to say, nobody breaks encryption, they break trust - which is much easier, and has side-benefits like "generating actual evidence".
  - BLKNSLVR 3y ago
    This "real world" link is missed (intentionally by politicians) by a majority of people because the Internet has become "the great solution". It scales, we can stay seated at our desks and still (claim to) solve crime. Electronic communications are merely 'theory' to the physical world's 'reality'. It's like the phrase "no plan survives contact with the enemy". The Internet only contains the symptoms. If you want to know where there are real problems that need solving in this arena, speak to some teachers - but no, children's services remain under-funded and under-staffed whilst we spend more and more on internet surveillance. Social problems can not be solved by technology legislation.
- schoen 3y ago
  > There are no controls because there is no possibility of controls, as a matter of mathematics. This is kind of true because, for example, the one-time pad is information-theoretically secure, and anyone could choose to use a one-time pad with anyone else given prior arrangements. Or anyone could choose to use RSA for confidentiality with anyone else given a mutual desire to communicate confidentially and an authentic but not confidential channel. However, there's nothing mathematically stopping a government from punishing people who are observed to follow a protocol to create a confidential channel. Although Eben Moglen has argued that the right to speak PGP is the right to speak Navajo, a government could conceivably choose to punish people for speaking a foreign language. One might wish (I would certainly wish) that people would be extremely upset by this, but I guess it wouldn't contravene mathematics. In fact, there are some historic cases where populations were subject to official military censorship in wartime, which included overt government review of some of their communications, and possibly a prohibition on the use of "codes", and sometimes restrictions on the use of foreign languages. One might again wish that this would be both much less acceptable and much less feasible now than in the past, but it's not completely impossible.
  - nonrandomstring 3y ago
    > there are some historic cases where populations were subject to official military censorship in wartime, That's fine, and those may have been legitimate needs at the time. Overcoming the Nazis meant stilling loose lips. But are we at war? I mean officially according to UN declarations? And if we are not at war, or in an official state of emergency and official censorship re-emerges we need a rethink. So long as decent people acknowledge that we are under illegitimate censorship accordant with a tyrannical/fascist regime, then they must reposition with respect to resistance and toppling that regime. What's problematic for me (and everybody else here I think) is the double-think - a widespread belief that we remain in a liberal democracy while in reality de-facto censorship has snuck in.
- barrysteve 3y ago
  Nation States are one of Big Tech's best customers. Nation States love to give legal and regulatory incentives as 'guidelines'. It's the average joe that loses. The only way out is privacy from both nations and corporations. If another person knows your technology exists, it will be inexorably wrenched from your hands and controlled by the biggest bully in town. We see it every single day.

bdominy 3y ago

"By offering end-to-end encryption they can give power back to the users and simultaneously simplify their regulatory burden." This is exactly why I use e2ee in my app. I sleep better knowing that the keys to the castle are not solely in my hands, but rather with each user. They will always have a say in how their data is used because they ultimately control access.

Metus 3y ago

One of the largest holes in encrypted communication is still the fact that the vast majority of email is still neither digitally signed, nor encrypted. And even if they are, the usual schemes do not encrypt the subject line. I wish there was something like Let's encrypt but for email. Just make it trivial to sign and encrypt your mail. Also, mail clients should give a huge warning for unencrypted and/or unsigned mail, just like browsers do with web sites. Right now, at least on Outlook for macOS, you only get a happy green padlock on signed email, if you ever receive one.

alwayslikethis 3y ago
I agree with the sentiment, but I question how useful this would really be. Most people nowadays unfortunately use web clients, so the keys are going to have to be stored somewhere else, since backing up a browser's local storage is no easy task. If you don't have sole access to keys, but rather the keys are controlled by the same entities that control your email, I don't think there will be any benefit.
- Metus 3y ago
  I have similar doubts as well. Especially considering that digital signatures and encryption do not protect against impersonation attacks, like phishing via facebok.com or other similar sounding domains, in either the case of websites or email. But without widespread use you don't even have the option.
- americanriver 3y ago
  There are plenty of email users on IMAP, and they use web mail to host mail storage. The IMAP clients can do S/MIME (or PGP I suppose). The bigger problem is trustworthy user discovery service i.e. a directory to exchange public keys. This exists at an enterprise level (active directory) but not globally.
  - 3c6bYDXLMj 3y ago
    Usually anyone that buys into the viability of PGP email will also tell me with a straight face that the MIT keyserver is completely appropriate for civilians.

hgjjugtyh 3y ago

[flagged]

hgjjugtyh 3y ago

[flagged]

controversiview 3y ago

And for hiding the activities of pedophiles and terrorists. Encryption isn't solely beneficial to human rights, it enables considerable harm to be shielded from scrutiny. There has to be a balance with the extent to which applications of encryption are permitted in society.

haolez 3y ago
Without encryption, the pedophiles and terrorists have access to your communication as well. Not a very bright world.
techbrovanguard 3y ago
you aren’t very bright, are you?
- sampli 3y ago
  Based on their username, I assume they play devils advocate
BLKNSLVR 3y ago
Cars, guns, knives, sharp sticks, rocks, language, religion, belief, opinion, cigarettes, sugar, bad parenting, divorce, marriage. Ban 'em all! Humanity's evils pre-date technology, therefore banning technology will not remove them. I'd also go on to say that many of the examples I've listed above have more to do with the creation of both terrorists and pedophiles, by a very wide margin, than encryption. Problems that are hard to solve inevitably have scapegoat solutions thrown at them.
- userbinator 3y ago
  Ban 'em all! Sadly, I have already observed that exact opinion strongly advocated for on here for several of the things on that list.
tjpnz 3y ago
Without encryption pedophiles have access to your family photos. One innocent photograph of a toddler bathing could become the gratification of a sex criminal.

wbl 3y ago

Shouldn't global encryption day be on April 18?

userbinator 3y ago

Given encryption's increasingly critical role in taking control away from users, I've become more skeptical of such proclamations in the past few years. Governments are against encryption, because it takes power away from them. Yet on the other side, there's Big Tech who will use encryption for things like Secure Boot and continued locking-down of "devices" (they don't even want you to think it's a general-purpose computer) against users, ostensibly for "security". Thus I believe their reasons to oppose the government's opposition to encryption are not truly in the interests of the users, but because it gives them the power instead. Encryption is classified as a munition, because that's what it fundmentally is; everyone would probably agree that it's better to have a gun yourself, instead of one pointed at you. I don't know of a simple solution to this problem. I'm just offering a critical alternative viewpoint to the "encryption = good" and "encryption = bad" sides.