13 ms·

We should separate anti-abuse laws that don't compromise e2e (like Apple's hash matching) and laws that ban e2e. Once we do it we should fight for one against t

We should separate anti-abuse laws that don't compromise e2e (like Apple's hash matching) and laws that ban e2e. Once we do it we should fight for one against the other. If abuse is real and e2e is key to it, taking measures against abuse while keeping e2e is important. Fighting against any measure altogether is immoral

rtkwe 3y ago
What are actual laws you're thinking of that aren't attacks on end to end encryption? All of this is already highly illegal the difficulties are finding and prosecuting the criminals.
- throwaway290 3y ago
  Finding and prosecuting is the point? What made people do it before is mental illness. What makes people do it now more and more is additionally profit. The e2e apps and crypto is what drives their profit. But critically there are ways of keeping e2e without being complicit in crime. Things like Apple's hash matching or requiring all messaging apps to do on device scan are that. Pretending these compromises are unacceptable because they affect your privacy is a nonce move. You routinely compromise your privacy in much bigger ways in order to live in society, every time you are searched at security or present ID for verification etc, but when it comes to doing anything to help victims who unlike you can't even stand up for themselves you are suddenly the unyielding freedom fighter.
  - kelnos 3y ago
    > Things like Apple's hash matching or requiring all messaging apps to do on device scan are that. No thanks. It's bad enough that our devices often play fast and loose with our privacy as it is, but don't want my devices to be violating my privacy in ways where errors can have legal consequences for me. Beyond that, these sorts of systems will always be increased in scope by people who want to abuse them for their own purposes.
    - throwaway290 3y ago
      > No thanks. I was not making a suggestion, I was stating facts.
  - rtkwe 3y ago
    There's no way to have E2E encryption that's strong against government overreach that doesn't also facilitate crime full stop. It's a moral conundrum that anyone interested in preserving privacy is going to have to grapple with in the end, your tools are going to be used by criminals to evade justice no matter how many exceptions or tools you try to include to differentiate between "good guys" and "bad guys". Even things in the neighborhood of Apple's hash and device scans can only detect existing minimally altered images and also fall down to context if they try to detect more general issues like "nude children". We don't even have to get hypothetical about false positives of anti-CSAM measures [0] they're already out there happening. The devices are blind to context and the occurrence of actual CSAM are rare (blessedly) but there's a whole genre of "my kid did something cute in the tub" that look a lot like it without the context to a machine. [0] https://9to5google.com/2022/08/22/google-locked-account-medical-photo-story/ https://9to5google.com/2022/08/22/google-locked-account-medi...
    - throwaway290 3y ago
      > There's no way to have E2E encryption that's strong against government overreach that doesn't also facilitate crime full stop > There's no way to have cash that doesn't also facilitate crime full stop Life is not black and white. You can have freedom enabling technologies like cash but you acquiesce to cash controls, maximum transaction amounts, personal searches if there is reasonable suspicion and so on. Same applies to e2e encryption or anything else. To think otherwise just in this case is a nonce move, you have not refuted my points in the slightest.
      - rtkwe 3y ago
        To do all of those you have to go to the person and perform the search, the law can also go to a person and perform a search of their E2E encrypted files by getting a warrant and requiring them to unlock the devices. Providing a back door in E2E for law enforcement gives them the weakness to search anyone's traffic with or without a warrant, it's also an ambivalent weakness anyone can potentially exploit. Compromises in digital systems for communications are infinitely more abusable than any physical search because they can be performed automatically and at a massive scale, pretending they won't or can be trusted to follow the law is ignoring the 2 decades of evidence we've been given since the Patriot Act allowed mass wiretapping. Do you remember parallel construction? Room 641A? The rubber stamp of the FISA courts?
  - matheusmoreira 3y ago
    We don't have to "pretend". Those compromises are unacceptable.
    - throwaway290 3y ago
      They are perfectly acceptable. In fact if you live in a civilized society I can guarantee you that you accept equivalent compromises in all areas of your life at all times. If it's only in this case that you're up in arms about, that's telling.
      - matheusmoreira 3y ago
        Even when "civilized" society forces such laws on me, I accept nothing. I go out of my way to avoid this stuff. You can guarantee absolutely nothing, you don't know a single thing about me. Take your pedophilia accusations somewhere else, they don't work on me. I'm wise to your strategy.
        throwaway290 3y ago
        "e2e & crypto does not hurt children" is techbro's equivalent of "guns do not kill people". The lower bounds of morality in this industry will never cease to amaze...
        matheusmoreira 3y ago
        Correct. Encryption does not hurt chilren and guns do not kill people. Humans do all that.
  - Brian_K_White 3y ago
    Any tool that is useful, is useful for both good and bad purposes. Any tool that is rendered not useful for bad purposes, has also been rendered not useful for good purposes. There is no such thing as a compromise. It requires pretending (or ignorance) to imagine that there is even any sort of compromise logically or physically possible.
    - throwaway290 3y ago
      > Any tool that is useful, is useful for both good and bad purposes. Exactly. Which means tradeoffs. Like cash enables freedom, it also means that there are measures to reduce its use for bad purposes (including maximum transaction limits, how much you can carry in/out of country, etc) that we all agree to. Like using public transport enables mass killings, it also means there are measures to reduce that (security inspections, etc). Like advances in science and tech enable cool gadgets, they also enable deadly weapons and that's why their export is regulated (sanctions, etc). If you want to have absolute freedom, please go start with those things instead of child abuse. It's top of double standard to agree to compromise when it concerns your personal adult freedom, but not when it concerns innocent and powerless victims. > There is no such thing as a compromise. It requires pretending (or ignorance) to imagine that there is even any sort of compromise logically or physically possible. Dude, it literally does not follow from what you write before this sentence. Any tool that can be used for good can also be used for bad, and there are always compromises in order to restrict its uses for bad.
Analemma_ 3y ago
"Anti-abuse laws that don't compromise e2e" don't exist, the entire concept is impossible ipso facto. Apple's hash matching still requires scanning your plaintext (or plain image, or whatever), which means 1. the "fingerprint" can still be silently updated to look for other things like [the current Power's that Be's definition of] "misinformation", 2. false positives can completely fuck over your life 3. it doesn't even work to prevent CSAM, because there will always be an arms race to improve the anti-fingerprinting measures. The "perceptual hashing" algorithms you've heard about don't actually work at all, they're a lie being pushed by commercial interests. Those three points mean that even message fingerprinting is unacceptable, full stop.
kelnos 3y ago
Or maybe we just accept that some people in the world do bad things, and unfortunately we can't actually catch all of them. Continually eroding more and more security and privacy in our personal effects in return for less crime is not a trade off that any rational person who wants to live in a free society should make. Certainly there can be disagreement as to where the line should be drawn, but even schemes like Apple's hash matching is going too far.
- throwaway290 3y ago
  > Or maybe we just accept that some people in the world do bad things, and unfortunately we can't actually catch all of them. If we don't try, we are complicit in their crime by developing technology they use to fulfil their messed up purposes. Hope you sleep well at night! > Continually eroding more and more security and privacy in our personal effects in return for less crime How about you fight for your privacy and security in other aspects of life that concern yourself first (security checks, cash controls, etc) and then go after victims who cannot stand up for themselves.
_Algernon_ 3y ago
The platonic ideal of end-2-end encryption is that it is encrypted from my brain until it is received in my correspondent's brain. This is obviously not currently feasible. The closest approximation, is having a trusted client. This hashing scheme ruins the "trusted client" and I would no longer consider it e2e. Not to mention that a database of hashes is trivially to expand with content that isn't CSAM. Next thing we know the European equivalent of the Tankman picture is included in the hash to more effectively pursue political opposition or activists. This would destroy all ability to protest and singlehandedly eliminate democracy in Europe. I'm not exagerating. Climate activists in Germany are already put in "präventivhaft"[1] (preventive detention) before a civil disobedience / crime occurs. A scheme such as this would make it trivial to do at massive scales. [1]: https://www.br.de/nachrichten/bayern/staatsregierung-verteidigt-30-tage-haft-fuer-klima-aktivisten,TMaIMEM https://www.br.de/nachrichten/bayern/staatsregierung-verteid...
- viscousviolin 3y ago
  Thirty days of preventive detention is outrageous. Way to go Bavaria.
- throwaway290 3y ago
  Then go ahead and suggest any credible way to combat the modern epidemic of child abuse instead of being like the rest of the thread making excuses for it. Your vocal sheltered armchair maximalism on this topic is not a moral option if you agree to equivalent compromises in all other areas of your life. Either suggest an alternative measure in this case, or show an example and fight against those other compromises (that limit your freedom and privacy) first. After all, many of them only concern yourself and your family rather than countless innocent victims who cannot stand up for themselves. If techies don't suggest any good alternative measure to prevent abuse then someone else will do it in a worse way and then welcome to panopticon. There's no black and white where tech touches human factor so learn to compromise.
  - defrost 3y ago
    > the modern epidemic of child abuse How is there a modern epidemic of child abuse? It's always lurked in the shadows alongside, for example, marriages in 1655 to 14 year old brides ( https://en.wikipedia.org/wiki/Elisabeth_Pepys https://en.wikipedia.org/wiki/Elisabeth_Pepys ). If anything the modern age can be characterised by shining a stronmger light on the subject rather than sweeping it under the carpet.
matheusmoreira 3y ago
> Fighting against any measure altogether is immoral Not at all. I want end-to-end encryption and I want complete control over my computer. I couldn't care less how hard it makes the life of police either. The "measure" is they get the hell out there and do actual real police work instead of pushing a button and having your entire life revealed to them. There's a limit to how many cops they can spare to tail some suspect. There's no limit at all when computers are involved.

rtkwe 3y ago

What are actual laws you're thinking of that aren't attacks on end to end encryption? All of this is already highly illegal the difficulties are finding and prosecuting the criminals.

throwaway290 3y ago
Finding and prosecuting is the point? What made people do it before is mental illness. What makes people do it now more and more is additionally profit. The e2e apps and crypto is what drives their profit. But critically there are ways of keeping e2e without being complicit in crime. Things like Apple's hash matching or requiring all messaging apps to do on device scan are that. Pretending these compromises are unacceptable because they affect your privacy is a nonce move. You routinely compromise your privacy in much bigger ways in order to live in society, every time you are searched at security or present ID for verification etc, but when it comes to doing anything to help victims who unlike you can't even stand up for themselves you are suddenly the unyielding freedom fighter.
- kelnos 3y ago
  > Things like Apple's hash matching or requiring all messaging apps to do on device scan are that. No thanks. It's bad enough that our devices often play fast and loose with our privacy as it is, but don't want my devices to be violating my privacy in ways where errors can have legal consequences for me. Beyond that, these sorts of systems will always be increased in scope by people who want to abuse them for their own purposes.
  - throwaway290 3y ago
    > No thanks. I was not making a suggestion, I was stating facts.
- rtkwe 3y ago
  There's no way to have E2E encryption that's strong against government overreach that doesn't also facilitate crime full stop. It's a moral conundrum that anyone interested in preserving privacy is going to have to grapple with in the end, your tools are going to be used by criminals to evade justice no matter how many exceptions or tools you try to include to differentiate between "good guys" and "bad guys". Even things in the neighborhood of Apple's hash and device scans can only detect existing minimally altered images and also fall down to context if they try to detect more general issues like "nude children". We don't even have to get hypothetical about false positives of anti-CSAM measures [0] they're already out there happening. The devices are blind to context and the occurrence of actual CSAM are rare (blessedly) but there's a whole genre of "my kid did something cute in the tub" that look a lot like it without the context to a machine. [0] https://9to5google.com/2022/08/22/google-locked-account-medical-photo-story/ https://9to5google.com/2022/08/22/google-locked-account-medi...
  - throwaway290 3y ago
    > There's no way to have E2E encryption that's strong against government overreach that doesn't also facilitate crime full stop > There's no way to have cash that doesn't also facilitate crime full stop Life is not black and white. You can have freedom enabling technologies like cash but you acquiesce to cash controls, maximum transaction amounts, personal searches if there is reasonable suspicion and so on. Same applies to e2e encryption or anything else. To think otherwise just in this case is a nonce move, you have not refuted my points in the slightest.
    - rtkwe 3y ago
      To do all of those you have to go to the person and perform the search, the law can also go to a person and perform a search of their E2E encrypted files by getting a warrant and requiring them to unlock the devices. Providing a back door in E2E for law enforcement gives them the weakness to search anyone's traffic with or without a warrant, it's also an ambivalent weakness anyone can potentially exploit. Compromises in digital systems for communications are infinitely more abusable than any physical search because they can be performed automatically and at a massive scale, pretending they won't or can be trusted to follow the law is ignoring the 2 decades of evidence we've been given since the Patriot Act allowed mass wiretapping. Do you remember parallel construction? Room 641A? The rubber stamp of the FISA courts?
- matheusmoreira 3y ago
  We don't have to "pretend". Those compromises are unacceptable.
  - throwaway290 3y ago
    They are perfectly acceptable. In fact if you live in a civilized society I can guarantee you that you accept equivalent compromises in all areas of your life at all times. If it's only in this case that you're up in arms about, that's telling.
    - matheusmoreira 3y ago
      Even when "civilized" society forces such laws on me, I accept nothing. I go out of my way to avoid this stuff. You can guarantee absolutely nothing, you don't know a single thing about me. Take your pedophilia accusations somewhere else, they don't work on me. I'm wise to your strategy.
      - throwaway290 3y ago
        "e2e & crypto does not hurt children" is techbro's equivalent of "guns do not kill people". The lower bounds of morality in this industry will never cease to amaze...
        matheusmoreira 3y ago
        Correct. Encryption does not hurt chilren and guns do not kill people. Humans do all that.
- Brian_K_White 3y ago
  Any tool that is useful, is useful for both good and bad purposes. Any tool that is rendered not useful for bad purposes, has also been rendered not useful for good purposes. There is no such thing as a compromise. It requires pretending (or ignorance) to imagine that there is even any sort of compromise logically or physically possible.
  - throwaway290 3y ago
    > Any tool that is useful, is useful for both good and bad purposes. Exactly. Which means tradeoffs. Like cash enables freedom, it also means that there are measures to reduce its use for bad purposes (including maximum transaction limits, how much you can carry in/out of country, etc) that we all agree to. Like using public transport enables mass killings, it also means there are measures to reduce that (security inspections, etc). Like advances in science and tech enable cool gadgets, they also enable deadly weapons and that's why their export is regulated (sanctions, etc). If you want to have absolute freedom, please go start with those things instead of child abuse. It's top of double standard to agree to compromise when it concerns your personal adult freedom, but not when it concerns innocent and powerless victims. > There is no such thing as a compromise. It requires pretending (or ignorance) to imagine that there is even any sort of compromise logically or physically possible. Dude, it literally does not follow from what you write before this sentence. Any tool that can be used for good can also be used for bad, and there are always compromises in order to restrict its uses for bad.

Analemma_ 3y ago

"Anti-abuse laws that don't compromise e2e" don't exist, the entire concept is impossible ipso facto. Apple's hash matching still requires scanning your plaintext (or plain image, or whatever), which means 1. the "fingerprint" can still be silently updated to look for other things like [the current Power's that Be's definition of] "misinformation", 2. false positives can completely fuck over your life 3. it doesn't even work to prevent CSAM, because there will always be an arms race to improve the anti-fingerprinting measures. The "perceptual hashing" algorithms you've heard about don't actually work at all, they're a lie being pushed by commercial interests. Those three points mean that even message fingerprinting is unacceptable, full stop.

kelnos 3y ago

Or maybe we just accept that some people in the world do bad things, and unfortunately we can't actually catch all of them. Continually eroding more and more security and privacy in our personal effects in return for less crime is not a trade off that any rational person who wants to live in a free society should make. Certainly there can be disagreement as to where the line should be drawn, but even schemes like Apple's hash matching is going too far.

throwaway290 3y ago
> Or maybe we just accept that some people in the world do bad things, and unfortunately we can't actually catch all of them. If we don't try, we are complicit in their crime by developing technology they use to fulfil their messed up purposes. Hope you sleep well at night! > Continually eroding more and more security and privacy in our personal effects in return for less crime How about you fight for your privacy and security in other aspects of life that concern yourself first (security checks, cash controls, etc) and then go after victims who cannot stand up for themselves.

_Algernon_ 3y ago

The platonic ideal of end-2-end encryption is that it is encrypted from my brain until it is received in my correspondent's brain. This is obviously not currently feasible. The closest approximation, is having a trusted client. This hashing scheme ruins the "trusted client" and I would no longer consider it e2e. Not to mention that a database of hashes is trivially to expand with content that isn't CSAM. Next thing we know the European equivalent of the Tankman picture is included in the hash to more effectively pursue political opposition or activists. This would destroy all ability to protest and singlehandedly eliminate democracy in Europe. I'm not exagerating. Climate activists in Germany are already put in "präventivhaft"[1] (preventive detention) before a civil disobedience / crime occurs. A scheme such as this would make it trivial to do at massive scales. [1]: https://www.br.de/nachrichten/bayern/staatsregierung-verteidigt-30-tage-haft-fuer-klima-aktivisten,TMaIMEM https://www.br.de/nachrichten/bayern/staatsregierung-verteid...

viscousviolin 3y ago
Thirty days of preventive detention is outrageous. Way to go Bavaria.
throwaway290 3y ago
Then go ahead and suggest any credible way to combat the modern epidemic of child abuse instead of being like the rest of the thread making excuses for it. Your vocal sheltered armchair maximalism on this topic is not a moral option if you agree to equivalent compromises in all other areas of your life. Either suggest an alternative measure in this case, or show an example and fight against those other compromises (that limit your freedom and privacy) first. After all, many of them only concern yourself and your family rather than countless innocent victims who cannot stand up for themselves. If techies don't suggest any good alternative measure to prevent abuse then someone else will do it in a worse way and then welcome to panopticon. There's no black and white where tech touches human factor so learn to compromise.
- defrost 3y ago
  > the modern epidemic of child abuse How is there a modern epidemic of child abuse? It's always lurked in the shadows alongside, for example, marriages in 1655 to 14 year old brides ( https://en.wikipedia.org/wiki/Elisabeth_Pepys https://en.wikipedia.org/wiki/Elisabeth_Pepys ). If anything the modern age can be characterised by shining a stronmger light on the subject rather than sweeping it under the carpet.

matheusmoreira 3y ago

> Fighting against any measure altogether is immoral Not at all. I want end-to-end encryption and I want complete control over my computer. I couldn't care less how hard it makes the life of police either. The "measure" is they get the hell out there and do actual real police work instead of pushing a button and having your entire life revealed to them. There's a limit to how many cops they can spare to tail some suspect. There's no limit at all when computers are involved.