4 ms·

This isn't a good thing. It's a step towards regulating the kinds of encryption required to market software in the EU. Once there are rules on the kinds of enc

This isn't a good thing. It's a step towards regulating the kinds of encryption required to market software in the EU. Once there are rules on the kinds of encryption that must be used, then a backdoored algorithm can be required by law. We want companies to choose the cryptographic algorithms based on what is recommended by experts in the field. The experts in cryptography inform software engineers, who implement the algorithms where they work. They pass on good software recommendations to family members and friends who ask. That leads to a world where everyone is using Signal, or a competent competitor. The chain of trust is organic and legitimate all the way from the user to the person that told them to use signal, to the domain expert that said signal uses solid cryptography to the cryptographers designing the algorithms. If you want privacy you have to create demand for it. Markets can satisfy demand, legislating supply creates excess unwanted things (like backdoored algorithms).

braiamp 3y ago
What in the article motivates you to write such comment? The only thing that this court rules does is to reaffirm the right of privacy, and that non-broken encryption is one of the guarantees that citizens have to obtain the right. > The court praised end-to-end encryption generally, noting that it “appears to help citizens and businesses to defend themselves against abuses of information technologies, such as hacking, identity and personal data theft, fraud and the improper disclosure of confidential information.”
pas 3y ago
We regret to inform you but we have run out of pure good things. (Also pure bad things too, so yeey?) It's a step, but precedent is (was) already established (US export controls on crypto), and regulations can take two steps at once. (It's not a nice discrete process.) And yes, of course, it's a trade off. Mandating strong encryption and sane security (no preset password in IoT/other devices), and the usual nice things (security updates) for things sold in the EU definitely puts these things in the regulated sphere. (Also, a hypothetical "right of the people to keep and bear Cryptography" law is also regulation, it's just a trivial one. And then folks start talking about what is and what is not Cryptography. And we're back to square whatever.)

braiamp 3y ago

What in the article motivates you to write such comment? The only thing that this court rules does is to reaffirm the right of privacy, and that non-broken encryption is one of the guarantees that citizens have to obtain the right. > The court praised end-to-end encryption generally, noting that it “appears to help citizens and businesses to defend themselves against abuses of information technologies, such as hacking, identity and personal data theft, fraud and the improper disclosure of confidential information.”

pas 3y ago

We regret to inform you but we have run out of pure good things. (Also pure bad things too, so yeey?) It's a step, but precedent is (was) already established (US export controls on crypto), and regulations can take two steps at once. (It's not a nice discrete process.) And yes, of course, it's a trade off. Mandating strong encryption and sane security (no preset password in IoT/other devices), and the usual nice things (security updates) for things sold in the EU definitely puts these things in the regulated sphere. (Also, a hypothetical "right of the people to keep and bear Cryptography" law is also regulation, it's just a trivial one. And then folks start talking about what is and what is not Cryptography. And we're back to square whatever.)