6 ms·

I strongly agree with 2) and 3), but sadly I think 1) is overplaying our collective hand. I would guess that the largest deployments of end-to-end-encryption t

I strongly agree with 2) and 3), but sadly I think 1) is overplaying our collective hand. I would guess that the largest deployments of end-to-end-encryption today is Whatsapp and iMessage by a quite large margin. E2EE for "real people" is provided by the grace of two massive publicly traded companies who have to follow local regulation. If Apple complies [1] with dubious requirements in China, I wouldn't bet against them doing it elsewhere either. Sure, we have Signal, but how many normal users would start delving into side loading if the application simply was banned and not allowed on the marketplaces? We can always use PGP-over-whatever, but that's an argument for 3) - not 1). I think politicians / police (and honestly many normal people) believe that the government have the right to do lawful interception of private communication and see E2EE as a step to far. The US has been wiretapping phones for a century already. We as privacy arguers have a pedagogical challenge of explaining why regulation like this is bad and not equivalent to 1930's style phone wiretapping. [1]: Chinese iOS users have their iCloud data (that for the vast majority includes the decryption keys) on Chinese servers, subject to the Chinese legal system. For the rest of the world the situation is the same, but s/China/U.S, which is arguably problematic as well.

tga_d 2y ago
I don't think their first point meant to say that there is no going back on deployed e2ee at scale, I believe they were just providing ground for connecting the next two points: it's so pervasive currently that, even if outlawed, criminals will always have no problem retaining access to it somehow. Even Signal, which relies on fairly centralized infrastructure, still has an open source server implementation that I suspect wouldn't be terribly difficult for a motivated criminal enterprise to deploy privately. Contrast with something like advanced weapon systems, where rarity makes it still viable to control and legislate.
- palata 2y ago
  Yes that was exactly what I meant! E2EE exists out there in so many different forms that it is impossible to make it disappear as a technology. You don't need a world expert to deploy it: it's just a matter of using one of the available libraries. I mentioned that it is deployed as scale because it is not a niche thing anymore: most people in the world have benefited from E2EE already! It's not something one could hide or make disappear. The point is that policy makers need to accept this as a reality: they cannot wish E2EE did not exist, that ship has sailed long ago.
  - filleokus 2y ago
    Hmm. Well yes, the crypto wars are over, and strong encryption is readily available. That will never disappear. But that's been the case for decades now. The change (and possibly what's driving these legislative initiatives) is that a huge chunk of communication is E2EE by default. If WhatsApp/FB Messenger and iMessage added the government as a hidden group member to all our conversations tomorrow, and the day after that Signal was removed from the app marketplaces due to not complying, >99% of people would loose E2EE. We would go back to how it was in the early 2000's, 99% of people used Yahoo/AOL/MSN "normally" and people like us would dabble with Jabber/XMPP off-the-record. In some ways it would be easier today, the cryptographic libraries and standards are better and invented. In other ways it would be much more difficult. Undoubtedly Ylva Johansson would be happy! (I hate to bring up crypto currencies. But it's similar. It's impossible to make crypto currencies disappear, but it's fairly simple to make them marginalised and/or not effective as privacy tools by introducing stringent KYC measurements at the intersection between crypto currencies and the normal economy. Sure, you can always buy drugs on the darkweb and food at anarcho capitalist festivals, but it will never have any real privacy impact on real people in their everyday lives.)
    - palata 2y ago
      Sure, but if you make E2EE marginalized, then it benefits those who can access it. And criminals have an incentive to access it. Again my point is that it is impossible to remove it. Making it illegal will not making inaccessible to those who ignore the laws.
      - filleokus 2y ago
        I don't fully understand the talking about "scale" then. Scale is irrelevant to criminals. OpenPGP has been around longer than I've been alive, and OTR for soon 20 years. The fact that WhatsApp and iMessage has been per default for the last 10 does not push the needle for a motivated criminal. The fact that it IS deployed at scale now is the "problem" and what will be "solved" by something like Chat Control. We would go back to how it was before E2EE became the norm. What this legislation would allow is (even more) mass surveillance of normal people.
rstuart4133 2y ago
> Sure, we have Signal, but how many normal users would start delving into side loading if the application simply was banned and not allowed on the marketplaces At lot. Police concocted a fake chat app and somehow convinced their targets to side load it. By all reports it was a wild success: https://www.theguardian.com/australia-news/2021/jun/08/anom-encrypted-app-fbi-afp-australia-federal-police-sting-operation-ironside-an0m https://www.theguardian.com/australia-news/2021/jun/08/anom-...
- filleokus 2y ago
  I would assume those users were somehow highly motivated to use the app. "In this gang we only use An0m, install it if you wanna deal our drugs". I doubt any of my non-techie friends (or even my parents) would side load an app if it was required to text me. WhatsApp has 2 billion users, Signal 40 million and An0m had 12k. Legislation like this will make E2EE communications unavailable to everyone but the most motivated techies and criminals.
  - palata 2y ago
    > but the most motivated techies and criminals I don't think you need to be "the most motivated techie/criminal" to install an app. If you go on an illegal forum to access illegal content, most likely you are ready to install such an app. Meaning that "this law targets child pornography" makes no sense. But again, I think we all agree here. You just seem to keep repeating that legislation like this is dangerous (but we already all agree)!
    - filleokus 2y ago
      If the app is not available in the regular app stores and requires side loading, (or possibly rooting) the threshold is quite high. > You just seem to keep repeating that legislation like this is dangerous And you keep repeating that it's a problem for the legislators that E2EE technology exists, when it's not. If a person doesn't think this is ethically problematic, even only 10 caught sex offenders every year would be consider a win. Whether there are ways to circumvent the law or not (hint: there are always ways) is irrelevant. > Meaning that "this law targets child pornography" makes no sense It makes total sense! I can almost guarantee that there would be more than 0 child sexual abusers who will use WhatsApp post this law, and will be caught. The aim of this law is to limit the spread of CSAM, and if more than 0 people are caught then the legislators will have succeeded (to some extent). Then when ChatControl 3.0 comes, targeting terrorists and organised crime within the same framework, again more than 0 will probably be caught. With ChatControl 15.0 worthless discussions online about legislation will be reported to employers and I will be caught ;-). Therefore, as I wrote in my original post, we need to explain WHY this is dangerous and not worth it. The fact that "E2EE exists and you can't catch all bad guys" is a very weak argument.

tga_d 2y ago

I don't think their first point meant to say that there is no going back on deployed e2ee at scale, I believe they were just providing ground for connecting the next two points: it's so pervasive currently that, even if outlawed, criminals will always have no problem retaining access to it somehow. Even Signal, which relies on fairly centralized infrastructure, still has an open source server implementation that I suspect wouldn't be terribly difficult for a motivated criminal enterprise to deploy privately. Contrast with something like advanced weapon systems, where rarity makes it still viable to control and legislate.

palata 2y ago
Yes that was exactly what I meant! E2EE exists out there in so many different forms that it is impossible to make it disappear as a technology. You don't need a world expert to deploy it: it's just a matter of using one of the available libraries. I mentioned that it is deployed as scale because it is not a niche thing anymore: most people in the world have benefited from E2EE already! It's not something one could hide or make disappear. The point is that policy makers need to accept this as a reality: they cannot wish E2EE did not exist, that ship has sailed long ago.
- filleokus 2y ago
  Hmm. Well yes, the crypto wars are over, and strong encryption is readily available. That will never disappear. But that's been the case for decades now. The change (and possibly what's driving these legislative initiatives) is that a huge chunk of communication is E2EE by default. If WhatsApp/FB Messenger and iMessage added the government as a hidden group member to all our conversations tomorrow, and the day after that Signal was removed from the app marketplaces due to not complying, >99% of people would loose E2EE. We would go back to how it was in the early 2000's, 99% of people used Yahoo/AOL/MSN "normally" and people like us would dabble with Jabber/XMPP off-the-record. In some ways it would be easier today, the cryptographic libraries and standards are better and invented. In other ways it would be much more difficult. Undoubtedly Ylva Johansson would be happy! (I hate to bring up crypto currencies. But it's similar. It's impossible to make crypto currencies disappear, but it's fairly simple to make them marginalised and/or not effective as privacy tools by introducing stringent KYC measurements at the intersection between crypto currencies and the normal economy. Sure, you can always buy drugs on the darkweb and food at anarcho capitalist festivals, but it will never have any real privacy impact on real people in their everyday lives.)
  - palata 2y ago
    Sure, but if you make E2EE marginalized, then it benefits those who can access it. And criminals have an incentive to access it. Again my point is that it is impossible to remove it. Making it illegal will not making inaccessible to those who ignore the laws.
    - filleokus 2y ago
      I don't fully understand the talking about "scale" then. Scale is irrelevant to criminals. OpenPGP has been around longer than I've been alive, and OTR for soon 20 years. The fact that WhatsApp and iMessage has been per default for the last 10 does not push the needle for a motivated criminal. The fact that it IS deployed at scale now is the "problem" and what will be "solved" by something like Chat Control. We would go back to how it was before E2EE became the norm. What this legislation would allow is (even more) mass surveillance of normal people.

rstuart4133 2y ago

> Sure, we have Signal, but how many normal users would start delving into side loading if the application simply was banned and not allowed on the marketplaces At lot. Police concocted a fake chat app and somehow convinced their targets to side load it. By all reports it was a wild success: https://www.theguardian.com/australia-news/2021/jun/08/anom-encrypted-app-fbi-afp-australia-federal-police-sting-operation-ironside-an0m https://www.theguardian.com/australia-news/2021/jun/08/anom-...

filleokus 2y ago
I would assume those users were somehow highly motivated to use the app. "In this gang we only use An0m, install it if you wanna deal our drugs". I doubt any of my non-techie friends (or even my parents) would side load an app if it was required to text me. WhatsApp has 2 billion users, Signal 40 million and An0m had 12k. Legislation like this will make E2EE communications unavailable to everyone but the most motivated techies and criminals.
- palata 2y ago
  > but the most motivated techies and criminals I don't think you need to be "the most motivated techie/criminal" to install an app. If you go on an illegal forum to access illegal content, most likely you are ready to install such an app. Meaning that "this law targets child pornography" makes no sense. But again, I think we all agree here. You just seem to keep repeating that legislation like this is dangerous (but we already all agree)!
  - filleokus 2y ago
    If the app is not available in the regular app stores and requires side loading, (or possibly rooting) the threshold is quite high. > You just seem to keep repeating that legislation like this is dangerous And you keep repeating that it's a problem for the legislators that E2EE technology exists, when it's not. If a person doesn't think this is ethically problematic, even only 10 caught sex offenders every year would be consider a win. Whether there are ways to circumvent the law or not (hint: there are always ways) is irrelevant. > Meaning that "this law targets child pornography" makes no sense It makes total sense! I can almost guarantee that there would be more than 0 child sexual abusers who will use WhatsApp post this law, and will be caught. The aim of this law is to limit the spread of CSAM, and if more than 0 people are caught then the legislators will have succeeded (to some extent). Then when ChatControl 3.0 comes, targeting terrorists and organised crime within the same framework, again more than 0 will probably be caught. With ChatControl 15.0 worthless discussions online about legislation will be reported to employers and I will be caught ;-). Therefore, as I wrote in my original post, we need to explain WHY this is dangerous and not worth it. The fact that "E2EE exists and you can't catch all bad guys" is a very weak argument.