3 ms·

I don't think their first point meant to say that there is no going back on deployed e2ee at scale, I believe they were just providing ground for connecting the

by tga_d 2y ago

I don't think their first point meant to say that there is no going back on deployed e2ee at scale, I believe they were just providing ground for connecting the next two points: it's so pervasive currently that, even if outlawed, criminals will always have no problem retaining access to it somehow. Even Signal, which relies on fairly centralized infrastructure, still has an open source server implementation that I suspect wouldn't be terribly difficult for a motivated criminal enterprise to deploy privately. Contrast with something like advanced weapon systems, where rarity makes it still viable to control and legislate.

palata 2y ago
Yes that was exactly what I meant! E2EE exists out there in so many different forms that it is impossible to make it disappear as a technology. You don't need a world expert to deploy it: it's just a matter of using one of the available libraries. I mentioned that it is deployed as scale because it is not a niche thing anymore: most people in the world have benefited from E2EE already! It's not something one could hide or make disappear. The point is that policy makers need to accept this as a reality: they cannot wish E2EE did not exist, that ship has sailed long ago.
- filleokus 2y ago
  Hmm. Well yes, the crypto wars are over, and strong encryption is readily available. That will never disappear. But that's been the case for decades now. The change (and possibly what's driving these legislative initiatives) is that a huge chunk of communication is E2EE by default. If WhatsApp/FB Messenger and iMessage added the government as a hidden group member to all our conversations tomorrow, and the day after that Signal was removed from the app marketplaces due to not complying, >99% of people would loose E2EE. We would go back to how it was in the early 2000's, 99% of people used Yahoo/AOL/MSN "normally" and people like us would dabble with Jabber/XMPP off-the-record. In some ways it would be easier today, the cryptographic libraries and standards are better and invented. In other ways it would be much more difficult. Undoubtedly Ylva Johansson would be happy! (I hate to bring up crypto currencies. But it's similar. It's impossible to make crypto currencies disappear, but it's fairly simple to make them marginalised and/or not effective as privacy tools by introducing stringent KYC measurements at the intersection between crypto currencies and the normal economy. Sure, you can always buy drugs on the darkweb and food at anarcho capitalist festivals, but it will never have any real privacy impact on real people in their everyday lives.)
  - palata 2y ago
    Sure, but if you make E2EE marginalized, then it benefits those who can access it. And criminals have an incentive to access it. Again my point is that it is impossible to remove it. Making it illegal will not making inaccessible to those who ignore the laws.
    - filleokus 2y ago
      I don't fully understand the talking about "scale" then. Scale is irrelevant to criminals. OpenPGP has been around longer than I've been alive, and OTR for soon 20 years. The fact that WhatsApp and iMessage has been per default for the last 10 does not push the needle for a motivated criminal. The fact that it IS deployed at scale now is the "problem" and what will be "solved" by something like Chat Control. We would go back to how it was before E2EE became the norm. What this legislation would allow is (even more) mass surveillance of normal people.
      - palata 2y ago
        > What this legislation would allow is (even more) mass surveillance of normal people. Totally. I feel like we agree but are talking past each other :-). Maybe you don't like my wording or the fact that I mentioned the scale of E2EE. But I think we agree on the fact that policy makers need to accept the reality of encryption: it exists, it's out there, and there is no compromise to be made, we have to live with those facts.
        filleokus 2y ago
        We've now passed the threading limit so I'll make this my last reply (maybe) :-). I think we are in agreement that laws like this are bad and not something we want in our societies. Where I think we might have differing views is that I consider the "it exists" argument as being really weak against a proposal like this. If someone truly believes that this will only be used for "good" purposes and that it has near-zero cost on society ("Honest people don't have anything to hide"), arguing that "criminals can still use illegal E2EE" is not fruitful. "So what? We will probably catch many or even most criminals. They aren't known to be the sharpest tool in the toolbox, it's going to be cumbersome to use illegal Signal and criminals are lazy. And by the way, child sexual abuse material will also always exist, does that mean we can't make that illegal either??" No law is ever 100% effective, and policy makers know that. They just have a different cost/benefit calculus, or don't see all the costs (or both).

by tga_d 2y ago

palata 2y ago

Yes that was exactly what I meant! E2EE exists out there in so many different forms that it is impossible to make it disappear as a technology. You don't need a world expert to deploy it: it's just a matter of using one of the available libraries. I mentioned that it is deployed as scale because it is not a niche thing anymore: most people in the world have benefited from E2EE already! It's not something one could hide or make disappear. The point is that policy makers need to accept this as a reality: they cannot wish E2EE did not exist, that ship has sailed long ago.

filleokus 2y ago
Hmm. Well yes, the crypto wars are over, and strong encryption is readily available. That will never disappear. But that's been the case for decades now. The change (and possibly what's driving these legislative initiatives) is that a huge chunk of communication is E2EE by default. If WhatsApp/FB Messenger and iMessage added the government as a hidden group member to all our conversations tomorrow, and the day after that Signal was removed from the app marketplaces due to not complying, >99% of people would loose E2EE. We would go back to how it was in the early 2000's, 99% of people used Yahoo/AOL/MSN "normally" and people like us would dabble with Jabber/XMPP off-the-record. In some ways it would be easier today, the cryptographic libraries and standards are better and invented. In other ways it would be much more difficult. Undoubtedly Ylva Johansson would be happy! (I hate to bring up crypto currencies. But it's similar. It's impossible to make crypto currencies disappear, but it's fairly simple to make them marginalised and/or not effective as privacy tools by introducing stringent KYC measurements at the intersection between crypto currencies and the normal economy. Sure, you can always buy drugs on the darkweb and food at anarcho capitalist festivals, but it will never have any real privacy impact on real people in their everyday lives.)
- palata 2y ago
  Sure, but if you make E2EE marginalized, then it benefits those who can access it. And criminals have an incentive to access it. Again my point is that it is impossible to remove it. Making it illegal will not making inaccessible to those who ignore the laws.
  - filleokus 2y ago
    I don't fully understand the talking about "scale" then. Scale is irrelevant to criminals. OpenPGP has been around longer than I've been alive, and OTR for soon 20 years. The fact that WhatsApp and iMessage has been per default for the last 10 does not push the needle for a motivated criminal. The fact that it IS deployed at scale now is the "problem" and what will be "solved" by something like Chat Control. We would go back to how it was before E2EE became the norm. What this legislation would allow is (even more) mass surveillance of normal people.
    - palata 2y ago
      > What this legislation would allow is (even more) mass surveillance of normal people. Totally. I feel like we agree but are talking past each other :-). Maybe you don't like my wording or the fact that I mentioned the scale of E2EE. But I think we agree on the fact that policy makers need to accept the reality of encryption: it exists, it's out there, and there is no compromise to be made, we have to live with those facts.
      - filleokus 2y ago
        We've now passed the threading limit so I'll make this my last reply (maybe) :-). I think we are in agreement that laws like this are bad and not something we want in our societies. Where I think we might have differing views is that I consider the "it exists" argument as being really weak against a proposal like this. If someone truly believes that this will only be used for "good" purposes and that it has near-zero cost on society ("Honest people don't have anything to hide"), arguing that "criminals can still use illegal E2EE" is not fruitful. "So what? We will probably catch many or even most criminals. They aren't known to be the sharpest tool in the toolbox, it's going to be cumbersome to use illegal Signal and criminals are lazy. And by the way, child sexual abuse material will also always exist, does that mean we can't make that illegal either??" No law is ever 100% effective, and policy makers know that. They just have a different cost/benefit calculus, or don't see all the costs (or both).