3 ms·

Hmm. Well yes, the crypto wars are over, and strong encryption is readily available. That will never disappear. But that's been the case for decades now. The ch

Hmm. Well yes, the crypto wars are over, and strong encryption is readily available. That will never disappear. But that's been the case for decades now. The change (and possibly what's driving these legislative initiatives) is that a huge chunk of communication is E2EE by default. If WhatsApp/FB Messenger and iMessage added the government as a hidden group member to all our conversations tomorrow, and the day after that Signal was removed from the app marketplaces due to not complying, >99% of people would loose E2EE. We would go back to how it was in the early 2000's, 99% of people used Yahoo/AOL/MSN "normally" and people like us would dabble with Jabber/XMPP off-the-record. In some ways it would be easier today, the cryptographic libraries and standards are better and invented. In other ways it would be much more difficult. Undoubtedly Ylva Johansson would be happy! (I hate to bring up crypto currencies. But it's similar. It's impossible to make crypto currencies disappear, but it's fairly simple to make them marginalised and/or not effective as privacy tools by introducing stringent KYC measurements at the intersection between crypto currencies and the normal economy. Sure, you can always buy drugs on the darkweb and food at anarcho capitalist festivals, but it will never have any real privacy impact on real people in their everyday lives.)

palata 2y ago
Sure, but if you make E2EE marginalized, then it benefits those who can access it. And criminals have an incentive to access it. Again my point is that it is impossible to remove it. Making it illegal will not making inaccessible to those who ignore the laws.
- filleokus 2y ago
  I don't fully understand the talking about "scale" then. Scale is irrelevant to criminals. OpenPGP has been around longer than I've been alive, and OTR for soon 20 years. The fact that WhatsApp and iMessage has been per default for the last 10 does not push the needle for a motivated criminal. The fact that it IS deployed at scale now is the "problem" and what will be "solved" by something like Chat Control. We would go back to how it was before E2EE became the norm. What this legislation would allow is (even more) mass surveillance of normal people.
  - palata 2y ago
    > What this legislation would allow is (even more) mass surveillance of normal people. Totally. I feel like we agree but are talking past each other :-). Maybe you don't like my wording or the fact that I mentioned the scale of E2EE. But I think we agree on the fact that policy makers need to accept the reality of encryption: it exists, it's out there, and there is no compromise to be made, we have to live with those facts.
    - filleokus 2y ago
      We've now passed the threading limit so I'll make this my last reply (maybe) :-). I think we are in agreement that laws like this are bad and not something we want in our societies. Where I think we might have differing views is that I consider the "it exists" argument as being really weak against a proposal like this. If someone truly believes that this will only be used for "good" purposes and that it has near-zero cost on society ("Honest people don't have anything to hide"), arguing that "criminals can still use illegal E2EE" is not fruitful. "So what? We will probably catch many or even most criminals. They aren't known to be the sharpest tool in the toolbox, it's going to be cumbersome to use illegal Signal and criminals are lazy. And by the way, child sexual abuse material will also always exist, does that mean we can't make that illegal either??" No law is ever 100% effective, and policy makers know that. They just have a different cost/benefit calculus, or don't see all the costs (or both).
      - palata 2y ago
        > arguing that "criminals can still use illegal E2EE" is not fruitful. That's why I mentioned 3 points, I would say :-). They go together. They mean that it makes no sense to say "we want to weaken E2EE for the sake of our children". Either you remove E2EE (and enable mass surveillance), or you don't (and protect the children differently). In those discussions by politicians, there is systematically someone who comes back with an argument like "no, but imagine we could detect child pornography without actually weakening the encryption", and that argument just does not make any sense at all. Decision makers need to understand that, so that they can choose between keeping E2EE and removing E2EE improperly. Then of course, some politicians could try to push for mass surveillance. That's a political stance. But at least they would be having the real debate, instead of hiding it behind weird technical solutions that do not and cannot exist.

palata 2y ago

Sure, but if you make E2EE marginalized, then it benefits those who can access it. And criminals have an incentive to access it. Again my point is that it is impossible to remove it. Making it illegal will not making inaccessible to those who ignore the laws.

filleokus 2y ago
I don't fully understand the talking about "scale" then. Scale is irrelevant to criminals. OpenPGP has been around longer than I've been alive, and OTR for soon 20 years. The fact that WhatsApp and iMessage has been per default for the last 10 does not push the needle for a motivated criminal. The fact that it IS deployed at scale now is the "problem" and what will be "solved" by something like Chat Control. We would go back to how it was before E2EE became the norm. What this legislation would allow is (even more) mass surveillance of normal people.
- palata 2y ago
  > What this legislation would allow is (even more) mass surveillance of normal people. Totally. I feel like we agree but are talking past each other :-). Maybe you don't like my wording or the fact that I mentioned the scale of E2EE. But I think we agree on the fact that policy makers need to accept the reality of encryption: it exists, it's out there, and there is no compromise to be made, we have to live with those facts.
  - filleokus 2y ago
    We've now passed the threading limit so I'll make this my last reply (maybe) :-). I think we are in agreement that laws like this are bad and not something we want in our societies. Where I think we might have differing views is that I consider the "it exists" argument as being really weak against a proposal like this. If someone truly believes that this will only be used for "good" purposes and that it has near-zero cost on society ("Honest people don't have anything to hide"), arguing that "criminals can still use illegal E2EE" is not fruitful. "So what? We will probably catch many or even most criminals. They aren't known to be the sharpest tool in the toolbox, it's going to be cumbersome to use illegal Signal and criminals are lazy. And by the way, child sexual abuse material will also always exist, does that mean we can't make that illegal either??" No law is ever 100% effective, and policy makers know that. They just have a different cost/benefit calculus, or don't see all the costs (or both).
    - palata 2y ago
      > arguing that "criminals can still use illegal E2EE" is not fruitful. That's why I mentioned 3 points, I would say :-). They go together. They mean that it makes no sense to say "we want to weaken E2EE for the sake of our children". Either you remove E2EE (and enable mass surveillance), or you don't (and protect the children differently). In those discussions by politicians, there is systematically someone who comes back with an argument like "no, but imagine we could detect child pornography without actually weakening the encryption", and that argument just does not make any sense at all. Decision makers need to understand that, so that they can choose between keeping E2EE and removing E2EE improperly. Then of course, some politicians could try to push for mass surveillance. That's a political stance. But at least they would be having the real debate, instead of hiding it behind weird technical solutions that do not and cannot exist.