3 ms·

> 2. There is no middle ground: either it is end-to-end encrypted, or it is not. "Sniffing" encrypted messages is not a thing, period. Yes, but ... it's also n

> 2. There is no middle ground: either it is end-to-end encrypted, or it is not. "Sniffing" encrypted messages is not a thing, period. Yes, but ... it's also never truly end to end encrypted as humans can't do encryption in their heads. Thus there is an analogue hole at both ends. All you need to is install a spy app at the end points to access the unencrypted version. And lo, I present to you the Australia "Assistance and Access Bill (2019)". It demands that companies that develop the endpoint software shall "assist" them in writing spy apps that are undetectable. It also demands those same companies shall use their "auto security patch" feature to silently install those spy programs on the targets devices. I have no idea what the EU is proposing, and yes I agree if they are proposing we all use "breakable encryption" then it won't succeed for a whole host of practical reasons. But, I suspect they are smarter than that. And if they adopt the Australian solution, then while: > 3. Make all the laws you want, criminals will always be able to use end-to-end encryption. Those laws will only prevent honest people from protecting their communications. is true, it's also moot. There is a way around the Australian version because it insists the government shall not introduce a "systemic weakness", which translates to "you shall not break the security our society depends on". Because of that they are prohibited from installing their spy software on everyone's devices; all installations must be pre-authorised by a court. That in turn means the software company must be able to target the targeted individuals devices, and only those devices. That's simple for the likes of Google, Microsoft and Amazon of course because they insist you create an account. So the ways around it are: 1. Use open open source software, because the anonymous security updates make impossible to target someone. This is very difficult to do for most people. 2. Use a Chinese phone. They have been banned from using the closed versions of software, so they base their products on something like AOSP. You will probably get spied on by the Chinese government instead, of course - but if you live in the west why would you care? This is the easy one to do, so that's what will probably happen. I find the ironies of the directions these proposals take us in absolutely delicious.

palata 2y ago
> I have no idea what the EU is proposing Well the article is about efforts aiming at weakening encryption, and my comment is about that. > is true, it's also moot. Anything is moot if you completely ignore the context. The article talks about policy makers who want to alter encryption in such a way that they get more control over it. My point is that they need to understand that they cannot get this kind of control the way they advertise it (with "privacy-preserving sniffers"). Of course you can say that anyway the NSA can hack you, but that's off-topic here. My point is that politicians need to understand the basics of how encryption works, such that they can think properly about propositions like that. Even for politicians, there is a big difference between "privacy-preserving sniffing" and "adding a spyware in every device". The former is impossible, the latter is possible. But many politicians wouldn't vote for the latter.

palata 2y ago

> I have no idea what the EU is proposing Well the article is about efforts aiming at weakening encryption, and my comment is about that. > is true, it's also moot. Anything is moot if you completely ignore the context. The article talks about policy makers who want to alter encryption in such a way that they get more control over it. My point is that they need to understand that they cannot get this kind of control the way they advertise it (with "privacy-preserving sniffers"). Of course you can say that anyway the NSA can hack you, but that's off-topic here. My point is that politicians need to understand the basics of how encryption works, such that they can think properly about propositions like that. Even for politicians, there is a big difference between "privacy-preserving sniffing" and "adding a spyware in every device". The former is impossible, the latter is possible. But many politicians wouldn't vote for the latter.