9 ms·

What do they do if I send: AFBC67CEDA7AD? Ban all “non-intelligible” content? Who can stop me from hiding information in very normal looking sentences? If yo

What do they do if I send: AFBC67CEDA7AD? Ban all “non-intelligible” content? Who can stop me from hiding information in very normal looking sentences? If you want privacy, there will always be a way.

Freak_NL 2y ago
This is not about preventing you from doing that, it is about preventing services with many users from providing that service to you without a backdoor. You can just send anyone you want an encrypted e-mail or message, but Signal can't facilitate that without the required provisions set out in those laws. If these dumb laws get enacted, Signal cannot get away with just pretending you are sending gibberish whilst providing true end-to-end encryption without any client-side scanning or whatever to you, but you are well within your rights do so yourself on top of Signal (if that's even possible); they just can't provide an automated means to do that for you.
- eterps 2y ago
  > they just can't provide an automated means to do that for you What I'm wondering is whether two separate applications can be set up to communicate automatically, with one handling messaging and the other being responsible for encrypting and decrypting the data. What would be against the law in that case? The messaging app? The encryption app? Or the interaction you are doing in that moment?
  - mfiro 2y ago
    > The encryption app? That might be the next step. Banning encryption. We live in a strange world right now.
    - Freak_NL 2y ago
      The EU does not want to ban encryption, because it is the backbone of e-commerce and banking. There are plenty of public references that show the EU's explicit support of strong encryption. What some law-and-order types (globally) want, is the means to scan, peek, or otherwise access private communication, especially if that communication is provided by a service used by millions. You can encrypt all you like, but if you use WhatsApp or Signal, laws like these force those services to create a way to eavesdrop. How is probably not defined in the law. Client-side scanning before encryption, having those services act as men-in-the-middle for each conversation; this is all fine, and can use encryption as usual. As long as certain agencies get to have a peek somewhere between those strongly encrypted tunnels.
      - effie 2y ago
        Neutralizing encryption is real; it is not about forbidding websites and clients using TLS, it's about getting in the middle.
  - Freak_NL 2y ago
    Step one would be determining if anyone actually uses those two apps together. A handful of people? No one cares. Is it now the default way you install Signal (or its two components) and do hundreds of thousands of users do this? Then the next question asked is who is facilitating it and how is that done? Does the backdoored Signal have a plug-in that allows this kind of use? Does Android facilitate that? Those people will likely find themselves in legal trouble. Of course these laws are dumb, but that doesn't mean they can't be (mis)used to get the desired effect.
    - temac 2y ago
      > Does Android facilitate that? Does Android facilitates IPC and services?
      - Freak_NL 2y ago
        That's not what the law cares about. Being able to encrypt stuff end-to-end, is not what is being targetted — it is not realistically possible. What is being targetted is millions of people getting private, true end-to-end secure communication with no content scanning of any kind through some service. Are you providing that service to millions like Signal is? This law applies. Are you the size of Meta and are you implementing some 'clever' two-component solution to sidestep this law? Expect legal trouble. You can already install a mail client with PGP-support. Will K-9 Mail get in to trouble if a million users in the EU started privately exchanging keys and using GPG with K-9 Mail? Who knows. These laws are not about such practical details. This is about unlocking massive amounts of signal intelligence to do… who knows what, and those large communication platforms are juicy targets. All it needs is a law to coerce them to cooperate. Don't expect reasonable arguments from the proponents of such laws, and don't expect to be able to avoid them for millions of users with clever tricks; you'll still fall foul of the spirit of the law, if not the letter.
    - effie 2y ago
      > A handful of people? No one cares. Actually police and various agencies do, because when most people aren't encrypting, the few that do are suddenly interesting. Some of them will turn out to be organized crime, but some of them are just adults who want to communicate privately.
- huygens6363 2y ago
  I am using a special keyboard that outputs these sequences automatically. Must my keyboard driver send the keypresses to the EU? Fine, here are they: AFC628BCF627. I understand Signal is handicapped now, but I couldn’t care less about Signal. I only care about being able to communicate in private. Why don’t we implement this stuff at a lower layer? Surely the guys on top must see this is an endless game that they will never win? It’s not an arm’s race, it’s fundamentally impossible.
  - Freak_NL 2y ago
    You don't seem to understand the point of these laws. It is not about stopping anyone with enough technical know-how from encrypting their communications. This is possible today, and not something which can be easily legislated away without resorting to a much heavier class of draconian laws (at which point you won't be living in a democracy any longer in any case). This is about making it hard (or impossible) for some perceived group of miscreants to communicate privately. People sharing CSAM (however you define that) or dealing drugs, and stuff like that. Anyone can encrypt their communication, but most people don't do this consciously; the masses just use WhatsApp and Signal and what have you. You and your special keyboard are not of interest, and unless you start selling these along with a service to route the encrypted messages to thousands of users, you are not the target of this legislation. Take away Signal and WhatsApp and sending an end-to-end encrypted message to your drug dealer without exchanging keys and agreeing on a protocol suddenly isn't as easy as just opening an app. That's the point of this law. It's a dumb law, but you won't make it go away by playing silly semantic games.
    - effie 2y ago
      > without resorting to a much heavier class of draconian laws They may be coming down the pipe, after the soft version gets people macerated. > at which point you won't be living in a democracy But you will be hearing from talking heads that you are, and Russia and North Korea are the real dictatorships. And maybe they will be right, because what is democracy? The word has different meanings to different people, and it won't be difficult to shape the discussion about what our liberal democracy is all about. Maybe it's about accepting who has power now and about protecting the vulnerable. We have seen a bit of this stance and real capabilities in recent years.
- cchance 2y ago
  Exactly, this just pisses off companies with added costs, strips freedoms and criminals move to using their own encrypt and decrypt step that the "Scanners" just see as bullshit gibberish or some form of stenography image etc. Or ... they develop their own darknet webrtc based chat lol, like its silly to enforce this on the general populace when its so obviously circumvented by the people looking to do scary shit.
dhx 2y ago
A timely reminder that 9/11 hijackers communicated in the clear. Examples: “The semester begins in three more weeks. We've obtained 19 confirmations for studies in the faculty of law, the faculty of urban planning, the faculty of fine arts and the faculty of engineering.” — Mohamed Atta “Two sticks, a dash and a cake with a stick down. What is it?”[2] — Mohamed Atta “The first semester commences in three weeks. Two high schools and two universities. ... This summer will surely be hot ...19 certificates for private education and four exams. Regards to the professor. Goodbye.”[2] — Abu Abdul Rahman Even in China with extreme surveillance and censorship in place, Chinese people have been quite creative in their ways of circumventing censorship. An example approach is cutting and pasting official political videos together in a way that changes their meaning ever so slightly. Automatic censorship algorithms are fooled, and human analysis and censorship are necessary and very expensive to carry out. Other examples are playing with the sounds of words, or using memes or rapidly-changing euphemisms.[3] It's too difficult to automatically censor stuff where people have taken a normal word such as "chair" and send each other images of chairs as a sign of protest. An image of a chair and a birthday cake with a number of candles could indicate a date of protest. Or a chair in a picture with a number of ducks in the background, or a number of chairs stacked on top of each other. And if censors start blocking all chairs, everyone just shifts to buses, or pieces of paper, or bananas, or whatever. [1] https://community.apan.org/cfs-file/__key/docpreview-s/00-00-08-13-49/2003_2D00_03_2D00_01-Al-Qaeda-and-the-Internet-_2D00_-The-Danger-of-Cyberplanning-_2800_Thomas_2900_.pdf https://community.apan.org/cfs-file/__key/docpreview-s/00-00... [2] https://www.nytimes.com/2004/12/20/business/technology/on-the-open-internet-a-web-of-dark-alleys.html https://www.nytimes.com/2004/12/20/business/technology/on-th... [3] https://en.wikipedia.org/wiki/2022_COVID-19_protests_in_China#Censorship_and_resistance https://en.wikipedia.org/wiki/2022_COVID-19_protests_in_Chin...
effie 2y ago
> What do they do if I send: AFBC67CEDA7AD? If this sort of surveillance stuff gets accepted, in time, you're gonna get noticed, put into database, and maybe called for questioning. Why are you using encryption, people that have nothing to hide do not use it.
xorcist 2y ago
"We kill people based on metadata"

Freak_NL 2y ago

This is not about preventing you from doing that, it is about preventing services with many users from providing that service to you without a backdoor. You can just send anyone you want an encrypted e-mail or message, but Signal can't facilitate that without the required provisions set out in those laws. If these dumb laws get enacted, Signal cannot get away with just pretending you are sending gibberish whilst providing true end-to-end encryption without any client-side scanning or whatever to you, but you are well within your rights do so yourself on top of Signal (if that's even possible); they just can't provide an automated means to do that for you.

eterps 2y ago
> they just can't provide an automated means to do that for you What I'm wondering is whether two separate applications can be set up to communicate automatically, with one handling messaging and the other being responsible for encrypting and decrypting the data. What would be against the law in that case? The messaging app? The encryption app? Or the interaction you are doing in that moment?
- mfiro 2y ago
  > The encryption app? That might be the next step. Banning encryption. We live in a strange world right now.
  - Freak_NL 2y ago
    The EU does not want to ban encryption, because it is the backbone of e-commerce and banking. There are plenty of public references that show the EU's explicit support of strong encryption. What some law-and-order types (globally) want, is the means to scan, peek, or otherwise access private communication, especially if that communication is provided by a service used by millions. You can encrypt all you like, but if you use WhatsApp or Signal, laws like these force those services to create a way to eavesdrop. How is probably not defined in the law. Client-side scanning before encryption, having those services act as men-in-the-middle for each conversation; this is all fine, and can use encryption as usual. As long as certain agencies get to have a peek somewhere between those strongly encrypted tunnels.
    - effie 2y ago
      Neutralizing encryption is real; it is not about forbidding websites and clients using TLS, it's about getting in the middle.
- Freak_NL 2y ago
  Step one would be determining if anyone actually uses those two apps together. A handful of people? No one cares. Is it now the default way you install Signal (or its two components) and do hundreds of thousands of users do this? Then the next question asked is who is facilitating it and how is that done? Does the backdoored Signal have a plug-in that allows this kind of use? Does Android facilitate that? Those people will likely find themselves in legal trouble. Of course these laws are dumb, but that doesn't mean they can't be (mis)used to get the desired effect.
  - temac 2y ago
    > Does Android facilitate that? Does Android facilitates IPC and services?
    - Freak_NL 2y ago
      That's not what the law cares about. Being able to encrypt stuff end-to-end, is not what is being targetted — it is not realistically possible. What is being targetted is millions of people getting private, true end-to-end secure communication with no content scanning of any kind through some service. Are you providing that service to millions like Signal is? This law applies. Are you the size of Meta and are you implementing some 'clever' two-component solution to sidestep this law? Expect legal trouble. You can already install a mail client with PGP-support. Will K-9 Mail get in to trouble if a million users in the EU started privately exchanging keys and using GPG with K-9 Mail? Who knows. These laws are not about such practical details. This is about unlocking massive amounts of signal intelligence to do… who knows what, and those large communication platforms are juicy targets. All it needs is a law to coerce them to cooperate. Don't expect reasonable arguments from the proponents of such laws, and don't expect to be able to avoid them for millions of users with clever tricks; you'll still fall foul of the spirit of the law, if not the letter.
  - effie 2y ago
    > A handful of people? No one cares. Actually police and various agencies do, because when most people aren't encrypting, the few that do are suddenly interesting. Some of them will turn out to be organized crime, but some of them are just adults who want to communicate privately.
huygens6363 2y ago
I am using a special keyboard that outputs these sequences automatically. Must my keyboard driver send the keypresses to the EU? Fine, here are they: AFC628BCF627. I understand Signal is handicapped now, but I couldn’t care less about Signal. I only care about being able to communicate in private. Why don’t we implement this stuff at a lower layer? Surely the guys on top must see this is an endless game that they will never win? It’s not an arm’s race, it’s fundamentally impossible.
- Freak_NL 2y ago
  You don't seem to understand the point of these laws. It is not about stopping anyone with enough technical know-how from encrypting their communications. This is possible today, and not something which can be easily legislated away without resorting to a much heavier class of draconian laws (at which point you won't be living in a democracy any longer in any case). This is about making it hard (or impossible) for some perceived group of miscreants to communicate privately. People sharing CSAM (however you define that) or dealing drugs, and stuff like that. Anyone can encrypt their communication, but most people don't do this consciously; the masses just use WhatsApp and Signal and what have you. You and your special keyboard are not of interest, and unless you start selling these along with a service to route the encrypted messages to thousands of users, you are not the target of this legislation. Take away Signal and WhatsApp and sending an end-to-end encrypted message to your drug dealer without exchanging keys and agreeing on a protocol suddenly isn't as easy as just opening an app. That's the point of this law. It's a dumb law, but you won't make it go away by playing silly semantic games.
  - effie 2y ago
    > without resorting to a much heavier class of draconian laws They may be coming down the pipe, after the soft version gets people macerated. > at which point you won't be living in a democracy But you will be hearing from talking heads that you are, and Russia and North Korea are the real dictatorships. And maybe they will be right, because what is democracy? The word has different meanings to different people, and it won't be difficult to shape the discussion about what our liberal democracy is all about. Maybe it's about accepting who has power now and about protecting the vulnerable. We have seen a bit of this stance and real capabilities in recent years.
cchance 2y ago
Exactly, this just pisses off companies with added costs, strips freedoms and criminals move to using their own encrypt and decrypt step that the "Scanners" just see as bullshit gibberish or some form of stenography image etc. Or ... they develop their own darknet webrtc based chat lol, like its silly to enforce this on the general populace when its so obviously circumvented by the people looking to do scary shit.

dhx 2y ago

A timely reminder that 9/11 hijackers communicated in the clear. Examples: “The semester begins in three more weeks. We've obtained 19 confirmations for studies in the faculty of law, the faculty of urban planning, the faculty of fine arts and the faculty of engineering.” — Mohamed Atta “Two sticks, a dash and a cake with a stick down. What is it?”[2] — Mohamed Atta “The first semester commences in three weeks. Two high schools and two universities. ... This summer will surely be hot ...19 certificates for private education and four exams. Regards to the professor. Goodbye.”[2] — Abu Abdul Rahman Even in China with extreme surveillance and censorship in place, Chinese people have been quite creative in their ways of circumventing censorship. An example approach is cutting and pasting official political videos together in a way that changes their meaning ever so slightly. Automatic censorship algorithms are fooled, and human analysis and censorship are necessary and very expensive to carry out. Other examples are playing with the sounds of words, or using memes or rapidly-changing euphemisms.[3] It's too difficult to automatically censor stuff where people have taken a normal word such as "chair" and send each other images of chairs as a sign of protest. An image of a chair and a birthday cake with a number of candles could indicate a date of protest. Or a chair in a picture with a number of ducks in the background, or a number of chairs stacked on top of each other. And if censors start blocking all chairs, everyone just shifts to buses, or pieces of paper, or bananas, or whatever. [1] https://community.apan.org/cfs-file/__key/docpreview-s/00-00-08-13-49/2003_2D00_03_2D00_01-Al-Qaeda-and-the-Internet-_2D00_-The-Danger-of-Cyberplanning-_2800_Thomas_2900_.pdf https://community.apan.org/cfs-file/__key/docpreview-s/00-00... [2] https://www.nytimes.com/2004/12/20/business/technology/on-the-open-internet-a-web-of-dark-alleys.html https://www.nytimes.com/2004/12/20/business/technology/on-th... [3] https://en.wikipedia.org/wiki/2022_COVID-19_protests_in_China#Censorship_and_resistance https://en.wikipedia.org/wiki/2022_COVID-19_protests_in_Chin...

effie 2y ago

> What do they do if I send: AFBC67CEDA7AD? If this sort of surveillance stuff gets accepted, in time, you're gonna get noticed, put into database, and maybe called for questioning. Why are you using encryption, people that have nothing to hide do not use it.

xorcist 2y ago

"We kill people based on metadata"