5 ms·

'Encryption is deeply threatening to power': Meredith Whittaker of Signal

72 points by Vinnl 2y ago

kkfx 2y ago
Honestly? No. In a past world ability to communicate easily, cheaply, fast, around the whole world was definitively threatening. In the present hyper-surveilled world let's pretend for an instance that Signal is a totally good netizen, once used on closed source Android-based macro-bugs (aka smart-phone, the big bug bout and kept working by the spied target instead of by the spy) how can it's encryption "encrypt" anything? All you type is typed with a closed virtual keyboard on a connected closed system... Even in the past those who know, so those who can be a threat for those in power also know how to communicate covertly, it was not cheap, not fast, not sure and not easy, but it was done in every single historic moment. The threat nowadays for the oppressor is the individual ability to communicate, no matter if in clear text or not, but the ability to communicate uncensored, the ability to own, devices and data, the ability to be autonomous instead of depending on the big and powerful. So Signal might be a threat to WA, not to the government. The threat is the fact that almost everybody can run their own XMPP server, a small SIP Witch instance, or maybe a Murmur/Mumble one, the ability to operate in an open network without depending on the GAFAM and without easy censorship. In term of secrecy even if we print something we can't trust modern printers, proprietary iron, connected, with enough resources to offer a webapp for configuration and so on, we can't be safe that the printer itself do not store and send here an there any documents, do not inject dots-signature to identify the printer and so on. We can't even talk in a modern connected car confident that the car OEM do not get the complete record. Encryption in that sense matter very, very little. At maximum it makes less easy to plant false evidence in citizens systems in case the government or someone else want to falsely accuse them of something. A classic accusation let's say for a new disturbing candidate of CSAM-related and tax-fraud related stuff to be found thereafter for a just-in-time show-trial.
lrvick 2y ago
And yet, Signal insists on having centralized power over the network, the very vulnerable SGX metadata encryption servers, and the binary supply chain. These things are power and they can be co-opted to decrypt the messages of any target surreptitiously, without even the knowledge of Signal. Centralized power you have no vote in is a dictatorship, and dictatorships have a single point of failure, no matter how benevolent, that will be co-opted by a more powerful governing body. Centralized control of communications is fundamentally incompatible with the free and private speech required for a functioning democracy. Delete Signal and rebuild your social graphs on fully open decentralized or federated platforms.
- beardedwizard 2y ago
  Which signal replacement do you recommend?
  - lrvick 2y ago
    Matrix
- cageface 2y ago
  Or, maybe the tech nerd fantasy that bad policy can be circumvented by clever hacking is just that and really freedom depends on taking an active role in government and making sure what legislation and regulation does get passed serves the users. It doesn't matter how federated your system is if the pipes are controlled by an autocracy.
- criddell 2y ago
  Do you plan on leaving HN for a more open social media site?
- itscrush 2y ago
  What are your recommendations amongst open sourced + decentralized + bring your own federation then for Signal meets Discord replacement? Your points are pretty accurate and yet lead folks into 'shred your social networks, the other side is greener'. I've been generally following the advice wherever I can without success for long term now. - First it was dump Gmail etc taking aim at Google messenger / Google Chat, folks ask why you are walking away from the connection / leaving them and only your parents install Signal, and a decade later one sibling does but only uses it every other time they message. - Dump Facebook and What's App, recommend folks snag Signal etc, none do since all their international comms are What's App only. Take a look at options beyond Signal and laugh. - Telegram is like for like situation as a friend tried to do the same with his graph that I did with mine on What's App, unsuccessful and he's back to Telegram as the graph is more worth it to him. - Drop Slack or other group chats w/o E2EE, even though they are technical groups maybe 1 in 20 grab Signal, losing the group aspect of that social graph. They won't still have Signal installed 5+ years later. - Dump discord next too? What replacement would you consider for that last centralized bastion providing voice + text? Self host matter most with me and myself while walking on my social friend groups on Discord next? - Do we draw the line before or after HN? Why isn't the recommendation to just run away from anything social graph related at this point? The experience of swapping and dumping for better options never brings along the social parts that brought you to the bad option in the first place like Discord or Facebook. TL;DR: I've been shredding my social graph in the name of privacy for quite a while, it's an efficient means at losing friends along the way though.
arresin 2y ago
She plays the role well.
hyperman1 2y ago
This is new for me: At the same time, the Clinton administration endorsed surveillance advertising as a business model, so there was an incentive to gather data about your customers in order to sell to them. I assumed the lack of trustworthy small payments on the internet pushed adtech forward as an alternative income source, even without the governement endorsing anything. Does someone know more?
clwg 2y ago
I think the title is backward — the article discusses power as a threat to privacy and encryption, which is often the case. If everyone had perfect privacy from those in power, the tax system would be entirely based on honor, and no one would have government-issued IDs. Encryption does not significantly impact metadata collection, and its use could be a signal (no pun intended); and a single warrant can revoke a fair amount of the privacy that has been granted. I believe that an educated population poses a greater threat to "power" more than anything else. If more people understood what encryption is and how it affects the integrity and confidentiality of communication(and understood what those terms mean) and why privacy is important, we would be having a much more constructive discussion or at least adopting a more united adversarial stance against attacks on these technologies and rights, similar to the 90s when the online population was generally more technical and concerned about these issues as a whole. More than anything, attacks on encryption and privacy should be seen as attacks against the social contract we have with those in power, and they're failing to provide adequate justification for the mass erosion of privacy.
- roenxi 2y ago
  Your first two sentences are in contradiction and the article has it right. The reason privacy is a threat to power is because the more of it people have the harder it is to raise taxes. Taxes are the crux of the entire system. What use is power without being able to raise taxes? It doesn't get discussed much because if pressured most people would rather abandon privacy than give up taxing others. If we all pretend that privacy and taxes can both be achieved at once we can at least get everyone to, in principle, agree privacy is an admirable goal and maximise what privacy we do all get. Although with things like Monero and other privacy coins we have suddenly got an asset that is actually private and therefore fundamentally resistant to taxation. It is a weird development with hard-to-foresee implications.
  - clwg 2y ago
    I didn't intend for there to be contradictions (it's early, and I was on my first cup of coffee). What I meant was that the privacy battle against power has either already been decided or it never truly existed. We are granted rights by those in power, and these rights can also be rescinded by them, it's at the heart of the matter. At most, privacy is an annoyance to them because their authority is derived from their monopoly on violence. If I hide my finances to evade taxes, it's a crime, and there are consequences if I get caught. If crypto becomes an issue, they can just make it illegal like in China. We've also had the ability to perform tax evasion using cash for quite some time.
senectus1 2y ago
she's right.
deleted 2y ago
[deleted]

72 points by Vinnl 2y ago

kkfx 2y ago

Honestly? No. In a past world ability to communicate easily, cheaply, fast, around the whole world was definitively threatening. In the present hyper-surveilled world let's pretend for an instance that Signal is a totally good netizen, once used on closed source Android-based macro-bugs (aka smart-phone, the big bug bout and kept working by the spied target instead of by the spy) how can it's encryption "encrypt" anything? All you type is typed with a closed virtual keyboard on a connected closed system... Even in the past those who know, so those who can be a threat for those in power also know how to communicate covertly, it was not cheap, not fast, not sure and not easy, but it was done in every single historic moment. The threat nowadays for the oppressor is the individual ability to communicate, no matter if in clear text or not, but the ability to communicate uncensored, the ability to own, devices and data, the ability to be autonomous instead of depending on the big and powerful. So Signal might be a threat to WA, not to the government. The threat is the fact that almost everybody can run their own XMPP server, a small SIP Witch instance, or maybe a Murmur/Mumble one, the ability to operate in an open network without depending on the GAFAM and without easy censorship. In term of secrecy even if we print something we can't trust modern printers, proprietary iron, connected, with enough resources to offer a webapp for configuration and so on, we can't be safe that the printer itself do not store and send here an there any documents, do not inject dots-signature to identify the printer and so on. We can't even talk in a modern connected car confident that the car OEM do not get the complete record. Encryption in that sense matter very, very little. At maximum it makes less easy to plant false evidence in citizens systems in case the government or someone else want to falsely accuse them of something. A classic accusation let's say for a new disturbing candidate of CSAM-related and tax-fraud related stuff to be found thereafter for a just-in-time show-trial.

lrvick 2y ago

And yet, Signal insists on having centralized power over the network, the very vulnerable SGX metadata encryption servers, and the binary supply chain. These things are power and they can be co-opted to decrypt the messages of any target surreptitiously, without even the knowledge of Signal. Centralized power you have no vote in is a dictatorship, and dictatorships have a single point of failure, no matter how benevolent, that will be co-opted by a more powerful governing body. Centralized control of communications is fundamentally incompatible with the free and private speech required for a functioning democracy. Delete Signal and rebuild your social graphs on fully open decentralized or federated platforms.

beardedwizard 2y ago
Which signal replacement do you recommend?
- lrvick 2y ago
  Matrix
cageface 2y ago
Or, maybe the tech nerd fantasy that bad policy can be circumvented by clever hacking is just that and really freedom depends on taking an active role in government and making sure what legislation and regulation does get passed serves the users. It doesn't matter how federated your system is if the pipes are controlled by an autocracy.
criddell 2y ago
Do you plan on leaving HN for a more open social media site?
itscrush 2y ago
What are your recommendations amongst open sourced + decentralized + bring your own federation then for Signal meets Discord replacement? Your points are pretty accurate and yet lead folks into 'shred your social networks, the other side is greener'. I've been generally following the advice wherever I can without success for long term now. - First it was dump Gmail etc taking aim at Google messenger / Google Chat, folks ask why you are walking away from the connection / leaving them and only your parents install Signal, and a decade later one sibling does but only uses it every other time they message. - Dump Facebook and What's App, recommend folks snag Signal etc, none do since all their international comms are What's App only. Take a look at options beyond Signal and laugh. - Telegram is like for like situation as a friend tried to do the same with his graph that I did with mine on What's App, unsuccessful and he's back to Telegram as the graph is more worth it to him. - Drop Slack or other group chats w/o E2EE, even though they are technical groups maybe 1 in 20 grab Signal, losing the group aspect of that social graph. They won't still have Signal installed 5+ years later. - Dump discord next too? What replacement would you consider for that last centralized bastion providing voice + text? Self host matter most with me and myself while walking on my social friend groups on Discord next? - Do we draw the line before or after HN? Why isn't the recommendation to just run away from anything social graph related at this point? The experience of swapping and dumping for better options never brings along the social parts that brought you to the bad option in the first place like Discord or Facebook. TL;DR: I've been shredding my social graph in the name of privacy for quite a while, it's an efficient means at losing friends along the way though.

arresin 2y ago

She plays the role well.

hyperman1 2y ago

This is new for me: At the same time, the Clinton administration endorsed surveillance advertising as a business model, so there was an incentive to gather data about your customers in order to sell to them. I assumed the lack of trustworthy small payments on the internet pushed adtech forward as an alternative income source, even without the governement endorsing anything. Does someone know more?

clwg 2y ago

I think the title is backward — the article discusses power as a threat to privacy and encryption, which is often the case. If everyone had perfect privacy from those in power, the tax system would be entirely based on honor, and no one would have government-issued IDs. Encryption does not significantly impact metadata collection, and its use could be a signal (no pun intended); and a single warrant can revoke a fair amount of the privacy that has been granted. I believe that an educated population poses a greater threat to "power" more than anything else. If more people understood what encryption is and how it affects the integrity and confidentiality of communication(and understood what those terms mean) and why privacy is important, we would be having a much more constructive discussion or at least adopting a more united adversarial stance against attacks on these technologies and rights, similar to the 90s when the online population was generally more technical and concerned about these issues as a whole. More than anything, attacks on encryption and privacy should be seen as attacks against the social contract we have with those in power, and they're failing to provide adequate justification for the mass erosion of privacy.

roenxi 2y ago
Your first two sentences are in contradiction and the article has it right. The reason privacy is a threat to power is because the more of it people have the harder it is to raise taxes. Taxes are the crux of the entire system. What use is power without being able to raise taxes? It doesn't get discussed much because if pressured most people would rather abandon privacy than give up taxing others. If we all pretend that privacy and taxes can both be achieved at once we can at least get everyone to, in principle, agree privacy is an admirable goal and maximise what privacy we do all get. Although with things like Monero and other privacy coins we have suddenly got an asset that is actually private and therefore fundamentally resistant to taxation. It is a weird development with hard-to-foresee implications.
- clwg 2y ago
  I didn't intend for there to be contradictions (it's early, and I was on my first cup of coffee). What I meant was that the privacy battle against power has either already been decided or it never truly existed. We are granted rights by those in power, and these rights can also be rescinded by them, it's at the heart of the matter. At most, privacy is an annoyance to them because their authority is derived from their monopoly on violence. If I hide my finances to evade taxes, it's a crime, and there are consequences if I get caught. If crypto becomes an issue, they can just make it illegal like in China. We've also had the ability to perform tax evasion using cash for quite some time.

senectus1 2y ago

she's right.

deleted 2y ago

[deleted]