4 ms·

I assume this is just a police state overreach rather than genuine intent to stop crime. They must know that anyone actually engaging in criminal activity is go

I assume this is just a police state overreach rather than genuine intent to stop crime. They must know that anyone actually engaging in criminal activity is going to not be caught by this because they use other forms of encrypted communication.

philipallstar 1y ago
Continent-wide police overreach.
bccdee 1y ago
It'd be extremely easy to circumvent, too. Since the scanning runs client-side on images uploaded into the messenger, you just need an app to mangle and unmangle images. XOR the pixels in your payload with a picture of static, then do it again on the other side. It does not need to be particularly secure—the messages are still E2E encrypted so long as nothing trips the client-side scanner.
- k7sune 1y ago
  I suppose by XOR the payload the image size will multiply many times because no compression, whether lossy or lossless, will be possible.
  - bccdee 1y ago
    Or transform the bytes of the compressed image file into pixels and send that. That'll be incompressible, but the file size should be similar.
myrmidon 1y ago
I'm not saying that this is NOT police state overreach, but the assumption that all (or even most) criminals practice good operational security still seems laughable to me. I think you are letting your ideological alignment (against surveillance state) push you into irrational standpoints ("more surveillance would not catch additional criminals"). I'm 100% with you on opposing legislation like this, but it is very important to not delude oneself about its likely effects, and to pick the right hills to die on, figuratively speaking.
- IncreasePosts 1y ago
  I've always thought we're actually very lucky that terrorists tend to be idiots.
  - shadowgovt 1y ago
    I'm reminded of the story of the bombing attempt that failed because two cells miscommunicated on timezone. The bomb was handed off across a political boundary and detonated at some arbitrary point on the way to its target, an hour earlier than expected. (And then there was the one in France, where a cellphone-triggered bomb detonated prematurely and eliminated its builders because the mobile carrier they were using sent a "HAPPY NEW YEAR" SMS to every customer).
- tolmasky 1y ago
  I think the slightly more sophisticated position is that, regardless of the operational security that is currently employed, if you were to implement something like this, then criminals would quickly adapt to improve their operational security accordingly. Especially because "operational security" in this case is doing a lot of heavy lifting to obscure how easy it would be: just use a good E2E messenger. This is not some wild hypothetical, the recent explosion in VPN use by every country that has implemented an age restriction law should be sufficient to display this effect in place. In a world without weird country restrictions (whether that be intellectual property restrictions or content restrictions), VPNs would be a niche technology for business. Instead unbelievably large amounts of the general population are now not only using it, but paying for it. I think the assumption that criminals would not learn how to use one of the many free E2E encrypted messengers is the deluded and naive position.
  - IshKebab 1y ago
    > you were to implement something like this, then criminals would quickly adapt to improve their operational security accordingly This just isn't the case. Many criminals use non-encrypted phone calls, leave voice mails, etc. all the time. For example this recent theft of a gold toilet: https://www.bbc.co.uk/news/articles/cgeg39vr3j3o https://www.bbc.co.uk/news/articles/cgeg39vr3j3o > A photograph found by police on his phone showed a carrier bag stuffed with cash, which was sent on WhatsApp with the message "520,000 ha ha ha". The only reason that was E2E encrypted is because everyone in the UK uses WhatsApp and they enable E2E encryption by default. > I think the assumption that criminals would not learn how to use one of the many free E2E encrypted messengers is the deluded and naive position. It absolutely isn't. Some would, but the vast majority of criminals are not security experts. It's still a dumb law. Also the criminals that it claims to target (paedophiles) are probably the least likely to get caught because they're already used to lots of electronic scanning things. Though even there it's not like they're all criminal masterminds. I can't find it now but there was recently a story about a someone who tried to hide child porn just in a deep folder structure like .../secret/do_not_open/i_warned_you/... Dumb law, but lets use real reasons to argue that.

philipallstar 1y ago

Continent-wide police overreach.

bccdee 1y ago

It'd be extremely easy to circumvent, too. Since the scanning runs client-side on images uploaded into the messenger, you just need an app to mangle and unmangle images. XOR the pixels in your payload with a picture of static, then do it again on the other side. It does not need to be particularly secure—the messages are still E2E encrypted so long as nothing trips the client-side scanner.

k7sune 1y ago
I suppose by XOR the payload the image size will multiply many times because no compression, whether lossy or lossless, will be possible.
- bccdee 1y ago
  Or transform the bytes of the compressed image file into pixels and send that. That'll be incompressible, but the file size should be similar.

myrmidon 1y ago

I'm not saying that this is NOT police state overreach, but the assumption that all (or even most) criminals practice good operational security still seems laughable to me. I think you are letting your ideological alignment (against surveillance state) push you into irrational standpoints ("more surveillance would not catch additional criminals"). I'm 100% with you on opposing legislation like this, but it is very important to not delude oneself about its likely effects, and to pick the right hills to die on, figuratively speaking.

IncreasePosts 1y ago
I've always thought we're actually very lucky that terrorists tend to be idiots.
- shadowgovt 1y ago
  I'm reminded of the story of the bombing attempt that failed because two cells miscommunicated on timezone. The bomb was handed off across a political boundary and detonated at some arbitrary point on the way to its target, an hour earlier than expected. (And then there was the one in France, where a cellphone-triggered bomb detonated prematurely and eliminated its builders because the mobile carrier they were using sent a "HAPPY NEW YEAR" SMS to every customer).
tolmasky 1y ago
I think the slightly more sophisticated position is that, regardless of the operational security that is currently employed, if you were to implement something like this, then criminals would quickly adapt to improve their operational security accordingly. Especially because "operational security" in this case is doing a lot of heavy lifting to obscure how easy it would be: just use a good E2E messenger. This is not some wild hypothetical, the recent explosion in VPN use by every country that has implemented an age restriction law should be sufficient to display this effect in place. In a world without weird country restrictions (whether that be intellectual property restrictions or content restrictions), VPNs would be a niche technology for business. Instead unbelievably large amounts of the general population are now not only using it, but paying for it. I think the assumption that criminals would not learn how to use one of the many free E2E encrypted messengers is the deluded and naive position.
- IshKebab 1y ago
  > you were to implement something like this, then criminals would quickly adapt to improve their operational security accordingly This just isn't the case. Many criminals use non-encrypted phone calls, leave voice mails, etc. all the time. For example this recent theft of a gold toilet: https://www.bbc.co.uk/news/articles/cgeg39vr3j3o https://www.bbc.co.uk/news/articles/cgeg39vr3j3o > A photograph found by police on his phone showed a carrier bag stuffed with cash, which was sent on WhatsApp with the message "520,000 ha ha ha". The only reason that was E2E encrypted is because everyone in the UK uses WhatsApp and they enable E2E encryption by default. > I think the assumption that criminals would not learn how to use one of the many free E2E encrypted messengers is the deluded and naive position. It absolutely isn't. Some would, but the vast majority of criminals are not security experts. It's still a dumb law. Also the criminals that it claims to target (paedophiles) are probably the least likely to get caught because they're already used to lots of electronic scanning things. Though even there it's not like they're all criminal masterminds. I can't find it now but there was recently a story about a someone who tried to hide child porn just in a deep folder structure like .../secret/do_not_open/i_warned_you/... Dumb law, but lets use real reasons to argue that.