5 ms·

Can someone explain how they could read my e2e Signal chat messages to my wife about what I'm cooking for dinner? Can someone explain how they could read my e2

Can someone explain how they could read my e2e Signal chat messages to my wife about what I'm cooking for dinner? Can someone explain how they could read my e2e Sessions chat message sent via TOR to my wife about what I'm cooking for dinner? Genuinely curious. Can those that are in power break this encryption?

ivanjermakov 1y ago
Making it illegal to use "non-compliant" e2ee services and prosecuting those who does. Realistically, they couldn't, but could ban such apps in EU stores, making them less popular. They can break encryption by stealing keys from your device, or by pwning your device, or by introducing backdoor into the chat client for every user.
danielheath 1y ago
They can fine apple and google for offering signal in their app stores, until nobody has it installed. That doesn’t break your comms today - but later, you replace your phone, can you get a current copy of the app?
- layer8 1y ago
  Not quite. It would be illegal for Signal to continue operating in the EU if they don’t implement the required scanning functionality. And Signal has already stated that they’d rather leave the EU.
  - account42 1y ago
    If the one western nation passes this then it's only a matter of time until the other ones do to. At that point Signal "leaving" means they may as well stop doing business. Companies like to say they won't bend the knee if it gets them support now but in the end they always do.
    - danielheath 1y ago
      I wouldn't believe a for-profit company claiming it'd stand firm. Signal is a 501c3 nonprofit. There isn't capital to lose
- andrewinardeer 1y ago
  I can download the Signal APK from their site.
rkomorn 1y ago
The idea isn't to break encryption, it's to have apps implement client-side scanning "pre-encryption".
- stephen_g 1y ago
  Yes, what is proposed is breaking the end-to-end security model, not breaking the encryption itself. Effectively it causes the same loss of security and trust as if they broke the encryption, but it allows them the fig-leaf of pretending that you're still secure because they "haven't broken the encryption".
  - rkomorn 1y ago
    I like your wording. I wasn't expressing an opinion in that comment but I do find the whole concept terrible.
- nickslaughter02 1y ago
  > The idea isn't to break encryption That comes later with ProtectEU. "Technical experts call on Commissioner Virkkunen for a seat on the table of the European Commission’s Technology Roadmap on encryption" https://edri.org/our-work/technical-experts-call-on-virkkunen-for-a-seat-on-the-table-european-commissions-technology-roadmap-on-encryption/ https://edri.org/our-work/technical-experts-call-on-virkkune...
zbentley 1y ago
No, but many political figures have proposed banning the distribution/possession/operation of tools (e.g. Signal, Tor) which can be used to circumvent surveillance.
ymir_e 1y ago
Definitely wouldn’t break the encryption itself. I think the way it could work is to send a letter to each of the messaging apps saying that they are now legally required to use the EU’s encryption keys and make the messages available to the EU. Then they would make it so that the apps that don’t comply are not available in the app stores by pressuring google and apple respectively. I think this is the reason why for example telegram is not end to end encrypted by default - as some regions require them to be able to access users info. Software you’re using on your own wouldn’t be effected, but wouldn’t necessarily be legal either. People who are technically savvy could get around it, but the vast majority of people just assume that their private messages are private.
- coldblues 1y ago
  Telegram is not E2EE because it's easier and faster to sync and transmit messages between millions of people. The scale of Telegram groups and channels is massive. Telegram, for a long time, has not complied with law enforcement requests and has made it hard for authorities to get data because of their architecture. You still have Secret Chats for E2EE messaging as an option.
  - palata 1y ago
    Not sure what your point is. Telegram is not an example when it comes to privacy. Anyone who has access to the server has access to pretty much everything. Nothing can tell you that governments (or bad actors) are not already reading your Telegram messages.
layer8 1y ago
The proposed regulation is about imposing requirements on service providers, as defined by the Digital Services Act, for messaging and other services, effectively requiring them to implement backdoors in their software. Purely P2P communication isn’t affected.
protocolture 1y ago
The app that decrypts the message, will have the capability to provide that message, now decrypted, to the government.

ivanjermakov 1y ago

Making it illegal to use "non-compliant" e2ee services and prosecuting those who does. Realistically, they couldn't, but could ban such apps in EU stores, making them less popular. They can break encryption by stealing keys from your device, or by pwning your device, or by introducing backdoor into the chat client for every user.

danielheath 1y ago

They can fine apple and google for offering signal in their app stores, until nobody has it installed. That doesn’t break your comms today - but later, you replace your phone, can you get a current copy of the app?

layer8 1y ago
Not quite. It would be illegal for Signal to continue operating in the EU if they don’t implement the required scanning functionality. And Signal has already stated that they’d rather leave the EU.
- account42 1y ago
  If the one western nation passes this then it's only a matter of time until the other ones do to. At that point Signal "leaving" means they may as well stop doing business. Companies like to say they won't bend the knee if it gets them support now but in the end they always do.
  - danielheath 1y ago
    I wouldn't believe a for-profit company claiming it'd stand firm. Signal is a 501c3 nonprofit. There isn't capital to lose
andrewinardeer 1y ago
I can download the Signal APK from their site.

rkomorn 1y ago

The idea isn't to break encryption, it's to have apps implement client-side scanning "pre-encryption".

stephen_g 1y ago
Yes, what is proposed is breaking the end-to-end security model, not breaking the encryption itself. Effectively it causes the same loss of security and trust as if they broke the encryption, but it allows them the fig-leaf of pretending that you're still secure because they "haven't broken the encryption".
- rkomorn 1y ago
  I like your wording. I wasn't expressing an opinion in that comment but I do find the whole concept terrible.
nickslaughter02 1y ago
> The idea isn't to break encryption That comes later with ProtectEU. "Technical experts call on Commissioner Virkkunen for a seat on the table of the European Commission’s Technology Roadmap on encryption" https://edri.org/our-work/technical-experts-call-on-virkkunen-for-a-seat-on-the-table-european-commissions-technology-roadmap-on-encryption/ https://edri.org/our-work/technical-experts-call-on-virkkune...

zbentley 1y ago

No, but many political figures have proposed banning the distribution/possession/operation of tools (e.g. Signal, Tor) which can be used to circumvent surveillance.

ymir_e 1y ago

Definitely wouldn’t break the encryption itself. I think the way it could work is to send a letter to each of the messaging apps saying that they are now legally required to use the EU’s encryption keys and make the messages available to the EU. Then they would make it so that the apps that don’t comply are not available in the app stores by pressuring google and apple respectively. I think this is the reason why for example telegram is not end to end encrypted by default - as some regions require them to be able to access users info. Software you’re using on your own wouldn’t be effected, but wouldn’t necessarily be legal either. People who are technically savvy could get around it, but the vast majority of people just assume that their private messages are private.

coldblues 1y ago
Telegram is not E2EE because it's easier and faster to sync and transmit messages between millions of people. The scale of Telegram groups and channels is massive. Telegram, for a long time, has not complied with law enforcement requests and has made it hard for authorities to get data because of their architecture. You still have Secret Chats for E2EE messaging as an option.
- palata 1y ago
  Not sure what your point is. Telegram is not an example when it comes to privacy. Anyone who has access to the server has access to pretty much everything. Nothing can tell you that governments (or bad actors) are not already reading your Telegram messages.

layer8 1y ago

The proposed regulation is about imposing requirements on service providers, as defined by the Digital Services Act, for messaging and other services, effectively requiring them to implement backdoors in their software. Purely P2P communication isn’t affected.

protocolture 1y ago

The app that decrypts the message, will have the capability to provide that message, now decrypted, to the government.