8 ms·
Germany must stand firmly against client-side scanning in Chat Control [pdf]
- kekqqq 1y agoNo one should remove from us the right to privacy in chat rooms. Otherwise, PGP might become cool again, or I bet that there will be new ways to chat without mass surveillance.
- bigyabai 1y ago> Otherwise, PGP might become cool People need convenient access to PGP. If their App Store removes all PGP apps then they might have to upload their privatekey to a PWA. And then no one's any better off. If the everyman is forced to choose between being surveilled or using PGP, I reckon I know what he'd choose regardless.
- reorder9695 1y agoThere's no reason email clients can't make PGP keys easy, proton actually makes it quite easy to add a PGP key for an email address.
- dwedge 1y agoDoes Proton allow you to use any email client? Last I checked IMAP and SMTP is disabled and you're captive in their webmail or official client unless you pay for their bridge software. Which makes this post ironic https://proton.me/blog/what-is-an-email-client https://proton.me/blog/what-is-an-email-client
- cwbriscoe 1y agoI use Thunderbird to access my Proton Mail. They have an app called Proton Mail Bridge that allows you to access it via IMAP or SMTP. https://proton.me/mail/bridge https://proton.me/mail/bridge Edit: Missed the paid part in you message. Yeah, I have a paid account.
- Telemakhos 1y agoNobody ever talks about S/MIME, but it's the corporate version of PGP/GPG for mail. Apple made it dead easy to use S/MIME encryption. Most vendors do, because it's still a requirement for some government purchasing (DoD is moving away from it). I was honestly and pleasantly surprised how easy it was to use S/MIME with the built-in mail programs on macOS and iOS/iPadOS, and I'm a bit surprised that Apple didn't just automate an S/MIME key for every iCloud mail user.
- whatshisface 1y agoWhat's the new standard that the DoD requires for secure communication with contractors?
- roywiggins 1y agoThere's no reason Chat Control can't mandate scanning in email apps, either.
- mr_mitm 1y agoAnd what's stopping the government from forcing proton to hand over private keys or else?
- udev4096 1y agohttps://autocrypt.org https://autocrypt.org
- thadt 1y agoHow would PGP help in the long run? If client side scanning is mandated for everything then the natural place for it to wind up is in the OS. Once your OS is scanning all the things, your privacy is finished - pretty good or otherwise.
- layer8 1y agoYou can run the forbidden Linux software on legacy hardware. Of course, all new hardware will have hardcoded firmware scanning the DRM’d keyboard controller.
- ForceOfEntropy 1y agoIn that case you could an Arduino, Raspberry Pi, or similar to write and convert the message. The converted msg can then be sent over USB, wifi, etc to the computer
- roywiggins 1y agoRight, and then Chat Control looks at the encrypted text and goes "oh huh this looks encrypted and suspicious, let's put this user on a list for closer inspection" or eventually just refuses to let you send the message at all. Steganography is hard and it will be very difficult to hide that you're sending encrypted messages.
- mr_mitm 1y agoBut how do we then protect our messages to less tech savvy people? Encryption must be effortless and usable by the masses, or it will be almost pointless.
- treszkai 1y agoIf Chat Control passes, then encryption will not be effortless and usable by the masses, that's the whole point. Basic encrypted chat will be on the level of Snowden trying to communicate with the journalists back in the days – only possible if both parties are willing to go to lengths.
- 1y ago
- mr_mitm 1y agoPGP will never ever see mass adoption. It's too complicated and nothing will fix that. If chat control succeeds, a handful of nerds might be able to protect their comms, but mass encryption as we have it today will be dead. I like how nobody can read my chats with my mom or my landlord and would prefer it stays that way. The average user simply does not care enough to jump through a single additional hoop.
- alex23478 1y agoBut isn't that what makes it so absurd? The people that this supposedly targets will then become "nerds" and use PGP for their messaging, while the majority of people not discussing illegal activities will just suffer from worse security.
- treszkai 1y agoI expect that a large portion of the actually – not supposedly – targeted demographic will still not care or know how to set up encrypted comms, and I guess the EP also expects them not to. If someone actually wants to evade CSAR, they probably would know how to (and if not, all the better).
- lukan 1y ago"or I bet that there will be new ways to chat without mass surveillance." In a way I am fatalistic about it now/see the good in the bad. If this really comes one day, it will be a great push for decentraliced anonymous communication networks again.
- NoiseBert69 1y agoI wouldn't expect much from this government. The CDU is legendary known for its umpteenth attempt to introduce illegal data retention (condemned by Germany's highest court). The SPD - which is also part of the ruling coalition - is a flag in the wind as it has proven since coming to power. They will do anything to stay in power. Deep down, Client Side Scanning that's what both want.
- IlikeKitties 1y ago> Deep down, Client Side Scanning that's what both want. Let's be absolutely real the CDU wants complete government access to all private communications on demand with essentially endless retention. They just aren't allowed yet.
- nosianu 1y agoFunny thing is, the last few times some guy attacked people, a few days later we could read or hear in the news updates that that person had already been known to be violent, and quite a few times we also learned that they were supposed to have been deported. Information does not seem to be the bottleneck at all! (Too) Many times, when we read about the person responsible for some sudden attack, everything needed to prevent that attack had already been known well before the attack. It's just that the authorities didn't do anything. Sure, one may say there are too many people fitting the criteria and we cannot do anything with so many potential suspects, most of whom have not actually done anything. But more information won't help in these many cases at all. Examples (German) - all reputable sources, mostly local public broadcasting (ARD) and one law publisher: https://www.tagesschau.de/inland/festnahme-solingen-syrer-102.html https://www.tagesschau.de/inland/festnahme-solingen-syrer-10... https://www.swr.de/swraktuell/baden-wuerttemberg/faq-syrischer-messerangreifer-stuttgart-darum-sind-abschiebungen-so-schwierig-100.html https://www.swr.de/swraktuell/baden-wuerttemberg/faq-syrisch... https://rsw.beck.de/aktuell/daily/meldung/detail/messerangriff-aschaffenburg-asyl-abschiebung-psychiatrie-ersatzfreiheitsstrafe https://rsw.beck.de/aktuell/daily/meldung/detail/messerangri... https://www.ndr.de/nachrichten/niedersachsen/braunschweig_harz_goettingen/tote-16-jaehrige-friedland-was-wir-nicht-brauchen-ist-hass-und-hetze,friedland-130.html https://www.ndr.de/nachrichten/niedersachsen/braunschweig_ha... https://www.ndr.de/nachrichten/mecklenburg-vorpommern/Tatverdaechtiger-nach-Messerattacke-in-Wismar-abgeschoben,mvregioschwerin2970.html https://www.ndr.de/nachrichten/mecklenburg-vorpommern/Tatver... (2nd to last paragraph, he had attacked people the month before already)
- deleted 1y ago[deleted]
- killparty 1y agoHandle jetzt: https://chat-kontrolle.eu/index.php/2025/10/02/der-kampf-gegen-die-chatkontrolle-braucht-dich-jetzt/ https://chat-kontrolle.eu/index.php/2025/10/02/der-kampf-geg... Info: https://netzpolitik.org/2025/eu-ueberwachungsplaene-die-chatkontrolle-gefaehrdet-die-demokratie/ https://netzpolitik.org/2025/eu-ueberwachungsplaene-die-chat... "Wichtige Stimmen wie Amnesty International, Reporter ohne Grenzen und der Chaos Computer Club appellieren eindringlich an die Bundesregierung, die Chatkontrolle zu verhindern. Sie warnen vor einem Angriff auf die Pressefreiheit, einem IT-Sicherheitsalptraum und einer Gefahr für die Demokratie."
- jhoho 1y agohttps://fightchatcontrol.eu/ https://fightchatcontrol.eu/
- dinoqqq 1y agoPoliticians to reach out to in Germany, with a template email: poststelle@bmi.bund.de, poststelle@bmjv.bund.de, info@bmds.bund.de, baerbel.bas@bundestag.de, lars.klingbeil@bundestag.de, friedrich.merz@bundestag.de, landesleitung@csu-bayern.de, fraktion@cducsu.de, matthias.miersch@bundestag.de, sebastian.fiedler@bundestag.de, alexander.throm@bundestag.de, johannes.schaetzl@bundestag.de, ralph.brinkhaus@bundestag.de Sehr geehrte Damen und Herren, ich wende mich heute an Sie, um meine große Sorge über die geplante Einführung der sogenannten „Chatkontrolle“ auszudrücken. Die flächendeckende Überwachung privater Kommunikation stellt einen massiven Eingriff in unsere Grundrechte dar. Sie gefährdet die Privatsphäre aller Bürgerinnen und Bürger und untergräbt zentrale Prinzipien eines demokratischen Rechtsstaates. Der Schutz der Vertraulichkeit von Kommunikation ist ein unverzichtbarer Bestandteil unserer freiheitlichen Gesellschaft. Zudem zeigen zahlreiche Expertinnen und Experten auf, dass das flächendeckende Scannen privater Nachrichten zur Bekämpfung von Kindesmissbrauchsdarstellungen nicht wirksam ist. Stattdessen schwächt eine solche Maßnahme die Sicherheit digitaler Kommunikation insgesamt und schafft gefährliche Überwachungsinfrastrukturen, die leicht missbraucht werden können. Ich bitte Sie daher eindringlich, sich bei der entsprechenden Abstimmung klar gegen die Einführung der Chatkontrolle auszusprechen und sich für den Schutz der Bürgerrechte und der Privatsphäre einzusetzen. Mit freundlichen Grüßen
- guywithahat 1y ago> Under the guise of protecting children, the latest Chat Control proposals would require mass scanning of every message, photo, and video on a person’s device, assessing these via a government-mandated database or AI model to determine whether they are permissible content or not. This is pretty terrifying, although not unexpected. Given Germany's aggressive crackdown on speech I wouldn't feel too optimistic. If the BKA is going to launch criminal investigations for calling overweight politicians fat, they're probably not going to protect any rights to private conversation. The lack of free speech laws in Europe is becoming a serious issue
- IlikeKitties 1y agoGerman speaking here: People here in Germany do not want to think about just how bad our constitution really is designed. We only get free speech lte, There's no fruit of the poisonous tree doctrine leading to constant prosecutorial overreach and illegal searches[0] that are later ruled illegal but with on effect and our public prosecutors are so much lacking in independence that they aren't allowed to issue european arrest warrants [1]. But I've heard people tell me with complete conviction how great our constitution is. I can't even bother arguing about it anymore. [0] And they brag about it on 60 minutes https://www.youtube.com/watch?v=-bMzFDpfDwc https://www.youtube.com/watch?v=-bMzFDpfDwc [1] https://curia.europa.eu/jcms/upload/docs/application/pdf/2019-05/cp190068en.pdf https://curia.europa.eu/jcms/upload/docs/application/pdf/201...
- lawn 1y ago> People here in Germany do not want to think about just how bad our constitution really is designed. I think that's exactly the same as in the US.
- AAAAaccountAAAA 1y agoI don't think those issues are necessarily interconnected. If I have understood it correctly, many Germans view both hateful propaganda and surveillance as tools of dictators. Surveillance of private communications obviously has a chilling effect on free speech as well, but freedom from surveillance does not imply a freedom to openly spread hate speech in public.
- udev4096 1y agoHow would chat control even work, with federated and decentralized networks? This is the reason you should not use signal. Moxie wants everyone to be in a closed loop, tightly controlled by his decisions. Matrix ftw!
- keanb 1y agoYou make those networks illegal to use. Just using them would be illegal, regardless of the contents of your communications.
- munchlax 1y agoIn the end it's saying you can learn all the math you want except certain formulas. Just not those. Good luck with that
- roywiggins 1y agoYou're welcome to run any algorithm you want with paper and pencil, but you might not be able to run them on your devices that are allowed to talk to cellular networks. Communications that look encrypted can also be straightforwardly flagged and logged for a closer look, perhaps keeping a closer watch on any cleartext messages, metadata that invariably leaks, etc
- deleted 1y ago[deleted]
- mtlmtlmtlmtl 1y agoYes, because criminals and pedophiles care deeply about following laws. They would never even think of using a piece of software if it was illegal, right?
- lucb1e 1y agoI can't believe how infrequently this point comes up, given how fundamental a flaw to the whole scheme this point out. So long as you're allowed to have a computer and run code on it, you can run programs that do your bidding. ChatControl cannot be effective, at least I can't imagine for longer than a few months until the first 2% of CSAM handlers are caught who didn't get the memo and spread the word to the remaining 8% who didn't get the memo, until we outlaw computers It's mind-bending levels of absurdity. Surely nobody intends to (be able to) truly outlaw computers? That cat is out of the bag and people will build them or get their hands on them if they wish The only possible outcome is that only honest citizens have their chats scanned and devices locked down. The latter has as side effect that Google, Apple, and Microsoft can do whatever the heck they want because open OSes are illegal now
- tiku 1y agoI wonder if we can make a chat app that doesn't use encryption but hides your messages inside random words. The solution should be saved locally on your device.
- Trasmatta 1y agoThat's just an insecure form of encryption
- bigyabai 1y ago> The solution should be saved locally on your device. Installed as a signed app...?
- byteknight 1y agoEncryption is defined as "the process of converting information or data into a code, especially to prevent unauthorized access." What you describe is the same thing just not cryptographic.
- markild 1y agoSpecifically, steganography: https://en.m.wikipedia.org/wiki/Steganography https://en.m.wikipedia.org/wiki/Steganography
- nixass 1y agoLet's invent it and name it Enogma. For the fun sake
- byteknight 1y agoIsn't that specific to pictures?
- nathanielbennet 1y agoFormat-Transforming Encryption (FTE) is what you're looking for--it ensures the resulting message isn't vulnerable to cryptanalysis techniques while enabling encoding of a message in arbitrary formats [0], including a blog post or text message. The authors of the source use it specifically to hide messages in semantically-correct network protocol packets, but it applies just as well to text. [0] - https://dl.acm.org/doi/pdf/10.1145/2508859.2516657 https://dl.acm.org/doi/pdf/10.1145/2508859.2516657
- deleted 1y ago[deleted]
- throw_a_grenade 1y agoI'm sorry to pick non-technical details, but this PDF is typeset on „Letter” paper, which is immediately noticeable (different aspect ratio). Normally it's on „yeah, whatever” level, but since this paper (sic) aims to influence European policy, now this detail is actually important. This whole piece reeks „I'm an 1) outsider that 2) couldn't be bothered to get to know local culture so 3) probably has no stake in the affair” and as such is liable to get dismissed after only cursory glance. We know every single enumerated point above is false, but it doesn't matter. That every single word written on the page is right nd warranted, doesn't matter. @Meredith and anyone else writing papers aimed at EU, would you kindly please switch to A4 before exporting the PDF.
- layer8 1y agoThe letter also says “October 3, 2025” instead of “3 October 2025”. ;) (https://commission.europa.eu/system/files/2023-11/styleguide_english_dgt_en.pdf https://commission.europa.eu/system/files/2023-11/styleguide...) But anyway, if they truly wanted to address the letter to Germans, they should be providing a German-language version in the first place.
- tonyedgecombe 1y agoIt’s a malicious attack, right now thousands of printers around Brussels are stuck with the message “PC Load Letter”.
- nisten 1y agoI think a good way to shame politicians that push this type of erosion of civil liberties is to label it at gestapoware.
- Netcob 1y agoFor some more recent crimes against society and humanity, I'd also compare it to Stasi. Plenty of people alive today who lived with that. Around 1 in 30 people was secretly telling on their neighbors. After unification, it was presented as a dark chapter in German history that had finally come to an end. People would get to look into their own "file" to see what and how much had been written about their daily activities. I was a bit young at the time, but I do remember frequent discussions on TV about how to move on from this, and how to make sure it doesn't happen again. And now we're talking about reading everyone's private messages on a scale that would be the Stasi's wet dream. I wonder - if the Stasi had been presented as a legitimate way to fight CSAM - would that have been okay?
- 1718627440 1y agoThey did say these protesting on the street are outlaws who also rape and kill the little children.
- petre 1y agoUnsurprisingly the Stasi and Gestapo types always say things like that.
- beezlewax 1y agoThe Stasi while more recent and more correct a name to use here are still something not everyone knows about to the same extent as the gestapo.
- volkl48 1y agoIn Germany they certainly do.
- deleted 1y ago[deleted]
- luxuryballs 1y agothis is an objectively funny headline with how it so nimbly jumps from political to technical, “we must stand in a united front against client-side (software feature)” lol
- quotemstr 1y agoI've been wondering how Chat Control's proponents settled on such a comically villainous name for their project. They didn't even bother being Orwellian. Skeletor could have have come up with "Chat Control"
- nickslaughter02 1y agoThe name was coined by a former MEP Patrick Breyer, one of the most important opponent of the law. EU's other proposal for mandating backdoors into devices is however from a group officially called "EU Going Dark" tho (you thought Chat Control was the only thing coming?). https://netzpolitik.org/2024/going-dark-eu-states-push-for-access-to-encrypted-data-and-increased-surveillance/ https://netzpolitik.org/2024/going-dark-eu-states-push-for-a...
- quotemstr 1y agoThat makes more sense
- layer8 1y agoIt’s the critics who named it Chat Control. The official name is Regulation to Prevent and Combat Child Sexual Abuse (Child Sexual Abuse Regulation, or CSAR). Let’s hope there will be enough Brutuses.
- ktallett 1y agoThe next official name will be to prevent and combat terrorism, then the next proposal after that will be to prevent and combat child sexual abuse again, then the one after that will be to prevent and combat terrorism, then the one after that will be to prevent and combat child sexual abuse again..... and well you get the gist of that.
- kwar13 1y agohttps://en.wikipedia.org/wiki/Think_of_the_children https://en.wikipedia.org/wiki/Think_of_the_children
- deleted 1y ago
- nickslaughter02 1y agoI think many outside of EU dismiss this as an EU only thing and don't think much about it. 1. Have you ever texted someone from EU? You are now chat controlled too. 2. EU is pumping billions to foreign countries to promote EU values. How long until they condition this "help" with chat control?
- AAAAaccountAAAA 1y agoIt's definitely not an EU only thing. China, Russia and such have been doing this for years. There have been attempts to introduce it in US (EARN IT Act) as well, and the current regime there might very well end up doing that. Australia has also been pretty authoritarian what it comes to this kind of things.
- nickslaughter02 1y agoI don't understand your response and the downvotes. I'm saying Chat Control will spread to other countries. I'm aware of attempts from other countries. Add France and Sweden to your list.
- irusensei 1y ago[flagged]
- AAAAaccountAAAA 1y agoI primarily meant that I haven't really encountered the belief that it was somehow EU specific
- deleted 1y ago[deleted]
- rlpb 1y agoHow does this fit with Apple's pushback against the UK government's encryption backdoor efforts against them? Why aren't Apple also pushing back against this EU initiative?
- oytis 1y agoI thought Apple already voluntary implemented it on their devices?
- ls612 1y agoApple briefly proposed something similar but then reversed course pretty quickly and has unequivocally stated that it was a poorly thought out idea when they proposed it. I'd have to assume that Apple and WhatsApp are taking a more behind the scenes approach on this and that they too would leave the EU if it came to it. Both of their messenger brands are so fundamentally tied to E2EE that its hard to imagine them thinking its worth it to stay and break their encryption.
- nickslaughter02 1y agoApple has sold out their Chinese users. Why would it not do the same for EU? https://www.reuters.com/article/technology/apple-moves-to-store-icloud-keys-in-china-raising-human-rights-fears-idUSKCN1G805Z/ https://www.reuters.com/article/technology/apple-moves-to-st...
- dvngnt_ 1y agoChina market is much more lucrative and harder to enter
- aniviacat 1y agoAre they really? I'd be surprised if a substantial portion of WhatsApp users even know what end-to-end encryption is.
- encom 1y ago
- jMyles 1y agoIt's great that signal / open whisper engage in the political situation and the pressure on these states. We also need to be sure that signal / open whisper / matrix / telegram / everybody continues to make end-to-end encryption available regardless of what politicians say. Math is bigger than human affairs. There is no shame in breaking laws that prohibit math.
- roywiggins 1y agoChat Control doesn't prohibit you from using whatever encryption you want, it mandates that your phone snitch on any plaintext that it has access to.
- jMyles 1y agoYeah, I see this argument all over HN. And in a sense it's true that the affront here isn't against math per se, but against general purpose computing. But ultimately, the right to general purpose computing (ie, the right to run a program that doesn't snitch the plaintext) is the same as the right to engage in the underlying mathematics. I think it's a distinction without a meaningful difference.
- permo-w 1y agoone nitpick: CSAM isn't likely to be text that can be plaintext, is it? surely it would be image and/or video?
- jMyles 1y agoI have always used the word "plaintext" to mean content that has not been subject to encryption or hashing, whether it is text, arbitrary bytes (including multimedia formats), or even abstract ideas which can be somehow subject to a cipher. But these terms are certainly used different in different situations by different people. But yeah, images and/or video can still be "the plaintext" in the parlance to which I'm accustomed.
- alltheseas 1y ago[flagged]
- yupyupyups 1y agoA beautifully written message. Thank you to Meredith Whittaker and the Signal team for this.
- pndy 1y agoNo, not only Germany should stand firmly against this bullshit Brussels tries to push but ALL member states should be. Especially the former soviet republics and other countries of the Eastern Bloc which during communistic times ran censorship offices and security services against their citizens. Ideas like this shows that there's a power within EU structures that works against us, the citizens.
- munksbeer 1y ago> No, not only Germany should stand firmly against this bullshit Brussels tries to push but ALL member states should be For the umpteenth time, this isn't an EU initiated agenda. This is certain groups from certain member states pushing this *hard*. Focus your anger at the correct targets.
- PicassoCTs 1y ago[dead]
- deleted 1y ago[deleted]
- deleted 1y ago[deleted]
- kwar13 1y agoSignal is doing phenomenal work here. They could've sold out long ago. I highly encourage anyone to donate whatever they can.
- Gud 1y agoCould they, though? Signal is marketing themselves as the privacy alternative. If chat control passes, you can’t make the same guarantees as they are. Don’t get me wrong, I am happy they are doing what they are doing. But for signal, selling out is not really an alternative.
- xnzakg 1y agoHasn't stopped a lot of companies from selling out and then being ran into the ground by their new owners.
- 1vuio0pswjnm7 1y ago"For Signal, Chat Control is also an existential threat." Perhaps it would not be if users could write their own clients and run their oown servers Perhaps the commercial third party intermediary model of "private" and "secure" communication over the internet (cf. the free, open source, peer-to-peer model) is fundamentally-flawed. This is the model where a third party like Meta or Signal controls the software and requires connections be made to its servers in order to communicate over the internet. It is not an internet service provider, it's just a middleman trying to attract internet subscribers to use its software and connect to its remote servers Perhaps this proposed legislation is simply leveraging that fundamental flaw Acording to the latest draft I have seen, "Chat Control" does not attempt to regulate peer-to-peer communication, it does aim to stop internet subscribers from encrypting messages and sending them across the internet. It aims to regulate third party intermediaries providing "messaging services" to the public The proposed legislation leverages the "centralisation" or "intermediation" of "private" messaging (the opposite of peer-to-peer) in Silicon Valley companies
- 57986422798542 1y agoSpoiler: It won't.
- Ey7NFZ3P0nzAe 1y ago"We cannot let history repeat itself, this time with bigger databases and much much more sensitive data." Great line Meredith!
- aprilfoo 1y agoSignal is doing a great job fighting for its survival as a public platform. It's obvious that "chat-control" cannot be effective in its official purpose: there are already and will be many ways to evade surveillance like CSS for those who really want to. But it might achieve a devastating side-product, the dream of any authoritarian regime: the criminalization of privacy, which would lead to the end of freedom as we know it. "1984" was supposed to be a warning, not an instruction manual.