Stop the Earn IT Bill Before It Breaks Encryption • Hacker News Board

Re: Stop the Earn IT Bill Before It Breaks Encryption

#31

Post by choward » Tue, Oct 06, 2020, 9:17 AM UTC

mytailorisrich wrote: post #24

Jon_Lowtek wrote: post #19

Earlier quoted context omitted.

How was it solved before modern communication tech made it possible to automatically record, transcribe and search peoples private communication?

The key problem is not automation, it's access. It's simple to read a letter. It's not difficult to eavesdrop on a phone copper wire. But it's impossible to intercept communications encrypted end-to-end, or encrypted at rest, considering the strength of the algorithms freely available today.

> The key problem is not automation, it's access.

I agree. There is a problem if they have open access to everyone's data.

> But it's impossible to intercept communications encrypted end-to-end, or encrypted at rest, considering the strength of the algorithms freely available today.

What about to people talking to each other in private. That could be considered as "problematic" as end to end encryption. Should their phones be recording them so the government can snoop later? And for encryption at rest, what if someone has a safe that self destructs is someone unauthorized tries to open it? Should that be illegal?

Re: Stop the Earn IT Bill Before It Breaks Encryption

#32

Post by giantDinosaur » Tue, Oct 06, 2020, 9:20 AM UTC

nix23 wrote: post #25

What i don't get, yes you can force Facebook to implement Backdoors, but how would you do that with a opensource project like Matrix or even the full opensource Android?

Many options:

- block access ala GFW, ensuring that most people will have difficulty accessing it or using it

- block access to any data you cannot decrypt or from an endpoint you cannot backdoor

- go after creators and ensure some kind of backdoor is inherent to the project

- shut down projects by exerting pressure on developers

- run some kind of propaganda campaign on the evils of using unsanctioned software (supporting terrorism etc.)

- do nothing, knowing that most users will avoid using anything that isn't one of the major web platforms

Re: Stop the Earn IT Bill Before It Breaks Encryption

#33

Post by fsflover » Tue, Oct 06, 2020, 9:20 AM UTC

sdoering wrote: post #3

I strongly believe we have lost the war for privacy and security (against state level actors) already. Once the net adopted the platform model, we were screwed. Platforms are as easy to regulate, as for example the telephone companies were back in the days. They were easily forced to comply with wiretapping demands of the government. The moment a central platform controlled (most of) our communication and was able to…

> I strongly believe we have lost the war for privacy and security (against state level actors) already. Once the net adopted the platform model, we were screwed.

This is very pessimistic. People still can understand the dangers (and are understanding) and switch to decentralized platforms, which by the way are actively being developed: https://joinmastodon.org.

Re: Stop the Earn IT Bill Before It Breaks Encryption

#34

Post by mikeyjk » Tue, Oct 06, 2020, 9:20 AM UTC

anonymfus wrote: post #2

There is a clear need for an opposite law which will make backdoors illegal. Who could fight for it?

Sadly Australia did the opposite - they can force us to backdoor applications and punish us for refusing. Australia is not the place to look for security applications.

Re: Stop the Earn IT Bill Before It Breaks Encryption

#35

Post by t-writescode » Tue, Oct 06, 2020, 9:20 AM UTC

mytailorisrich wrote: post #22

choward wrote: post #7

Earlier quoted context omitted.

> they know that without legal provisions technology can make it impossible to access communication during legitimate police investigations > How do we solve this problem? It's called a search warrant.

Well, no. That's the issue! If you only have peer-to-peer encryption with communications still passing through servers unencrypted then, sure, you can get a warrant to force disclosure. With end to end encryption, however you can show up with a warrant all you want it makes no difference because they physically cannot hand you clear-text communications. Same for encryption at rest. The strength of the encryption algo…

A very real problem with "backdoors" and wiretapping in the digital age is that, in the past, wiretapping was for future communications and between two specific individuals.

That is not how E2E encryption breaking will be used.

For E2E encryption breaking, they won't ask for "future conversations between A and B for the next 2 weeks" they will say "give me all historical communication from this person between all of their followers for the last 5 years".

For the first time in the history of the world, were are in a time when, not just your future communications, but your past ones, the ones that you think are private between two people in a modern-world way (that is, over the internet) are not private except when E2E. Worse, by all accounts from a normal person - they are private. I mean, we certainly act like the messages we send family iMessage or whatever are private, and we assume the same level of privacy we'd be afforded for a phone call, except that's not present; and, with laws like this, it will be even less present.

And not only is the former bad, but the latter is much, much worse.

Re: Stop the Earn IT Bill Before It Breaks Encryption

#36

Post by roblabla » Tue, Oct 06, 2020, 9:22 AM UTC

nix23 wrote: post #25

What i don't get, yes you can force Facebook to implement Backdoors, but how would you do that with a opensource project like Matrix or even the full opensource Android?

You enforce it on the main providers. For Android, force Google to supply the backdoor (In Google Play Services), for Matrix force the hosted Element.io instance to provide it.

Even if the project is open source and development is distributed, there is often a major entity behind it driving it on which the requirements can be enforced.

Re: Stop the Earn IT Bill Before It Breaks Encryption

#37

Post by Freak_NL » Tue, Oct 06, 2020, 9:23 AM UTC

StavrosK wrote: post #21

Freak_NL wrote: post #11

Earlier quoted context omitted.

> They were easily forced to comply with wiretapping demands of the government. Of some governments. If you are not one of the five (or whatever) eyes, you probably won't get your hand in WhatsApp's panties; much to the annoyance of those governments (e.g., the Dutch government which in its current incarnation seems to have developed a dislike for end-to-end encryption as well). For American citizens to be spied on b…

> China sidesteps this issue completely by using home-grown platforms like WeChat of course. How is that different from what the US does? It seems to me an error to think that US companies are somehow the default, and any other country using its own services is sidestepping the issue.

It's not that different, only that China was acting in response to the status quo of US companies dominating this global market. For most users outside of the US those companies are the default; China excepted.

By 'default' I don't mean to imply that this is desirable or healthy though.

Re: Stop the Earn IT Bill Before It Breaks Encryption

#38

Post by Quarrelsome » Tue, Oct 06, 2020, 9:23 AM UTC

sdoering wrote: post #3

I strongly believe we have lost the war for privacy and security (against state level actors) already. Once the net adopted the platform model, we were screwed. Platforms are as easy to regulate, as for example the telephone companies were back in the days. They were easily forced to comply with wiretapping demands of the government. The moment a central platform controlled (most of) our communication and was able to…

these are all just battles though and all that losing these battles does is pass more and more power to the technical class.

I know where I'm watched and how not to be watched, I know how to very easily hide the odd activity. The average citizen no longer gets that for free and it really sucks for them but remember that's what this has always been about, trying to improve the lot of the average, not us. We're fine because we know and can do.

So its elliptic curve time for messengers but everyone that "knows" will get some European or underground US piece of software on their phone via an unofficial app store.

Re: Stop the Earn IT Bill Before It Breaks Encryption

#39

Post by AmericanChopper » Tue, Oct 06, 2020, 9:24 AM UTC

blackbear_ wrote: post #12

AmericanChopper wrote: post #6

Earlier quoted context omitted.

The world is welcome to compete with American tech, and has been trying very hard at it for quite a long time.

And America is welcome to put up a fair fight instead of banning competitors.

If a fair fight is one where everybody plays by the same rules, then America fights as fair as you can get.

The main issue with something like this though isn’t really about the rest of the world catching up to the US technologically. It’s a question of whether service providers would choose not operating in the US over following their rules. But given the size of the US market, you’d find a lot of service providers choosing to follow the rules.

Which is incidentally the same way EU nations enforce their laws on companies like Google. And how countries like France, Germany and UK would enforce the anti-encryption laws they’ve been trying for years to get on the books.

Re: Stop the Earn IT Bill Before It Breaks Encryption

#40

Post by StavrosK » Tue, Oct 06, 2020, 9:24 AM UTC

Freak_NL wrote: post #37

StavrosK wrote: post #21

Earlier quoted context omitted.

> China sidesteps this issue completely by using home-grown platforms like WeChat of course. How is that different from what the US does? It seems to me an error to think that US companies are somehow the default, and any other country using its own services is sidestepping the issue.

It's not that different, only that China was acting in response to the status quo of US companies dominating this global market. For most users outside of the US those companies are the default; China excepted. By 'default' I don't mean to imply that this is desirable or healthy though.

I'm not very up to date on the history of WeChat, was it launched as a reaction to US services or did it just grow organically?