Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Earn-IT threatens encryption and therefore user freedom

fsf.org

Post reply on HN
Print view View original

161–170 of 209 posts

Re: Earn-IT threatens encryption and therefore user freedom

#161

Post by dchftcs »

CJefferson wrote: post #142
usrbinbash wrote: post #137

Everytime someone invokes an argument how taking something away by law prevents some form of crime, my answer is a simple fact: Criminals, by definition, don't follow the law. Now, in some cases, that isn't a problem: Guns are an obvious example, because they take resources and knowledge to manufacture, and are physical objects that can be tracked. Taking these away by law works. But encryption isn't a physical objec…

By that argument, why have laws against stealing (criminals will just take stuff), or grevious bodily harm (criminals will just hit people), or verbal abuse (criminals will just keep shouting at people). I don't buy this argument at all -- if we ban encryption, except for government sanctioned encryption, it will be the easiest thing in the world to detect if anyone tries sending it over the open internet.

Poor analogy.

Stealing is the actual bad behaviour, stealing itself is bad for society, anyone who steals should be punished.

Substitute "encryption" for "stealing" then you know why you're wrong.

Re: Earn-IT threatens encryption and therefore user freedom

#162

Post by docmars »

fsflover wrote: post #147
parineum wrote: post #44

Earlier quoted context omitted.

>Locking your door at night is a poor metaphor. It is a poor metaphor because locks prevent invasion not enable privacy. Banning encryption is such an attack on privacy that it's closer to banning clothes and easing concerns by making looking at naked people illegal. Encryption is the fundamental unit of network privacy.

> Banning encryption is such an attack on privacy that it's closer to banning clothes and easing concerns by making looking at naked people illegal. This is completely missing the point of why one needs privacy. Lack of it harms journalism and activism, making the government too powerful and not accountable. If only activists and journalists will try to have the privacy, it will be much easier to target them. Everyon…

The right to privacy, and protections against unreasonable search and seizure are enshrined in the U.S. Constitution after all!

Re: Earn-IT threatens encryption and therefore user freedom

#163

Post by raxxorrax »

vitiral wrote: post #20

I feel like they missed the primary point which is that E2E encryption is the primary thing protecting everyone from hackers/criminals/other-governments. Without it the criminals WILL have access to your systems and data and then you can basically say goodbye to anything being valuable at all. Locking your door at night is a poor metaphor. A criminal can literally infiltrate and search through every unsecured compute…

That and I think it is pretty safe to say that the reasons most constitutions specifically prohibit governments to access these kind of private correspondance are quite obvious too.

Re: Earn-IT threatens encryption and therefore user freedom

#164

Post by A4ET8a8uTh0 »

vitiral wrote: post #20

I feel like they missed the primary point which is that E2E encryption is the primary thing protecting everyone from hackers/criminals/other-governments. Without it the criminals WILL have access to your systems and data and then you can basically say goodbye to anything being valuable at all. Locking your door at night is a poor metaphor. A criminal can literally infiltrate and search through every unsecured compute…

I am starting to wonder if this bill is why CNN published an article on FB allowing some violence posts, but not others riling up people like me, who likes rules applied consistently and without favoritism.

Re: Earn-IT threatens encryption and therefore user freedom

#165

Post by IncRnd »

alibero wrote: post #113
IncRnd wrote: post #101

Earlier quoted context omitted.

In this case, your quote is only one third of the content. You are not quoting the first sentence or the last part, which is why the quote doesn't make sense. Your quote should read the following, where I've italicized the two parts you left out, "NO EFFECT ON CHILD SEXUAL EXPLOITATION LAW.—Nothing in this section (other than subsection (c)(2)(A)) shall be construed to impair or limit— any charge in a criminal prosec…

Yes, I skipped or paraphrased those parts of the bill to keep things short in a way that I thought made sense. But I think the message is unchanged with the full text. Namely that Section 230 would be amended to also state: "NO EFFECT ON CHILD SEXUAL EXPLOITATION LAW. Nothing in this section [NB Section 230] (other than subsection (c)(2)(A)) shall be construed to impair or limit ... any charge in a criminal prosecuti…

Good point. For this, I read the wording as Section 230 will not "impair or limit" child exploitation laws, not that Section 230 will cease to apply.

Re: Earn-IT threatens encryption and therefore user freedom

#166

Post by jimhefferon »

galoisscobi wrote: post #30

Wrote to Dianne Feinstein of CA about being against Earn-IT act and got a letter back about how Earn IT act would prevent child sexual abuse material online. Sigh. As disappointed as I was in the response, I'm glad that EFF makes it really easy to reach out to reps. Took me less than a minute to send out my stance against the Earn IT act to my representatives https://act.eff.org/action/stop-the-earn-it-act-to-save-ou…

Yes, I had the same experience with Patrick Leahey. Usually he is pretty reasonable, but here completely he (or his office) missed the mark.

Re: Earn-IT threatens encryption and therefore user freedom

#167

Post by brightball »

indigochill wrote: post #122
seanw444 wrote: post #91

Earlier quoted context omitted.

> Making crypto illegal will ensure that only criminals have the ability to use it. The right to bear digital arms.

This is an interesting angle I´d not heard before, as cryptography had at least at some point been classified as munitions (maybe still is, I haven't been watching that). "Okay, in that case, the constitution says you can't infringe my right to it." Although I would fear going down that path would lead to them saying, "Well, we already infringe on access to certain kinds of munitions, so you can still have encryption…

The munitions angle for cryptography didn't prevent us from having it, but it did prevent us from EXPORTING it globally. At least if I remember the debate correctly.

Re: Earn-IT threatens encryption and therefore user freedom

#168

Post by usrbinbash »

CJefferson wrote: post #160
usrbinbash wrote: post #154

Earlier quoted context omitted.

> I don't see why, hypothetically, they can't all be sent with encryption that the government has a secret key to decrypt. Because it's too risky, simple as that. Let's say there is a single, super-secret-key, for government use only, that can decrypt any encrypted message on the planet. What happens if this key is leaked? What if it's found out? What if the implementation of that key turns out to be buggy and is cra…

I feel there is already a similar problem with the internet in general -- there exist keys which could be used to sign a HTTPS certificate for any website. If you work your way up the heirachy there are some very high-value keys, and the same kind of problems you describe would occur. However, we all just seem to live with that. Something similar could be set up with, with a collection of keys. I'm not saying it's a…

Difference 1: These certificates are used for the purpose of Authentication, not Encryption. If they get compromised, bad actors can impersonate certain entities for some time, but they cannot decrypt any prior recorded traffic to these entities.

Difference 2: If something happens to these keys, the CA can simply revoke the validity of the public key. This is a major pain in the _ for everyone involved, especially since all downstream certs needs to be re-issued and signed, but it's manageable. A built-in key that is somehow algorithmically included in every encryption mechanism, cannot easily be changed when it's leaked.

Difference 3: There is no single "highest Certificate Authority", so there is no single key to compromise the whole system.

Difference 4: These keys are ordinary asymmetric keys. They are not built-in backdoors into the system.

Re: Earn-IT threatens encryption and therefore user freedom

#169

Post by throw0101a »

galoisscobi wrote: post #30

Wrote to Dianne Feinstein of CA about being against Earn-IT act and got a letter back about how Earn IT act would prevent child sexual abuse material online. Sigh. As disappointed as I was in the response, I'm glad that EFF makes it really easy to reach out to reps. Took me less than a minute to send out my stance against the Earn IT act to my representatives https://act.eff.org/action/stop-the-earn-it-act-to-save-ou…

> Wrote to Dianne Feinstein of CA about being against Earn-IT act and got a letter back about how Earn IT act would prevent child sexual abuse material online. Sigh.

This is a decades-old response, along with terrorists, drug dealers, and organized crime:

* https://en.wikipedia.org/wiki/Four_Horsemen_of_the_Infocalyp...

Of course if people are willing to do one illegal activity (CP), what's to stop them from doing a second illegal activity (strong crypto) to protect themselves against detection of the first activity?

We've been here before: if the US (or any other jurisdiction) limits strong crypto, it will simply be offshored:

* https://wiki.debian.org/non-US

If you're older than ~40 and were on the Internet in the 1990s, this probably isn't your first rodeo:

* https://en.wikipedia.org/wiki/Crypto_Wars

Re: Earn-IT threatens encryption and therefore user freedom

#170

Post by brightball »

monksy wrote: post #112
galoisscobi wrote: post #30

Wrote to Dianne Feinstein of CA about being against Earn-IT act and got a letter back about how Earn IT act would prevent child sexual abuse material online. Sigh. As disappointed as I was in the response, I'm glad that EFF makes it really easy to reach out to reps. Took me less than a minute to send out my stance against the Earn IT act to my representatives https://act.eff.org/action/stop-the-earn-it-act-to-save-ou…

This is the copy/paste response I got from Duckworth: (Which is disappointing) Thank you for contacting me about S. 3538, Eliminating Abusive and Rampant Neglect of Interactive Technologies (EARN IT) Act of 2022. I appreciate you taking the time to make me aware of your concerns on this important matter. The EARN IT Act would establish a National Commission on Online Child Sexual Exploitation Prevention, which would…

I'm so torn on this.

I 100% support and demand E2E encryption be legal and available for anyone to use whenever they want to.

On the other hand, I also completely agree with the need to fix Section 230. The stories I've heard about providers essentially turning a blind eye to taking down things like revenge porn after victims have won in court is a huge problem. There's an entire Darknet Diaries episode on Kik that goes into just how bad the problem really is.

Want to smear somebody? Just post a business review on Google or Yelp. The person and the business will be fairly helpless to get it taken down. One place I worked years ago saw a review posted about the business accusing one of the Director's of an affair. The review remained up for over 6 months because of the complete lack of accountability.

Something absolutely has to be done to combat that type of harassment because it's slanted way to far in favor of the harassers right now. If service providers have no responsibility to take this stuff down it's never going to get any better.

Post reply on HN