Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

TikTok will not introduce end-to-end encryption, saying it makes users less safe

bbc.com

Post reply on HN
Print view View original

171–180 of 458 posts

Re: TikTok will not introduce end-to-end encryption, saying it makes users less safe

#171

Post by babyshake »

azinman2 wrote: post #89
debazel wrote: post #39

Earlier quoted context omitted.

Children are just too effect of a tool when building a surveillance state. We should have banned children from owning open computers a long time ago just like we do with Alcohol, Driving licenses, etc. Instead children would own special devices that are locked down and tagged with a "underage" flag when interacting with online services, while adults could continue as normal. We already heavily restrict the freedom of…

Would be a nightmare to implement and achieve the goal, but I have to say I think it’s more right than wrong. All of the data is very clear about the harms. China has restrictions for social media and screen time for kids — how do they implement this?

It's a nightmare to some extent to prevent underage people from consuming alcohol if you want to phrase it that way. But we don't try to ban stores from selling alcohol because of concerns children will be drinking it. Instead we require the store checks for ID.

Re: TikTok will not introduce end-to-end encryption, saying it makes users less safe

#172

Post by jbstack »

nandomrumber wrote: post #76
ranyume wrote: post #20

This might be off-topic but on-topic about child safety... but I'm surprised people are being myopic about age verification. Age verification should be banned, but people ignore that nowadays most widely used online services already ask for your age and act accordingly: twitter, youtube, google in general, any online marketplace. They already got so much data on their users and optimize their algorithms for those gro…

> people are concerned about their children's DMs but are not concerned about what companies serves them and what they do with their data. Hogwash. Where are these mythical people who aren’t concerned with both?

> Where are these mythical people who aren’t concerned with both?

They're called politicians.

Re: TikTok will not introduce end-to-end encryption, saying it makes users less safe

#173

Post by rustyhancock »

computerex wrote: post #37

TikTok is a front for government surveillance, so it's not really surprising that this is their position.

Now it's a franchise too!

Once it gets big enough in your location you buy it for that sweet sweet intel.

Re: TikTok will not introduce end-to-end encryption, saying it makes users less safe

#174

Post by gorgoiler »

I don’t really understand how we are supposed to believe in e2ee in closed proprietary apps. Even if some trusted auditor confirms they have plumbed in libsignal correctly, we have no way of knowing that their rendering code is free of content scanning hooks.

We know the technology exists. Apple had it all polished and ready to go for image scanning. I suppose the only thing in which we can place our faith is that it would be such an enormous scandal to be caught in the act that WhatsApp et al daren’t even try it.

(There is something to be said for e2ee: it protects you against an attack on Meta’s servers. Anyone who gets a shell will have nothing more than random data. Anyone who finds a hard drive in the data centre dumpster will have nothing more than a paperweight.)

Re: TikTok will not introduce end-to-end encryption, saying it makes users less safe

#175

Post by theblazehen »

ThoAppelsin wrote: post #77

DMs are akin to private conversations in real life. Thus, every DM feature should entail E2EE. It’s ok for a platform to not feature private conversations. They should just have no DM feature at all, then; make all messages publicly visible. Private conversations are indeed not for all ages. Parents should be able to grant access to that on individual basis.

Sure, however kids these days often can't socialize irl - should kids be isolated from friends because they're unable to have any private conversations at all?

During times in which I was unable to socialize irl (eg school holidays), and unable to talk to my friends online, I can confirm that the isolation was not good for my mental health.

Re: TikTok will not introduce end-to-end encryption, saying it makes users less safe

#176

Post by edarchis »

> But critics have said E2EE makes it harder to stop harmful content spreading online, because it means tech firms and law enforcement have no way of viewing any material sent in direct messages.

Like they give a damn. I report accounts that explicitly sell fake credit cards, citing laws that make it illegal and 95% of the time "we checked and there is no violation here, we know that you're not happy but don't give a crap".

So the argument of security is utter bullshit and they just want to snoop.

Re: TikTok will not introduce end-to-end encryption, saying it makes users less safe

#177

Post by pjc50 »

Nursie wrote: post #75
ranyume wrote: post #20

This might be off-topic but on-topic about child safety... but I'm surprised people are being myopic about age verification. Age verification should be banned, but people ignore that nowadays most widely used online services already ask for your age and act accordingly: twitter, youtube, google in general, any online marketplace. They already got so much data on their users and optimize their algorithms for those gro…

> Age verification should be banned Why? > They already got so much data on their users There are a variety of ways (see "Verifiable Credentials") that ages can be verified without handing over any data other than "Is old enough" to social media services.

The problem with this discussion is that this is a wonk solution for wonkish times. You're trying to thread the needle between various reasonable compromises. Ironically due to social media, that is simply not how politics and lawmaking works any more. Instead it's an emotionally driven fight between various different sorts of moral panic, and the only option is to get people more mad about surveillance than "think of the children".

You might be able to get somewhere by getting a tech company on your side, but they generally also hate adult content and don't mind banning it entirely.

(people are not going to get age verification _banned_ any time soon! That's simply not going to happen!)

Re: TikTok will not introduce end-to-end encryption, saying it makes users less safe

#178

Post by Traster »

I think this is... fine? Am I just totally naive. I think it's fine to say "You don't really have privacy on this app" - as long as there are relatively good options of apps that do have privacy (and I think there are). TikTok is really a public by default type of social media, there's not much idea of mutual following or closed groups. So sure, you don't have privacy on tiktok, if you want it you can move to snapchat or signal or whatever platform of your choice.

Like, it's literally a platform that was run under the watchful eye of the CCP, and now the US version is some kleptocratic nightmare, so I just don't see the point in expecting some sort of principled stance out of them.

In some ways I think it's worse for places like Facebook to "care about privacy" and use E2EE but then massively under-resource policing of CSAM on their platform. If you're going to embrace 'privacy' I do think it's on you to also then put additional resources into tackling the downsides of that.

Re: TikTok will not introduce end-to-end encryption, saying it makes users less safe

#179

Post by AnthonyMouse »

Nursie wrote: post #142
afiori wrote: post #132

Earlier quoted context omitted.

because most implementations are not going to be like that.

In the context of "Age verification should be banned" though, we're already talking about legislative intervention. If there's no particular problem with schemes that are like that then we don't necessarily need a blanket ban on age verification. Perhaps what we're really saying is "Ban age verification that collects lots of personal information". Or perhaps we could distil it down further to "Ban unnecessary collect…

> If there's no particular problem with schemes that are like that then we don't necessarily need a blanket ban on age verification.

There is a problem with schemes like that.

The way computer security works is, attacks always get better, they never get worse. A scheme that nobody has found any privacy holes in when it's enacted will have one found a week after.

The way governments work is, the compromise bill passes if the people who care about privacy support it because then it has the votes of the people who care about privacy and the people who want to ID everyone. But then when the vulnerability is found, the people who care about privacy can't get it fixed because they can't pass a new bill without also having the votes of the people who want to ID everyone, and those people already have what they want. More specifically, many of them then have what they really want, which is to invade everyone's privacy, as they were hoping to do once the vulnerability was found.

Which means you need it to be perfect the first time or it's already ossified and can't be fixed. But the chances of that happening in practice are zero, which means it needs to not happen at all.

Re: TikTok will not introduce end-to-end encryption, saying it makes users less safe

#180

Post by Nursie »

shakna wrote: post #163
Nursie wrote: post #97

Earlier quoted context omitted.

> Age verification obliviates anonymity on the internet. How so? Please explain in detail, because there are already schemes such as "verifiable credentials" which allow people to prove they are of age without handing over ID to online services.

Last time my government tried that, they failed. [0] You need to 100% trust those verification services. And considering their success rate [1], you shouldn't. [0] https://thinkingcybersecurity.com/DigitalID/ [1] https://discord.com/press-releases/update-on-security-incide...

> You need to 100% trust those verification services.

First link - mitigation: use a well supported standard like OIDC, not a home-cooked scheme. Duh.

Second link - this is part of the problem such schemes as verifiable credentials are designed to address, random third parties collecting ID they don't need.

Yes, any system needs to be executed well. Neither of these really display that.

Post reply on HN