Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

TikTok will not introduce end-to-end encryption, saying it makes users less safe

bbc.com

Post reply on HN
Print view View original

441–450 of 458 posts

Re: TikTok will not introduce end-to-end encryption, saying it makes users less safe

#441

Post by Leno1225 »

hogwasher wrote: post #399
johnisgood wrote: post #361

Earlier quoted context omitted.

And I think because of all the handholding we are left worse off.

Most people couldn't tell you how their car works, at least not enough to fix it. Is that handholding, too? People can't be knowledgable about everything. There's just too much information in the world, and too many different skills that could be learned, and not enough time. A carpenter can rely on power tools without understanding fully how the tools work, and it's fine, as long as the tools are made to safe standa…

“As long as the user understands basic safety instructions” Yes, the internet has basic safety instructions, too (and probably just as many bother to read them), number one or two is “almost nothing online is ever really private”. I learned it by the mid 2000s, not knowing it in 2026 is not excusable with “people don’t need to know how everything works”.

Re: TikTok will not introduce end-to-end encryption, saying it makes users less safe

#442

Post by sleepybrett »

danlitt wrote: post #434
sleepybrett wrote: post #344

Earlier quoted context omitted.

Hasn't been true ANYTIME IN HISTORY. Hell it was well understood even by children that no conversation you had on the telephone was truly private. That's why cyphers were invented.

What are you talking about? It is illegal to tap people's phone lines or to interfere with mail. Are you saying people don't have a reasonable expectation of privacy even when it's illegal to be spied on?

'Illegal' doesn't really mean anything in this, or any other, day and age when you are talking about the very rich, the very powerful, or the state.

The good thing about e2ee is that it probably makes the list of those with the ability to decrypt things encrypted e2e somewhat smaller. Fact is hacking can get to those keys. (i.e. state actor zero-click exploits your phone they are going to be able to get your private key and the messages in memory)

Re: TikTok will not introduce end-to-end encryption, saying it makes users less safe

#443

Post by danlitt »

sleepybrett wrote: post #442
danlitt wrote: post #434

Earlier quoted context omitted.

What are you talking about? It is illegal to tap people's phone lines or to interfere with mail. Are you saying people don't have a reasonable expectation of privacy even when it's illegal to be spied on?

'Illegal' doesn't really mean anything in this, or any other, day and age when you are talking about the very rich, the very powerful, or the state. The good thing about e2ee is that it probably makes the list of those with the ability to decrypt things encrypted e2e somewhat smaller. Fact is hacking can get to those keys. (i.e. state actor zero-click exploits your phone they are going to be able to get your private…

> 'Illegal' doesn't really mean anything in this

This is a thread arguing about what the law should be.

> Fact is hacking can get to those keys.

Everything made by humans is fallible.

Re: TikTok will not introduce end-to-end encryption, saying it makes users less safe

#444

Post by hk__2 »

pino83 wrote: post #199
hk__2 wrote: post #167

Earlier quoted context omitted.

Switch to what exactly?

If there is nothing else, then you as a customer has screwed up with it before, right? And then the entire strategy/philosophy is maybe to be reviewed?! Or, in other words: If there is no alternative, this is due to your own faults. Either deal with it, or find ways to undo your mistakes.

How is it the customer’s fault that no good alternative to TikTok exists?

Re: TikTok will not introduce end-to-end encryption, saying it makes users less safe

#445

Post by [deleted] »

gzread wrote: post #265
hk__2 wrote: post #167

Earlier quoted context omitted.

Switch to what exactly?

Alternatives to private messaging on TikTok? Uh, Signal. SimpleX. Session. XMPP/OTR. PGP. Discussing things on TikTok, that the government must not know about, seems a bad idea.

[deleted]

Re: TikTok will not introduce end-to-end encryption, saying it makes users less safe

#446

Post by chaz6 »

I am happy with this. Users should be under no allusion that their messages are secret. It just gives a false sense of security. If you don't want people reading your messages you should be using one-time pads. Of course this cannot prevent discovery of your messaging network.

Re: TikTok will not introduce end-to-end encryption, saying it makes users less safe

#447

Post by derangedHorse »

Meh, I don’t care if they keep this product decision but I don’t like the unsupported assertion that enabling it would cause harm to the children on their platform. If it really is to help combat predators they should publish data on who they are able to help by having access to every conversation on the platform.

Have they stopped a kidnapping? A battery? A murder? Maybe they helped a court case? If we can’t see how the public is benefiting from this, we’re left to assume it’s mostly in TikTok’s benefit. They could be using messaging data to blackmail politicians for all we know!

Re: TikTok will not introduce end-to-end encryption, saying it makes users less safe

#448

Post by AnthonyMouse »

Nursie wrote: post #428
AnthonyMouse wrote: post #420

Earlier quoted context omitted.

> Then we don't legislate specific schemes? Except that you have to in this case because IDs are issued by the government and then it's the government having to provide some privacy-protecting means of using them, which is the thing they're incapable of in practice. > There are ways that private entities can implement age checks both securely and without leaking much other information I have yet to see a single one i…

> it's the government having to provide some privacy-protecting means of using them Nope, not necessarily. > I have yet to see a single one implemented in real life. There are likely to be a lot more coming as the newer standards in this area were finalised last year. Online identity is a continually evolving space. > Moreover, private entities have the perverse incentive to do the opposite of implementing it securel…

> Nope, not necessarily.

Necessarily, in fact, for any system that uses a government ID, because that requires there to be some interface between the government ID and a private bureaucracy that the holder of the ID would be pressured into interacting with. If that interface allows the private party to e.g. learn who you are, instead of just your age, it's only the government that could replace it with one that didn't.

> There are likely to be a lot more coming as the newer standards in this area were finalised last year. Online identity is a continually evolving space.

Evolution is supposed to cause bad ideas to die. The problem with laws, such as the ones surrounding government identity documents, is that they regularly require bad ideas to live. Which is why the use of government ID should be minimized.

> Some do in some circumstances, but far from all.

They all have that incentive, because it leads to money, and money is an incentive.

It's possible to turn someone down who is offering you money, but we're dealing with large scale systems here, and then the incentives determine the averages.

> Others (often financial institutions) have wised up to PII being a liability rather than an opportunity and some are working on frameworks and capabilites in this space that don't involve any more storage or transfer of anyone's ID than already happens in banks.

We really need to get it to stop happening in banks. The fact that every single thing you buy using a digital payment method is tied to your government ID is a preposterously dangerous status quo to leave unchallenged.

Re: TikTok will not introduce end-to-end encryption, saying it makes users less safe

#449

Post by Nursie »

shakna wrote: post #431
Nursie wrote: post #416

Earlier quoted context omitted.

> No, uploading identity documents is never a safe process. You should probably stop pretending you understand verifiable credentials then. Because if you did, you'd understand that they don't need to involve uploading identity documents anywhere. The idea is to defer to service providers such as banks that have already performed such verification, often physically. And if you want to argue that banks should stop ver…

KYC rules require the banks collect those, and keep them on an online portal. This information is held by the ABA - hence why they were falsely accused because of the infostealer breach last year. I have absolutely not said banks should stop collecting ID. Collecting it in person is a fantastic idea. Holding it on an isolated network is difficult, but a good compromise, and banks are better suited to doing that than…

I believe that nobody's ID will be at risk of leaking, because it will never be handled in the first place, nor will it be accessed. So that's already better than most of the schemes people are upset about.

> But I expect the same result as Forticode.

What happened there? I can't find a lot of reference to it on the net other than "we make amazing security products" and then "entering liquidation", so clearly a lot went wrong!

It's always possible for people to make mistakes and do things badly, but I don't see "age verification" as some special case in the identity landscape that presents unique challenges. And the system is already in use without major issue (touch wood). Verifiable Credentials will be an addition to the platform at some point.

Re: TikTok will not introduce end-to-end encryption, saying it makes users less safe

#450

Post by trashb »

Cider9986 wrote: post #336
trashb wrote: post #223

Earlier quoted context omitted.

The government are able to access your conversations, data and connections with e2ee in place already. I don't see how not having e2ee would have an effect on that ability in any way.

Please provide proof for these claims.

  Myth: End-to-end encryption (E2EE) is the only way to ensure robust cybersecurity.  
  
  Reality: E2EE carries its own risks and vulnerabilities. No single, standalone method achieves bulletproof cybersecurity.
  
  Robust cybersecurity requires layering multiple, diligently managed security measures and best practices. Malevolent actors can exploit E2E encryption to avoid critical data security scanning, to allow malware inside a network or onto a device, and to evade law enforcement.
https://www.fbi.gov/how-we-investigate/lawful-access/lawful-...
Post reply on HN