EU to legislate about Chat Control behind closed doors

> It's not like we are all spending all our time going over a random s3 bucket to say `Aha, I am sure Bob didn't add this new key because he logged in from his desktop. It has to be a man in the middle`

That's not how key transparency works. The whole point of key transparency is that you don't have to do that.

If you are into manually checking that you have the right key, you can do it by scanning a QR code (or exchanging the key manually through some trusted channel), both on Signal and WhatsApp.

> Can they just siphon keys of your device?

Whoever hacks your device can read the messages, end-to-end encryption protects the data in transit, not at rest.

> Can they just deploy a special version to just your device

If you get WhatsApp through the Play Store, they would need to collude with Google to do that. But it is technically possible. If you get WhatsApp on the web it's a lot easier though: they can just serve you a different codebase this one time. BTW ProtonMail can do that too, or any webapp. Which I assume is why Signal doesn't have a web version.

> The gold standard would be personally managed keys, exchanged and signed by your contacts in person, open source software that is not auto-updating, distributed over a channel that does not know your identity.

You can get the sources of Signal, audit them yourself, compile them yourself, and verify the key with your contacts through a trusted channel (in person if you like). That is already possible.

> No one in Microsoft, Yahoo, Google, Facebook, AOL, Skype, or Apple said anything about PRISM

I think it is pretty different. Was PRISM available in the code source in the mono repo of all those companies? WhatsApp is.

The machine is working exactly as intended.

That is one gigant If indeed.

The point is, if the regulation works as intended, it consolidates USB-C as the standard and slows or blocks new types of ports from being designed and tested. If it doesn't, then it's useless. You can't have it both ways.

Imagine a company that wants to design the next type of port. Normally, it would just do R&D and engineer the product, then put it on the market with that type of port. If the device only has that type of port, people must use it and provide feedback by choosing to keep buying the product (maybe they'll also make it explicit that they like the new port). If this phase is successful and the company opens the specs and other companies adopt it, it might become a de facto standard.

Now consider doing it with the current regulation. You need to do R&D, but the design will require higher costs because you have to make the device work with the old USB-C, too.

Maybe it's not a high cost for the company, so they do it anyway. People might use the port much less because some may not even try the new port and stick to the USB-C for simplicity, or because they are accustomed to it.

So the company won't have the same strong feedback. But let's assume they manage to make most users happy to use the new one because it's so much better. Now they open the standard. Other companies have to pay the additional engineering costs to add the other port. Some might be able to afford it just fine, while others might not want to add the complexity and costs of two ports.

Let's say, however, it spreads anyway. Now you hope the EU will accept it as a new standard so you can ditch the now-old USB-C standard. But the EU might just say "NO". It's very hard to predict if the government would be happy with it.

Given the compounding of these effects, the result is most likely that the company won't even think about wanting to develop the next standard.

The probability of a new standard happening is much reduced. And as I said before, if it weren't reduced, then the regulation would be useless to begin with, as people would use and test different connectors regardless of the USB-C support.

As I said in the root comment, I don't care too much about the connectors not evolving, but it just goes to show that people don't realise that there is no free lunch. Add constraints, and you add costs and slow down progress.

You can't force companies to add value with no costs, and value is also subjective, so the government often doesn't know what is valuable to people. At most, the government might know what some people say is valuable to them. But this is not the same thing.

Very few people would have said smartphones were the future, and they would buy one in 2007. Democracy is a very bad way for economic and technological progress to happen - unless it's for some military technology for which the government is the only customer.

> You would still need some infrastructure to link users with IPs

I thought we cracked this with P2P streaming? I know torrents have trackers but can't we do some kind of multicast kind of thing, completely P2P?