Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

ChatControl: EU wants to scan all private messages, even in encrypted apps

metalhearf.fr

Post reply on HN
Print view View original

551–560 of 656 posts

Re: ChatControl: EU wants to scan all private messages, even in encrypted apps

#551

Post by palata »

pests wrote: post #487
palata wrote: post #408

Earlier quoted context omitted.

That's not what I meant. Would you say that a minimal install of Linux or *BSD is "watching your communications"? It has to "read" your data in order to show them to you, but you wouldn't count this as "watching communications" or "surveillance". Siri running locally is not considered "surveillance". The problem is when your data is exfiltrated, which is what you complain about with your Microsoft example. But again…

It’s not what you meant but it’s what you said. I understand what you meant, but others might not. Many people think their phones/computers are watching their communications. This was in response to your ‘Nobody would say that your OS is "watching your communications", right?’, which I cannot agree with as everybody I know says those exact words about android/windows/etc.

> It’s not what you meant but it’s what you said.

Technically, I did not say it, I wrote it. Normally, the way it works is that you don't take a single sentence out of its context and then say it's wrong. You take the context.

I specified my thought in the next sentence:

> Even though the OS has to "read" your messages in order to print them on your screen.

Nobody would say that the OS is watching your communications, even though the OS has to "read" your messages to print them on your screen.

Re: ChatControl: EU wants to scan all private messages, even in encrypted apps

#552

Post by palata »

stephen_g wrote: post #458
palata wrote: post #335

Earlier quoted context omitted.

> I’m sure it’s not even deliberately dismantling privacy. But it is not even dismantling privacy. ChatControl would run client-side and only report what's deemed illegal. Almost all communications are legal, and almost all of the legal communications wouldn't be reported to anyone at all. They would stay private. The problem I see is that the "client-side scanner" has to be opaque to some extent: it's fundamentally…

It's a mechanism where the Governments give lists of un-auditable hashes to chat operators and force them to send the content of messages to them when they match. You can't for a second imagine how that could possibly go wrong? The hashes are "only for what's deemed illegal" because just trust me bro . There won't be any false-positives because just trust me bro . Even if you do believe the Governments are fully trus…

> You can't for a second imagine how that could possibly go wrong?

I can, and that is why I am against ChatControl. But many many comments here say stuff like "it breaks encryption", and that's not actually what it does.

The debate should focus on what ChatControl cannot solve, not on details it could solve. If you spend your day complaining about something that can be solved, politicians will (rightfully) say "I hear you, don't worry we will solve that".

> There won't be any false-positives because just trust me bro.

"There will be false-positives, but they won't have any impact on you". You find it invasive? 99% of people don't care, they already give all their data to private companies like TooBigTech.

> whether adversaries have compromised the system to add their own hashes.

So what? Legal material gets reported to the authorities, they see it's legal, and they realise that the list has been tampered with.

> And we don't know that the mechanism that sends our private messages

"Don't worry, we will make the code open source, you'll be able to audit it!"

> The hashes are "only for what's deemed illegal" because just trust me bro.

YES. That's my problem with it. It can be abused because fundamentally we cannot audit those hashes. We don't want to create a system that gives that power to whoever controls it.

Re: ChatControl: EU wants to scan all private messages, even in encrypted apps

#553

Post by palata »

amarant wrote: post #454
palata wrote: post #419

Earlier quoted context omitted.

The fact that ChatControl is killing democracies. It's a tool that could be abused, but I wouldn't say that it is enough to kill a democracy all by itself.

To make a silly analogy: A stone in go has 4 liberties. Take away all four and the stone dies. Chat control takes away one liberty from democracy. Ask any half decent go player what will happen to that stone if we just ignore the attack upon it?

If they suspect that you own CSAM material, law enforcement will check your devices. Actually if they have convincing arguments, the way they get access to your devices may touch your physical integrity.

You don't have the liberty to avoid that, today. By design.

My point being that if one could prove that the ChatControl detection is only running locally and that it is only reporting what's acceptable to report, then it wouldn't hurt your freedom (except for your freedom to do illegal stuff, but that's the whole point).

The problem is that it is not possible to prove this. Fundamentally. We need to talk about that. Not throw some "it will kill democracy because you should trust me when I say it".

Re: ChatControl: EU wants to scan all private messages, even in encrypted apps

#554

Post by DeusExMachina »

victorbjorklund wrote: post #530
ohman876 wrote: post #510

Earlier quoted context omitted.

> If this gets pushed through, you will gradually lose control of your government A little bit off-topic but so called president of the EU is not elected, nor are the figures in so called EU commission :)

EU commission president isn’t directly elected, but neither is the US. President. Voter choose electors who then pick the US president. In EU: voters elect national parties that form groups in the Parliament, which then elects the Commission President.

The two are not comparable. In the US, the presidential candidate is known in advance and people vote mostly for the candidate they want, even if indirectly.

In the EU, no party runs with a candidate for the commission. Those are decided only after the election and are often people that would have lost a party votes if they were known in advance.

Re: ChatControl: EU wants to scan all private messages, even in encrypted apps

#555

Post by onequestion1 »

senko wrote: post #525

Meanwhile, in one part of the EU (Croatia): urgent tax law change is being considered to allow the tax authorities to demand access (passwords, keys, etc) to any electronic/digital device or service used by a person involved with (owning, operating, or just working in) a business, "to combat tax fraud". No warrants necessary.

Can you please give a source on this? t. balkanian

Re: ChatControl: EU wants to scan all private messages, even in encrypted apps

#556

Post by palata »

ulrikrasmussen wrote: post #485
palata wrote: post #318

Earlier quoted context omitted.

Ok, but with ChatControl, you still send your messages encrypted. They are scanned on your device . So all communications aren't stored outside of your device, right?

All falsely flagged communication is. And there will be lots and lots of it, even if it is just a tiny fraction of the total number of messages sent, since the number of messages sent between people is so big. This is the classic problem with statistical methods looking for rare things in large populations which also is why we don't screen everyone for all illnesses all the time - the false positives would do too muc…

If you care about the tiny fraction of the total number being stored by the government, frankly you should care a lot more about all the data being stored by TooBigTech.

Feels a bit hypocritical to accept one and not the other.

Really, I think that the problem with ChatControl is that it is a weapon for surveillance. Not because of the false positive, but because whoever controls it can decide what gets reported. Depending on how a government evolves, that could be very dangerous. And we have examples of governments evolving like this in history.

Re: ChatControl: EU wants to scan all private messages, even in encrypted apps

#557

Post by palata »

mystraline wrote: post #459
palata wrote: post #422

Earlier quoted context omitted.

> By definition, they must state what is actually illegal, lest I be hidden laws with hidden punishments. I don't need to murder you in order to say that murdering you is illegal, do I? Of course they don't have to publish CSAM material in order to say that this is illegal CSAM material. If you could go get CSAM material at your local library, nobody would be talking about scanning it with ChatControl...

Then from a picture, tell me what the exact age of the nude person is. Again, we need to know the exact year and day. 17y364d is illegal but 18y is legal.

Not sure how this answers my comment above.

Re: ChatControl: EU wants to scan all private messages, even in encrypted apps

#558

Post by palata »

AlexandrB wrote: post #494
palata wrote: post #251

Earlier quoted context omitted.

This is nonsense. Anyone who has the smallest clue would use Signal for anything sensitive. Of course people would use Signal to talk about illegal stuff. I am against ChatControl. But I am amazed by all the bullshit arguments that people find to criticise ChatControl. If you have more control, obviously it's easier to track criminals. That's not the question at all. The question is: what is the cost to society? A fe…

> If you have more control, obviously it's easier to track criminals. So why are criminals not being tracked? Seems like there's a shit ton of cameras everywhere but stores are still locking everything valuable behind glass. The benefits of this stuff never seem to materialize in practice.

Sorry, but you won't convince anyone with that argument.

That's my point: there are good arguments against ChatControl. Better focus on them.

Re: ChatControl: EU wants to scan all private messages, even in encrypted apps

#559

Post by palata »

AlexandrB wrote: post #497
palata wrote: post #426

Earlier quoted context omitted.

Most, not all of them. Or are you saying that we should not care about the others?

It's impossible to stop all crime without an all-encompassing surveillance state. At some point you have to set boundaries for what the state is allowed to do in the name of safety.

Agreed. But then you have to explain how you set your boundary. You can't just say that the right boundary is yours.

ChatControl will protect some kids. If your argument is "yeah, shit happens", you won't convince anyone. If your argument is "yes, but at a great cost for society", then you need to explain what the cost is.

Saying "your freedom" is worth exactly as much as "but CSAM" when said from the other side. It's not enough. What is the tangible risk of ChatControl?

Re: ChatControl: EU wants to scan all private messages, even in encrypted apps

#560

Post by 8fingerlouie »

gambiting wrote: post #431
nickslaughter02 wrote: post #378

Earlier quoted context omitted.

I'm looking forward to seeing this in practice when Chat Control passes.

In what way? Most EU countries are for it, so of course they are going to implement it. Nothing to do with sovereignty.

except for some countries, the right to privacy is also written in the constitution, which would require changing said constitution, which is probably a lot harder than just implementing a law.

I can't say what it takes in every country, but in Denmark the procedure is as follows :

- The proposed change must pass a vote in parliament.

- There must then be an election to parliament.

- The new parliament must also vote in favor of the proposed change.

- Finally a popular vote must pass with at least 40% of all eligble voters voting for it. If less than 40% of eligble voters vote (regardless of where they cast their vote), the proposition fails.

It probably goes without saying that changing the Danish constitution is not a task taken lightly. The Danish constitution also explicitly forbids giving up soverenity.

Post reply on HN