5 ms·
"End-to-end encryption means the company providing the service does not have access to the key, meaning it cannot "listen in" to what is being shared - giving t
by IsaacL 9y ago
"End-to-end encryption means the company providing the service does not have access to the key, meaning it cannot "listen in" to what is being shared - giving the sender and recipient added confidence in the privacy of their conversation.
"The principle of confidentiality should apply to current and future means of communication, including calls, internet access, instant messaging applications, email, internet phone calls and personal messaging provided through social media," said a draft proposal from the European Parliament's Committee on Civil Liberties, Justice, and Home Affairs."
How would this work in practice? Would any web service that includes a private messaging feature need to ensure it is end-to-end encrypted? Would there be fines or penalties for startups that included an unencrypted messaging feature in their product?
- nvarsj 9y agoThe same as any other similar legislation, like requiring cookies notification on every website, or the data protection requirements.
- kuschku 9y agoEvery site with the cookie notification violates the original cookie regulation. The original regulation is clear, you only need to ask the user if you want to track them, no matter how, but they have to be able to opt out of tracking. - Login cookies? No notification required. - Tracking via fingerprinting? You need to ask. - User says no to the tracking? You have to allow them to continue using your service. It’s pure bullshit what most sites do, based on the UK interpretation of the cookie law. Luckily, that’s gone soon (both due to the EU GDPR, and due to Brexit)
- IsaacL 9y agoBut implementing end-to-end encryption is much harder than adding a cookie notification. https://www.howtogeek.com/166507/why-most-web-services-dont-use-end-to-end-encryption/ https://www.howtogeek.com/166507/why-most-web-services-dont-... There's a few startups working on platforms to make adding E2E encryption easier, but I doubt the EU is planning to mandate everyone use their services. The plan sounds nice from a distance (who in tech is anti-encryption?) but closer inspection reveals problems. All legislation can do is ban certain activities. You want to release a new dating app, or add a basic messaging feature to your Q&A site, and you're not a crypto expert with 3 months to spend adding E2E encryption? Should it be illegal for you to release your app without encryption?