5 ms·

Why does this stupid idea have to be killed so many times? Being watched constantly means living in fear, but seeing it almost become legally mandated practice

by an_ko 1y ago

Why does this stupid idea have to be killed so many times? Being watched constantly means living in fear, but seeing it almost become legally mandated practice over and over again is itself a form of living in fear. I'm so tired.

amelius 1y ago
Open source will find a way around it; there's no reason to be afraid. Unless one day their spyware is installed at the hardware level but that would be the equivalent of raiding our homes, so that's not very likely.
- ekianjo 1y ago
  open source wont save you. if they make encryption without backdoor illegal they will just throw you in jail
  - amelius 1y ago
    https://en.wikipedia.org/wiki/Steganography https://en.wikipedia.org/wiki/Steganography
  - wobfan 1y ago
    It'll definitely save the criminals. Selling drugs on the Internet is also illegal. Selling them in real life too. How many people are doing it still? Doesn't seem very effective, this solution.
  - ghusto 1y ago
    They will once they catch you doing it, yes. The people who this _won't_ stop however, are criminals.
    - morkalork 1y ago
      Seeing that carve out for Google with non-licensed androids being banned from the age verification app., it looks like there's going to be a heavy swing towards trusted devices and apps. in general. Perhaps untrusted ones will be blocked from carrier networks. And then what? You'll be able to have phones with your own custom apps/chat installed that's useless, or phones that are useful but you're stuck with only official, compromised apps.
- inglor_cz 1y ago
  Many OSS developers live in Europe and the logical next step will be throwing them in jail for production of illegal software.
EagnaIonat 1y ago
It was more misunderstood than stupid. Ironically when Apple introduced their solution it was actually better than what we have now. It was interesting to watch people lose their minds because they didn't understand how the current or proposed system worked. Current system everything can be decrypted on the cloud and is scanned for CSAM by all ISPs/service providers. Apple wanted the device to scan for CSAM and if it got flagged, it allowed the file to be decrypted on the cloud for a human to check it (again, what happens now). If it didn't get flagged then it stayed encrypted on the cloud and no one could look at it. This not only was a better protection for your data, it has a massive reduction in server costs. CSAM is also a list of hashes for some of the worst CP video/images out there. It doesn't read anything, just hash matching. The chance of mismatch is so incredibly small to be almost non-existent. Even so the current CSAM guidelines require a human to review the results and require multiple hits before you are even flagged. Again this is what is happening now. Personally I'm against having any agency the ability to read private messages, while at the same time I fully agree with what CSAM is trying to do. Realistically if countries want to read encrypted messages, they can already do so. Some do too. The fact that the EU is debating it is a good thing.
- wobfan 1y ago
  > Realistically if countries want to read encrypted messages, they can already do so. How? Are you implying adynchronous and synchronous encryption is broken? Because last time I checked since Snowden our encryption is basically the one single thing in the whole concept of the internet that has been done very right, with forward secrecy and long term security in mind. AFAIK there are no signs that someone or something has been able to break it. Also, the solutions you present do imply that someone already has the private key to decrypt. Sure, they'll say they'll just decrypt if your a bad person, but the definition of a bad person changes from government to government (see USA), and from CEO to CEO. Encryption should and mostly is built on zero trust and it only works with zero trust. Scanning, and risking the privacy of billions and billions of messages by having the key to read them because there have been some bad actors is fighting a fly with a bazooka. Which sounds funny overkill, but, fun fact, it also just doesn't work. It destroys a lot, and gains nothing. I don't have a better solution for the problem. But this solution is definitely the wrong one.
ghusto 1y ago
Almost as if there should be a rule that disallows introducing the same proposal multiple times under different names.
- raron 1y ago
  AFAIK there is a rule like that, but it needs that the proposal was voted down. Chatcontrol was never voted on by the EP. They bring it up every half a year and it would not be voted on until they can be sure it would pass.

by an_ko 1y ago

amelius 1y ago

Open source will find a way around it; there's no reason to be afraid. Unless one day their spyware is installed at the hardware level but that would be the equivalent of raiding our homes, so that's not very likely.

ekianjo 1y ago
open source wont save you. if they make encryption without backdoor illegal they will just throw you in jail
- amelius 1y ago
  https://en.wikipedia.org/wiki/Steganography https://en.wikipedia.org/wiki/Steganography
- wobfan 1y ago
  It'll definitely save the criminals. Selling drugs on the Internet is also illegal. Selling them in real life too. How many people are doing it still? Doesn't seem very effective, this solution.
- ghusto 1y ago
  They will once they catch you doing it, yes. The people who this _won't_ stop however, are criminals.
  - morkalork 1y ago
    Seeing that carve out for Google with non-licensed androids being banned from the age verification app., it looks like there's going to be a heavy swing towards trusted devices and apps. in general. Perhaps untrusted ones will be blocked from carrier networks. And then what? You'll be able to have phones with your own custom apps/chat installed that's useless, or phones that are useful but you're stuck with only official, compromised apps.
inglor_cz 1y ago
Many OSS developers live in Europe and the logical next step will be throwing them in jail for production of illegal software.

EagnaIonat 1y ago

It was more misunderstood than stupid. Ironically when Apple introduced their solution it was actually better than what we have now. It was interesting to watch people lose their minds because they didn't understand how the current or proposed system worked. Current system everything can be decrypted on the cloud and is scanned for CSAM by all ISPs/service providers. Apple wanted the device to scan for CSAM and if it got flagged, it allowed the file to be decrypted on the cloud for a human to check it (again, what happens now). If it didn't get flagged then it stayed encrypted on the cloud and no one could look at it. This not only was a better protection for your data, it has a massive reduction in server costs. CSAM is also a list of hashes for some of the worst CP video/images out there. It doesn't read anything, just hash matching. The chance of mismatch is so incredibly small to be almost non-existent. Even so the current CSAM guidelines require a human to review the results and require multiple hits before you are even flagged. Again this is what is happening now. Personally I'm against having any agency the ability to read private messages, while at the same time I fully agree with what CSAM is trying to do. Realistically if countries want to read encrypted messages, they can already do so. Some do too. The fact that the EU is debating it is a good thing.

wobfan 1y ago
> Realistically if countries want to read encrypted messages, they can already do so. How? Are you implying adynchronous and synchronous encryption is broken? Because last time I checked since Snowden our encryption is basically the one single thing in the whole concept of the internet that has been done very right, with forward secrecy and long term security in mind. AFAIK there are no signs that someone or something has been able to break it. Also, the solutions you present do imply that someone already has the private key to decrypt. Sure, they'll say they'll just decrypt if your a bad person, but the definition of a bad person changes from government to government (see USA), and from CEO to CEO. Encryption should and mostly is built on zero trust and it only works with zero trust. Scanning, and risking the privacy of billions and billions of messages by having the key to read them because there have been some bad actors is fighting a fly with a bazooka. Which sounds funny overkill, but, fun fact, it also just doesn't work. It destroys a lot, and gains nothing. I don't have a better solution for the problem. But this solution is definitely the wrong one.

ghusto 1y ago

Almost as if there should be a rule that disallows introducing the same proposal multiple times under different names.

raron 1y ago
AFAIK there is a rule like that, but it needs that the proposal was voted down. Chatcontrol was never voted on by the EP. They bring it up every half a year and it would not be voted on until they can be sure it would pass.