6 ms·

I wonder where platforms like slack would land in all of this, and how would they go about akeeping people from just using their own encryption e.g. pgp over un

I wonder where platforms like slack would land in all of this, and how would they go about akeeping people from just using their own encryption e.g. pgp over unencrypted channels? Is public key cryptography too weak to matter?

naijaboiler 1y ago
This legislation makes every digital communication open to being policed at the source. It is far too overreaching and too rife for abuse.
palata 1y ago
Slack is not end-to-end encrypted and belongs to a US company. So there is no need for ChatControl there: the US government already has access to everything that is written on Slack.
- Bender 1y ago
  I believe they are referring to using GPG to encrypt data before putting it into Slack, much like using the out of band OTR. In that case all the data shared between those using GPG or OTR would only be accessible to those with the right out of band keys. There are probably not a lot of people doing this, or not enough for governments to care. I do this in IRC using irssi-otr [1]. If that ever became illegal because encryption then groups of people could simply use scripts or addons to pipe through different types of encoding to make AI fuzzy searches harder. They can try to detect these chains of encoding but it will be CPU expensive to do every combination at scale given there are literally thousands of forms of encoding that could be chained in any order and number. Mon -> base64 -> base2048 [2] Tue -> base2048 -> base131072 [3] ...and so on. [1] - https://irssi.org/documentation/help/otr/ https://irssi.org/documentation/help/otr/ [2] - https://github.com/qntm/base2048 https://github.com/qntm/base2048 [3] - https://github.com/qntm/base131072 https://github.com/qntm/base131072
  - palata 1y ago
    > I believe they are referring to using GPG to encrypt data before putting it into Slack In good approximation, nobody does that. And anyone who is capable of communicating over PGP won't be covered by ChatControl anyway. They can keep using PGP over whatever they want, or just compile Signal from sources. > If that ever became illegal because encryption then groups of people could simply use scripts or addons to pipe through different types of encoding to make AI fuzzy searches harder. I don't think that this makes any sense at all. This is some kind of poor encryption. Either you honour the law and you send your messages in plaintext, or you don't and you use proper encryption. There is nothing worth anything in-between. If encryption is illegal, those who really need it can still use steganography.
    - Bender 1y ago
      This is some kind of poor encryption. In fact it is exactly zero encryption both technically and legally. By using encoding I would not be breaking the law at all assuming encryption itself is actually outlawed. Encryption is mathematical obfuscation. This is only useful for text to/from the server of course. Local storage is still being scanned which means one still have to use a device that does not have local scanning if the files are sensitive such as financial documents or those files would also have to be encoded. Encoding may not have value to some people but it has value to me. Obviously if I am trying to hide something that is highly sensitive like a master password database then I would probably do something a tad bit stronger, maybe 64 to 256 chains of encoding. This is still sufficient to break fuzzy scanning. Here's an easy one: MDExMTAxMTEwMDExMDAwMDAwMT EwMDAwMDExMTAxMDAwMTExMDEx MTAwMTEwMDAwMDAxMTAwMDAw MTExMDEwMDAwMTAwMDAwMDEwMA oxMDAxMDAxMDAwMDAwMTEwMDAw MTAxMTAxMTAxMDAxMDAwMDAw MTEwMDAwMTAwMTAwMDAwMDExMT AwMTEwMTEwMTAwMTAxMTAxMTAw CjAxMTAxMTAwMDExMTEwMDEw MDEwMDAwMDAxMTEwMTExMDExMD ExMTEwMTEwMTEwMTAxMTAwMDEw MDExMDAwMDEwMTExMDEwMAo= Zero encryption but it might take people a while to figure this out. The commands I used are installed by default to most Linux distributions. If I wanted to get really crazy I would add different levels and types of compression in the middle of the chain.
      - palata 1y ago
varispeed 1y ago
You are already looking for workarounds like people struggling under authoritarian regimes. This is completely unacceptable.

naijaboiler 1y ago

This legislation makes every digital communication open to being policed at the source. It is far too overreaching and too rife for abuse.

palata 1y ago

Slack is not end-to-end encrypted and belongs to a US company. So there is no need for ChatControl there: the US government already has access to everything that is written on Slack.

Bender 1y ago
I believe they are referring to using GPG to encrypt data before putting it into Slack, much like using the out of band OTR. In that case all the data shared between those using GPG or OTR would only be accessible to those with the right out of band keys. There are probably not a lot of people doing this, or not enough for governments to care. I do this in IRC using irssi-otr [1]. If that ever became illegal because encryption then groups of people could simply use scripts or addons to pipe through different types of encoding to make AI fuzzy searches harder. They can try to detect these chains of encoding but it will be CPU expensive to do every combination at scale given there are literally thousands of forms of encoding that could be chained in any order and number. Mon -> base64 -> base2048 [2] Tue -> base2048 -> base131072 [3] ...and so on. [1] - https://irssi.org/documentation/help/otr/ https://irssi.org/documentation/help/otr/ [2] - https://github.com/qntm/base2048 https://github.com/qntm/base2048 [3] - https://github.com/qntm/base131072 https://github.com/qntm/base131072
- palata 1y ago
  > I believe they are referring to using GPG to encrypt data before putting it into Slack In good approximation, nobody does that. And anyone who is capable of communicating over PGP won't be covered by ChatControl anyway. They can keep using PGP over whatever they want, or just compile Signal from sources. > If that ever became illegal because encryption then groups of people could simply use scripts or addons to pipe through different types of encoding to make AI fuzzy searches harder. I don't think that this makes any sense at all. This is some kind of poor encryption. Either you honour the law and you send your messages in plaintext, or you don't and you use proper encryption. There is nothing worth anything in-between. If encryption is illegal, those who really need it can still use steganography.
  - Bender 1y ago
    This is some kind of poor encryption. In fact it is exactly zero encryption both technically and legally. By using encoding I would not be breaking the law at all assuming encryption itself is actually outlawed. Encryption is mathematical obfuscation. This is only useful for text to/from the server of course. Local storage is still being scanned which means one still have to use a device that does not have local scanning if the files are sensitive such as financial documents or those files would also have to be encoded. Encoding may not have value to some people but it has value to me. Obviously if I am trying to hide something that is highly sensitive like a master password database then I would probably do something a tad bit stronger, maybe 64 to 256 chains of encoding. This is still sufficient to break fuzzy scanning. Here's an easy one: MDExMTAxMTEwMDExMDAwMDAwMT EwMDAwMDExMTAxMDAwMTExMDEx MTAwMTEwMDAwMDAxMTAwMDAw MTExMDEwMDAwMTAwMDAwMDEwMA oxMDAxMDAxMDAwMDAwMTEwMDAw MTAxMTAxMTAxMDAxMDAwMDAw MTEwMDAwMTAwMTAwMDAwMDExMT AwMTEwMTEwMTAwMTAxMTAxMTAw CjAxMTAxMTAwMDExMTEwMDEw MDEwMDAwMDAxMTEwMTExMDExMD ExMTEwMTEwMTEwMTAxMTAwMDEw MDExMDAwMDEwMTExMDEwMAo= Zero encryption but it might take people a while to figure this out. The commands I used are installed by default to most Linux distributions. If I wanted to get really crazy I would add different levels and types of compression in the middle of the chain.
    - palata 1y ago

varispeed 1y ago

You are already looking for workarounds like people struggling under authoritarian regimes. This is completely unacceptable.