Hacker News Reader

Comment by silvestrov | Hacker News Reader

No, the problem is that the SMS standard was never updated with an encrypted version.

Apple didn't want to open iMessage to the world. EU/USA should enforce a common, secure method for sending text messages to mobiles.

View on HN

> EU/USA should enforce a common, secure method for sending text messages to mobiles.

No way do we want any regulation here! I will accept balkanization of messaging apps for the lack of government interference here. If a government messaging standard is introduced, it will absolutely be designed to consider lawful intercepts like US CALEA. It would be a key escrow system upon inception.

EDIT: downvoters, join the debate. Do you feel differently? If so, why?

Shouldn't such old standards like SMS just die?

I didn't write or receive any SMS for like 5 years now (except some confirmation codes) since encrypted messengers became so common and accessible.

I think it's obvious that SMS is outdated either way and I too think that encryption should be P2P on the "application layer" for many reasons. Encrypting the actual physical transport would add extra cost in terms of latency and hardware and could become a maintenance disaster over time if I'm not mistaking.

I downvoted you because you show disdain regulation but it is clear the marketplace for a secure, unified messaging solution has failed. EU regulation of the telcom sector has proven effective in protecting consumers from poor decisions (such as exorbitant roaming fees). Regulation should not be the first option, but the last, and it is clear it is the only solution left in this regard.

It's not a general disdain but IMO here it makes sense.

Has it really failed though?

Do we have secure SMS messages? Do we have unified mobile messaging with a mature protocol that is both widely accessible as well as secure? How many more decades shall we wait? (asked rhetorically, yet politely) Yes, I argue it has failed, and an SMS/MMS successor would look like a descendent of iMessages and Google's RCS.

iMessages supports CALEA (but is still end to end encrypted, as well as FaceTime), all US messaging products must support it (even Twilio supports it [1] [2]). You are unable to subvert nation state legal jurisdictions within fundamental telcom infrastructure. Signal can get away with it, Apple, Google, and cellular carriers cannot.

Can't have your cake (universal messaging) and eat it (end to end encryption with zero trust requirement) too. So can't we push from something better than SMS, using regulation if required? It must not be perfect, but simply extensible in the future (similar to SS7). In jurisdictions that are favorable to it, you support E2E encryption. In those that are not, you downgrade loudly. Compromises must occasionally be made.

[1] https://www.twilio.com/legal/law-enforcement-guidelines

[2] https://support.twilio.com/hc/en-us/articles/223136547-Submi...

The telcos were a national monopoly, which then became "deregulated" but for all practical purpose they hold a monopoly position with regards to cable-in-the-ground and various local right-of-way rights.

So, the SMS solution is what these quasi-regulated entities gave you. Whereas iMessage, RCS, Signal, etc is what private industry gave you.

I think it's great when private industry innovates and utilities can incorporate that innovation in new standards.

Literally every single time government create a communication system the first thing they do is to make sure they can read it completely breaking the overall security. Look at all the state version of 'email' non of them used end-to-end encryption. Germany had a nice example but of course the project crashed and burned.

Also, its simply false that the market has not produced good solutions and if there was a 'unified message solution' then people would cry 'monopoly' and demand government regulation as well.

The fact is that the standard tool for most people use for messaging in Europe is an incredibly secure protocol.

I'm curious to know how you feel about Tor being primarily funded by the Office of Naval Research and DARPA

Honeypot?

I feel that there is a significant difference between funding and owning/building. I also feel confusing the two harms both the value of grants and the legitimate privacy concerns for public sector tech projects.

They provide money to an independently organised group who I trust with code and a design that has nothing to do with the government. Totally different situation.

It seems silly to reject regulation without seeing it and assuming the worst. After all, we already have the worst—closed source manipulative chat apps that exploit for profit for a small cabal of capitalists.

It’s better than entrusting messaging to a cabal of socialists. Capitalism means that there is diversity in products. If you don’t like Apple’s iMessage or What’s App, create your own. You might like your government today, but I am unwilling to bet my life on government being trusted to do the right thing. Also, the right thing for you might not be the right thing for everyone. That’s what capitalism understands that socialism doesn’t.

Capitalism means there’s a diversity of products and they are ALL bad. We need collectivization to actually produce software that primarily benefits the user.

If we want the equivalent of 1987 Aeroflot, then sure, let’s do that. If the products are all bad, what’s stopping you from making a good one? You’d be a billionaire overnight, assuming the market agrees that they are all bad. I’ve used France’s government sponsored taxi app and it doesn’t come close to Uber’s. I’ve ridden in public buses and they don’t come close to the private FAANG shuttles in Silicon Valley. If you build technology optimized for everyone, that means it’s necessarily optimized for no one.

As far as messaging apps, iMessage benefits me greatly. The premise that apps don’t benefit the user is flawed: if they didn’t benefit the user, nobody would use it — except government, we have no choice on using government or not. If the government meets 99 people’s needs, but doesn’t meet my needs, I’m stuck. I can’t switch to an alternative. If an app meets 99 people’s needs but not mine, I can switch to an alternative or build my own. Nothing is stopping you and your friends from building the most amazing messaging app ever. From someone who grew up remember Lada and Yugo, my faith in collectivism in product development is admittedly thin. Very few products from Soviet era factories were any good, I have no expectation that a government built Messaging service would be any better.

> what’s stopping you from making a good one? You’d be a billionaire overnight,

This is exactly the problem with this site: no good tools made anyone rich.

There’s a reason I am having this discussion on HN: People should separate the building of valuable things from the pursuit of riches. Those two are inherently contradictory, and we have nothing but closed mediocre technology making someone rich who barely worked at all.

I believe cooperatives, collectives, and trade unions should be discussed more here. Nothing about Yelp is hard to build, and yet it’s a piece of crap, but the only piece of crap we have. Capitalism is a future of absolute mediocrity, where your needs are considered proportional to your wealth.

I'm sure both of your positions have merit, however I do think it's a bit disingenuous to claim that a capitalist system rewards a good solution in any way. It rewards good marketing.

"Small cabals of capitalists" didn't murder a hundred million of their own customers in the last century alone. It took governments to do that. (Or, I suppose, tobacco conglomerates.)

So when the regulators come to you and explain why they need a back door in the messaging protocol you're working on, try downvoting them.

The foreign policy of the US, including all invasions, death squads, oppressive trade deals supporting open slave labor (sometimes to death), is primarily to support the business interests of the upper class of the united states. The petite bourgeois’s increased “quality of life” (which is an incredibly misleading term) is a byproduct of the largest wealth redistribution in history, at american gunpoint.

So, it’s incredibly disingenuous to reduce all alternatives to capitalism to murder when american capitalism is objectively morally broke.

'Whataboutism' isn't the answer, I'm afraid.

If "the business interests of the upper class" makes governments do all the evils, why do you think this time will be different?

It won’t, permanently, and who thinks that about anything? But it would be a good change to try and have human ethics reflected on a societal level. I do have faith with enough failed attempts at capitalism we’ll learn, and at some point in the future capitalism will have the big failure, the one that makes it obvious how unsustainable it is. I’d like to avoid that one in my lifetime. One way that could happen is our AUTOMATED nuclear system built to protect capitalism fails and accidentally destroys civilization. This could happen at literally any time.

> "Small cabals of capitalists" didn't murder a hundred million of their own customers in the last century alone. It took governments to do that. (Or, I suppose, tobacco conglomerates.)

lol I appreciate you offering an excellent counter-example to your own point within the sentence.

I agree with you. If security is the goal, trusting a nation state with the rules would be antithetical.

More importantly, even if the standard wasn't required to have lawful intercepts, carriers want would provide it. They aren't in the business of making legal stands to protect privacy.

There is a new standard to replace SMS in flight called RCS. Arguably, this makes the world better -- SMS sucks, RCS brings a lot of the iMessage features to standard carrier messaging. But therein lines the problem: it's carrier-controlled, and carriers want lawful intercept. So, the standard does not call for end-to-end encryption and it is not implemented.

I still think this is a better state of the world than SMS, but it's pretty depressing that it's 2019 and e2e encryption isn't the default. I understand why it isn't when there's government interests in play, but it's still depressing.

I agree with you. The Balkanization of messaging services is a minor inconvenience compared to the cost of a government mandated standard.

That, and I’m fairly certain any government mandated standard would just be one more service to support.

> If a government messaging standard is introduced, it will absolutely be designed to consider lawful intercepts like US CALEA.

Then that is obviously not what the parent is asking for. The government could decide to enforce an insecure messaging standard at any time. What does that have to do with the people demanding them to enforce a secure one? Are you suggesting that if we demand a secure messaging standard, it will give them the idea of turning around and enforcing an insecure one instead, as though they haven't had that idea already?

"it will absolutely be designed to consider lawful intercepts" is a bit of a stretch. If we were talking just the US, I would agree that that precedent has been set. But we're not, we're also talking the EU - which doesn't have a history that dystopic.

I dunno, Articles 11 and 13 came pretty close... the old EUCD proposal some years ago...

Those articles were rejected.

> If a government messaging standard is introduced, it will absolutely be designed to consider lawful intercepts like US CALEA.

Happened exactly like that when Germany introduced their "official version" of e-mail, called "De-Mail".

When the Chaos Computer Club pointed out how their whole system is insecure, due to, amongst other issues, a lack of end-to-end encryption. The German government simply decided to declare the whole thing as "secure" trough legal definitions [0].

Which means that in practice the system is not secure, but the law considers it secure because it fulfills the arbitrary, political, definitions for "secure transmission", which also includes the capabilities for lawful interception.

[0] http://www.spiegel.de/netzwelt/netzpolitik/de-mail-bundestag...

Introducing a better "SMS" standard wouldn't kill your messaging apps, so I don't see the problem, even if they come with lawful intercept crap. SMS gets strictly better, even more secure messengers still exist and will continue to be used widely.

I agree with your main point but I feel like SMS is going to remain cleartext forever. It's basically like email (it's not like encrypted email formats ever gained mainstream traction). Besides I can't really imagine the EU/USA pushing for end-to-end SMS encryption.

Fortunately as data plans get cheaper we have plenty of alternatives for encrypted messaging on smartphones.

Didn't the UK prevent SMS encryption when the standard was developed?

Reply on news.ycombinator.com