Hacker News Reader

Comment by chii | Hacker News Reader

This is why full end to end encryption is required.

Technology always loses to policy when the government has a monopoly on force.

No government does. There are power vacuums and blind spots everywhere. That's why you taking a bit of power in your hands works.

How do you know someone in the group chat isn't a spy for the government?

How do you know the government does not already have the root cert anyway

I hope some day we have RISCV phones where you can swap processors and all software is auditable.

This isn't how E2E encryption works.

You don't know that a group is free of spies, but a group is less likely to have a spy than the current setup whereby pervasive, omnipresent surveillance is facilitated by WeChat, leading to people needlessly imprisoned and tortured for the thoughtcrime of others.

In that case you need to pay those spies, while at this moment you just run a database query.

You don’t need to pay neighbors to report one another. They’ll turn each other in over petty grievances, or the expectation of favored treatment by authorities. China’s social credit points seem like a potentially powerful incentive.

Examples from East Germany:

https://spiegel.de/international/germany/east-german-domesti...

WeChat groups are designed to be private (as opposed to being public, not necessarily to protect privacy). To join one you normally have to know either the admin or a member of the group. A QR code for public access is available but it's forced to expire in seven days. So for a regular sized group of a few dozen people, it's relatively easy to spot a stranger.

How do you know you can trust your friends?

I think that’s naive. China can just arrest you for using encryption.

Same result.

(This isn’t limited to China - the US could have similar results with slightly differing laws)

Enter: steganography. Useful under totalitarian regimes, I would think.

Unlike the burden required to hide gigs required for large file transactions, hiding mere hundreds of bytes for textual conversations might be feasible. Maybe. Distribution of participating client software might be the problem.

When they discover that you have stenographic tools on your computer, how will they know when to stop torturing you?

So the real solution is to force everyone to use stenographic tools.

Basically, the point is to make it so it is impossible to tell the difference between a normal user and a crypto user.

So the only way they could target you is if they target 1 billion other people in the world.

Unfortunately there's already steganography detecting software on the market[0], and it seems they have a branch in China[1]. But that is a little reductionist of me because there are evolving techniques being produced by researchers that are not so easy to detect. For example I recently read about a CNN-based method for hiding data in images that proved much more resilient against detection.

[0] https://www.wetstonetech.com/products/stegohunt/

[1] https://www.wetstonetech.com/corporate/channel-partners/

Steganography can be trivially detectable though if someone actually starts looking for it. The problem is that making it accessible makes it stand out.

As long as you don’t share it in a picture of Winnie the Pooh! LOL!

They can't arrest everyone. Make encryption widespread and unquestionably superior to unencrypted communication and I don't think the government can do much to stop it.

According to Wikipedia [1] Stalin actually came pretty close to arresting everyone.

[1] https://en.wikipedia.org/wiki/Gulag#Brief_history

Encryption should be a free speech issue, assuming we keep free speech.

Not if literally everything is using encryption.

The point of encryption and plausible deniability, is to force everyone to use encryption, so that if authoritarian regimes want to punish people, then they have to screw over everyone, including completely innocent internet users.

See xkcd 538: https://xkcd.com/538/

There is a difference between "a random bureaucrat can read all my chats just by typing at the keyboard" and "a random bureaucrat must authorize and pay for someone to pay me a visit".

You don't encrypt everything to prevent the state actors from breaking it--if a state actor wants you bad enough they'll just fabricate what they need and arrest you. You encrypt everything to prevent random idiots (including those working for state actors) from getting at your stuff cheaply.

If it's expensive enough, there will always be lower hanging fruit to go after. I don't need to out run the hungry tiger; I simply need to out run somebody else being chased by the tiger.

Reply on news.ycombinator.com