Hacker News Reader

Comment by OedipusRex | Hacker News Reader

"We are writing to request that Facebook does not proceed with its plan to implement end-to-end encryption across its messaging services without ensuring that there is no reduction to user safety."

Isn't the entire point of E2E Encryption for user safety, as in safety from the government reading your message?

View on HN

They’re talking about national security. They want to read your messages so they can see if you’re a potential terrorist. They are not talking about users security. They don’t give a fuck about that as evidenced by the equifax debacle.

> They want to read your messages so they can see if you’re a potential terrorist.

That is their stated reason. If given access they will also read your messages to determine if you are a drug dealer, or a drug user, or have committed financial crimes, or if you're organizing disfavored political activity, or...

Even the capability of mass surveillance means that the public can be abused by the powers that be without much worry of backlash. It takes fear of the public out of the policy making equation, along with having a chilling effect. I don't think a representative democracy is really representative or a democracy anymore with a power imbalance that steep. Nevermind Citizens United.

True E2E Encryption would also mean the platform(FB, Telegram, Google, Apple, etc.) also can not read the messages and thus the law enforcement can not force them to reveal what a user said because it would be impossible for them to know.

You are partially right but the issue is that E2E isn't even enough. E2E doesn't matter if they force a patched binary that also sends the data to the government. This is EXACTLY what the Australian laws saws they must do, oh and it is a gag order so they can't disclose it.

I'm starting to wonder if this is a smokescreen. Eventually give in to E2E because you know you have got app store signing keys for the apps so you can upload a patched one with backdoors.

> You are partially right but the issue is that E2E isn't even enough. E2E doesn't matter if they force a patched binary that also sends the data to the government. This is EXACTLY what the Australian laws saws they must do, oh and it is a gag order so they can't disclose it.

> I'm starting to wonder if this is a smokescreen. Eventually give in to E2E because you know you have got app store signing keys for the apps so you can upload a patched one with backdoors.

Is there no way to prevent auto-updating of apps? If the app blocks access barring upgrade it may be suspicious. Though I guess the upgrade would probably be veiled in new features.

On iOS, you can disable automatic app updates in the Settings.

Some apps (like Signal) force you to upgrade or they eventually stop working. It's a terrible practice.

Right, because the alternative of having a broken user experience for a monotonically increasing set of your users isn’t terrible.

How would letting people continue to use what's been working for them cause a "broken user experience"?

Users should have to power to decide when and if to update. If their old version causes them technical problems or exposes them to security issues that is their business. Software can (and often should) offer auto-updates to make things easier for most users but it should respect a user's choice not to update. Especially when updates often introduce anti-features and/or disable existing features.

Can't speak for Signal but an app might reasonably require an update when the API also had a breaking change.

This is a good point. E2E is better then not, but you still can't trust FB. Anybody who seriously cares about privacy will still use something open source.

But its not about those couple people, its about rolling out better security to billions of people. Even a 0.01% increase in secuirty is an incredible benefit if it runs on a platform like Facebook.

It also totally changes how government has to force Facebook into giving them something. They can't just request access to some server anymore.

The main way to defeat a state is to make mass survailance difficult enough that it doesn't scale well.

And not just the gag order, there is limited reporting so you don't even know if the laws are or are not being used.

Apple has true E2E encryption with iMessage if you don't turn on iCloud backup of your messages. It's encrypted when it leaves your device and decrypted on the receiving device. Furthermore the messages on your device are locked via passwords from the Secure Enclave.

> if you don't turn on iCloud backup of your messages

You and whoever you are messaging of course.

Of course. That's exactly why they don't want E2E encryption.

Reply on news.ycombinator.com