Hacker News Reader

Comment by manfredo | Hacker News Reader

So in short:

* EARN IT creates a committee that is set out to define "best practices" for preventing child sex abuse.

* Companies that don't adhere to these best practices lose liability protections for user-generated content.

* The attorney general can unilaterally edit these best practices as he sees fit.

* The current attorney general has repeatedly made statements that he wishes to eliminate the ability for companies to offer end-to-end encryption - he wants all communications to be vulnerable to wiretapping.

This effectively gives the attorney general the power to compel tech companies to do whatever he wants (so long as he can argue that it's preventing sex abuse) by threatening to revoke section 230 protections, and it's likely that this would be used to revoke protections from companies that offer end to end encryption.

View on HN

This is a perfect case against centralized messaging: no company = no liability.

Sorry, moxie; there's going to be no way to have a beautiful e2e encrypted IM еxperience under wise oversight of a single company; only ugly p2p hodgepodge without a legal SPOF has a chance to pull it off.

We still need to replace the ultimate centralized industry: internet service providers. The telecommunications industry has always cooperated with the government and they can be ordered to block the "dangerous" messaging services. We need to somehow replace ISPs with a world-wide mesh network that can't be censored no matter how much governments want to.

I agree that ISPs are a problem, but it's possible to build a reasonably blockproof service with a doze of p2p darknet and reliance on common transport protocol (read: https). They would, essentially, have to find every node on the network and block them. Or perform very expensive traffic analysis, which can be defended against by designing normal protocol traffic to look very much like normal web traffic.

As always, adoption is going to be poor because even among geeks it's rare for one to deeply care about privacy & anonymity let alone lift a pinky for it.

Unfortunately, the worst threat is a legal one: just offer punishment for anyone who is found guilty of participating in such a network.

Unlike Signal, however, which the parent was taking a pop at - ISPs federate. This is a decent insurance policy in places covered by more than 1 ISP - if an ISP starts blocking content people want, they'll lose their customers overnight.

Not so good in most parts of America, though, where there's often an ISP monopoly.

How do you loop in the rural areas?

Unfortunately, in today’s App environment, no company = no signed binary = no relevance anywhere whatsoever.

Benefits of the push to "trusted computing" right here and there!

It doesn't have to be p2p. It just needs to be sufficiently decentralized, like email. If a company provides software but not a service then it's not liable under the new ruling. You can also run it outside of US jurisdiction. For example, use something like https://github.com/tinode/chat to set your own chat service.

Sure, they may try to go after a myriad of individual operators but it's a completely different story that forcing half a dozen US companies to drop e2e encryption.

If it has poor UX nobody will use it and people will use unencrypted centralized messaging instead.

> there's going to be no way to have a beautiful e2e encrypted IM еxperience under wise oversight of a single company;

At least, not headquarterd in countries where the government is known to compel staff to do "things". eg China, Russia, USA, Australia, (etc)

The article does mention that companies could argue they took "reasonable steps" if they refuse to follow the best practices. If they choose that route and win whatever court battle that follows, it'd essentially neuter this law. So there would at least a way out but it's risky.

Lets think of what "reasonable steps" a service provider of encrypted messaging could take to prevent child porn on their service...

* They could put up a big message saying 'no child porn'. I don't think that would be considered sufficient by a court.

* They could put a 'report' button. Again - insufficient.

* They could make client-side automated content scanners. Might be accepted by a court, but if you provide the scanner to the user, the government could argue it is easy to make images which bypass the scanner, which it would be.

* They could break encryption on some percentage of chats. A court would likely be looking at a particular case, and would consider the service provider not to have done their duty if the particular case at hand hadn't been checked.

I don't really see any reasonable steps which would stand up, other than breaking e2e and doing server-side scanning.

The proposed law (according to the article) requires the committee coming up with the rules to consider user privacy (not that they have to actually do that), but that gives a platform some cover to argue that breaking end-to-end encryption is not reasonable and that the report button will have to suffice.

That would be fine, if not for the fact that the committees rules can be completely overridden as desired, essentially making the committee nothing more than a public appeasement piece.

Do you know how much such an "argument" would cost? Forget all the small forums, 4chan, Mastodon instances after this law.

Maybe forget even Tor then, because by running a node at home or in your small business you are not adhering to the "best practices"

It would only take 1 platform with deep pockets to set a precedent for everyone

Say iMessage, for example?

Would such a thing have a positive side effect of effectively encouraging decentralized end-to-end encrypted technologies?

Don't Stand Out is a key privacy defence and is impossible with actually decentralized technologies. "The alleged terrorist was communicating with somebody else" is nothing, whereas "The alleged terrorist was communicating with JeremyNT's Private Node" means now you (JeremyNT) are getting the third degree. "It was somebody else" will get you just as far then as it would any number of people who were in the wrong place at the wrong time and went to prison (Birmingham Six) or worse (several inmates at modern US "black sites" as described in the Senate's book on torture).

When fifty people organise something the government wants to track but it can't distinguish that from the five hundred people ordering an Uber, the five thousand people reacting to a funny cat video or the fifty thousand people who just got a weather update those fifty people have privacy. That's important, it's why for example Signal uses Google's and Apple's generic notification frameworks rather than only using their own. It's also why eSNI plus DoH is on the critical path for the Internet.

> "The alleged terrorist was communicating with somebody else" is nothing, whereas "The alleged terrorist was communicating with JeremyNT's Private Node"

P2P does not imply direct communication between the private nodes of communicating parties.

We could have extremely strong anonymity today with a huge p2p (semi-dark-) net.

eSNI still gives away the public key for the encrypted host name. You only get a privacy advantage there if you're going through a large aggregator (Cloudflare, maybe Google and AWS load balancers), in which case, you have maybe reduced the number of governments that can identify your users. That's useful if you're trying to evade the GFW and you can find a service provider they won't block, but that's assuming GFW doesn't just block DoH and the ESNI txt records over plaintext DNS. And it adds a reliance on a small list of providers that have a scary monitoring capability themselves.

Not really. TLS 1.3 at least does a certificate-free ECDH handshake, deriving symmetric encryption keys that are then used to transmit the certificate(s) and any further negotiation. You can deploy TLS 1.3 without leaking anything to a passive observer, and blowing up in the face of an active (MitM) observer.

That's a problem with the internet in general really. eSNI or not, "don't stand out" can only work if you aren't standing out in regards to the source and destination IPs your packets have.

You can easily run a proxy from AWS (or whoever) to wherever, and get don't stand out, without giving the keys to your proxy host. If you cycle those often enough, you'll have some degree of don't stand out. Of course, if you use eSNI, or SNI, you'll still stand out

That's still assigning an IP to a website, and more than likely also assigning your identity or credit card to that IP address.

>Don't Stand Out is a key privacy defence and is impossible with actually decentralized technologies.

It's true that it's a key privacy defense but it's false that it's impossible.

People almost never deliberately use end-to-end encryption. They use it by accident when centralized services they already use like WhatsApp and iMessage implement it.

The people encouraged to use the decentralized end-to-end encryption would not be the average end user but the people who write the next generation of applications would use it and the end users would get it by accident just like they do now.

For the layperson (not trying to be insulting, just honest), sure. For hn readers, it's probably more appealing.

I find the parent comment more insulting than stating there is in fact a group of good people out there who value and seek privacy. Interesting that people are taking issue with my comment instead.

Elitist connotations aside, the fact that you want to use encryption is irrelevant if noone else is using. Are you going to talk to yourself, or only with a close-knit group?

I'm a member of several group chats on keybase which I use daily... Who is elitist here exactly? Sure I also have several friends who I talk to not on keybase. As soon as there's a service that's easier to setup, more reliable, and supports voice, I'll push it on all my friends.

Also, the keybase app on desktop runs 8+ processes, chewing more than 1gb of ram and several gb of storage, and the phone app is using about 1gb of storage too. I very begrudgingly endure this because it's the only service I trust so far, along with my friends who also value e2ee.

Really not sure what makes you adopt your attitude, can you explain? Do you think e2ee is not a worthy pursuit, or are you just being cynical?

I didn't intend "commoner" to be as insulting as people here seem to be reading it. Not everyone understands e2ee yet. I'd like to change that but it's the current reality.

Probably your use of the word "commoner".

It's just being honest, not insulting. Most people don't understand e2ee. They don't realize that reclaiming some privacy is an option available to them right now. (Or, they don't care, in which case I really do have less sympathy.)

"layperson" is a better word with a little less bite.

Thanks.

The continued subversion of our democracy

>Companies that don't adhere to these best practices lose liability protections for user-generated content.

https://signal.org/blog/the-ecosystem-is-moving/

>we’d be unlikely to ever federate with clients and servers we don’t control

This didn't age well.

Reminds me of a lot of the ire that I had for GDPR when I first read it (vague wording, general legislative over-reach, potential for arbitrary enforcement, and shoving it all through due to popular consumer sentiments that aren't necessarily directly related). And like GDPR, it will hurt innovation, although that detriment is difficult to measure.

At least GDPR is trying to improve privacy and the rules aren't arbitrarily made up by unelected officials.

I don't think the European Parliament or the European Commission are elected by the general public, I'm pretty sure the EP is selected by governments and the EC is voted on by the EP.

The European Parliament has been directly elected since 1979.

https://en.wikipedia.org/wiki/European_Parliament#Elected_Pa...

So what will happen? Facebook will lose ability to deploy encryption and move servers overseas? Unlikely to affect non US internet users, unless my phone suddenly looses ability to use encryption.

Sorry if this seemed flippant. Of course there will be massive impact. But I was asking people if they though they knew what the impact will be? Will it only affect social platforms that need moderation?

Reply on news.ycombinator.com