Hacker News Reader

Why can’t we have the alternative we already have, where we don’t have our phones scans and E2EE exists without compromise? Why do we have to accept it any other way?

If you’re trying to frame this as “we need to prevent Congress from ever passing something like the EARN IT act”, I agree. Apple and other tech companies already lobby Congress. Why aren’t they lobbying for encryption?

They did, they lobbied heavily against EARN IT, and so did groups like the ACLU and EFF. However, it didn't stop Congress members from moving it along through the process - they were only stopped because Congress just ran out of time. It was clear that Congress was not interested in listening at all to the lobbyists on the issue.

It's clear that EARN IT could literally be revived any day if Apple didn't do something to say "we don't need it because we've already satisfied your requirements."

It's clear that EARN IT could literally be revived any day if Apple didn't do something to say "we don't need it because we've already satisfied your requirements."

Alternatively, "Apple has shown that it's possible to do without undue hardship, so we should make everyone else do it too".

Congress doesn't give a rip about "undue hardship." Otherwise why would we pay income tax?

They were going to legally mandate that everything be scanned through methods less private than the ones Apple has developed here, through EARN IT and potentially LAED (which would have banned E2E in all circumstances and any device that could not be unlocked by the manufacturer). While that crisis was temporarily averted, the risk of it coming back was and is very real.

Apple decided to get ahead of it with a better solution, even though that solution is still bad. It's a lesser evil to prevent the return of something worse.

While I broadly agree that this (and other attempts in Australia and rumblings about it in UK) may have been the impetus for developing the technology, I'm not sure it explains why they released it on Photos, where Apple holds the keys, and not very far since you can look at your entire photo roll on icloud.com with just your username and password.

That tech is not being deployed on iMessage which is the only e2ee(ish) service from Apple (with Keychain) and is what those legislative attempts are usually targeting. One could argue it would have made sense (technically) there though, sure.

Was it a reason to release it preventively, on something unrelated, to be in the good graces of legislators ? I'm not sure it's a good calculation, and it doesn't cover other platforms like Signal and Telegram that would still be seen as a problem by those legislators and require them to legislate anyway.

This seems like speculation with no evidence. The government cares about more than just CSAM, they care about terrorism, human and drug trafficking, organized crime, gangs, fraud, drug manufacturing etc.

This would only make sense if Apple intends to expand their CSAM detection and reporting system to detect and report those other things, as well.

The EARN IT Act would have basically legally mandated a backdoor in all services, with shifting recommendations, in the name of preventing the spread of CSAM. Sound familiar?

Also, there is another reason why there is the CSAM Detecting and Reporting system. With Apple CSAM Scan, that big "excuse" Congress was planning to use through EARN IT to ban E2E is diffused, meaning now Apple has the potential to add E2E to their iCloud service before Congress can figure out a different excuse.

CSAM scanning is only one type of scanning which is performed at the behest of governments and corporations around the world. This alone will not allow for end-to-end encryption of items in the cloud.

There would need to be end-device scanning for arbitrary objects, including full text search for strings including 'Taiwan', 'Tiananmen Square', '09 F9', and so forth to even begin looking at e2e encryption of your items in the cloud.

At which point… what's the point?

Not really. E2E iMessage is still available in China if you disable the iCloud Backup. It's also the only messenger in China with an E2E option.

>which would unilaterally banned E2E encryption in entirety

It did not do this. The bill was essentially asking for search warrants to become a part of the protocol. If you're only solution to allowing for search warrants to work is to stop encrypting data I feel you are intentionally ignoring other options to make this seem worse than it is.

I am very intrigued about what you think the other options are that preserve E2E encryption. How do you make search warrants part of the process without some kind of escrow or third party involvement, at which point it is no longer "end to end"?

You can't ban encryption, it's practically impossible, it's like banning math.

You can ban it's use, you can't ban its existence. You can't mandate math work differently, you just mandate people not use math.

Its amazing since this would have decimated the American Tech sector in many unknown ways.

All they have to do is force Apple and Google to ban it and any apps that use it from their app store and they've effectively banned encryption for like 99% of people.

The ban won't make encryption disappear. You can still have it. But if you're found using it, it's a felony.

Well, we are already banning numbers (see: DeCSS), what’s the big difference?

In some countries even discussing the application of certain numbers is unlawful.

If you can get jailed for speech, you can get jailed for encryption.

Technically in the real world you can get jailed for anything as long as corruption exists and humans remain imperfect.

But you shouldn’t get jailed for protected speech and you shouldn’t get jailed for preserving your privacy (via encryption or otherwise.) As cynical as people may get, this is one thing that we have to agree on if we want to live in a free society.

And above all, most certainly, we shouldn’t allow being jailed over encryption to become codified as law, and if it does, we certainly must fight it and not become complacent.

Apathy over politics, especially these days, is understandable with the flood of terrible news and highly divisive topics, but we shouldn’t let the fight for privacy become a victim to apathy. (And yes, I realize big tech surveillance creep is a fear, but IMO we’re starting to get into more direct worst cases now.)

> If you can get jailed for speech, you can get jailed for encryption.

Not in any democratic country.

How can you prove that I'm using encryption? How you even define what encryption is to make it possible to have a law that bans it? If me and you we put down a code to communicate, is that encryption and thus banned?

Also you wouldn't need to ban encryption completely. There are cases where encryption is required by law (e.g. digital signature on documents) and others where the encryption is required for things to work (e.g. credit cards, mobile phones, etc).

You have to put down a list of cases where you can use encryption and others where you can't. That is nearly impossible.

in a loose sense, mathematics, and its associated notations are a form of encryption

> If you are Apple, even though EARN IT failed... you know where Washington's heart lies.

If you are IG Farben, you know where Berlin's heart lies...