UK is spending £500k on a PR campaign demonising end-to-end encryption

Oh don't worry they will still have access to their signal.gov.uk -- national security is too important!

YM/YPM aged so well!

It's funny, just a modicum of common sense should tell them that the biggest problem is the government themselves. There have been a number (to understate it) of high profile cases of "gross predators" in Britain who were allowed to operate freely with the government fully aware of what they were doing and turning a blind eye to it or even protecting them.

It's not that breaking encryption could not solve any crimes or help people (on the contrary it clearly could and if we had a perfect benevolent government that was immune to corruption and incompetence we may well want them to have a crypto backdoor). The problem is that governments have clearly and repeatedly demonstrated, by their actions, that they have no intention of using powers like this to help the common person or to better society. They use powers like this to protect and enrich the government and its friends.

CCTV has become almost entirely useless when anyone planning on committing some crime just wears a hoodie and face mask. Tracking via the internet and peoples phones is so much more effective.

Tech, law enforcement, and media, folks aside, people will collectively shrug and move on. To most, it's all abstract fights about other people's problems, like most banking regulations are to me, no matter how much they might impact me. See James Comey/FBI vs Apple, Apple iCloud CSAM scanning, etc. etc. etc.

Which could indicate the gov has already broken TLS's trusted model. It's known a CA was breached some years back by a state, why would it be so far fetched to say CA's haven't been required to hand over private keys and are prevented from speaking about it?

I would not be surprised in the slightest that the government has subpoenaed a UK based CA or has a UK controlled CA of their own.

Having access to end private keys or being able to sign your own valid cert from a well known entity in the trusted list, to just operating your own all means the user is (almost) none the wiser TLS communication is opened wide to a state actor.

I think this is mostly because Facebook is going to go E2E now. I can understand why Facebook wants to do this, as it's starting to get risky with stuff like Jan 6th and other violent political demonstrations in the US maybe starting to happen more. If they go E2E they don't have to deal with the risk of having to "pick a side".

> apparently I'm blocked from replying below

There are some rules on replying, I think. Timing, maybe, whether you're replying to someone who replied to you, maybe. I haven't worked them all out. But I will say that if the reply link does not show below the post, clicking on the timestamp link will take you to the post by itself, and on that page there will be a reply link. At least, every time I've needed to use it myself for that reason.

> and very few people are willing to say: the less a government does, the better.

A lot of people are saying that, and in most cases just out themselves as loud and not very knowledgeable people.

Governments exist for a bunch of reasons. Many things are only possible or can only work well if done centrally and without a profit motive (like most things infrastructure and utility, healthcare to name a few). Yes, people want their governments to do things said people want. What's the problem that? If i want more bike lanes in my city, you can bet your ass I'll petition and lobby the mayor for that. Who else could do it? A benevolent rich person? As if.

Same goes for many many many other things. Banning single use plastics? Carbon tax? Giving incentives so that energy generation and transportation switch to less carbon intensive ( nuclear, renewables, EVs, rail electrification) energy? Creating good public transit so that less people need polluting and space wasting vehicles? Etc etc etc.

The US libertarian "small government" dream simply doesn't work. And the best part is that state governments that ostensibly follow that dogma are still able to force their nonsense pet preferences ( like abortions in Texas) or ask for federal help when disaster strikes ( the recent Kentucky natural disasters). Off the top of my head i can't think of other places in developed countries that went so far on the "the less a government does, the better" thing, that's why I'm only giving them as examples.

It's either child abuse, organized crime or terrorism.

Can I have it please? I feel like I could put it to good use

If anything, it’s a cheap distraction from lockdown Christmas parties.

If we're being fair, it's 500k too much.

Judging by this video, you would think so.

just enough to trigger a Streisand effect?

Naw mate, you're the one that's mistaken.

Or name me a single one that doesn't use at least https.

With chat apps it's a different story, because the end isn't the server in that case - but in the context of banking https is enough for e2ee

> when the alternative is a government backdooring or banning all encryption.

That is not the alternative because the mathematics of encryption is already very widely known. In the scenario where all encryption is outlawed, there will be a black market for encryption tools designed for criminals (this already exists today) and society will not be significantly safer. Or alternatively, open source encryption software development will continue happen outside the UK/USA/AU.

Banning encryption will only make inept criminals (those who don't have the resources or aren't smart enough to buy the encryption tools) easier to catch and the general public unsafe. If the police are having trouble catching inept criminals to the point that they want to make the general public unsafe, the issue here isn't the encryption.

Currently messaging providers like WhatsApp and Facebook Messenger have an obligation to scan images against centralized hash databases of known child abuse imagery. End to end encryption unburdens the providers because they don't know what the message content is.

This type of reporting catches people who are not just consumers, but are actively sharing and trading - in theory the people who might be directly abusing or trafficking children to produce content and may lead to organized rings. Given the direct evidence and the fact they find a ton more when they raid the house - they are slam dunk cases for the police.

I don't have any hard numbers, but as you suggest I believe the vast majority of cases where they are communicating directly with children are self or parent reported. These cases of course wouldn't go away with end-to-end encryption.

> I am curious about the actual numbers around CSAM on encrypted networks, and if there's other enforcement avenues.

I'd be also curious to see the budget breakdowns for the different detect-deter-deny-disrupt activities going on, and the effectiveness of each. Like is intercepting encrypted communications addressing production and materially stopping abuse from happening, more effectively than tracing victims, social work, etc (I don't have a good sense of options available). Or is it just a low hanging fruit that catches a few criminals, but provides an important pretext for broader snooping like you say. They would have a much more compelling case (in any e event I disagree with violating innocent peoples privacy to prevent crime) if they explained why this was the best option.

I am sure there is plenty. I am also sure it is mostly all sting operations and bait.

It's not lobbying to prevent people from working on it. It's lubing up the masses for an eventual ban on encryption, or the power to demand access to, and the creation of, backdoors. This doesn't need to mean HTTPS traffic is banned, but would give them the power to jail you for refusing to unlock your phone for them, or ensuring no tech firm with a local presence can keep their data from you.

Australia codified it semi-recently, and we are quite often the 5 Eyes beta testers -- early access Orwellianism.

  2. Change the image to Ann Frank

Except for, perhaps, the posters purchased outside of Parliament. Directly across the street they should put up a billboard showing the logos of all the Cayman Islands banks.

I'd make it more generic and relevant to everyone... a home bathroom, a kids bedroom, a psychiatrists office, all the places where every day people expect privacy.

Yes.

But, privacy is not just important against (traditional) tyranny of the state.

Maybe change the image to be a bathroom to get the mesage across.

Interesting algorithm HN has for ordering comments.

> Change the image to Ann Frank.

4chan is not real life. Sure, you will get truly epic lulz but in reality it will only be used against to add another label to go along with the pedophile one.

Change the image to Prince Andrew.

Good idea in theory, but maybe not Ann Frank please? It's not right to use her image that way.

I'm fairly confident that the UK isn't campaigning against encryption to make multi device sync work better

I remember when cellphones came out and the problems we had when a phone would go into a zone where it was halfway between towers.

The technicals do make things more complex but these are solvable problems that different developers will attack in different ways.

If that's true then why are the Tories and Blairites trying so hard to ban it?

Why would you want to encrypt your communication?

An easy example is you are going to China for business. You share some trade secrets in private and by tomorrow some factory is producing your new part.

Another example. You live in a cheap apartment. Your landlord wiresharks all communication over your internet connection and steals your private pictures

Why would you want to hide information from your government?

Maybe you are a journalist with a story on someone in power.

You could have been raped by a high powered government employee

You could be part of a minority who is being made into a villian in the current political climate.

You have rights for a reason. You need to make a case why we should give up those rights.

I see it more as a 'why not?' kind of issue. Why can't I encrypt my own communications? Why does the government need to see what I talk about and to whom? Criminals aren't going to avoid encryption technology just because the government says so, which means the law only really applies to law abiding citizens. I want the government to explain why they need this power without invoking the criminal scare tactic since we already know it isn't relevant.

> I can see a need to encrypt privileged communications, like with your lawyer, your health care provider, etc, but chats, for example? Can someone please change my mind?

Most normal people share those kind of legal or health conversations with their parents/partners/close friends as well. If you were spying on an opposition politician (say) or social activist, being able to read their personal private chats with their mother or husband would probably tell you just as much as reading their "professional" chats or medical chats - perhaps more, since you'd know what they were actually worrying about.

> I seriously doubt the Government wants me to put it out in the clear (oh, and also, banks are so heavily regulated, e.g. Anti-Money-Laundering, that if the Government wants to find anything about anything, they probably already can, regardless of how encrypted your communication with the bank is).

You've contradicted yourself. The Government absolutely does want a backdoor that lets them read your communications with your bank, the AML laws are proof of that.

I absolutely consider plenty of conversations with friends and loved ones absolutely private.

What your argument misses is that end-to-end encryption has a very important role - keeping information safe from hacks of the messaging platform. If a messaging service is hacked, and the database dumped, I’d prefer that what they get was encrypted by keys on my device, not keys that are able to be stolen by the hack (or not being encrypted at rest at all). Extremely personal, private and intimate conversations, photos and videos have been leaked that way. End to end encryption prevents that.

Secondly, it protects my messages from being able to be snooped on by bad actors at the messaging service (like a nosy sysadmin). Somebody could easily be physically stalked using information gleaned in this scenario, or a bad actor could use the information gathered from reading their messages to groom a minor for example! I’ve read stories of cyber-stalking happening in this way, like a Google Hangouts SRE who was reading a woman’s messages, messaging her inappropriately, and when she would block him, unblocking himself through the backend (luckily he was eventually found out and fired). End to end encryption would help from these people being able to see messages or steal photos an pod images.

There are even more scenarios and circumstances when it’s important. So I’d say your comment is not as much a ‘devil’s advocate view’ as a ‘haven’t thought hard enough about possible threats’ view.

Perhaps I can convince you with a more philosophical argument.

Private communication is essential for freedom of speech. I may not speak freely with my friends or family if I believe that those conversations are easily accessible by the government. It's not that these conversations are inherently bad either; rather, I believe that people have a tendency to self-censor themselves depending on their audience. When the audience consists of an entity that has overwhelming influence on your life, I believe the potential for self-censorship is enormous.

Historically, many of the world’s greatest ideas were first discussed in private. Bold ideas were discussed in discreet locations, free from the threat of eavesdroppers out of fear of government recourse. Nowadays, technology has enabled people to communicate instantaneously with one another from thousands of miles away. Encryption enhances that capability by further allowing that communication to be private, fostering freedom of speech and the discussion of new ideas. It is really quite amazing when you think about it!

I consider communication with my parents, friends and coworkers to be privileged communication.

Because I could be talking about something that gets me in trouble, depending on where I am. There are plenty of things that are reasonable to discuss with friends, but not not reasonable to be made public. There is no such thing as a person with nothing to hide; only those that don't know what they need to hide.

And that's ignoring the fact that these entities pushing to ban e2e encryption on chat programs include many of the same ones that pushed to ban secure encryption all together, outside of their own uses, of course. So, if they get this, it's just one step on the way to ban secure encryption everywhere, which would be catastrophic.

>but chats, for example? Can someone please change my mind?

your chat may be pretty legal in the country you're residing at the moment of the chat. Few days or years later you may be flying over/into the country where the content of that chat is illegal. Say, you're trying to come into US, and in the chat you discussed that time you smoked a weed back in your home country where it is legal.

> I wish people would argue in good faith in these types of discussions about responsible use of encryption.

You are assuming people are not arguing in good faith. That is, in itself, a kind of bad-faith arguing, suggesting that people who disagree with you simply don't understand and would change their minds if they did.

In good faith, and with understanding and acceptance of potential consequences, I will continue to say that using encryption is always responsible, the responsible use of encryption is "yes, always", and any two or more (or one or more) people have the right to keep communications exclusively and nigh-unbreakably between themselves. My answer to that will not change, regardless of the people communicating or the content of the communication. If you want the contents of that communication, get it from one of the people communicating.

> No one is arguing that we should remove E2EE between you and your bank.

Many people are arguing that; I've seen people say that it wouldn't matter for the purposes of securing financial transactions if the government has access.

This post seems like it was argued in good faith, there were a couple of examples given besides the banking one. I think the issue here is that while cryptography can allow for many different sets of parties to read a given piece of plain text, the only reasonable set of parties who should be able to read a text chat between myself and my friend is {me, my friend}. Just as we have no obligation to notify the cops of what we're saying when we have a private conversation in person. (Even if we give it to the cops in a sealed envelope, and the cops pinky promise not to open the envelope unless they can get a warrant.)

There is no “responsible use of encryption”, there is only “irresponsible use of clear text protocols”. This is a another meme to make it seem like encryption is dangerous. Reject!!

Encrypted communications between humans should be a basic human right. You are arguing that it is not. That some contexts don’t deserve encryption. They all do, no exception. Nobody has the right to demand access to encrypted communications except the peers involved in the establishment of the channel.

The safety argument has and will always be a red herring to take fundamental rights away.

That is not possible if some people believe that government is infallible. That is a wrong axiom to take. On the contrary, I think the UK had government officials involved here. Handling of political dissent also is not optimal in many states and it tends to get worse the last 1-2 decades. To fight for safety and against terror while living in the safest time in history. It will never be enough for some and those people need clear red lines. Most constitutions have those, but careless lawyers found some ways to ignore those so that they mostly become meaningless.

If you have a bad conscience of neglecting your children, maybe start spending time with them instead of endangering secure communications. Most cases of child abuse isn't inflicted by strangers, even less so through the internet.

There is a measurable effect that mass surveillance has on many people and it already has a significant negative effect on trust towards state institutions. Self inflicted mostly.

No dialogue shall be had, encryption is a technology that is available to all. Maybe we should restrict governments because they have to provide transparency.