Earn-IT threatens encryption and therefore user freedom
fsf.org
fsf.org
Locking your door at night is a poor metaphor. A criminal can literally infiltrate and search through every unsecured computer connected to the internet in a matter of minutes and using almost no resources and with little risk. This drastically diverges from physical assets.
Making encryption illegal will ensure that only criminals use it, thus making only criminals safe online.
Replacing criminals and state overreach with foreign adversaries may be more salient.
Our encryption debate came of age after the Cold War. The boogeymen of that era have been surpassed. We have new ones, and they're more sinister than thieves and more tangible than a your government turning on you.
I'm going to continue to worry about criminal fraud and my own government, rather than ghosts with foreign names.
One of them is invading its neighbor.
> I'm going to continue to worry about criminal fraud and my own government
That's fine and these are things to worry about. But if the argument wants staying power, it needs to be adaptable.
Take your pick, it isn't like there's a shortage!
For you and me, certainly. For the members of Congress you need to convince of this? They ARE the state. Outside of a few ideological libertarians, protecting the people from the state is not on their agenda.
We agree in a limited sense. (There are lots of politicians who genuinely believe in curtailing state power.)
Arguments about state overreach won’t convince a power-hungry vote chaser. Talk about foreign adversaries will.
Or if you're in the US, depending on your audience, Donald Trump or Joe Biden.
It is a poor metaphor because locks prevent invasion not enable privacy.
Banning encryption is such an attack on privacy that it's closer to banning clothes and easing concerns by making looking at naked people illegal.
Encryption is the fundamental unit of network privacy.
The important point I'm trying to convey is that banning encryption is so extreme that it makes invasion of privacy something that someone can accidentally do. You have to try not to look, similar to if a person was nude in front of you against their will.
You have nothing to hide there, do you, citizen?
This is completely missing the point of why one needs privacy. Lack of it harms journalism and activism, making the government too powerful and not accountable. If only activists and journalists will try to have the privacy, it will be much easier to target them. Everyone should have privacy to protect them. It’s sort of like freedom of speech is necessary not just for journalists, but for everyone, even if you have nothing to say.
Throughout US history, there is a march towards ignoring citizens rights, through political, judicial, and bureaucratic maneuvering. The constitution is a piece of paper. There are people who’s full time job is to separate your understanding of your rights from what is written in that document. When they’re clever enough, they will allow state violence to be imposed on you with no repercussions.
Can't you go to the court if you disagree that they had a probable cause?
The judicial branch can choose not to enforce the Constitution, contrary to its duty and purpose, but what they can't do—what no branch of the government can do without amending the Constitution—is legally authorize any agent of the government to perform a search or seize property (i.e. issue a warrant—whether they use that term or not) without "probable cause, supported by Oath or affirmation, and particularly describing the place to be searched, and the persons or things to be seized." The text is perfectly clear and permits no exceptions or "carve outs". I doubt the intent was for the police to issue their own warrants, but even if the judiciary grants them that power they still have to fulfill the requirements.
Of course if you're just saying that what they can get away with in practice and what the Constitution actually allows are two different things, I agree. There are rights, constitutional and otherwise—and then there is power. Every time they do this, however, it undermines whatever legitimacy or respect they might have otherwise had. Any thug can steal your stuff or invade your privacy and have a chance at getting away with it. To the extent a government wants its actions to be seen as legitimate it can't afford to ignore that "piece of paper" it was founded on.
> The police, of course, determine if they have probable cause.
What counts as "probable cause" is indeed the weakest part of the 4th Amendment. At the very least, if a given "cause" does not lead to the target's conviction in a majority of cases, of a crime sufficient to justify the search, then you cannot reasonably consider it "probable". Unfortunately that can only be observed in retrospect. It would have been better to require full compensation to the victim for any search or seizure which does not lead to their conviction, ensuring that the incentives are properly aligned.
The right to bear digital arms.
"Okay, in that case, the constitution says you can't infringe my right to it."
Although I would fear going down that path would lead to them saying, "Well, we already infringe on access to certain kinds of munitions, so you can still have encryption, but only the stuff we have a backdoor to." which has been on the agenda before.
He won because he published his source code in a printed book, and was able to effectively argue that his act was protected under the first amendment right to free speech.
https://en.wikipedia.org/wiki/Pretty_Good_Privacy#Criminal_i...
> Congress shall make no law...abridging the freedom of speech...
Cryptographic communication is speech.
Do encrypted files/data universally follow any sort of pattern? If not, then how would they be discernible from transmitting random bits? Will that be illegal, too?
Note that I'm not talking about any specific existing encryption algorithms or protocols. I am positing that someone could devise a new one that outputs data that is indistinguishable from noise (without breaking the cipher/keys).
It's likely completely impossible to actually ban encryption in a world overwhelmed with information flow.
Therefore, an encryption ban will only effect law abiding citizens and will give criminals a massively asymmetric weapon of power and influence.
The FSF has a complicated and niche advocacy position, they should stay focused. If they don't advocate software user freedom, nobody will. In this case, there are already lots of people against encryption restrictions.
But the point that the FSF needs to focus on is that EARN-IT is bad because it limits user freedom. The fact that users may choose to use that freedom to protect themselves from criminals isn't the issue. There might be an obvious and compelling reason users need freedom or there might not be. The FSF doesn't need to care and should be against the bill regardless.
Much like how the FSF doesn't care about whether the GPL is economic or not - they think software projects should all be licensed under it (or an equivalently free license). The point isn't whether freedom is good or necessary. That is taken as a priori truth. The point the FSF advocates is whether users have it.
While it is somewhat hyperbolic, *Three Felonies a Day"[0][1] seems relevant here.
[0] https://www.amazon.com/Three-Felonies-Day-Target-Innocent/dp...
[1] https://www.c-span.org/video/?289272-1/three-felonies-day
You won't get an argument about that from me. I was merely pointing out that the legal landscape is already filled with land mines.
Which is why (among other things) you should never talk to the police[0].
Uptown NYC has a tragically similar problem with fire arms.
We can play this game all day with many forms of abolition for any good or service that has a relatively inelastic demand and/or is impossible to effectively enforce.
Implementing a backdoor securely which only allows some government agencies to snoop in the decrypted data could technically be possible but I never happened to see a secure implementation of such a scheme – probably every cryptographer of name would refrain from contributing to insecurity.
So, IF a backdoor would be implemented securely, that would increase the power of the current government over all the people, including the opposition. If the US would go ahead with such legislation, countries like Hungary and Poland would follow soon, in which the new tool would be welcomed to suppress opinions diverting from the governments ideology, undermining freedom of speech further and increasing the "chilling effect".
In the mean-time, terrorists (etc.) would switch to steganography and add an undetectable layer of encryption on top.
As disappointed as I was in the response, I'm glad that EFF makes it really easy to reach out to reps. Took me less than a minute to send out my stance against the Earn IT act to my representatives https://act.eff.org/action/stop-the-earn-it-act-to-save-our-....
They voted opposite of what I requested, then wrote back giving a synopsis of the bill and mentioning it passed without even mentioning their vote against the bill.
There is nothing you can do if you live in a "safe" district.
If you live in a contested district, donate to their opponent, and send them a copy of the check, so that they can see it before they read the letter.
Some interesting stuff here:
https://www.wired.com/story/opengov-report-congress-constitu...
This is a while back, now, but I vaguely remember a Reddit AMA by people working for US federal politicians where they indicated that "big enough" is often as few as two for the right type of correspondence (bespoke letters and / or letters to the editors of voter-relevant newspapers, especially if the politician get specifically called out)
Things may well have changed in the interim, but given how often engagement begins and ends at signing on to a form letter, I wouldn't be surprised if this was still the case today.
My representative called me to talk about it. He told me he hadn't seen the bill but he agrees that isn't where the FBI should be spending their energy. It seems like the bill never got off the ground.
My guess is the prewritten letters are probably less considered.
The representative sent back an obvious copy-paste. Could've been the response to any email about the topic, and sounded like a campaign pitch.
The senator (or at least a staffer) replied with reasoning. I didn't agree with the reasoning or conclusion, but somebody definitely read my email and responded specifically to it. I appreciated the respect they showed that way.
seeing it with Earn-IT and also the "don't say gay" bill.
everyone thinks that they are "protecting the children."
I'm working on the wording of this that I intend to use in any such discussion of fake attempts at "think of the children":
Whenever a politician invokes "think of the children", ask them about their funding of Child Protection Services.
Any political action that's said to be under the umbrella of "think of the children" that doesn't provide massive amounts of additional funding into Child Protection Services (boots on the ground, education programs, etc), is hiding something, and actively working against helping children because it's distracting from the actual efforts that Child Protection Services are providing as well as spending money on entirely "something else".
Thank you for contacting me about S. 3538, Eliminating Abusive and Rampant Neglect of Interactive Technologies (EARN IT) Act of 2022. I appreciate you taking the time to make me aware of your concerns on this important matter.
The EARN IT Act would establish a National Commission on Online Child Sexual Exploitation Prevention, which would be responsible for developing recommended best practices for providers of interactive computer services, such as email or cloud storage providers or social media services like Facebook or WhatsApp. These best practices would pertain to how best to prevent, reduce or respond to the online sexual exploitation of children, in particular the proliferation of online child sexual abuse material (CSAM).
This bill would also amend Section 230 of the Communications Decency Act of 1996. Section 230 in its current form creates a so-called “safe harbor” for providers of interactive computer services from legal or civil liability for the content posted on their sites. For example, if a user posts defamatory information on Twitter that individual may be sued and held liable, but Twitter as a company may not be held liable. The EARN IT Act would require these service providers to earn that safe harbor by complying with the recommended best practices developed by the Commission. Senator Lindsey Graham of South Carolina introduced the bipartisan EARN IT Act on January 31, 2022, and it was referred to the Senate Judiciary Committee.
The proliferation of child sexual abuse material has a devastating effect on its victims, their families and their communities. Like you, I believe there is no place in society for this material. However, some internet privacy advocates have expressed concern that the EARN IT Act may unintentionally drive CSAM purveyors into the dark net, where these horrific criminals would become more difficult to track, identify and ultimately build a case that is required for a successful prosecution. Please know that I will keep your thoughts in mind should a majority of the Judiciary Committee decide to favorably report S. 3538 to the full Senate for consideration.
Thank you again for contacting me on this important issue. If you would like more information on my work in the Senate, please visit my website at www.duckworth.senate.gov. You can access my voting record and see what I am doing to address today’s most important issues. I hope that you will continue to share your views and opinions with me and let me know whenever I may be of assistance to you.
Sincerely,
Tammy Duckworth United States Senator
I 100% support and demand E2E encryption be legal and available for anyone to use whenever they want to.
On the other hand, I also completely agree with the need to fix Section 230. The stories I've heard about providers essentially turning a blind eye to taking down things like revenge porn after victims have won in court is a huge problem. There's an entire Darknet Diaries episode on Kik that goes into just how bad the problem really is.
Want to smear somebody? Just post a business review on Google or Yelp. The person and the business will be fairly helpless to get it taken down. One place I worked years ago saw a review posted about the business accusing one of the Director's of an affair. The review remained up for over 6 months because of the complete lack of accountability.
Something absolutely has to be done to combat that type of harassment because it's slanted way to far in favor of the harassers right now. If service providers have no responsibility to take this stuff down it's never going to get any better.
The thing is mothers really believe that. When I told a friend's wife that there should be no regulation on what people can post online she replied with "even child abuse". And I was caught unprepared. Of course I don't want children or any other people to be abused but outlawing crypto is not the solution to that problem.
Of course I'm aware that you're aware.
This is a decades-old response, along with terrorists, drug dealers, and organized crime:
* https://en.wikipedia.org/wiki/Four_Horsemen_of_the_Infocalyp...
Of course if people are willing to do one illegal activity (CP), what's to stop them from doing a second illegal activity (strong crypto) to protect themselves against detection of the first activity?
We've been here before: if the US (or any other jurisdiction) limits strong crypto, it will simply be offshored:
* https://wiki.debian.org/non-US
If you're older than ~40 and were on the Internet in the 1990s, this probably isn't your first rodeo:
As did the fact that nobody listened to the few of us who were children online back then. It's always based on these weird, interesting hypotheticals.
(This isn't to minimize child abuse or trafficking, of course.)
Edit: Also I'll say as someone who's been online for almost 30 years (age 4 to now almost 34) that the harassment and sexual abuse I received/was subject to were at their highest levels from the ages of 14 to 25.
Fight fire with fire, fund EFF so that we have our own well stocked army. To be clear, I'm not trivialising or belittling the impact of individual effort, just that it takes too much to be sustainable. And yes, individual and organized efforts are not mutually exclusive.
An analogy I use to explain to people who don't have a technical background is, "Imagine if we made it law that every pen ever made was required to be chained to a special clipboard that makes a carbon copy of whatever the pen writes." Even when explained like that, it's clear how such a system could be bypassed and would only harm innocent users, but even worse is just how ridiculous it all seems, since this would all be because we can't subpoena a pen. Hopefully it's made clear that despite the subpoena being lawful, it simply doesn't make sense, and attaching this fictitious clipboard doesn't really help make it make more sense, since it seems even more ridiculous once it's made clear that you can't subpoena a pen. It's no difference than saying you can't subpoena math, and that's OK.
I hope as we progress technologically, every day users will understand encryption to the point where they can form their own analogies as to what a ban on encryption would even imply.
EDIT: What happens when I send someone an email in a made-up language which only we both know?
Cryptography is just a special kind of speech/language that is theoretically impossible to understand without the consensual invitation of the speakers.
I am a US citizen (never left the country) and I always vote Republican. Down-vote away!
The FBI came to my house in October 2021. Two special agents (one of which I knew from prior IT Security engagements) and a 'Threat Assessment' Police Officer from the local police department.
They asked me if I was an Islamic extremist/terrorist. I am not. I am not religious at all. I am an IT security practitioner and amateur cryptographer.
I once used Tor for remote network security assessments and to maintain my privacy. I ran Tor hidden services (as experiments) and posted code showing best practices on how to do this without revealing the clear-net IP address. I no longer do this. I believe that is one reason I was targeted.
I have written one-time pad software and other cryptographic tools that may be used to evade IP/Cellular network meta-data analysis and tracking. I believe this is another reason I was targeted.
The agents told me that I was considered a threat and an extremist because someone had used my home network to search for Islamic extremist videos. I have not done this. And, to my knowledge, none of my family members have done this either.
I am not sure why this happened. I may never know. But I do know that true end to end encryption is critical to maintaining our security and privacy (assuming end devices are not compromised already). That is a big assumption IMPO.
Now, I also encourage people to not use Tor. I feel it is backed-doored and mostly controlled by Nation State actors to identify 'interesting' subjects via meta-data analysis alone.
That's my story. I hope you all do well.
I am sorry that these things happened to you, and this highlights how the rights of the accused to face their accusers, with legal representation present as well as to not be discriminated against before adjudication of those charges should be the standard and only procedures. Maybe for some highly important things these accusations might initially be under seal; but there should still be a defense present to advocate for the accused.
Do you think your party loyalty made you a more likely target, or should have made you a less likely target?
That said, I use Tor for anything medical related. The NSA might wonder why I am licking my paws so much, or why I keep worrying about foxtails in my ears, but they haven't knocked on my door yet.
..hopefully they posted from tor and arent about to get a ton of popups now about "do you have foxtail in your ears"
It seems like better practice to learn which sources tell mainstream, reliable information about things like bordetella vaccines and regular nail clipping, before I get really emotional about an anal gland that needs to be expressed or before my person finds a weird lump on my front leg.
More seriously, back to human medicine, I am disappointed that so many reputable medical information sources with read-only information prevent Tor network users from accessing their information even though malicious Tor users aren't able to add misinformation.
No, you should encourage them to use it as much as possible to increase the anonymity set. Tor is not 'backdoored' (it is Free Software) and it is incredibly unlikely for most relays even to be malicious. Rather, Tor has a defined threat model and in the interest of offering high performance with low latency at a low cost, eschews the so-called 'Anonymity Trilemma' and it is thus possible to trace connections through the network if you can monitor the entry stream as well as the exit stream. There are a large number of entities who control various parts of the physical infrastructure between each link of your Tor circuit, from your router, to your ISP, to the local internet exchange point, and every other hop along the way to a destination. If an adversary controls even one of these entities in between you and your chosen guard relay, and between your chosen exit relay and the destination (including even the destination logs), it may be possible to perform correlation attacks to confirm whether or not a particular user connected to a given host (something which is easier to do if the stream is more 'distinct' from other streams, as well).
Tor is a tool which serves to significantly increase the cost of undermining user privacy, and while it is true that it should not be treated as some end-all-be-all of internet privacy, I fail to understand why it should be discarded, rather than treated as just one of a number of tools in the toolkit. For example, if you are attempting to make it more difficult for these global adversaries to trace you, you may consider physical indirection (driving around), adding a layer of wireless relays before the connection to the Internet backbone, exclusion of relays in countries which your own nation can more easily influence in your torrc file, inducing dummy traffic in some capacity, preferring anonymity over pseudonymity, and a myriad of other techniques.
I tried Tor one time years ago when I was testing Maxmind. It always seemed like if you were using it you'd become an exit node by default (I could be completely wrong on this, I haven't looked into deeply). Just gave me the impression that my IP address would suddenly be associated with whatever anyone else was doing and that seemed...bad.
Totally understand that there are plenty of perfectly valid uses of Tor but you don't really hear much about those.
They remind me of things like: if you don't vote to ban driving, you must want children to die. After all, driving a leading cause of death among children.
Children in particular are the perfect political weapon. It's political suicide to challenge any claims because you end up looking like a pedophile.
The bill's text is here. [1] I don't think it does anything that is stated in the article. It's stated purpose is to create a commission that will create recommendations that nobody will have to follow. It actually says that. Then, in Section 5, (7)(A) it explicitly says that it won't affect end-to-end encryption - it says that companies won't need to stop using E2EE and there won't be any liability created for using E2EE.
In general, I am against regulation, but this bill doesn't do what the article claims it will do. Yes, it is absolutely politicking, but it doesn't seem to do much of anything outside of wasting time and resources.
[1] https://www.congress.gov/bill/117th-congress/senate-bill/353...
So the EARN-IT act would seem to me to modify Section 230 to not apply in cases of child sexual exploitation law, importantly "any charge in a criminal prosecution brought against a provider of an interactive computer service under State law regarding the advertisement, promotion, presentation, distribution, or solicitation of child sexual abuse material". However despite this amendment, using E2EE would not "serve as an independent basis for liability of a provider", whatever that means.
This seems more notable to me than the whole "creating a committee to create best practices" sections but I could be misreading or misinterpreting the bill honestly, I'm no expert.
Your quote should read the following, where I've italicized the two parts you left out, "NO EFFECT ON CHILD SEXUAL EXPLOITATION LAW.—Nothing in this section (other than subsection (c)(2)(A)) shall be construed to impair or limit— any charge in a criminal prosecution brought against a provider of an interactive computer service under State law regarding the advertisement, promotion, presentation, distribution, or solicitation of child sexual abuse material, as defined in section 2256(8) of title 18, United States Code;"
"NO EFFECT ON CHILD SEXUAL EXPLOITATION LAW. Nothing in this section [NB Section 230] (other than subsection (c)(2)(A)) shall be construed to impair or limit ... any charge in a criminal prosecution brought against a provider of an interactive computer service under State law regarding the advertisement, promotion, presentation, distribution, or solicitation of child sexual abuse material, as defined in section 2256(8) of title 18, United States Code;"
And so Section 230 protections to content providers would cease to apply* in cases of child secual exploitation law, I think.
* EDIT: Except for those points that would be added to Section 230 specifically regarding E2EE
Individual user, and those who own the content of their website, are free to use E2E if they choose to, whatever benefit that still gives.
Anticipation of this law feels like why Apple went through its CSAM debacle. Expect to see more content scanning after this passes. The CSAM DB Apple was said to be using will likely be “best practice” in how online service may get liability shield back.
I too don’t like how HN, FSF, EFF jumps straight to “encryption ban”. It spells fear that too much nuance will weaken their argument.
Criminals, by definition, don't follow the law.
Now, in some cases, that isn't a problem: Guns are an obvious example, because they take resources and knowledge to manufacture, and are physical objects that can be tracked. Taking these away by law works.
But encryption isn't a physical object or something that needs to be manufactured. It's math and algorithms. It can be copied infinitely. So, if the law takes that away, law abiding people will no longer have access to the benefits, while criminals will just ... well, as criminals by definition do, ignore the law, and still use encryption.
For example, criminals who abuse children to produce pornography aren't going to follow laws against having child pornography. Does it follow that laws against the posession of child pornography have no effect in curbing abuse?
I think they do. Being seen with child pornography is a huge red flag indicating that you might be an abuser. Plus, the demand is lower. I see no reason this couldn't apply to encryption too.
All payment processing (ATMs, credit cards, online shops) generate encrypted traffic. Sending legal documents, technical data, company internals, contracts, etc. generated encrypted traffic. Sending sensible personal information like medical, indurance or financial records generates encrypted traffic.
Most of these cannot be sent unencrypted, without breaking fundamental processes in our society.
And there simply is no reliable way to differentiate between encryption used for legal or illegal reasons.
Pretending that you don't understand the argument of the other side ("it won't work because only criminals") won't get you any closer to a dialogue with those who say it.
The world worked using mail, then phones, for many decades. These were treated as "mostly secure", but could be tapped. The world basically worked fine.
Because it's too risky, simple as that.
Let's say there is a single, super-secret-key, for government use only, that can decrypt any encrypted message on the planet.
What happens if this key is leaked? What if it's found out? What if the implementation of that key turns out to be buggy and is cracked? Remember, once there is such a key, it won't just be some criminals in godknowswherecountry trying to get it, it will be state-level actors with unlimited funds, resources and manpower.
If a single one of them gets their hands on this key, even ONCE, it's game over. Our modern society relies on encryption. If this key gets out, the results could be catastrophic; eg. Airplane navigational data manipulated in flight, stock market data manipulated in transit, financial transfers wide open for everyone to read and manipulate at will, control data for electrical grids, hydroelectric dams, nuclear power plants out in the open...it would be anarchy.
Something similar could be set up with, with a collection of keys. I'm not saying it's a good idea, but we already base the security of the internet on a small number of top-level encryption keys.
Difference 2: If something happens to these keys, the CA can simply revoke the validity of the public key. This is a major pain in the _ for everyone involved, especially since all downstream certs needs to be re-issued and signed, but it's manageable. A built-in key that is somehow algorithmically included in every encryption mechanism, cannot easily be changed when it's leaked.
Difference 3: There is no single "highest Certificate Authority", so there is no single key to compromise the whole system.
Difference 4: These keys are ordinary asymmetric keys. They are not built-in backdoors into the system.
I don't buy this argument at all -- if we ban encryption, except for government sanctioned encryption, it will be the easiest thing in the world to detect if anyone tries sending it over the open internet.
And how shall "goverment sanctioned encryption" be distinguished from "non sanctioned encryption"? The point of (good) encryption is to make the result look like stochastically random bytes.
You could claim you are sending packets of random bytes for no reason to a friend, but I doubt any jury would believe you.
The question isn't how its decrypted, the question is how to determine WHICH traffic to decrypt in order to inspect it.
Stealing is the actual bad behaviour, stealing itself is bad for society, anyone who steals should be punished.
Substitute "encryption" for "stealing" then you know why you're wrong.
Sorry but it doesn’t even work for physical objects. Guns are completely illegal in some cities (NYC, SF and Chicago, unless you have connections), so I suppose there’s no gun crime there, right? Or, research compliance rates when states have retroactively made certain firearms illegal and asked for citizens to turn them in or face the risk of criminal charges.
The War on Drugs has also been highly ineffective at preventing motivated individuals from obtaining certain physical objects.
https://en.wikipedia.org/wiki/List_of_countries_by_firearm-r...
It works when implemented country-wide. Countries like Germany have much stricter gun laws, and as a result lower gun violence.
Obviously, the method doesn't work, when someone who wants a gun can just drive a couple hours and get one at some gun show without even leaving the country.
edit: Most gun crimes in the city are done with illegal guns, 74% of which come from out of state. https://www.vox.com/policy-and-politics/2016/10/26/13418208/...
I'm all for encryption rights, but if I'm going to call my congressional rep, I want to know what I'm talking about, and the FSF link really doesn't explain what's going on.
Full bill here: https://www.congress.gov/bill/117th-congress/senate-bill/353...
[1]: https://en.wikipedia.org/wiki/Export_of_cryptography_from_th...
Is there any way I can contribute?
Or do I just sit and watch the world burn as policymakers elsewhere indirectly make policies that might inadvertently affect people far far away as well?
I don't see how, from a plain reading of the bill's text, one can argue what their letter claims.
Can someone connect these dots?
Off-topic: Happy to see your reply here, Beej. I love the books you have authored :)
And what is that for? Some false promise of security? People who commit real crimes will just use illegal tools and would rather be prosecuted for """illegal use of real encryption""" than for whatever they are doing
Meanwhile people who actually need it for legitimate reasons are endangered by this law
This is not a tradeoff between just privacy and child safety. This is the matter of freedom and democracy.
[1]: I would say Telegram is available option for privacy but Telegram has pretty much possibility to be attacked than Signal...
Therefore we position EARN-IT as a national security threat over individual privacy.
Politicians also don't know a damn thing about it, but the incentives are very strong for them to insert more gov. into everyone's life, so that is what will inevitably happen.
Sorry about being the party pooper, especially on a Friday, so just enjoy your PGP, E2E encryption, Tor, Btc, etc. while you still can (the more you do, the better our chances of keeping them for longer).
Also, I have a website that you can point politicians to: https://everyoneneedsencryption.gavinhoward.com/ .
Suggestions welcome on how to improve that site.
Many comments here declare voting as irrelevant and ineffectual. This leaves a sense of learned helplessness in challenging dangerous political forces.
But hackers seem to be overlooking important ideas that we should know better about. Voting may not work on the individual level, but it works at scale, and we are really good at scaling things. Emotion is a much more powerful tool than reason, and influence is really just social engineering at scale. We are good at social engineering. Modern propaganda is as much technical craft as a creative one. We are great at both.
The British Saatchi campaign is a flop, almost a laughable example of how disconnected from people they really are. What makes information war interesting is that highly polished short documentaries and video clips are not expensive or difficult to produce. The EFF already tried their hand with "The Corruptibles", which I think was very promising.
The EFF are wasting their time writing blog posts that preach to the choir and only a handful of regular readers will see. I know because that's what I do, and as a writer I am realising that I speak almost entirely to those whose minds don't need changing.
What's needed is a fight with the politicians on their own ground with funny, viral, highly emotive, slickly produced influence materials that show how ridiculous any attack on E2E technologies really is at this time in history. I think the EFF could better use their resources this way.
[1] read about Vladislav Surkov and the tactics of discombobulation.
Perhaps Lawmakers belong a different class than you and that they are fully aware of what they are doing. Perhaps they actually want to rule over you by removing your rights one by one.
Software, devices, protocols etc are not just used in a single country. They are used worldwide. If a backdoor needs to be supported for a several dozen governments, each with various levels of security practices, there’s no way it stays secret for long. It’s only a matter of time before a country or state like Georgia gets it’s old poorly configured IT infrastructure hacked and the attackers now have access to some backdoor keys. How do governments revoke old keys and create new ones across all applicable devices? It’d be pretty hard to do that without going to companies and saying “fix” or “get me that” with some type of warrant or court order. That is kinda like what we have now which is mostly limited user information located in the cloud somewhere.
I think the larger issue is that there is a coordinated push to get complete government access to everything. This is happening at a time where dystopian surveillance is not only quickly becoming possible, but also profitable. The government has the right to pretty much everything legally, but the potential for misuse in situations where the government gets access everything is really high. The ability for citizens to combat that misuse is reduced the more government gets.
This is my understanding of things. Let me know how I’m wrong.
I can't see a US court preventing free speech, so why prevent someone digital free speech?
Never mind NSA and the likes still recording every little data fragment we transmit. That's fair and just, because they're the good guys. They would of course never spy into my sex video chat with my girlfriend.
It's the age of struggle of the rulers vs the oppressed. Ideally it wouldn't be like this, but ultimately that's what it is.
Less privacy is never the better option.
I wonder how we can ... change ... I know: end to end encryption and encryption in general should be a basic human right in the information age.
It opens the bigger question, do we need to be ruled at all. I say yes we need rules but do we need oppression, censorship and removal of privacy?
Isn't that what all the western propagandists accuse Russia/Putin of, correctly I might add?
It's a tough situation. Encryption can be used for good or bad (and even the definition of what's "good" or "bad" encryption varies depending on who you ask). Unfortunately, I see it increasingly being used to oppress users, in the form of DRM and other "security" features.
Perhaps classifying encryption as munitions makes the most sense, if you support 2A rights.
On the other hand, it's just maths. Maths which anyone can theoretically do.
I don't know if there is a good solution to this problem.
I realize this is likely not your argument but the only thing that does is delay the access to data, not prevent it.
Private keys will eventually leak, if not publicly, through nation state espionage.
Weak encryption prevents the average attacker today but not the average attacker in the future.
It would price innovation out of the market.
Also, not sure what you mean by weak encryption. An average attacker now has access to decrypting tools out of the box (with a few Linux distros) so wep isn't stopping anyone really. Even noobs can be trained to crack with an hour of youtube.
We'll never be truly free until we can literally manufacture our own free chips at home just like we can make our own free software at home. There should be no big chip manufacturing company they can target with regulation or make agreements with. It's either this or eventually free computers will no longer exist. Just like the radio situation where your software has to be approved by some government agency to make sure it won't cause interference.
The FSF is stuck in the 80s on everything - whether it be dealing with Stallman or specifying acceptable ways to load firmware, and has failed to accomplish almost anything since GPLv3 in 2006. And after recent events, I’d almost consider dismissing them from involvement in the movement.
Bug fixes, sure. They managed to alienate a bunch of people from gcc, which was fun. Their anti-DRM campaign is over a decade old and is running on fumes with no accomplishments.
This is the same organization that when Windows 8 came out, they protested outside Microsoft stores and handed out copies of GNU Trisquel - an OS with only FOSS code back in 2012, which to this day runs on very few systems and likely caused everyone who got copies to look on open source as a buggy flop and actively undermined the cause.
I could go on.
https://mobile.twitter.com/marcan42/status/10406262109994311...
Richard Stallman wrote at length in the past about how he feels it's ethical to use non-free systems to build free systems if there's no viable alternative. But you can only do that if there's a clean division between what you're doing and what the hardware vendors are doing. Unfortunately it's messy in the embedded world. These makers don't abstract the products they build like Intel does. They rely on legal means instead to secure their advantage. While many corporations might view an agreement to access those bits under restrictive terms as a good thing, it can lead an open source dev to feel like the proprietary stuff, which they intend to decouple themselves from and ultimately escape, is instead being rubbed in their faces. No one wants to be constantly reminded of all the freedom they don't have.
So in other words, it's just a compromise. I'm sure if they could find someone willing to manufacture a truly libre phone, they would have used them instead. I think the FSF has a good understanding of the open source developer's needs / wants / desires and this compromise is perfectly in keeping with that. Perhaps one day they'll attain the obvious end game of a libre phone, which would be a ham radio that looks like iphone with unfettered access to ss7. It will be anarchy. https://youtu.be/eXnvTwRBrgc
If this is your reason then I would say you are trying to hide.
>Is it "hiding" to seal the envelope of the card you're sending your Valentine?
Yes, the point is to keep it a surprise.
>helps protect queer youth from intolerant violence (at home and abroad, as in Ghana).
E2EE doesn't prevent a parent from taking their phone and seeing their messages. These kids aren't communicating to their friends over their parent's IRC server. Most parents aren't technical and wouldn't even know how to MITM even an unencrypted messaging app.
>helping victims out of these relationships by enabling them to contact friends for help
Again most people don't know how to MITM this traffic. Especially if you are using mobile data.
Even in regard to whistleblowers they only need anonymity. They want to do the opposite of hiding their messages. They want the opposite. For as many people as possible to see their messages.
But we aren't talking about making something public. We are only talking about a case where the government already has a warrant.
Not explicitly, no. But it is not feasible for applications to comply with the provisions of the bill while still supporting E2EE, so the bill's effect will be to largely eliminate the use of E2EE.
There is no such thing as a 'government only, and only with a warrant' backdoor. There is either private or not private.
It is possible to design a system where judges have their own hardware keys. Hardware keys can not be cloned assuming strong tamper protection. If a hardware key gets stolen it can be revoked as being valid and a judge can be issued a new one.
DRM is different because the client ultimately has to have the keys to decrypt the content they have been permitted access to.
Who would control the creation of the keys? I mean which tech vender would control access to my android phones encryption? My phone was made in China, and the chips inside it were made in China. They also have the most people, so it seems fair they control the keys.
This website is freeeeeeeee
Of course, even just that scenario is bad enough. It would mean that the police, the FBI, the NSA, people at the messaging company, and hackers who breach the company's security would all be able to read those messages.
I could see it even becoming a feature in consumer grade network equipment. A bit like HDCP circumvention in video capture boxes or region free playback in optical media players. All you'll have to do is shop around.
Give it a couple of weeks and someone will have put together surveillance and parental control system for it.
????? CSGO chat is unencrypted. It's been more than a few weeks since source games have been out. Show me this parental control system you theorize would have been created.