Hacker News Reader

Comment by traceroute66 | Hacker News Reader

> criminals are using E2EE communication systems to share sexual abuse material

Blah blah blah, the same old argument given by the "think of the children" people.

There are many ways to counter that old chestnut, but really, we only need to remember the most basic fundamental facts:

1) Encryption is mathematics 2) Criminals are criminals

Can you ban mathematics ? No. Can you stop criminals being criminals ? No.

So, let's imagine you are able to successfully backdoor E2EE globally, on all devices and all platforms.

Sure, the "think of the children" people will rejoice and start singing "Hallelujah". And the governments will rub their hands with glee with all the new data they have access to.

But the criminals ? Do you honestly think they'll think "oh no, game over" ?

No of course not. They'll pay some cryptographer in need of some money to develop a new E2EE tool and carry on. Business as usual.

View on HN

> Can you stop criminals being criminals ? No.

[Citation needed]

This mindset—that assigns people into immutable categories, "criminal" and "not criminal"—is actually one of the biggest things that needs to change.

We absolutely can stop criminals from being criminals. We just can't do so by pointing at them and saying "Stop! Bad!" We have to change the incentives, remove the reasons they became criminal in the first place (usually poverty), and make it easier, safer, and more acceptable to go from being a criminal to being a not-criminal again.

> But the criminals ? Do you honestly think they'll think "oh no, game over" ?

> No of course not. They'll pay some cryptographer in need of some money to develop a new E2EE tool and carry on. Business as usual.

I used to think this, I changed my mind: just as it's difficult to do security correctly even when it's a legal requirement, only the most competent criminal organisations will do this correctly.

Unfortunately, the other issue:

> And the governments will rub their hands with glee with all the new data they have access to.

Is 100% still the case, and almost impossible to get anyone to care about.

they can just use/switch to unpatched devices with some opensource e2ee without big effort. Result? Criminals will continue doing criminal stuff, rest of the planet will be under surveillance system that can be altered at govt/company's will without your knowledge to either target specific ppl(from govt) or target groups of ppl(for 'relevant' ads)

> they can just use/switch to unpatched devices with some opensource e2ee without big effort.

Assuming no new zero-days, and that they were even doing best practices in the first place. How many legit companies do best practices?

zero days are irrelevant imo, zero days are for targeted attacks(assuming it's from gov), exploiting all zerodays for all devices is not that productive, csam scan on the other hand can handle both untargeted and targeted surveilance: untargeted by spotting bad actors from a generic csam list, targeted - by adding to that list target's face/specific things to locate it and monitor it.

That's the point, bad actors can circumvent the system if they feel threatened, but system can be exploited by gov/companies once rolled out globally to target any user, so we get something that may be not that effective against bad actors but poses great risk to be misused by gov/company in their own interests without users knowing. I've seen how an authoritarian gov in my country is targeting ppl bc they are uncomfortable for the system and this algorithm opens another potential vector of attack.

I don't buy your argument, but as for:

> I've seen how an authoritarian gov in my country is targeting ppl bc they are uncomfortable for the system and this algorithm opens another potential vector of attack.

As per my last sentence in my initial comment in this chain:

> And the governments will rub their hands with glee with all the new data they have access to.

Is 100% still the case, and almost impossible to get anyone to care about.

> only the most competent criminal organisations will do this correctly.

All it takes is for one criminal to write a one-page guide to using GPG and circulate it to the group ....

I know I mentioned paying a cryptographer earlier, but in reality downloading and using GPG is a crude and effective way of defeating an E2EE backdoor.

Are the GPG devs going to backdoor GPG to satisfy governments ? Probably not.

> All it takes is for one criminal to write a one-page guide to using GPG and circulate it to the group

If cybersecurity was that easy, we wouldn't have so many examples of businesses getting it wrong.

Just because everyone here can follow instructions like that, doesn't make it common knowledge for anyone else.

> If cybersecurity was that easy, we wouldn't have so many examples of businesses getting it wrong.

I can only partially agree with this point. Businesses getting cybersecurity wrong has almost no material and significant consequences. At best, they get a tiny slap on the wrist or asked to answer some questions. Nobody in said businesses goes to jail for it or personally pays any fines. Compare that to criminals who have a lot more to lose if they get caught — jail time, fines they have to pay, not having freedom for quite sometime, life not being the same after they’ve served their sentence, and more. Businesses have it extremely easy compared to this. No wonder cybersecurity is so poor among all businesses, including very large ones (like Microsoft, as a recent example).

> jail time, fines they have to pay

Fear of these is the reason for the (maliciously compliant) GDPR popups, and that despite discussion about extra-territoriality and relativity limited capacity-to-websites ratio.

The law and threats of punishment are clearly not hugely significant to anyone involved in the specific topic of this thread regardless; in the UK at least, it's the kind of thing where if someone is lynched for it, the vigilantes have to be extremely stupid (like attacking a paediatrician because they can't tell the difference, which happened) to not get public sympathy.

> If cybersecurity was that easy, we wouldn't have so many examples of businesses getting it wrong.

There are almost no consequences for anyone working at a business that gets it wrong.

The consequences for being a nonce are quite severe so the motivation to get it right will be quite high.

>one-page guide to using GPG

GPG is infamous for being difficult to use correctly and for an antiquated design (IIRC forward secrecy is impossible?). And assuming E2EE backdoor actually exists, the gov is likely to be able to get at your key.

>Are the GPG devs going to backdoor GPG to satisfy governments?

No, but most users are unlikely to verify their GPG build is the right build.

Reply on news.ycombinator.com