Hacker News Reader

Comment by miohtama | Hacker News Reader

Because client-side scanning is not going to work, and no one wants to government issued black box binary to send their conversations and photos to unnamed police person randomly, the non-compliance is the only way.

People just start to use chat programs in the EU that do not comply. This would be Signal, Telegram, others. The EU can fine and fight with Meta/WhatsApp, Apple, others, but that’s about it. The EU bureaucrats do not have power to magically insert spyware in our devices as long as we can install our own software.

… which of course means we know what’s going to come next.

View on HN

Signal advises its users to install the app from the Play Store. While you can still get the .apk from Signal’s website, the developers warn against that. The EU can definitely exert pressure against what is hosted on the Play Store.

Telegram famously lacks end-to-end encryption (unless you intentionally use its private-chat feature, which few people do) and shouldn’t be mentioned in the same context as Signal.

Telegram is a social media site pretending to be a messaging app.

The secret chats were the biggest feature when it started, but now it's an after-thought.

Molly is a just as good (if not better) fork of Signal that is distributed on FDroid. It's the same network and same chats/contacts, just a different front-end.

And Signal avoids FDroid because they don't want someone else signing packages but they can always provide an FDroid repository like many others do and sign everything themselves.

If push comes to shove they'll be fine and pressure to black box signal in the EU is unlikely to hold up if they can just move users to another app store.

Signal being restricted to F-Droid would be the end of the app as any kind of mass phenomenon. Sure, like my fellow nerds here on HN, I use F-Droid. But none of the ordinary friends and relatives I managed to convince to install Signal, since it was free from the Play Store with just a few taps, would continue using the app if it were relegated to that repository they have never heard of.

Signal’s developers have spoken on a number of occasions about how their aim is to ensure encryption for the masses, not a techie elite.

Yeah, I communicate with way too many people on iPhones who will simply not switch to Android. If it disappears from the Apple App Store we will have to use a different messenger.

I mean if the choice is between "installing black box MITM to signal", "pulling it from the EU google play store and requiring users to download the apk manually", and "pulling it from the EU google play store and allowing users to use fdroid" then the choice is obvious.

Mass adoption can continue elsewhere if the EU chooses to go down a route that would make play store support in the EU non-viable.

Their reasoning for having it Play Store only is that Google does not require app developers to provide their signing keys/sign the APK themselves. Now this is no longer the case as Google changed their policies.

NOTE: F-Droid does not require app developers to share their keys, instead they build the application themselves and sign it with their keys -- something Signal is not a fan of.

tl;dr their rationale no longer applies.

I have also seen the preference for installing from Play Store explained as being that users are safer if they use default setups and do what everyone else is doing. For users who are not savvy, going the sideloading route can expose them to risk.

For me this line of thinking doesn't make a lot of sense. The Google Play option will always exist as it is a prerequisite for widespread adoption on Android. Also arguably, you're safer on F-Droid due to the level of vetting on that platform; so providing Signal on it is a good endorsement for general user safety and privacy.

Either way, this isn't about only offering the application on Google Play or only on F-Droid; but providing the option for both. Non-tech savvy users will always pick the more familiar and easy option on average, Google Play.

How is providing a F-Droid repo the same as being restricted to only being available via F-Droid?

It was in reply to:

> If push comes to shove they'll be fine and pressure to black box signal in the EU is unlikely to hold up if they can just move users to another app store.

Yes but the assumption is that "push comes to shove" and they have to choose between pulling it from the EU play store and installing black box MITM software.

Having relatively easy alternatives in place would reduce the leverage the EU has to actually practically enforce this and hopefully pressure them into at minimum non-enforcement and preferably walking back the obviously unenforceable legislation.

But if it looks like they could practically force out Signal and co or force them to adopt this MITM if they want to continue existing, then they might be more likely to pursue it.

If you enable private chat, you don't get notifications for new messages, that way the feature is self defeating, it seems to me at least. (Something could also have gone wrong?)

Notifications generally go through Google Firebase so by not running private messages through firebase they avoid potential leaks. At least that's my guess

A common way around this is to simply send a notification through Firebase/other push notification mechanism that tells the app there is a new message.

The app can then retrieve the message and decrypt it. Most of them will then update the notification shown to the user with the full message content.

Maybe the concern is that Firebase still learns that user A and user B receive notifications back and forth at around the same time, interspersed with periods of no notifications for both

If A and B talk regularly, there might not be many other C who by coincidence exchange notifications at the same time

So you might be vulnerable to a sort of traffic analysis

That sounds pretty bad, a cloud service needs to see all notifications?

Server side push messaging uses cloud infrastructure on both Android and iOS devices.

Some applications choose to make these notifications more 'secure' by not sending any content through them, just the fact that you have a new notification, but that makes the UX a little less friendly.

https://en.wikipedia.org/wiki/Apple_Push_Notification_servic...

https://en.wikipedia.org/wiki/Firebase_Cloud_Messaging

No, it can be encrypted and then you have a hook that decrypts the notification on-device. On iOS you need to get approval from Apple to do this though

A good question. I am not sure if notifications on iOS, Android, Google Chrome or Firefox are end-to-end encrypted.

You can send whatever values you desire as long as your service worker handles it.

With Telegram on Android you should still get notifications, even for encrypted messages. They just won't show the message's content.

I don't have problems with notifications for secret chats ?

Their point isn’t about Telegram end to end encryption or lack thereof, its that they don’t comply

Nothing gets taken down from telegram and they ignore court orders they just go to null

And they store data on their servers in plain text so that ru state/arab investors can access it at will

Also do not miss the recent good article about the US software development companies who are behind the lobbying of client-side scanning, how is this madness is being funded and by whom.

https://balkaninsight.com/2023/09/25/who-benefits-inside-the...

Thanks - interesting. Phrases like this are eternally surprising:

> The same month, UK officials privately admitted to tech companies that there is no existing technology able to scan end-to-end encrypted messages without undermining users’ privacy

It's as though this is a secret that UK officials knew. Everyone technically minded knows this; it's a battle between those who regulate (the difficulty of whose job generally stops at "write down the rule and fine people if they don't do it") and those who know about current fundamental limitations.

Remember this is the same UK government that at one stage back in 2020 was proposing that there could be borderless customs enforcement between Ireland and Northern Ireland (part of the uk) "using drones". Because everyone knows drones do that.

I don't think they consider themselves limited by things technology is actually capable of when talking about what they are going to get technology to do.

cloudflare also comes to mind, as they proudly do whatever they can in their power to check off that CSAM box as long as it makes them money somehow.

And by next you mean in parallel. Spinning E2E encryption as a tool used only by bad actors is very common and pushing browsers to implement governments managed blacklists seems quite in progress. Banning VPNs from social networks (and more) was even suggested in France but quickly removed due to backlash.

Governments will mandate by law that the OS do client side scanning by peeping inside the app directories. Apple, Google, Microsoft will comply and realistically, which phones and computers are we going to use if we don't buy from them? Desktop Linux might become illegal.

Yes, the EU is already working to make this illegal

https://mullvad.net/en/blog/2023/2/1/eu-chat-control-law-wil...

The best bet is Android fork based on Android open source distribution, without Google.

Right.

Per program makes people use different programs.

Per OS, ok, maybe people will use a different OS (finally! Year of the Linux desktop!)

… ok, we’ll just roll it into the three companies making GPUs. Driver binary side scanning. Maybe hardware frame buffer scanning?

All is this is framed around children, but you are an absolute clown if you think that is truly the end goal.

It’s always “for the children”.

> The EU bureaucrats do not have power to magically insert spyware in our devices as long as we can install our own software.

EU bureaucrats have power to force ISPs to block connections to the messengers that would not comply, Chinese-style. They already do block websites they don't like - e. g. in Cyprus local provider CYTA shown me "access blocked due to EU comission regulation #whatever" for most of the Russian media sites.

The EU is trying to make it mandatory to allow sideloading. This is bad, but also the opposite of what you are saying.

At the moment, it is perfectly possible for e2ee to be compliant.

Reply on news.ycombinator.com