Signal: Will leave the EU market rather than undermine our privacy guarantees | Hacker News Reader

Signal: Will leave the EU market rather than undermine our privacy guarantees

twitter.com

649 pointsdoener626 comments

That Tweet links to this [1] description which, in glancing at the text, seems to indeed be accurate:

----

According to the latest draft regulation dated 28 May (Council document 9093/24), which is presented as “upload moderation”, users of apps and services with chat functions are to be asked whether they accept the indiscriminate and error-prone scanning and possibly reporting of their privately shared images, photos and videos. Previously unknown images and videos are also to be scrutinised using “artificial intelligence” technology. If a user refuses the scanning, they would be blocked from sending or receiving images, photos, videos and links (Article 10). End-to-end encrypted services such as Whatsapp or Signal would have to implement the automated searches “prior to transmission” of a message (so-called client-side scanning, Article 10a). The initially proposed scanning of text messages for indications of grooming, which is hardly being used to date, is to be scrapped, as is the scanning of voice communication, which has never been done before. Probably as a concession to France, the chats of employees of security authorities and the military are also to be exempted from chat control.

----

Strange times we live in. Entertaining, but strange.

[1] - https://www.patrick-breyer.de/en/majority-for-chat-control-p...

Article 12 of the declaration of Human Rights :

No one shall be subjected to arbitrary interference with his privacy, family, home or correspondence, nor to attacks upon his honour and reputation. Everyone has the right to the protection of the law against such interference or attacks.

Bugging communications by investigators with special approval is already an exception to this principle. Government bodies that make sure that laws conform to the constitution should veto any exception broader than that, so this draft should basically be pointless.

It feels like there are social/political mechanisms at work that allow that to however happen. They pave the road to Hell little by little, one stone at a time, and this is neither strange nor entertaining. To me, the beginning of this century has similarities with the beginning of the previous, which is quite worrying.

agreed. i feel the real motivation is much more sinister and much more to do with the geopolitical situation than anything else.

the reality is, if anyone is seriously determined to commit what they know are crimes then there are many solutions, of admittedly varying quality, for having private communications outside of the mainstream apps available on the app store. even signal itself has an apk you can install on android from their website.

so, it's unlikely this will indeed help in the fight against CSAM or whatever else is purportedly motivating this legislation. the end result will be mass surveillance 24/7 on the vast majority of the population who aren't commiting any crimes at all. it seems to me like big brother's wet dream. ironic that this is exactly the thing the US/EU political leadership have been bashing the chinese for since forever.

> ironic that this is exactly the thing the US/EU political leadership have been bashing the chinese for since forever.

there's a good reason for that. it's not controlled by and for the benefit of our oligarchs.

governments having low level dirt on their populations feels like manufacturing excuses to send people to war and remove their autonomy

Any intelligent criminal will just meet face-to-face to discuss their criminal activities. None of these apps protect against someone taking a photo of the screen and snitching to the authorities about what was said in exchange for less jail time.

To be fair, criminals are (fortunately) not always intelligent, especially the rabble they are trying to catch; or at least, the "small fry" isn't, but that's precisely how - I suppose - they hope to catch the bigger fishes who may be more cautious.

Or, to be honest, implement a fully E2EE chat application by themselves, right?

> agreed. i feel the real motivation is much more sinister and much more to do with the geopolitical situation than anything else.

Of course. Your "privacy" is very important for Microsoft, Google and Apple because of the "geopolitical situation". /s

Here I entirely blame Apple for opening this Pandora’s box. Politicians never attempt what they don’t know to be possible.

Yeah I truly don't see how this is all that ambiguous of a violation of privacy.

Will my email client using SMIME have to implement this? Seems kind of ridiculous.

Seems to be targeting platforms. Will it be illegal to send encrypted texts, what is keeping anyone from using crypto on top of existing messaging?

While I do not want to dive into any details on adverse effects of such stupidities, the EU seems to be actually taking a strange road to tech dependent overengineered regulation. It seems that this mostly driven by lobbyists that want to sell compliance services. Also it seems that there is more value in creating regulation rather than making sure it is enforcible.

> Will my email client using SMIME have to implement this? Seems kind of ridiculous.

Seems about right for the EU.

If you are in the business of selling SMIME clients as a service to other people, then yes, you would need to implement this if the law passes.

Maybe there's an unintended upside to all this regressive business legislation. With all the focus on the "platforms", then maybe, just maybe, this will be yet another nail among the thousands of nails needed to finally kill them off.

Signal is not selling anything. So my guess is that distribution is enough. So my guess this would also apply to e.g. Thunderbird then.

Yes. There are people with problems. Instead of helping them fix their problems it's just easier to prevent nice things from everybody.

Strange times indeed.

This is the standard reaction humans have these days, ban things because a small minority screw it up. See guns.

Seriously, who are they expecting to pay for that? AI vision detection run against _every image every person sends to anyone_, among other things, will get ridiculously expensive.

Half of the reason Microsoft is pushing "AI PCs" with special hardware is so they can push their spying to on-device and reduce all the extra costs the data processing they're imagining for things like automatic-screenshot-analysis-every-x-seconds will need.

And they're pretty much experts on spying on users. They've been collecting so much data for so long that apparently they've found a way to utilize what they collect in a way that makes the costs balance out in the end. Whether thats with government access, preferential antitrust treatment, or some actual financial method that directly affects the bottom line, I don't know. Somehow it's worthwhile for them. BUT -- when even Microsoft is looking for more efficient ways to spy on people, and forcing new hardware to support that effort, you know the data collection and analysis technique is definitely not ready to be made a legal mandate.

It doesn't make sense at all for some EU decision makers to decide it's acceptable for their citizens to bear the cost of so much data processing.

....wait, how much do large players in AI contribute to these politicians campaigns? Or if not them, who is really pushing this? It seems like someone should really try following the money on this one.

Follow the money article: https://balkaninsight.com/2023/09/25/who-benefits-inside-the...

Let me take the other side here. The western world couldn't make it without sovereignty. I do realize that it sounds bad that few states would have such power. But make no mistake - if they won't do it, other actors would, I think that your interests reconcile with a democratic state much more than the other crooked actors.

It's just a matter of lesser evil in my humble opinion.

E2E encryption would prevent anyone from intercepting texts by mathematic certainty.

At least on a mass scale, if we worry about back doors.

This SaaS fad is the underlying technical enabler of the spying and need to go away.

I guess Google is the main culprit by making P2P coms hard.

Asking faceless corps to open their users' mailboxes willy nilly is way easier then asking the voters to.

Implemented mass-surveilance is proof that democracy is dead.

What if the overwhelming majority of voters want surveillance?

Then put it to a referendum. It's certainly an important enough protection considering that correspondence is usually constitutionally protected.

I give you that if the voter opinion was not influenced by media reports. However, since that is pretty much impossible, no... There is actually no way the "overwhelming majority" will ever want that, without being influenced...

vry good take

You answered yourself : remember Apple’s implementation of CSAM detection.

We don’t own our devices anymore and we now have very limited control of what is executed or not so there is nothing stopping developers to run those legal spywares on the device since our only option if we don’t like what an app does is to not use it.

I don't know how to help folks that didn't treat the apple csam fiasco as a massive wake up call to ditch the ecosystem.

We have linux phones these days, caly, and grapheneos. There really isn't reason to give up on general computing. (Ignoring the propriety baseband blobs.)

Apple's backing down on that very sound initiative was a failure and a red flag indeed. They had the chance and the weight to pull it off and set a standard, but instead basically gave in for regulators to implement whatever spying laws they want.

Sadly, nothing else comes even close to Apple in terms of security and privacy, especially for someone who is not an infosec specialist and doesn't have time to read CVEs all day.

> Sadly, nothing else comes even close to Apple in terms of security and privacy, especially for someone who is not an infosec specialist and doesn't have time to read CVEs all day.

Even for someone that is not an infosec specialist, they should be using something like Graphene for phones and something like Qubes for their OS.

Apple isn't great at all honestly, at least in terms of MacOS security - they mostly benefit from not being worth the time to target.

While you make good points, I still wouldn't trust Apple to not scope creep over time. Client side scanning of hashes for csam presents the entry point they need to establish client side scanning as a norm. It's the preverbial inch. Give it a year, or months even, and watch that grow to include scanning of text for terroristic threats, or of teens' chats for grooming, or depression, etc. Then watch that data become a gold mine for both the gov and for advertisers.

The slope is so slippery that it's ot worth the risk, imo. It paves the way to reduce general computing even further, which is already quite restricted on apple devices to begin with.

A trusted app running on arm execution level 3 could make use of the NPU to offload some of the work?

Apple's proposed algorithm was probably the best so far.

The problem is not going away, we in tech are partly responsible and we should promote good ways to deal with it. If we don't then a solution will be found anyway, it'll just be a bad one.

I will quit using all these platforms then.

Finally, free from WhatsApp voice notes, stickers and images clogging my phone storage. Adieu.

If those are what's bothering you, nothing stops you from quitting right now.

For now I have a Tasker job routinely deleting WhatsApp's media directories. Unfortunately everyone is using it so I have to stick with it. Hate WhatsApp with passion.

If this law passes, bye bye.

As others have stated, just uninstall it now. Even at my work, my manager wanted us to use WhatsApp to communicate with our offshore teams. I let her know that I would be happy to do so with a company provided phone, but I don't install spyware on my devices, and furthermore don't have an app store so would need to be able to build it from source. But I'd be happy to use signal or email.

Do you imagine that people will stop chatting if this law passes? If you hate it so much, why not just stop using it now?

Everyone will be using it when the law passes so it’s no different.

"want to stick with it"..

dont misrepresent

"have to stick with it"..

dont misrepresent

"The initially proposed scanning of text messages ... is to be scrapped, as is the scanning of voice communication, which has never been done before."

If true, then it seems unnecessary to "leave the EU market" with respect to text messages and voice calls.

It would be so funny if a security authority was caught in a CSAM case, and it wasn't detected simply because said person is an authority and shall not be scanned for unlawful content.

The problem is the design of the system and the programs. It should not handle by the apps/services but you can use your own programs for encryption, for display, etc, and can be used separately. If the data is really end-to-end encrypted then the service and apps should not care what they are; the user should care based on what programs they install to handle them.

Additionally, it says photos, videos, links, but you can make any data represented as other files e.g. text, slowscan, steganography, etc.

The law says "images, photos, videos and links". What about simple encrypted or password protected zip files?

As far as I know, most messaging platforms allow you to send regular files too. Wouldn't "the bad guys" simply use that as a loophole and continue with their day?

I know the real reason behind the law isn't to actually protect children, but, you know...

I assume this will apply to all bits. After all, a zip could contain an image, so it should be scanned. And someone might accidently change the file extension from .jpg to .py.

The point he's making is if they enact this law, it will be trivial for anyone that cares (eg, people who do distribute CP) to bypass if it is implemented as described. They don't even have to stop using Signal or whatever. They just need to plonk whatever they want hidden in a password protected .zip (or something else if that's not strong enough, or use stenography if they ban containers) and send it using Signal as normal.

So it won't stop CP, or any other criminal activity that's in the slightest bit cluefull.

They must know this, so I'm left scratching my head wondering what they are actually up to.

> The point he's making is if they enact this law, it will be trivial for anyone that cares to bypass if it is implemented as described.

I took that as a given and therefore described what I would see as scan-creep of the gov implementation regardless of the exact verbiage of the law.

My point was that anyone expecting to use the file type as a loophole would likely ne compromised, and the only way to ensure bypass of the scan would be to locally encrypt before transmission, as any text or binary entered into an app affected by this law should be assumed to be fully mined, scanned, and reported to the gov regardless of its contents.

Yep, lol nothing to stop criminals from encrypting the file themselves and sending it across lol theirs hundreds of unhacked encryptions, all the end users need to do is share the passwords outside the spied upon platforms, like this doesn't solve any issues it just strips freedoms from the non-criminals.

Shit criminals will just meet and swap usb drives lol, like i don't get how this solves the crime issue. This is like banning monero or crypto because its used illegally.. meanwhile CP and other crimes have used Euro and USD paper money for long before crypto lol but yet "crypto seems shady" is enough reason to point at it as the reason crime exists lol.

I hope this passes.

I want to see the riots when EU cell phone consumers have to pay for text messages again.

Some men just want to watch the world burn...

There won't be any riots. This is the scariest part, most people just don't care

France: Hold by beer. https://en.wikipedia.org/wiki/List_of_incidents_of_civil_unr...

While it's a fun meme, if you actually look at the list, the inciting incidents are usually (accusations of) police violence/overreach, reforms to cut labor protections, welfare or public education, and Israeli military operations in Palestine.

In fact, most of the protests seem to neatly fall into the "police violence" (usually against minorities) and "austerity" buckets.

I think the parent meant that France is a country that actively protects its rights via violent protest as opposed to other countries that merely sit and suffer.

A lack of rioting doesn’t mean people don’t care.

Does anyone have to pay for text messages?

People often forget just how much we get from the EU that's taken for granted. Everything from practicalities like no roaming costs and consumer protection, all the way to freedom of movement, peace and overall stability.

Yes, but also the (1) push of PNR to keep a complete record of your travel and movements within the EU. Dutch train operator NS is operating in spirit of the future “PNR” already and makes it harder and harder to buy “anonymous” train ticket (even for local 15min journeys). The so called anonymous card, is linked to your bank account used to top it up. What if you prefer to use cash in your daily life (2), for envelope-style budgeting? Well, your bank will let inform the authorities of your anomaly. You will start receiving monthly questionnaires asking to backup your behavior and why you might want 2-3-4K eur in cash every month.

All that people have to do is vote for the Pirate Party. There are people holding the line in Europe, but the population is worried about war and immigration instead of net neutrality and encryption. These are understandable priorities but it'll not be good.

This is part of the trans Atlantic trade agreements. They have a certain responsibility, having negotiated them, but they clearly feel they are beneficial in some way.

Crediting the EU with peace while Israel and Ukraine are actively at war is a bit much.

Are Israel and Ukraine EU members? Are they fighting members of the EU?

Oh come on, France and Germany were basically in a perpetual war for hundreds of years before, and now there's not even a theoretical chance of any two EU states fighting each other.

Occasional war here and there not directly involving any of the member states is incomparably better than what came before.

I don't think the EU says anything about how much texts should cost...

Edit: I am *obviously* not talking about surcharges for roaming but cost in plans, which I think is the point of the OP when he asks who pays for texts. Pricing is not regulated and has nothing to do with the EU.

It does, quite a lot. For example, it says you should pay the same regardless where you are in the EU (roaming), it also says you get a clear and transparent pricing for your mobile service, it also says all kinds of things about your rights to cancel, change providers, get refunds etc... you should look it up.

In Germany at least, unless you opt for a super cheap package(e.g. sponsored free or less than EUR 6/-), calls and texts are unlimited in local(country level) networks, only data volume is limited. Not sure about other EU neighbors.

In Poland, 4.70€/mo will get you unlimited calls and texts. Can be purchased on pre-paid plans as a 30-day package, no need for post-paid plans.

If you have to run every image and text through some sort of "filter" you cant turn off... Yes.

Thats a LOT of compute.

That is already happening though, this just says it should also happen to e2e encryption by scanning on device. If it was that expensive costs would have appeared a long time ago.

Yes. The phone batteries across the EU are going to hate this.

I pay ~0.10€ for a text message - but I don't know anyone who uses text messages for communication so it's not a problem. I could buy a cheap plan for unlimited text messages, but I don't want a fixed monthly fee and prefer prepaid.

When was the last time public outcry actually impacted policy?

Example from last year: https://en.wikipedia.org/wiki/Dutch_farmers%27_protests?uses...

Holy shit thats creepy AF

What do they do if I send: AFBC67CEDA7AD?

Ban all “non-intelligible” content?

Who can stop me from hiding information in very normal looking sentences?

If you want privacy, there will always be a way.

This is not about preventing you from doing that, it is about preventing services with many users from providing that service to you without a backdoor.

You can just send anyone you want an encrypted e-mail or message, but Signal can't facilitate that without the required provisions set out in those laws. If these dumb laws get enacted, Signal cannot get away with just pretending you are sending gibberish whilst providing true end-to-end encryption without any client-side scanning or whatever to you, but you are well within your rights do so yourself on top of Signal (if that's even possible); they just can't provide an automated means to do that for you.

Exactly, this just pisses off companies with added costs, strips freedoms and criminals move to using their own encrypt and decrypt step that the "Scanners" just see as bullshit gibberish or some form of stenography image etc.

Or ... they develop their own darknet webrtc based chat lol, like its silly to enforce this on the general populace when its so obviously circumvented by the people looking to do scary shit.

> they just can't provide an automated means to do that for you

What I'm wondering is whether two separate applications can be set up to communicate automatically, with one handling messaging and the other being responsible for encrypting and decrypting the data.

What would be against the law in that case? The messaging app? The encryption app? Or the interaction you are doing in that moment?

Step one would be determining if anyone actually uses those two apps together. A handful of people? No one cares. Is it now the default way you install Signal (or its two components) and do hundreds of thousands of users do this? Then the next question asked is who is facilitating it and how is that done? Does the backdoored Signal have a plug-in that allows this kind of use? Does Android facilitate that? Those people will likely find themselves in legal trouble.

Of course these laws are dumb, but that doesn't mean they can't be (mis)used to get the desired effect.

> A handful of people? No one cares.

Actually police and various agencies do, because when most people aren't encrypting, the few that do are suddenly interesting. Some of them will turn out to be organized crime, but some of them are just adults who want to communicate privately.

> Does Android facilitate that?

Does Android facilitates IPC and services?

> The encryption app?

That might be the next step. Banning encryption. We live in a strange world right now.

The EU does not want to ban encryption, because it is the backbone of e-commerce and banking. There are plenty of public references that show the EU's explicit support of strong encryption.

What some law-and-order types (globally) want, is the means to scan, peek, or otherwise access private communication, especially if that communication is provided by a service used by millions. You can encrypt all you like, but if you use WhatsApp or Signal, laws like these force those services to create a way to eavesdrop. How is probably not defined in the law. Client-side scanning before encryption, having those services act as men-in-the-middle for each conversation; this is all fine, and can use encryption as usual. As long as certain agencies get to have a peek somewhere between those strongly encrypted tunnels.

I am using a special keyboard that outputs these sequences automatically. Must my keyboard driver send the keypresses to the EU? Fine, here are they: AFC628BCF627.

I understand Signal is handicapped now, but I couldn’t care less about Signal. I only care about being able to communicate in private. Why don’t we implement this stuff at a lower layer?

Surely the guys on top must see this is an endless game that they will never win? It’s not an arm’s race, it’s fundamentally impossible.

You don't seem to understand the point of these laws. It is not about stopping anyone with enough technical know-how from encrypting their communications. This is possible today, and not something which can be easily legislated away without resorting to a much heavier class of draconian laws (at which point you won't be living in a democracy any longer in any case).

This is about making it hard (or impossible) for some perceived group of miscreants to communicate privately. People sharing CSAM (however you define that) or dealing drugs, and stuff like that. Anyone can encrypt their communication, but most people don't do this consciously; the masses just use WhatsApp and Signal and what have you.

You and your special keyboard are not of interest, and unless you start selling these along with a service to route the encrypted messages to thousands of users, you are not the target of this legislation. Take away Signal and WhatsApp and sending an end-to-end encrypted message to your drug dealer without exchanging keys and agreeing on a protocol suddenly isn't as easy as just opening an app. That's the point of this law.

It's a dumb law, but you won't make it go away by playing silly semantic games.

> without resorting to a much heavier class of draconian laws

They may be coming down the pipe, after the soft version gets people macerated.

> at which point you won't be living in a democracy

But you will be hearing from talking heads that you are, and Russia and North Korea are the real dictatorships.

And maybe they will be right, because what is democracy? The word has different meanings to different people, and it won't be difficult to shape the discussion about what our liberal democracy is all about. Maybe it's about accepting who has power now and about protecting the vulnerable. We have seen a bit of this stance and real capabilities in recent years.

Criminals are using specialty phones or should I say, were using, because this was recently cracked and thus became useless. Catching Taghi in NL was a famous result of that.

Point is that dangerous people will use specialty devices/services and being legal is certainly not one of the requirements.

If you sell your keyboard as a service to people in questionable lines of business, then yes, you will need to comply with these laws. You can probably also expect a visit from three letter agencies. Which these targeted platform companies also do.

> What do they do if I send: AFBC67CEDA7AD?

If this sort of surveillance stuff gets accepted, in time, you're gonna get noticed, put into database, and maybe called for questioning. Why are you using encryption, people that have nothing to hide do not use it.

A timely reminder that 9/11 hijackers communicated in the clear. Examples:

“The semester begins in three more weeks. We've obtained 19 confirmations for studies in the faculty of law, the faculty of urban planning, the faculty of fine arts and the faculty of engineering.” — Mohamed Atta

“Two sticks, a dash and a cake with a stick down. What is it?”[2] — Mohamed Atta

“The first semester commences in three weeks. Two high schools and two universities. ... This summer will surely be hot ...19 certificates for private education and four exams. Regards to the professor. Goodbye.”[2] — Abu Abdul Rahman

Even in China with extreme surveillance and censorship in place, Chinese people have been quite creative in their ways of circumventing censorship. An example approach is cutting and pasting official political videos together in a way that changes their meaning ever so slightly. Automatic censorship algorithms are fooled, and human analysis and censorship are necessary and very expensive to carry out. Other examples are playing with the sounds of words, or using memes or rapidly-changing euphemisms.[3] It's too difficult to automatically censor stuff where people have taken a normal word such as "chair" and send each other images of chairs as a sign of protest. An image of a chair and a birthday cake with a number of candles could indicate a date of protest. Or a chair in a picture with a number of ducks in the background, or a number of chairs stacked on top of each other. And if censors start blocking all chairs, everyone just shifts to buses, or pieces of paper, or bananas, or whatever.

[1] https://community.apan.org/cfs-file/__key/docpreview-s/00-00...

[2] https://www.nytimes.com/2004/12/20/business/technology/on-th...

[3] https://en.wikipedia.org/wiki/2022_COVID-19_protests_in_Chin...

"We kill people based on metadata"

Frankly, GB was totally right in leaving, and if I had the ability to vote for stay/leave right now, I'd want to go. But this position is totally unwanted. You're being called Nazi or at least extreme-right the minute you utter it. This way of dealing with supposed democracy is what makes me want to leave even more. The EU has become a strange beast. The current election ads make that pretty clear. It basically reduces to "vote us, we're cool, we are deocracy" which is almost dystopianly void of real content.

GB has their own version of chat control: https://en.wikipedia.org/wiki/Online_Safety_Act_2023

UK has passed that law before EU. https://en.m.wikipedia.org/wiki/Online_Safety_Act_2023

Yeah, UK left because they thought EU wasn't draconian enough.

England's government already passed essentially the same thing.

Where are you living, if you don't mind sharing? I don't know about any place where expressing eurosceptic views would get you called "far right", let alone a Nazi.

And I disagree. You take for granted all the good regulating and all the things enabled by the EU, and focus on the one bad regulation we're discussing, which is not even a law yet. I, personally, am not looking forward to the future without EU (I remember my country before it joined and the progress is immense).

"Progress", sure. What you actually mean is "we got a lot of free money to build things with". Its easy to like the EU if you are in one of those countries that gets way more out then you have to put in.

> Where are you living, if you don't mind sharing? I don't know about any place where expressing eurosceptic views would get you called "far right", let alone a Nazi.

Try the largest German-speaking subreddit, for example.

> I don't know about any place where expressing eurosceptic views would get you called "far right", let alone a Nazi.

I think elsewhere online this may happen.

Also, some public broadcasters use the "far right" word group suspiciously often, almost as if it was some kind of effort to softly suggest to people how not to vote, but I must be imagining things, because they would never do that:)

Yeah, thats the problem. "they would never do that" has been violated far too often by supposedly centered media outlets. During corona, our state contrtrolled media actually really said that citizens are not supposed to listen to any other media because everyone else is likely lying. And since it is blatantly obvious that center-left parties will get a haircut for what they did during corona, again, the state controlled media are now doing exactly what you describe, warning the citizens of the evil right parties. And I am forced to pay for this, 50 cent a day. This isn't democracy anymore, its blatant manipulation of public opinion.

When apps created for overthrowing governments in other countries begin to backfire amid record low approval ratings, it all of a sudden turns out that “human rights” are merely a cudgel to beat others with.

Next week we have the European Parliament elections. Any tip on any "mainstream" party which is strongly against this? I know for sure the Pirate Party but they would never get a seat, at least in my country

Czech pirate party and German pirate party have seats and they're members of the Greens–European Free Alliance [1]. Take a look at which parties where you live are members of that alliance.

1. https://en.m.wikipedia.org/wiki/Greens%E2%80%93European_Free...

Just don't get guided by the tables with only those Alliance members, who actually made it into the European Parliament, on this page. For instance, only Sylwia Spurek is mentioned there for Poland - a terrible choice IMHO [1], while there's the Pirate Party in Poland (https://polskapartiapiratow.pl/) too.

[1] For example, while being the Vice Commissioner for Human Rights (vice ombudswoman) in Poland, she stated that "It is worth, first of all, stating a few facts. First, violence has a gender, whether we want it to or not. Women and children are the victims, and men are the perpetrators." (video transcript translated with https://www.deepl.com, source in Polish: https://wiadomosci.onet.pl/kraj/dr-sylwia-spurek-przemoc-ma-...).

In Poland, women are probably more often the victim than men, but in U.S., reported statistics are very surprising.

> men and women were equally likely to experience nonconsensual sex, and most male victims reported female perpetrators. [1]

[1] https://www.scientificamerican.com/article/sexual-victimizat...

If I correctly understand the linked materials by Patrick Breyer [1], then the parliament (which is the piece of the E.U. where we are presently asked for our vote), is opposed to this pretty much in its entirety: It says "Parliament has positioned itself almost unanimously against indiscriminate chat control." So, it seems, the way you vote here doesn't much affect that outcome at all.

Also, if I correctly understand this table [2], then "Renew" (formerly "ALDE") is also opposed, so you don't need to adopt the leftist political ideology of the Greens as a package, just to get pro-privacy representation in the European Parliament. "Renew" does seem to be a viable "libertarian" alternative there. They also make some pro-privacy representations on their website. I don't follow European politics much, so I may be mistaken here. For example, I haven't looked into their voting record.

[1] https://www.patrick-breyer.de/en/posts/chat-control/ [2] https://www.patrick-breyer.de/en/posts/chat-control/#negotia...

You can look at the votes of the members of European parliament. For example, here for a vote on "chat control" [1] (from 2021) and a recent one [2]. You can filter to your country to see how each party (or even each member) voted.

[1]: https://mepwatch.eu/9/vote.html?v=134463

[2]: https://mepwatch.eu/9/vote.html?v=167712

However, its not that easy to find these results. I was looking quite a while to find this one.

Thank you very much! I will definitely need to remember to vote in my country of residence next time, because my country of birth has almost nobody representing a good chunk of my views :(

Volt being valid as always with Damian Boeselager

All MEPs from my country voted in favor of both of those. Really wish I had a choice for the upcoming elections :/

EPP is pushing for this, ALDE is probably mixed depending on the country. So if Greens/EFA and parties like Volt or pirates stand no chance you could still not vote EPP.

I can't find specific policy positions for Volt on encryption, but they're very positive about open source [1], so you'd imagine they'd have a pretty reasonable approach to encryption too.

[1] https://volteuropa.org/policies/european-democracy-act/open-...

Well, apparently, it seems spying on the populace is kind of the mainstream position - among the political elites - in many European countries these days; so perhaps you should consider non-mainstream political currents.

Also - there is the question of EU legitimacy. Its structure is highly problematic, as are its politics vis-a-vis the US, NATO, Russia, Arab countries etc - and I'll naturally not open that whole discussion; my point is that I would also consider supporting dissolution of and/or secession from the EU. Not because friendly and cooperative inter-relations are bad for European countries - of course they are - but because the EU is not a good vehicle for that, it's a vehicle for realizing elite-minority political and economic interests.

s/of course they are/of course they are good for them/

Excuse the confusing mistype :-(

Not getting a seat doesn't matter, it can still signal growing voting in that party and give people confidence to vote for them on the next go around.

I don’t know where are you located, but I’d avoid voting based on “this party won’t get a seat”.

Voting for a party is a signal for other people and for the party itself. It may not be today but next time that they get that seat.

I'm feeling inclined to vote for them this time.

See the following. It seems more EU procurement lobbying and corruption, using child pornography as the dog whistle to garner public support. https://www.europeanpressprize.com/article/the-eu-fight-agai...

What upsets me the most about this and similar trends (ie. Climate change, AI, etc) is that when crap hits the fan, the current proponents will:

- tell you they couldn’t have know it would end this way

- they really were right, except for this one unpredictable thing that broke their master plan

- hide/pretend they were never pushing for this

- ask for help

- tell the rest to take a hike (the ones that managed to still benefit)

And there is no way for people in the present, who see this coming to prevent it or to ensure proponents are help accountable on the future. You will end up with lawsuits that take 20 years, watered down verdicts, weasel politics, etc.

> - ask for help

cite? I somewhat kid, of course, but this generally seems the last, if ever, step forward considered.

I don't mean asking for help fixing, I mean asking for help in getting away from consequences. Like a scientist unleashing a zombie apocalypse asking for a ride.

Oh, yes, that I totally have experienced!

Centralised service is weaker against surveillance than decentralised solutions. Signal should adopt selfhosting and federation.

jabber/xmpp is open standard and supports e2e encryption and can be self-hosted, has mobile clients

I use XMPP with OMEMO for my main encrypted messaging, and I don't get why Matrix got popular instead of XMPP (aside from a big marketing budget). Even a lighter server implementation takes up several times more resources than an XMPP server, plus the concerns about the enormous central instance.

XMPP FTW.

Last time I checked (2018) the support for media&file sharing was in a quite bad shape in all available Android clients. Even without e2e encryption enabled. Is it good now?

For Android - Conversations is in a very good shape now.

Matrix supports e2e encryption, so it would be a good candidate for self hosting. I already do.

Matrix has shady foundations, being born out of a Israeli company with alleged ties to Israeli intelligence. See https://hackea.org/notas/matrix.html

sigh. If you want to play project pedigree games; Matrix was actually the result of two existing teams - one in the UK and one in France, which happened to get acquired by Amdocs and then subsequently spun out once we'd created Matrix.

That page in particular is a pile of FUD; it keeps banging on about "impressive collection of private data being sent to Matrix central servers, even when you use your own instance" which is simply categorically untrue; it looks like they misread the privacy policy of the Matrix.org server at https://github.com/element-hq/policies/blob/master/docs/matr... and somehow assumed it applied to everyone's server instances. It doesn't, any more than https://www.w3.org/policies/privacy applies to a given random webserver on the internet :|

My only complaint with self-hosting matrix is that the canonical python implementation is quite resource-heavy. I was unable to run it on a cheap VPS. I hope that the ecosystem will improve in the future.

I agree. I really prefer Dendrite, their Go server, but development has slowed down lately. Also, because of the financial issues they have been having, I don't have a lot of hope that Dendrite will get a lot of attention. Maybe Conduit(https://conduit.rs) will become more viable instead of Dendrite. We really need a small efficient build with no moving parts, for the self hosters community.

When did you test it? It has improved very much in the past five years.

Another vote for XMPP with OMEMO here. I use it my wife, family, and a few friends and haven't heard any complaints yet[1] (aside from the lack of stickers, which are apparently important).

[1]: But like I said in another thread, who knows if they would directly complain to me.

How does it support e2e?

By clients having support and/or plugins for things like OMEMO and OTR.

On iOS app distribution and censorship is and will remain centralized.

It doesn’t matter if the relay service is centralized or federated. Apple can ban apps that don’t comply with the new law. Even self-distributed apps under the new sideloading provisions of the DMA can be censored by Apple by revoking the notarization.

This ignores the problem of client-side scanning of private messages.

Your hosting, your rules.

Most of my family use my brother's Matrix server, but it's the Element app that makes it appealing to us all. Client side scanning could be enforced in the app, regardless of the server's protections.

However there is a whole ecosystem of clients, and they can't all be back doored. You are also free with write your own client, and many do (which is why we have so many in the first place).

Protocols, not platforms, people!

But if in a group only one person uses a compromised client, all communication is compromised, isn't it?

Not in the Matrix ecosystem. The protocol is so brittle there's only one real server and one real client, probably intentional, since the designers of the protocol make money from that server and that client.

There are also several element forks. I would imagine there would be a fork without scanning if the main element app was doing scanning.

An their law.

Not on iOS.

Your choice

Making this argument whilst ignoring the trade-offs of federation (that Signal has historically addressed) is somewhat disingenuous and a little fundamentalist.

do you have any breakdown on the trade-offs? Most HN commentary focuses on FUD around the signal founder rather than technical reasons why it shouldn’t be federated and would love to understand them better

Moxie wrote an extensive blog post outlining the reasons they were not going to make use of a decentralised system.

I believe its this post here, but someone correct me if this is the incorrect link: https://signal.org/blog/the-ecosystem-is-moving/

Is this the same Signal that threatened to "absolutely, 100% walk" away from UK if the Online Safety Act "undermined" their privacy?

So I guess it didn't, and they'll find a reason why this won't either.

All meaningless talk.

My understanding is that the UK removed clauses that would undermine Signals security. Regardless of which, Signals didn't, and was never going to make concessions to the UK that would compromise it's users privacy.

Their strategy then as it seems to be now, is to do nothing but say they disagree and wait for the regulators to forcibly remove them from the market.

That is if they did themselves non-compliant with a countries laws, they'll do nothing and wait to be evicted rather then comply or voluntarily leave.

>My understanding is that the UK removed clauses that would undermine Signals security.

My understanding is that the law empowers the regulator (Ofcom) to require the use of accredited scanning technology if they consider it necessary and proportionate. No further changes to the law are necessary for that to happen.

But as of now, no such accredited technology exists. It seems likely that any client-side scanning technology that the EU mandates would also get accreditation in the UK.

https://www.gov.uk/government/publications/end-to-end-encryp...

Nothing changed in the UK Online Safety Bill before it became an Act, the troublesome clauses are still there.

All that happened is the government accepted that it was not currently practical to implement what they desired. So 'promised' not to require any providers to do so yet. If they deem it practical one can expect them to instruct providers.

Hence Apple and Signal both ignored their prior statements, and continue to provide their respective encrypted message and speech services.

Yep, that's the strategy now too https://mastodon.world/@Mer__edith/112535637912550792

So cannot wait for GNUtella (and its floating peer-to-peer cloud concept) to come back but retrofitted with Signal protocol.

It's almost impossible to solved political issues using only technology.

Laws can be ammended faster than implementations.

> It's almost impossible to solved political issues using only technology.

True.

> Laws can be ammended faster than implementations.

Really, really false.

>It's almost impossible to solved political issues using only technology.

It's extremely possible to solve political issues using technology. If you consider the government infringing people's right to put whatever substance they want into their body to be a political issue, it's been pretty much entirely solved by crypto and darknet markets for drugs.

Which are technical aspects of a fundamentally social problem. It's not the market platform itself that dodged the government - it's the people on the market.

Solving the political issue is a different matter and very ambitious. Meanwhile, tech mitigation would be nice.

The problem with GNU and Gnome is, to put it in the words of Steve jobs about Microsoft, "lack taste". They are too distant from the mainstream to cater to them.

postnote: this comment was Authored on Firefox under Wayland running on Linux 6.

I don’t think Gnutella is related to the GNU Project or GNOME in any way. It was initially going to be GPLd but I don’t think that came to pass.

As far as the mainstream I believe Gnutella, the protocol, had massive success with the LimeWire client.

Gtk-GNUtella is a GPL license.

https://gtk-gnutella.sourceforge.io/#:~:text=gtk%2Dgnutella%....

>> words of Steve jobs about Microsoft, "lack taste". They are too distant from the mainstream to cater to them.

Yeah, that's why Windows has been by far the most used OS by the mainstream

2015 called and want their stats back.

https://gs.statcounter.com/os-market-share#monthly-200901-20...

You are missing the point. Us hackers will always find ways to circumvent the surveillance. But the rest of the population is not that fortunate. A solution has to include general awareness and mobilization of the non-tech population against this law.

Heck. I'd leave the EU too if this passes. No clue where to go though.

And who will you message then? I assume most of your contacts will stay where they are.

You can message anyone using the internet.

but not securely

Pgp signed emails

That doesn't change the original problem much:

> And who will you message then? I assume most of your contacts will stay where they are.

You are out of luck if you can't convince people to install PGP/GnuPG in their favorite e-mail clients. And e-mail doesn't scale for spontaneous communication like chat does.

Iran, Palestine, North Korea, Syria.

Switzerland

https://en.wikipedia.org/wiki/Crypto_AG

Because Switzerland is so immigration-friendly?

Over a quarter of the country are immigrants, so they’re indeed immigration-friendly

If you have the means, yes.

If you are an EU citizen you have free movement rights to move to Switzerland.

it is for highly skilled/specialized workers coming from the EU. I've emigrated to Switzerland more than a decade ago and couldn't be happier.

So far, the law doesn't have a majority. Even if they manage to push it through the Commission and Parliament, it's very unlikely to survive contact with the European Court of Justice.

We shouldn't count on that though.

and the court of justice typically takes a looooong time to come to a conclusion

> users of apps and services with chat functions are to be asked whether they accept the indiscriminate and error-prone scanning and possibly reporting of their privately shared images, photos and videos

I take it this should apply to any web comments and messaging platform, and therefore require that all websites and web services comply if they can be accessed within the EU?

I’m not sure how that’s even remotely doable.

What do you mean? There are thousands more pixels in the timeline that can filled with POPUPS telling you how to think and how to CONSENT and how to OBEY

If such a law is introduced, will it still be possible to download the application from the website and use iOS sideloading as an alternative scenario? (I'm not talking about the convenience or ease of such a solution)

No because Apple still has to “notarize” the app before it can be sideloaded

So there is no way to overcome this by installing an unapproved app (unverified, unsigned, etc.)?

You could buy an android phone and download the APK from their homepage.

https://signal.org/android/apk/

You could just change your App Store region to any country outside the EU. For example all you need to change to US is an American phone number and credit card.

You don't even need a credit card if you don't plan to pay for things. I changed my Apple ID country to US with just a fake address.

Except you can only sideload in the EU.

No unless you jailbreak your iPhone (good luck with that) or re-sign the app every week because that's your only option without a $100/year developer account.

Good. Stick to your position. No irony or sarcasm, there is only one reason to use signal and these rules undermine it's integrity and purpose.

I don't agree with this. Encryption is a feature of Signal, but it's not the only reason to use it. The bigger reason to use it is that it is independent from Meta, so you can use it without having Facebook track you.

I don't rely on Signals encryption, since there is no way to verify that it works in the way that it does, and even if, there is no way to know that the recipients are as careful as you are. If there is something I don't want others to find out, I just don't write it down. No encryption is fool proof.

Matrix, IRC, Discord, Telegram, SMS, etc. You’ve got plenty of options to get away from Meta. Privacy and E2E encryption are Signal’s killer features

If you just want to be independent of Meta, send an SMS. They’re free and built into every phone. Signal is about privacy.

> there is no way to verify that it works in the way that it does

Since we're specifically talking about Signal, I think that it's worth mentioning that Signal is uniquely predictable here. They published their entire cryptosystem, it's been extensively inspected by the cryptography community, there are multiple open-source implementations that agree with the published mathematics, and I strongly suspect that more than a few people have sat down to verify that the bytes coming out of the app are actually produced by the published protocols. Claiming that that's not "working the way it does" is reaching out into territory along the lines of Trusting Trust, the unproven existence of trapdoor functions, and the Problem of Induction.

> I don't rely on Signals encryption, since there is no way to verify that it works in the way that it does

Totally. Not everyone is a cryptographer to review the code and ensure the app they're downloading is what was compiled by the aforementioned vetted code. That's what F-Droid and cybersecurity audits attempt to solve (and Apple's vetting process, though I think their mandatory $100/yr developer license is what drives malware off the platform).

The one reason to use Signal is privacy, and its replacement of Meta apps is under that umbrella.

How do you deal with passwords? You got to have a lot of critical passwords which are hence not written down, it’s really hard to memorise this.

This is why Signal needs to decentralise. There is no such thing as "leaving the EU market" if it can obtained from anywhere on the internet.

The EU has shot itself in the foot with demanding alternate app store exist, and then Signal has shot itself in the foot by not being open enough to be distributed on any app store by anybody.

The answer to these encryption laws, is to use their other laws against them. You want the iPhone to be an open platform? Great, here's a bunch of open platform chat apps that cannot be banned because they are decentralised.

Perhaps Matrix will be the future after all?

> This is why Signal needs to decentralise

They have been building a walled garden for a decade. They talk about "market": they want to make Signal profitable.

Right now they live off donations (including mine) and I won't donate if they commercialize. Also, there's no easy way to monetize on users without ads, and I'm pretty sure signal users are one of the last demographics to fall for "privacy preserving ads".

Moxie's stance is that "people won't self-host": https://moxie.org/2022/01/07/web3-first-impressions.html

Which I find very naive and destructive, but that's how it is.

Looks like we are going to have to move to two phone solutions.

The second phone will be very basic with open source hardware and self installed open source software, simple enough that you could build it yourself if you wanted. Its sole purpose will be secure communications and it would just use your phone as the communications medium.

It’s already a difficult to convince people to use signal instead of WhatsApp, FB messenger, iMessage, etc… if it requires a new phone with sideloaded software etc, I won’t have many people to text anymore.

I just gave up on smartphones altogether. It is much easier to make a laptop/desktop private instead and limit your private messaging and activities to it.

However 2FA. They're making it hard to not have a phone

I have a separate KeepassXC database for 2FA. I guess my life experience is limited, but I am yet to encounter cases when this would be outright required. The closest one was Steam, but I used an Android VM for this.

But that doesn't fit in a pocket.

Keeping stuff in pockets is overrated. There are ridiculously small portable laptops though.

https://www.gpd.hk/gpdmicropc

This Is The Way.

Bonus: you get a real keyboard.

What phones on the market have open source hardware?

Original reporting: https://www.euractiv.com/section/law-enforcement/news/audio-...

Seems they will reconsider this after the elections. So there is time, depressing as it is. As has been said here before : every country will eat away at privacy every few years with similar proposals that failed a few years before. Until they succeed.

All you have to do to circumvent this new pending EU rule is to apply muLaw encoding of your data stream into the audio file, or something.

Terrible Shannon's Limit although.

It’s the easiest thing for intelligence agencies to scan all your messages. They just need to submit a few million fake “content id” hashes and automatically your phone will share the images that match. Nobody can tell if content id has is of a photo of a document or a photo of a person it’s just a 256byte hash. This is so easily abused. I bet the way it’s implemented it doesn’t have enough resolution to read text so one evil content id hash will match any photo of any document or screenshot you have taken. So essentially your WhatsApp client will send every screenshot of a text document to nsa.

A few million fake "content id" hashes still gives them a 1/100000000000000000000000000000000000000000000000000000000000000000000000000000 chance that any one of those hashes will match. 256 bits are a lot, besides, what are they going to do? Sift through random vacation photos that happened to match this "ten jackpots in a row" chance?

I think OP is saying that the algorithm is designed in such a way it can match “visually similar” photos/content. The idea is you can’t just rescale, crop or otherwise slightly change a photo as you could if this was just a regular SHA hash of the file. Now they are saying that it might be possible to create an “evil hash” of a document that could match a large percentage of documents, because the hash algorithm obviously doesn’t have enough bits to actually represent the content. So if you have a hash of “white document with some black text” (for example, if looking for image scans of documents) and add this to the db of “watched” hashes, you could in theory hoover up documents.

A quick search didn’t lead me to any proof of concepts about this idea but on the surface (I don’t have any knowledge of the hashing algorithm used in these content filters) it seems like a plausible idea, depending on a lot of factors.

I'm not sure that this would work, mainly because it would mean that all the documents would have the same hash, rendering the content ID system useless. I don't know how many bits a content I'd contains, though, but I imagine it's enough to avoid having too many collisions (as that would reduce the usefulness of the system).

Right. That is the OPs point, however (as far as I can tell). They think it will be intentionally abused by governments as a way of collecting data by mandating certain hashes that will intentionally have many collisions.

Is there an alternative? (I currently only use Signal).

Also something where features work? Since this week my Signal "Something went wrong with you username, it no longer is connected to you. You can try to get a new one"

I find that Privacyguides always has recommendations worth following: https://www.privacyguides.org/en/real-time-communication/

Of these, https://simplex.chat/ seems the most promising, thanks to a level of decentralization.

Threema? https://threema.ch/en

simplex.chat fits my needs and doesn't require a phone number or even email address.

Session is another option http://getsession.org

> Is there an alternative?

Decentralized protocols

This is short sighted.

They poke a hole in signal and all secure messaging /communication is screwed. it wont matter what "other" product you use.

Wire. Open source, self hostable

DeltaChat.

I absolutely support Signal's position and abhorre the whole security circus with cries of "think of the children".

But, I'm in Europe (France) and I wonder who actually uses Signal? There was a move a couple of years ago to quit WhatsApp and go to Signal. Some groups did make the move, and then everyone went back. Today I have dozens of WhatsApp groups, and just one Signal group (and it's dying).

If no one uses Signal in Europe then obviously this threat is moot.

The network effect js real, but I have managed to move some groups to Signal. But you need to spend some social capital convincing people to make the move.

Same here, have got a bunch of family groups and a few friends on Signal now, but lots still on more popular apps like WhatsApp.

No signal = no comms for me. I refuse to use whatsapp and i have probably missed out on a lot, but oh well. I had neither 20 years ago and i survived ok - people called me, or i called them. I do see the contradiction, as i know calls are recorded but er...I've nothing to hide.

Signal has some advantages over WhatsApp, namely that you can install the app on more devices (including computers) at the same time, which has been a convincing argument for some of my friends. They hate how WhatsApp is locked to your phone without an app for your computer.

Signal has become the default video conferencing app for several of my larger groups, and it works surprisingly well! This is a trick WhatsApp currently can't do.

Well, there is only one thing left to do. I am going to self host my own XMPP server and try to move my friends and family to it.

Signal has been great but they won't be able to stop it.

Or we could encrypt the messages before pasting them in the messaging app so the CSS will be neutered.

Either way, I won't have the EU stasi look over my shoulder each time I send a message to a loved one.

SMS 2FA should end like backup recovery email. One is not safe, the other is a loop hole. If breaking encryption is too expensive, then either use the hammer approach, or compromise one of the terminals (or both). Computation will get so cheap and so good, that unless cryptography evolves pari pasu real freedom will be affected.

The EU is progressively turning into a Faschist dystopia. And this is coming from the not elected council, not the elected parliament. The EU in its very design is an autocracy, that wears the mask of democracy. And right now it's acting as the puppet of the USA, supporting its world domination plans.

Which eu countries do you feel are the most detrimentally affected?

How is that going to be enforced in practice? Isn’t someone going to write a messenger PWA without client side scanning which everyone will be able to use? Are they going to block the domain?

"We will run a secure messaging platform wherever governments protect security of messaging platforms."

Very understandable, but not particularly interesting.

Somehow however the NSA was reading Signal chats...

Source?

Don't implement the scanning for images, photos, videos, links.

Just send the image as a base64 encoded text string.

Decode when received.

And we still can’t backup our chats on iOS [0]. Does that mean that we might lose the history of all our messages?

Signal developers really seem to have some misconceptions about the priorities of their users…

[0] It‘s not a limitation of iOS itself but that Signal doesn‘t want to allow to store data and keys in a way that would ‚leak’ them to Apple - not even if I, the user, wouldn’t mind that.

perhaps, backups, even encrypted, hosted at Apple or Google doesn't fit the values of Signal and many if not most of their users?

Signal is primarily used by people sensitive to privacy concerns, so I’m not sure they are misconceptions.

Signal without the privacy obsession has no reason to exist. If you don’t value privacy, it is just a niche, hard to use messenger.

Just use WhatsApp then…

Oh and just today I've banned yet another pedophilia fediverse instance with no easy way od reporting it the any authority.

I'd have to give my name and address and potentially put me with 1 foot in jail because I have viewed the images and have them in my browser's cache.

If they really wanted to protect children from sexual abuse, they would've created easy to report online services. But it's not and never was about pedophilia.

The EU is a joke. Regulating themselves into obscurity.

They try to prevent people from sharing links?

Oh no, I wish there was a way to obfuscate links

//news .ycombinator .com/item?id=40551260

> They try to prevent people from sharing links?

They try to surveil people. You can post all the links you want, but you can't be sure that they will only be seen by your intended recipient.

Good. Meta should do the same.

But the only reason meta exists is to spy on people.

Ok, then we all need to switch to https://en.wikipedia.org/wiki/EncroChat

Ohh, wait…

The EU elections are just around the corner. It's a good moment to make an informed decision and stop electing alt-rights who'd do anything under the slogan of "protecting the children".

This proposal is coming from the EU council, which has nothing to do with this election (it is made up of PMs or Presidents of the EU countries).

The EU election is important though to ensure that the EU Parliament doesn't enact such a horrid proposal into law.

The ChatControl2.0 proposal was put forth by Ylva Johansson who is from the left in Sweden. She literally says "But think of the children" in every interview she made after this. There has been many accusations of corruption, for example the council was in contact with the AI companies that stand to gain from getting this in law.

https://www.svt.se/nyheter/ylva-johansson-ifragasatts-om-lob...

I don't like mass-surveillance or "dragnets" which are actually considered unconstitutional in the US (see https://en.wikipedia.org/wiki/Dragnet_(policing) ), where you make an extraordinary amount of people suspects in order to catch a single suspect.

In medicine there is a number called NNT (Number Needed to Treat) which is a really good comparision to this. It's how many you have to treat with a medicine or procedure in order to help one patient. If that number goes up too large it's a bad sign, like if you would have to feed 1 million people a pill every day to avoid 1 heart attack per year.

Here you have mass surveillance and an incredible breach of privacy of 500M citizens, in order to catch how many pedos? If they would even be caught by this at all to start with.

I wish they made it easier to vote in these EU elections. I live abroad. For me to cast my vote I’d have to physically travel to my country’s embassy which is several hours travel away return during the voting hours. Or give proxy to someone living there (don’t know anyone since I’ve never lived in that city).

Meanwhile, Canada lets me vote by mail, no fuss, and they even send the ballot to my home address automatically every election.

Would that really be so hard to do for EU or national elections?

I hope there'll come a time where the idea that these events that distribute ultimate power might not be flawlessly executed and maybe even partially fraudulent is seen with merit. It's certainly not the time yet, as always seen when this comes around.

Alt rights? You realize this is being driven by the heads of state from mainstream parties, yes?

that's such a hilarious /r/politics-tier take, I literally can't even.

You’re correct, these elections are pretty important, as we can vote for the parties/people that would bring this thing called the EU a little bit closer to disintegration, i.e. vote for the Nigel Farages of your countries. At this point the ghouls in Brussels are un-reformable.

> do anything under the slogan of "protecting the children".

This is far too forgiving a representation, they are surveillance wolves disingenuously wearing the sheeps' wool of protecting children to further their eventual thought-policing goals of "total information awareness."

Doing anything to protect children is difficult to object to. Using the children as their pretense for monitoring dissidents is really the heart of the matter. It's important to differentiate between the two.

I get that this difference could be subtly implicit in that comment, but let's please make it explicit.

These laws, as required by the EU constitution, do not come from the people who are elected, so changing who gets voted in will have zero impact on whether such laws appear or not.

Moreover the EU Parliament is controlled by social democrat (left) parties. There currently a bunch of stories in the press freaking out over the possibility that the EU Parliament might actually become majority right wing for the first time ever, example:

https://www.google.com/amp/s/ecfr.eu/publication/a-sharp-rig...

So it's very unclear how you reached your conclusions about who people should stop electing and what effect that would have.

That is ridiculous.

Both the commission and the parliament are controlled by socialists (of various kinds).

We should seriously ask, if being part of EU is beneficial or not. Electing left or right is just a game to keep system working. But it serves to scrap responsibility from us and lead to slavery with every new regulation.

> Either you agree to have your chats scanned or you can no longer share&receive pictures/videos and links!

I am very skeptical about this statement.

But we love the EU though? /s

Yes please. Then leave the rest of the world. Too bad Merkel is not in charge anymore. She would make herring from such bullies

How do they even make money? No ads, no subscriptions - what ‘market’?

Donations via in-app purchases. This is not hard to find out.

Oh, please. Such a behemoth business and only one channel of income?

This is ridiculous.

Is this Europe's plan? Pseudo tarrifs via regulation to boost local industry?

Nah, the people who force you to put your home address on your blog just care about individual privacy and consumer rights.

First they came for crypto, and you guys laughed and cheered them on because “crypto and web3 sucks”

I told you then, that end-to-end encryption is far more worrying for politicians, than mere cryptographic signatures. And that they’ll be coming for it next. Because it can hide billion-dollar transfers, or CSAM, or gasp seditious material against the king.

Well, it’s not just Europe, it’s all over the world:

https://community.qbix.com/t/the-global-war-on-end-to-end-en...

The above chronicles many cases even in your own country!

Today regular people are just as clueless about end-to-end encryption as many on HN are about web3 and decentralized network innovations. Think of the children!

And then they will come for the regular person, and by then there will be no one left making tools that could have helped them.

As for me and my views, I have come to believe that end-to-end encryption vs state actors is a band-aid, that if you are reduced to sneaking around then your government and agencies need fixing. Whereas digital signatures and smart contracts and decentralized networks are useful as they allow everyone to be in control of their own identity, voting, balances etc. without relying on a third party. It’s done in the open. But the difference is that it can be limited to “benign” things and enforces the rules, while everyone gets to make their own decisions and one party can’t corrupt the system.

To me, the transparency and resilience to corruption is the main thing. The sneaking around, I can see how governments can declare war on that.

> First they came for crypto, and you guys laughed

Crypto has probably done more to undermine privacy than Hoover’s FBI. Its proponents are ambitiously unlikeable, relishing their distastefulness to burnish outsider credentials. Its damage is easy to quantify in a way troublesome speech is not. And because a broad set of the population either doesn’t like it or, much more prominently, doesn’t care, it serves as a stalking horse for advancing general anti-privacy laws.

Signal is a great example. They should be a unifier for the notoriously-apathetic privacy crowd. But it isn’t. In part due to its crypto crossover. I genuinely can’t seriously take Signal as a canary of anything, because it’s unclear what motivates its leadership.

You make the politicians here the bad guys. And they are. But can you compare these assholes to terrorists?

If the states aren't the bigger fish, the bad actors would be.

Ah yes, if we had all just listened to you instead of laughed. How the tables have turned!

Just let Signal operate via Satellites and you are fine: https://de.m.wikipedia.org/wiki/Weltraumtheorie

No, you’re not fine.

They can ban that as well.

The only way anything can continue working in practice is if it’s decentralized, and served by different websites secured bu https rather than one app in one app store. Hard to take them all down.

Perhaps Moxie Marlinspike now better appreciates decentralization behind messengers. I have written here years ago as a response to him exactly this scenario: https://community.intercoin.app/t/web3-moxie-signal-telegram...

The thing with https of course is that the governments can insist that browsers include their backdoored certificates. But the browsers are large enough that it’s difficult to get them to do it. China’s Great Firewall probably can. But in order for that to happen they have to prevent packets encrypted with the non-backdoored certificate chain from being routed. That requires serious control over all the networks.

This is partly why I started Qbix. So people can host whatever they want on computers of their choice. Without this decentralization, the governments are two steps away from mandating ALL your voice conversations are scanned, transcribed and analyzed by AI at the edge. Microsoft Recall + message and voice scanning = 1 step away from total panopticon of everyone everywhere. And with superintelligent AIs doing precrime based on everyone’s conversations!

Oh no! - How will I be able to buy crypto in my messenger if Signal leaves the EU?

Telegram is far more heavily used in crypto circles in my experience.

Reply on news.ycombinator.com