Hacker News Reader

Comment by Freak_NL | Hacker News Reader

This is not about preventing you from doing that, it is about preventing services with many users from providing that service to you without a backdoor.

You can just send anyone you want an encrypted e-mail or message, but Signal can't facilitate that without the required provisions set out in those laws. If these dumb laws get enacted, Signal cannot get away with just pretending you are sending gibberish whilst providing true end-to-end encryption without any client-side scanning or whatever to you, but you are well within your rights do so yourself on top of Signal (if that's even possible); they just can't provide an automated means to do that for you.

View on HN

Exactly, this just pisses off companies with added costs, strips freedoms and criminals move to using their own encrypt and decrypt step that the "Scanners" just see as bullshit gibberish or some form of stenography image etc.

Or ... they develop their own darknet webrtc based chat lol, like its silly to enforce this on the general populace when its so obviously circumvented by the people looking to do scary shit.

> they just can't provide an automated means to do that for you

What I'm wondering is whether two separate applications can be set up to communicate automatically, with one handling messaging and the other being responsible for encrypting and decrypting the data.

What would be against the law in that case? The messaging app? The encryption app? Or the interaction you are doing in that moment?

> The encryption app?

That might be the next step. Banning encryption. We live in a strange world right now.

The EU does not want to ban encryption, because it is the backbone of e-commerce and banking. There are plenty of public references that show the EU's explicit support of strong encryption.

What some law-and-order types (globally) want, is the means to scan, peek, or otherwise access private communication, especially if that communication is provided by a service used by millions. You can encrypt all you like, but if you use WhatsApp or Signal, laws like these force those services to create a way to eavesdrop. How is probably not defined in the law. Client-side scanning before encryption, having those services act as men-in-the-middle for each conversation; this is all fine, and can use encryption as usual. As long as certain agencies get to have a peek somewhere between those strongly encrypted tunnels.

Neutralizing encryption is real; it is not about forbidding websites and clients using TLS, it's about getting in the middle.

Step one would be determining if anyone actually uses those two apps together. A handful of people? No one cares. Is it now the default way you install Signal (or its two components) and do hundreds of thousands of users do this? Then the next question asked is who is facilitating it and how is that done? Does the backdoored Signal have a plug-in that allows this kind of use? Does Android facilitate that? Those people will likely find themselves in legal trouble.

Of course these laws are dumb, but that doesn't mean they can't be (mis)used to get the desired effect.

> Does Android facilitate that?

Does Android facilitates IPC and services?

That's not what the law cares about. Being able to encrypt stuff end-to-end, is not what is being targetted — it is not realistically possible. What is being targetted is millions of people getting private, true end-to-end secure communication with no content scanning of any kind through some service. Are you providing that service to millions like Signal is? This law applies. Are you the size of Meta and are you implementing some 'clever' two-component solution to sidestep this law? Expect legal trouble.

You can already install a mail client with PGP-support. Will K-9 Mail get in to trouble if a million users in the EU started privately exchanging keys and using GPG with K-9 Mail? Who knows. These laws are not about such practical details. This is about unlocking massive amounts of signal intelligence to do… who knows what, and those large communication platforms are juicy targets. All it needs is a law to coerce them to cooperate.

Don't expect reasonable arguments from the proponents of such laws, and don't expect to be able to avoid them for millions of users with clever tricks; you'll still fall foul of the spirit of the law, if not the letter.

> A handful of people? No one cares.

Actually police and various agencies do, because when most people aren't encrypting, the few that do are suddenly interesting. Some of them will turn out to be organized crime, but some of them are just adults who want to communicate privately.

I am using a special keyboard that outputs these sequences automatically. Must my keyboard driver send the keypresses to the EU? Fine, here are they: AFC628BCF627.

I understand Signal is handicapped now, but I couldn’t care less about Signal. I only care about being able to communicate in private. Why don’t we implement this stuff at a lower layer?

Surely the guys on top must see this is an endless game that they will never win? It’s not an arm’s race, it’s fundamentally impossible.

You don't seem to understand the point of these laws. It is not about stopping anyone with enough technical know-how from encrypting their communications. This is possible today, and not something which can be easily legislated away without resorting to a much heavier class of draconian laws (at which point you won't be living in a democracy any longer in any case).

This is about making it hard (or impossible) for some perceived group of miscreants to communicate privately. People sharing CSAM (however you define that) or dealing drugs, and stuff like that. Anyone can encrypt their communication, but most people don't do this consciously; the masses just use WhatsApp and Signal and what have you.

You and your special keyboard are not of interest, and unless you start selling these along with a service to route the encrypted messages to thousands of users, you are not the target of this legislation. Take away Signal and WhatsApp and sending an end-to-end encrypted message to your drug dealer without exchanging keys and agreeing on a protocol suddenly isn't as easy as just opening an app. That's the point of this law.

It's a dumb law, but you won't make it go away by playing silly semantic games.

> without resorting to a much heavier class of draconian laws

They may be coming down the pipe, after the soft version gets people macerated.

> at which point you won't be living in a democracy

But you will be hearing from talking heads that you are, and Russia and North Korea are the real dictatorships.

And maybe they will be right, because what is democracy? The word has different meanings to different people, and it won't be difficult to shape the discussion about what our liberal democracy is all about. Maybe it's about accepting who has power now and about protecting the vulnerable. We have seen a bit of this stance and real capabilities in recent years.

Criminals are using specialty phones or should I say, were using, because this was recently cracked and thus became useless. Catching Taghi in NL was a famous result of that.

Point is that dangerous people will use specialty devices/services and being legal is certainly not one of the requirements.

Again, not what this law is about. This is all about wanting to gather signal intelligence on millions of people automatically. About being flagged when someone uploads CSAM or uses certain keywords. They know it won't stop anyone with the skills and means to use some other encrypted solution.

So they explain it to people as being able to catch criminals, but they known it won’t work against that?

How can you maintain such a position? At some point you’ll have to explain your reasons for draconian measures like this.

That’s why I’m spamming people with “it won’t work” because so many seem fooled by this. You will catch exactly zero people with this. The only people you’ll catch will be the ones that you would have caught anyway, because of their nonchalance.

I don’t know anything about law but I know tech.

> So they explain it to people as being able to catch criminals, but they known it won’t work against that?

Why a law is enacted is more complex than just the here and now. Some of these law-and-order types dream of the day they can order Apple or Samsung to completely lock down their smartphones and forbid any user controlled cryptography. Some just want to be able to feel that they are doing everything in their power to prevent children from being harmed, even if the measures only cover naive users. Some just want people to know that they are being watched, and have these laws act as deterrent.

And as a bonus: some parents really like the idea that none of their children or any of their mates are sharing (their own) underage nudes and that this is enforced automatically.

The law will likely work for some of these points, to some extent. It's still a bad law, but the people pushing it aren't idiots; just dangerous.

OK thank you for elaborating. I tend to assume that such laws - "let's listen in on everything you do" - need firm and solid justification. Coming up with a simple counter-example on first try signals to me the problem has not been handled effectively (understatement of the year). I'm not talking about having the perfect solution, just.. something that does not immediately fall down on first try within a few minutes.

This world confused me sometimes.

If you sell your keyboard as a service to people in questionable lines of business, then yes, you will need to comply with these laws. You can probably also expect a visit from three letter agencies. Which these targeted platform companies also do.

Reply on news.ycombinator.com