Hacker News Reader

Comment by moniosi | Hacker News Reader

The common fallacy people have regarding chat control (and should be clarified) is that it's not like internet is made of a few select providers, anyone can open an encrypted tcp connection from an ip to another, and the global traffic is too massive to be scrutinized, also the most widely available apps already comply to the single police request to access conversations from suspects. This means that this will create further privacy for criminals such as pedophiles and mass espionage for the common man. It's also curious to notice that at every proposal stage, politicians are always conveniently exempt from the regulation, which is hilarious coming after the Files.

View on HN

Yeah but messaging apps are really only useful if there are lots of people on them to message.

So in the real world a relatively small number of providers, WhatsApp, Signal etc, are in a position where all your friends are going to be on them. And those are the ones likely to be named and told they need to implement image scanning/review.

Messaging protocols are useful even if everyone is not on the same app. In the past I was chatting with my google using friend via some third party jabber server where I had an account. It was useful and didn't require us to be "in the same app". We both were using both different apps and different server providers.

But actual protocols are so last century. You might have to think ahead for fifteen minutes because the design has to be staaaa-a-ble. It's haa-a-ard! And you can't sell out to somebody who'll change it and have an exit event.

> In the past

Exactly. That time is mostly over.

It doesn't have to be though. There is countless benefits to decentralized and federated platforms, even for your average Joe.

It's just that all the Google, Microsoft, and Meta platforms had shiny new features and we all switched. There is no real reason we can't go back, sure the network effect is hard to overcome but the technological problem is moderately simple to solve (we did it in the past!)

And coming back again:

> As part of changing laws in Europe, Meta now offers the option for you to chat with others using third-party messaging apps that have integrated with WhatsApp and that you choose to turn on. - Whatsapp Help Center

Currently support is a bit shit, given it's relatively new. Give it 3-5 years and I'm sure this will look very different.

Yes but it's the same EU that mandates this. If they can mandate interoperability they will just mandate their backdoor at the same time

> So in the real world a relatively small number of providers.

Why do we even need providers? Locally store the convos on each device and there's not a need for the server.

No normal user wants that. You would still need some infrastructure to link users with IPs, and if you lose your device, all your chats are gone.

> You would still need some infrastructure to link users with IPs

I thought we cracked this with P2P streaming? I know torrents have trackers but can't we do some kind of multicast kind of thing, completely P2P?

> it's not like internet is made of a few select providers

In practice it is. Almost all messaging happens on a few apps.

> also the most widely available apps already comply to the single police request to access conversations from suspects

That is not true: Signal is widely available and doesn't do that. WhatsApp probably doesn't do it either.

Don't get me wrong: I am against ChatControl as well. I believe that security comes at the cost of freedom, and it is a choice to be made on a case-per-case basis. Removing E2EE for everybody is not worth it, because criminals will always be able to use encryption one way or another. The problem is that politicians don't seem to understand it.

They do understand it but what they want is not just criminals' data but all of us.

They want to pick the easy fruit. The dumb criminals that would do that sort of thing over whatsapp.

Yes, but this easy fruit has a flavor of the week:

https://stateofsurveillance.org/news/ben-werdmuller-signal-z...

https://www.whitehouse.gov/presidential-actions/2025/09/coun...

> Common threads animating this violent conduct include anti-Americanism, anti-capitalism, and anti-Christianity; support for the overthrow of the United States Government; extremism on migration, race, and gender; and hostility towards those who hold traditional American views on family, religion, and morality.

Like, you can get 30 years in prison now for moving some boxes with zines in them, just because you are anti-fascist.

Yes, this is American politics; but don't think that the benevolent overloads of the EU don't plan for this same outcome: Already in many European countries, I can go to prison for just saying, "Free Palestine". They want it so that people cannot even say that in private.

Listen I agree, but the solution to this problem is not social media mediated pseudo-anonymity the operators know who you are and they are working with them.

The solution is keeping fascists of the levers of power which America has done an incredibly bad job at for the last 10 years.

If you really want to have free speech, you need to be in your own domain and that is going to be increasingly dangerous as you have noted too. So you know I see antifa tor services run out of servers in Europe in your future.

I totally agree, the problem is difficult however because even if we create a perfectly anonymous system for registering with social media, modern LLMs make semantic analysis trivial. It's going to be impossible to remain anonymous without also using an LLM to strip the unique footprint of your text. Which leads to a very strange and monotonous culture for internet discussions. Might be unavoidable, though, at least for certain kinds of discussions.

Yes this is indeed a problem. But this is even more reason to keep private conversations private. It will stop those LLMs learning your footprint from your private conversations.

It's an interesting thing what you're saying. I've been thinking about this happening (I think it's inevitable) and also about using an LLM to sanitise my semantic footprint.

Yeah, it's been on my mind since the original transformers paper, because persona and identity management has been a long-time interest of mine. Both offensive and defensive tooling, such as fingerprinting and anti-fingerprinting.

If you're interested in building an open source persona management suite to distribute as freedom software and level the playing field against State agents who are already building and improving such tools, I would love to find a partner to help with such a project. Even if you don't code, there are other duties besides coding involved with successfully promoting such a project and developing a community around it.

Yes I work in cyber and I've always thought about the ability for fingerprinting people by their content. Not really semantically (that was just not really possible until LLMs came up) but more in terms of interests on social media.

But semantic analysis adds a whole new level with so much entropy that it's bound to be unique. And LLMs are just ideal for pattern recognition. There's not much we can do about that as a human, trying to fool it won't work. It really needs an artificial sanitiser. One that really builds a persona and aligns to it deeply (like little colloquialisms from the purported origin of the persona).

And also things like comment posting hours. I have identified several accounts from people who said they were chatting with me and I could prove they were doing something completely different at that same time. Us humans aren't consistent enough for that. Especially if you have multiple sockpuppets.

I don't think I could help much with that though. I'm neither a developer nor a promotor, I'm too much of an introvert for that. But it sounds really interesting.

But yeah I'm sure that within 5 years, if you are still writing comments yourself, it won't matter whether they know your phone number or email address, you will be uniquely identified by just what you write. I wouldn't be surprised if the darker forces in society have this capability already.

There was a thread not too long ago where someone did stylometric analysis on HN, and quite a few users had true positive matches (though there were plenty false positives).

They later pulled the dataset, but antirez recreated it.

https://news.ycombinator.com/item?id=33755016

https://antirez.com/news/150

You can try the demo here: https://antirez.com/hnstyle

but your account is too young to be in the dataset. You could ask an LLM to recrunch the numbers with a newer dataset, though.

> but your account is too young to be in the dataset.

This is on purpose yes. I've taken to rotating my accounts everywhere on a semi-regular basis as a feeble low-effort mitigation that I'm sure will not hold once this gets into full blown deployment.

I know the HN community frowns on that but it's not like I rotate every day. Probably should for it to be effective though.

Thanks for the link I will try that out! I missed that happening.

The whole point of end to end encryption is that providers cannot comply with police request to access conversations. A properly secured system would make it impossible without compromise of your device. Now i don't know what signal does, but I am almost certain WhatsApp can just lie about your contacts keys and man in the middle the connection.

> Now i don't know what signal does

That makes me question how much you know about end-to-end encrypted messengers, because Signal is the gold standard.

> I am almost certain WhatsApp can just lie about your contacts keys and man in the middle the connection.

The problem there is that WhatsApp is not open source, so you can't check. So obviously you have to trust. But there are many, many employees who have access to the WhatsApp sources, so if it was not implementing what it says it is, chances are that someone would have said it. Also thanks to the EU DMA we have some protocol published by WhatsApp.

> But there are many, many employees who have access to the WhatsApp sources, so if it was not implementing what it says it is, chances are that someone would have said it.

No one in Microsoft, Yahoo, Google, Facebook, AOL, Skype, or Apple said anything about PRISM. We had to wait for the NSA whistleblower. So the argument someone would say something does not really stand up to historical precedent.

I looked a bit into it and yeah they have a key transparency mechanism where they store a blockchain on s3.

So supposedly they can't just add a key for a user in secret. But still what if they do it in public does the client refuse to send messages to new keys?

It's not like we are all spending all our time going over a random s3 bucket to say `Aha, I am sure Bob didn't add this new key because he logged in from his desktop. It has to be a man in the middle`

Can they just siphon keys of your device? Can they just deploy a special version to just your device without the vast majority of engineers in meta even knowing about the compromised version? No one knows. Well no one in public.

The gold standard would be personally managed keys, exchanged and signed by your contacts in person, open source software that is not auto-updating, distributed over a channel that does not know your identity.

> It's not like we are all spending all our time going over a random s3 bucket to say `Aha, I am sure Bob didn't add this new key because he logged in from his desktop. It has to be a man in the middle`

That's not how key transparency works. The whole point of key transparency is that you don't have to do that.

If you are into manually checking that you have the right key, you can do it by scanning a QR code (or exchanging the key manually through some trusted channel), both on Signal and WhatsApp.

> Can they just siphon keys of your device?

Whoever hacks your device can read the messages, end-to-end encryption protects the data in transit, not at rest.

> Can they just deploy a special version to just your device

If you get WhatsApp through the Play Store, they would need to collude with Google to do that. But it is technically possible. If you get WhatsApp on the web it's a lot easier though: they can just serve you a different codebase this one time. BTW ProtonMail can do that too, or any webapp. Which I assume is why Signal doesn't have a web version.

> The gold standard would be personally managed keys, exchanged and signed by your contacts in person, open source software that is not auto-updating, distributed over a channel that does not know your identity.

You can get the sources of Signal, audit them yourself, compile them yourself, and verify the key with your contacts through a trusted channel (in person if you like). That is already possible.

> No one in Microsoft, Yahoo, Google, Facebook, AOL, Skype, or Apple said anything about PRISM

I think it is pretty different. Was PRISM available in the code source in the mono repo of all those companies? WhatsApp is.

> The problem is that politicians don't seem to understand it.

The problem is that politicians were corrupted by power.

This is an extremely naive view of politics in complex systems like the EU. We're not talking about the US of French president here. The people in the 27 EU countries elect their EU representatives, and nobody knows them. People usually vote for a party, and they usually don't care much about the EU, except for complaining.

It feels like people who are against the EU vote for far-right politicians (the ones that are against the EU).

EU politicians are elected by the people and they represent what the people from the 27 member countries voted. Which is different from e.g. the US president, where the people don't really have much choice. Same in France, where people voted against the far-right and not at all for Macron.

WhatsApp already does it for unencrypted messages for about half of the EU under the purview of the rules of lawful interception obligations for NI-ICS, as well as Norway, Switzerland and the UK.

When they want to read encrypted messages they seize the phone and use Cellebrite or similar 3rd Party tooling to gain physical user-level access. No need for cert-pinning or esoteric MITM attacks.

N.B. China does not allow WeChat to have e2e encryption.

> When they want to read encrypted messages they seize the phone

That is very, very different from mass surveillance.

this is rational because pedophiles are not a threat to the state. if they were, the bill would look very different.

A modest proposal: have governments consist of underage girls.

> which is hilarious coming after the Files.

Files?

Epstein

Reply on news.ycombinator.com