Plus, let’s be real, end to end encryption doesn’t exist if you’re using any sort of pre-built app. It’s encrypted-looking to most people, but the people who matter always get back door access.
Why do you think this is the case? I know for a fact (with a reasonably high level of confidence) this is not so.
Or do you really think that when for example DoH gains wider adoption all the countries using DNS based blocking will go "Oh well guess the techies got us".
End to end encryption is vital to the operations of modern businesses, it's not going anywhere anytime soon.
If they don't, your critical infrastructure (Internet) just stops working until you conform to the standards set by those who write the software.
And the competent criminals will still be able to roll their own encrypted communications from existing open source libraries.
I want E2E encryption as much as the next person, but we need to make sure we’re honest about its use cases
Well, I shouldn’t do that. Suffice to say, it’s simply a fact that China bans VPNs, and pretty much everyone goes along with it. People fear jail.
It’s hard (but not impossible) to imagine Europe and the US doing that. NordVPN is practically a household name, at least on YouTube.
People just have a 'compliance' phone when authorities ask to rummage through it.
Does this ever work? Depending on the jurisdiction, law enforcement authorities can easily get a warrant to enter your home and search through everything to ensure that they find all of your devices.
In general this holds: There's no privacy on the internet.
They’re not going to find every backdoor. But I’m sure their work serves as a deterrent to some degree. Vendors aren’t going to deploy backdoors unless some state actor forces them to, and even then chances are they’re caught and called out.
In short, if you are being targeted (and, granted, the chance of that is pretty low), your data and communication is not secure. It's an economical question, not a technological question. (the FBI paid $1.3m in one case to get access to a phone).
My bank(s) used password+client certificate, but now they have switched to proprietary mobile OTP apps. (also due to some directives). For some stuff, SMS codes are used.
Also, I've seen CA's simply deliver the .P12/.PFX file now instead of securely generating the key on the client and then signing it.
Open source practically died with personal computers.
You could also use something like pinephone or librem. You wont have access to a lot of android tech but the most important functionality. A web browser, sending sms, email, making calls all work.
States have access to "a monopoly of legitimate violence". We grant them that in order for them to be able to keep the peace, you know, law and order.
Everything else can be boiled down to this. No matter how many bits of encryption keys are used, someone with a chloroform infused rag and a wrench can visit any of us at any moment. And it's actually part of what we, collectively, as citizens, have granted as a power to the state.
That's where engineering comes into play, maybe materials science to build suitable systems to defend against such physical attacks. And, you can't just ban engineering.
I’m only even safe from nutcases because the nation collectively has enough experience dealing with people who think they know better.
Phrased like this it sounds like you are implying that the legal system in any EU country has no power over goons with wrenches, and everybody is effectively living in a police state. Why even bothering to pass laws around encryption?
Fingers crossed, but is it enough? What can we do to prevent this sh*tload?
Brexit showed just the enormous depth of high quality glue keeping all remaining countries together.
So I don’t think the EU will be collapsing any time soon, certainly not for rational reasons.
The UK wanted to drop the tight integration and acceptance of common goals, but keep all the tax and trade benefits. But the logical hurdles turned out to be insurmountable. Want to sell fish tax-free? Well let us fish in your waters. Want to sell frictionless to our markets? Accept our standards. So what should the common ground be for digital services?
Initiatives like this, good or bad, represent the EU’s drive to combat big issues facing the world, and again need to be tackled for the EU to remain relevant; it can’t just stick to subsidising farming, that is so 1950s.
I spoke once to a senior economist (can’t remember the name sadly) who made a good point: EU is often compared to national governments, and looks sluggish by comparison. But the real comparisons would be to other enormous bureaucracies: US federal government, China, UN etc. And when you make this comparison, it is in fact quite favourable for the EU. Basically, scaling is hard, and the EU is not bad at it.
It's not scaling economically though, is it?
This is definitely not true. There are tons of 0-tarrif trade agreements in this world, and even those without border checks for commercial goods - all without political integration.
NAFTA/USMCA have been doing this for 35 years and it's very effective.
Brexit doesn't show 'how good the EU is' it shows the opposite: that UK, Switzerland and Norway well get along quite well outside of the political body.
The EEC was entirely uncontentious - everyone wants some version of that. No arguments from anyone there.
But the argument that the 'Political Layer over the EEC, i.e. the EU, is necessary' might have some merit, but it's probably more complicated, and it might not even be true.
The real comparison is no between EU/US/China - but between the EU and a more comprehensive version of the EEC - i.e. some kind of 'deep trade integration' but without a political body, and without an ECJ with 'Legal Supremacy'.
This surveillance issue highlights one of those areas where I'm not so sure the EU would be perfectly ideal for supranational laws. Treaty-based regulation - for sure. But laws under ECJ Supremacy ... I'm not so sure. It's going to be interesting to see how this jives with the German Basic Law and their de-facto opt-out over constitutional issues.
Why would a 'really great trade agreement' not provide 'most, if not all of the carrot' with respect to economic upsides?
Does the EU political apparatus an ECJ, i.e. beyond comprehensive trade agreements, provide carrots?
Less reductively, I think that a major benefit of a political union is that it gives some degree of democratic legitimacy to decisions made about difficult region-wide issues like trade policy, consumer protection, immigration, the environment, and anti-trust law, to name but a few.
All of those matters could in theory be settled via multi-lateral treaties, but they would probably be hard to reach flexible compromises over while still being overseen by representatives voted for by the public with a mandate for deciding on those supranational issues.
[0] https://en.wikipedia.org/wiki/European_debt_crisis#Spain
Why bother with barely a vaneer of legitimacy at the EU level which has a democratic deficit?
Why not have an EEC that casts flexible treaties over immigration, environment and anti-trust on as as-needed basis, with actual elected represented 'regular' national MPs dedicated to those issues at the European level? i.e. Boris would have 5 Cabinet Ministers for major European level issues and a European ministry?
That way have the benefits of some degree of coherence without the sovereignty problem.
B.J. is an Elected Head of state. He won his mandate in a very clear and unambiguous election, the primary issues of which concerned not only on his leadership and tenure, but also the pivotal issue of Brexit. The election had very high participation rate, and the UK public was very well informed with respect to the stakes involved. B.J. doesn't have absolute power and both his party and opponent MPs can challenge his authority.
The EU meanwhile, has barely any democratic legitimacy.
The President of the Commission and members of the Cabinet - those that enact legislation - are unelected.
Ursula Von Der Leyen did not stand for election. She was plucked from obscurity by Macron and Merkel after the EU elections, in a closed, backroom deal in which voters had no effective influence. The protocols by which she was chosen are not codified, in fact, it's only recently agreed to (Treaty of Lisbon) elected MEPs should even have to be consulted.
Von Der Leyen was not introduced to the public before the election, she didn't go on a media circuit so as to be introduced to the public of various countries where people could learn about her or her platform. There were no editorials, there was no media vetting, there were no interviews, there was no pragmatic by which voters could even learn about their would be leader. She was imposed in EU voters, probably less than 2% of whom had even heard of her.
EU elections have very low rates of participation, EU voters have very low awareness of any of the material issues, MEPs have very little ability to influence legislation and very limited ability to censure leaders.
So yes, Boris Johnson (and Macron, and Merkel) have considerably more legitimacy than any members of the EU apparatus, and that might very well serve as a better basis for European citizens to influence the establishment of rules or laws via treaties as opposed to the very indirect democratic mechanisms of the EU.
Just so we're using the same terms, here, I think it is conventional to describe Johnson's role as "head of government".[0]
> members of the Cabinet - those that enact legislation - are unelected.
The Commissioners are appointed by the heads of government of the member states, exactly the process you suggested in your earlier comment. If you think that Boris would be limited to picking ministers who had actually gone to the trouble of winning an election, then you'll be surprised to read about the 19 unelected ministers that Boris has chosen.[1]
> Ursula Von Der Leyen did not stand for election.
While Boris did manage to win 25,351 votes in his constituency, and 92,153 in his leadership election, there is nothing preventing a UK prime minister from gaining power through a backroom deal, such as Theresa May's unopposed leadership "election" in 2016, or Brown taking over from Blair in 2007.
This is of course accepted since the PM must hold the confidence of the parliament, but the same is true of the Commission President, who must receive the approval of an absolute majority of MEPs.[2] In fact she (together with her Commission) was elected with 461 votes to 157.[3]
> She was imposed [on] EU voters, probably less than 2% of whom had even heard of her.
I agree that this is a failing of the process and the political culture of the EU.
> EU elections have very low rates of participation, EU voters have very low awareness of any of the material issues
That could be interpreted as meaning that a large proportion of EU citizens don't feel particularly affected by the EU's decisions, which would mean that the EU is (correctly) leaving national issues to national politicians (who then influence the decisions of the Commission through their appointed commissioner).
> MEPs have very little ability to influence legislation
Any influence the MEPs lack just means more power to the national governments who control their respective commissioners. I don't see how this process is any worse than having an unelected House of Lords which contains hereditary peers.
> and very limited ability to censure leaders.
MEPs have the power to call a Vote Of No Confidence in a Commission, which can lead to its dismissal. This came close to happening in 1997 during the BSE crisis.[4]
> So yes, Boris Johnson (and Macron, and Merkel) have considerably more legitimacy than any members of the EU apparatus
If by "any members of the EU apparatus" you mean "specifically Ursula Von Der Leyen" then you almost have a point. I would also be more convinced if you had limited the first part of your statement to just Merkel, as I believe that Germany's electoral system is more proportional than the UK's and doesn't have the "safe seats" problem of FPTP. (The two-rounds system that Macron was elected under has its own problems).
As a thought experiment, imagine that Biden had won the presidency with just 44% of the popular vote, and that win also granted him an effective super-majority in both houses of Congress (since the UK only requires a simple majority to force through constitutional changes). I can only imagine that scenario leading to civil war in the US, and yet this equivalent situation in the UK lets some people think they can throw stones at the EU's democratic character.
[0] https://en.wikipedia.org/wiki/List_of_current_heads_of_state...
[1] https://bylinetimes.com/2021/02/19/brexit-revives-the-power-...
[2] https://www.europarl.europa.eu/news/en/faq/8/how-are-the-com...
[3] https://www.europarl.europa.eu/news/en/press-room/20191121IP...
[4] https://www.politico.eu/article/meps-split-over-vote-of-no-c...
The Warsaw Pact, the Cold War, the Iron Curtain across Europe and the Berlin Wall, as well as the communist surveillance States that still-living Europeans lived within and remember well enough was not that long ago.
> The European Commission has already announced a follow-up regulation to make chat control mandatory for all email and messaging providers. Previously secure end-to-end encrypted messenger services such as Whatsapp or Signal would be forced to install a backdoor.
China has the same setup with providers in their country.
WhatsApp and iMessage simply aren't private when the providers get ~100% of the plaintext transiting the service within 24 hours (immediately in the case of iMessage, as thanks to "Messages in iCloud" (cross-device sync) being on by default, the MIC sync key is escrowed to Apple in a non-e2e backup, permitting them to decrypt the sync traffic in realtime).
Truly private, easily accessible, society-wide private communications are a threat to sovereignty, and governments know this, which is why even europe (leading the way on individual privacy and rights on this planet, in general) is reluctant to permit it. Same goes for truly censorship-resistant, easily accessible payment systems. They allow you to coordinate (private/uncensorable messaging) and pay for (uncensorable payments) an army outside of state prerogatives, in theory.
Messages in iCloud is off by default AFAIK.
In the case of MIC being on, then the MIC sync key is included in the (again, non-e2e) iCloud Backup.
MIC on = MIC sync key escrow via iCloud Backup (realtime iMessage content decrypt)
MIC off = iMessage plaintext escrow via iCloud backup (nightly)
https://www.reuters.com/article/us-apple-fbi-icloud-exclusiv...
Before you mention "but you can turn off iCloud Backup!": these default settings affect all of your conversation partners, too, so even if you disable iCloud Backup, it's likely that your messages are still getting escrowed from the devices of the people you talk to.
This kind of cooperation is definitely illegal in this moment and I'm nut sure future legislation will require services to set up persistent encryption keys exchange among services so that a backup file that is supposed to be encrypted on a cloud storage can be continually scanned for harmful/unlawful content by another service. If the EU or any government wanted to set up such kind of monitoring, they will require these services to adapt in a way that these kind of gimmicks with backups and encryption keys are not needed
I can understand that metadata is valuable -- of course it is. You can learn a lot from metadata. But more valuable than the actual content? Give me a break.
Something can be bad without being literally the worst thing ever. Pointless exaggeration like this does nothing for the cause of privacy.
Getting high precision is difficult when done on "all content", especially considering the multitude of languages and dialects in Europe. At a certain point, more data does not result in better output, sometimes it's actually detrimental
The patterns that arise from metadata are much more generalisable and there's less of it, so it's easier to search through
Widespread enough, this can be used to find dissidents today, suppressing ethically legitimate uprisings against injustice.
[1] https://blog.wolfram.com/2017/06/29/analyzing-social-network...
Direct communication is only interesting for direct surveillance.
https://joinup.ec.europa.eu/collection/open-source-observato...
> She wants tech companies to face mandatory detecting and reporting obligations
> “The problem is that many of these communications are now being end-to-end encrypted,” she said, whereby only the users exchanging messages have access to the content.
> While encryption is "really important," she said, "we don't want pedophiles to be able to do whatever they want, to not be seen, we have to protect [children] so this is not an easy challenge to tackle.”
https://www.politico.eu/article/encryption-could-hinder-chil...
As long as politicians pretend that you can have both I'll assume they are either disingenuous or ignorant and I won't be at ease.
Which, of course, is actually an argument AGAINST using Signal.
It's easy to recommend "end-to-end" when you're about to force a backdoor into it.
I'm not surprised that HN readers think politicians are all so dumb that they recommend their own staff use Signal and then recommend to break Signal. This kind of news pop up all the time and in almost all instances it turns out it isn't what is actually happening. Discussing it on HN -especially when it is the EU, Russia or China- is a complete waste of time as almost every single comment is low effort or trolling. We all know that the EU won't have backdoored Signal any more today than the next ten times this gets discussed on HN. It's all smoke and mirrors.
How can you say that it's not only the stated goal but they have been making real progress towards it?
They can't easily shut the service down without risking a lot of unwanted public attention. When "why can't I message grandma" is answered with "here's the list of politicians that caused that because they want to spy on your messages", those politicians will have a bad time. I think Signal is popular enough in Europe to be protected by this.