> No of course not. They'll pay some cryptographer in need of some money to develop a new E2EE tool and carry on. Business as usual.
I used to think this, I changed my mind: just as it's difficult to do security correctly even when it's a legal requirement, only the most competent criminal organisations will do this correctly.
Unfortunately, the other issue:
> And the governments will rub their hands with glee with all the new data they have access to.
Is 100% still the case, and almost impossible to get anyone to care about.
Assuming no new zero-days, and that they were even doing best practices in the first place. How many legit companies do best practices?
That's the point, bad actors can circumvent the system if they feel threatened, but system can be exploited by gov/companies once rolled out globally to target any user, so we get something that may be not that effective against bad actors but poses great risk to be misused by gov/company in their own interests without users knowing. I've seen how an authoritarian gov in my country is targeting ppl bc they are uncomfortable for the system and this algorithm opens another potential vector of attack.
> I've seen how an authoritarian gov in my country is targeting ppl bc they are uncomfortable for the system and this algorithm opens another potential vector of attack.
As per my last sentence in my initial comment in this chain:
--
> And the governments will rub their hands with glee with all the new data they have access to.
Is 100% still the case, and almost impossible to get anyone to care about.
All it takes is for one criminal to write a one-page guide to using GPG and circulate it to the group ....
I know I mentioned paying a cryptographer earlier, but in reality downloading and using GPG is a crude and effective way of defeating an E2EE backdoor.
Are the GPG devs going to backdoor GPG to satisfy governments ? Probably not.
If cybersecurity was that easy, we wouldn't have so many examples of businesses getting it wrong.
Just because everyone here can follow instructions like that, doesn't make it common knowledge for anyone else.
I can only partially agree with this point. Businesses getting cybersecurity wrong has almost no material and significant consequences. At best, they get a tiny slap on the wrist or asked to answer some questions. Nobody in said businesses goes to jail for it or personally pays any fines. Compare that to criminals who have a lot more to lose if they get caught — jail time, fines they have to pay, not having freedom for quite sometime, life not being the same after they’ve served their sentence, and more. Businesses have it extremely easy compared to this. No wonder cybersecurity is so poor among all businesses, including very large ones (like Microsoft, as a recent example).
Fear of these is the reason for the (maliciously compliant) GDPR popups, and that despite discussion about extra-territoriality and relativity limited capacity-to-websites ratio.
The law and threats of punishment are clearly not hugely significant to anyone involved in the specific topic of this thread regardless; in the UK at least, it's the kind of thing where if someone is lynched for it, the vigilantes have to be extremely stupid (like attacking a paediatrician because they can't tell the difference, which happened) to not get public sympathy.
There are almost no consequences for anyone working at a business that gets it wrong.
The consequences for being a nonce are quite severe so the motivation to get it right will be quite high.
GPG is infamous for being difficult to use correctly and for an antiquated design (IIRC forward secrecy is impossible?). And assuming E2EE backdoor actually exists, the gov is likely to be able to get at your key.
>Are the GPG devs going to backdoor GPG to satisfy governments?
No, but most users are unlikely to verify their GPG build is the right build.
[Citation needed]
This mindset—that assigns people into immutable categories, "criminal" and "not criminal"—is actually one of the biggest things that needs to change.
We absolutely can stop criminals from being criminals. We just can't do so by pointing at them and saying "Stop! Bad!" We have to change the incentives, remove the reasons they became criminal in the first place (usually poverty), and make it easier, safer, and more acceptable to go from being a criminal to being a not-criminal again.
Blah blah blah, the same old argument given by the "think of the children" people.
There are many ways to counter that old chestnut, but really, we only need to remember the most basic fundamental facts:
1) Encryption is mathematics 2) Criminals are criminals
Can you ban mathematics ? No. Can you stop criminals being criminals ? No.
So, let's imagine you are able to successfully backdoor E2EE globally, on all devices and all platforms.
Sure, the "think of the children" people will rejoice and start singing "Hallelujah". And the governments will rub their hands with glee with all the new data they have access to.
But the criminals ? Do you honestly think they'll think "oh no, game over" ?
No of course not. They'll pay some cryptographer in need of some money to develop a new E2EE tool and carry on. Business as usual.