1y ago

Stop playing games with online security, Signal president warns EU lawmakers

techcrunch.com

Stop playing games with online security, Signal president warns EU lawmakers | TechCrunch

Follow-up to last week's story:

https://lemmy.ml/post/16672524

EDIT1: Politicians expect to be be exempt.

EDIT2: Good news: Vote has been postponed due to disagreements.

Technology @lemmy.zip

BrikoX @lemmy.zip

1y ago

Stop playing games with online security, Signal president warns EU lawmakers

techcrunch.com /2024/06/17/stop-playing-games-with-online-security-signal-president-warns-eu-lawmakers/

privacy @lemmy.ca

lemme in @lemm.ee

1y ago

Stop playing games with online security, Signal president warns EU lawmakers | TechCrunch

techcrunch.com /2024/06/17/stop-playing-games-with-online-security-signal-president-warns-eu-lawmakers/

25 comments

They start with CSAM, move to copyright infringement, and end at censorship of those with opposing views.
Once such laws and mechanisms are in place all it takes is the ~~right~~ wrong leadership to take it all away to keep us safe.
- Once this has been implemented, something worse can be implemented.
  I don't like these slippery slope arguments. You might as well reduce it to any legislation.
  Once people are allowed to make laws, bad people can make bad laws.
  Which is why we must continue to vote in the right people, not abandon the concept of laws.
  In this case, I don't doubt that copyright infringement and general censorship are on some people's agenda.
  But this current proposal is bad enough itself and should be opposed because of that and not because someone might make other, even worse proposals in the future.
Good advise.
Right, you should see this article too about the upcoming vote (https://lemmy.ml/post/17004141)
PS: Thanks you to have republished my post
- News today: vote has been postponed.
  
  Good news
Article 10a, which contains the upload moderation plan, states that these technologies would be expected “to detect, prior to transmission, the dissemination of known child sexual abuse material or of new child sexual abuse material.”
This is what I guessed the other day when a post here didn't clarify what the censorship meant.
While I'm not a fan of this stupid regulation, it doesn't sound like being the armageddon that turns e2ee into ashes.
(Given that Signal doesn't like it, I might be wrong though.)
As long as we trust, say, Signal, it will possibly be able to do the scan without sending a good chunk of the image data that the user is sending. URLs can be hashed before sending it to the scanner.
The remaining piece for privacy is to use open source and to guarantee that the binaries are free of modification from the original. This problem always existed on the Apple ecosystem btw.
- How about the false positives? You want your name permanently associated with child porn because someone fucked up and ruined your life? https://www.eff.org/deeplinks/2022/08/googles-scans-private-photos-led-false-accusations-child-abuse
  The whole system is so flawed that it has like 20-25% success rate.
  Or how about this system being adopted for anything else? Guns? Abortion? LGBT related issues? Once something gets implemented, it's there forever and expansion is inevitable. And each subsequent government will use it for their personal agenda.
  
  They say they the images are merely matched to pre-determined images found on the web. You're talking about a different scenario where AI detects inappropriate contents in an image.
- Its a slippery slope thing. Sure, technically it doesn't break e2ee, but it basically forces app developers to integrate a trojan into their app that scans messages before they are encrypted and send. Right now it is "only" for images, but once this is in place and generally accepted, what is stopping lawmakers to extend it to scanning all messages?
  
  I think the parent is distinguishing between messages & the attachments as they are stored differently & often in different places in many systems. But I agree with you in assuming that the goal would ultimately be to then start scanning messages too.
  Imagine governments used something like SHA1 that has conflicts & now you have collision potential--you could even fabricate attachments that could cause a collision to get someone throw in jail since all you have to rely on is the file hashes. If you can’t scan the actually content & you are just using hashes, then you also don’t prevent new content that those in power deem ‘bad’ from being flagged either which doesn’t really stop the proliferation of the ‘bad thing’ just specific known ‘bad things’. If I were implementing clients, I would start adding random bits to the metadata so the hashes always change.
  The only way this system even works is if there are centralized points the governments/corporations can control. Chalk this up as another point for supporting decentralization & lightweight self-hosting since it would be impossible to have oversight over such a system if anyone can spin up a personal server in their bedroom.
  
  technically it doesn't break e2ee
  ** for some unorthodox definition of e2ee
  If the "endpoints" are defined as being somewhere outside the end users' control, because for example the client software they have is designed to betray their secrets, then the system is no longer end-to-end encrypted in the way that both cryptographers and normal people would usually understand the concept.
  
  Yes, I agree it is dangerous. I just wanted to assess the actual threat (current and future) before jumping onto the wagon.
- They say they the images are merely matched to pre-determined images found on the web. You're talking about a different scenario where AI detects inappropriate contents in an image.
- But you can't detect such things without either server side scanning (kills E2EE dead) or client side scanning (will always be limited in what it can detect, and it's easy to patch out of clients, AND there's still the risk of govs maliciously pushing detection of banned media)

25 comments