Privacy has become a very important issue in modern society, with companies and governments constantly abusing their power, more and more people are waking up to the importance of digital privacy.
In this community everyone is welcome to post links and discuss topics related to privacy.
[Matrix/Element]Dead
much thanks to @gary_host_laptop for the logo design :)
Terrorists will have no problem writing their own encryption program, and more ordinary citizens will install malicious apps from unofficial app stores.
And everyone else will have their shit dumped out in the open when ai starts breaking through all the back doors and manipulating officials into clearing them
You'll never decode me and my brother's Pig Latin
I have helped a little with some ongoing research on the subject of client-side-scanning in a European research center. Only some low level stuff, but I possess a solid background in IT security and I can explain a little what the proposition made to the EU is. I am by no means condemning what is proposed here.I myself based on what experts have explained am against the whole idea because of the slippery slope it creates for authoritarian government and how easily it can be abused.
The idea is to use perceptual hashing to create a local or remote database of known abuse material (Basically creating an approximation of already known CP content and hashing it) and then comparing all images accessible to the messaging app against this database by using the same perceptual hashing process on them.
It's called Client-Side-Scanning because of the fact that it's simply circumventing the encryption process. Circumvention in this case means that the process happens outside of the communication protocol, either before or after the images, media, etc, are sent. It does not matter that you use end-to-end encryption if the scanning is happening on you data at rest on your device and not in transit. In this sense it wouldn't directly have an adverse effect on end-to-end encryption.
Some of the most obvious issues with this idea, outside of the blatant privacy violation are:
This is a really nice summary of the practical issues surrounding this.
There is one more that I would like to call out: how does this client scanning code end up running in your phone? i.e. who pushes it there and keeps it up to date (and by consequence the database).
I can think of a few options:
Each of these has its own problems/challenges. How to compel them to insert this (ahem "backdoor"), and the different risks with each of them.
Another problem: legislation like this cements the status quo. It's easy enough for large incumbents to add features like this, but to a handful of programmers trying to launch an app from their garage, this adds another hurdle into the process. Remember: Signal and Telegram are only about a decade old, we've seen new (and better) apps launch recently. Is that going to stop?
It's easy to say "this is just a simple hash lookup, it's not that big a deal!", but (1) it opens the door to client-side requirements in legislation, it's unlikely to stop here, (2) if other countries follow suit, devs will need to implement a bunch of geo-dependant (?) lookups, and (3) someone is going to have to monitor compliance, and make sure images are actually being verified--which also opens small companies up to difficult legal actions. How do you prove your client is complying? How can you monitor to make sure it's working without violating user privacy?
Also: doesn't this close the door on open software? How can you allow users to install open source message apps, or (if the lookup is OS-level) Linux or a free version of Android that they're able to build themselves? If they can, what's to stop pedophiles from just doing that--and disabling the checks?
If you don't ban user-modifiable software on phones, you've just added an extra hurdle for creeps: they just need to install a new version. If you do, you've handed total control of phones to corporations, and especially big established corporations.
What is wrong with the eu? Why do they need to always ban end to end encryption?
As I remember at the moment partly Von Der Leyen, the current Commission president. She is a German Christian democrat and apparently bit with capital C. Meaning she has bit of a moral panic streak on her of the "won't you think of the children" variety. As I understand this current proposal is very much driven by her.
However her driving it doesn't mean it sail through to pass as legislation. Some whole memberstate governments are against the encryption busting idea.
And the fact that Ylva Johansson, being technologically illiterate as well as a close bed buddy with companies in the surveillance industry that stand to earn a crap load of money doesn't help...
5 eyes. Politicians are puppets.
Wait, you have a choice to vote for either puppet 1, puppet 2, or puppet 3. Your choice matters! .. as long as the politicians podiums are provided by the rich we don't have a real say.
I'm sure they will tell you it's weighing the security (against terrorists, criminals, etc) of the many against the security (from seeing dick pics or messaging a mistress) of the few.
Making it illegal only hampers those that follow the law.
Criminals, by definition, already don't follow the law.
Exactly. When privacy is criminal, only criminals will have privacy.
People in Reddit and sometimes here always praise the EU as some bastion of privacy, and I always got downvoted when I said that this isn't always true. And now here we are. I hope people don't forget this after a month, like they always do.
They will, and you're screaming into the wind sadly.
What you can do is never forget and base your voting decisions to include this as a priority going forward. Endorse and support companies that protect privacy.
It's a long uphill battle and every little thing can help no matter how small.
While this would be terrible if it passes, a part of me hopes a silver lining would be a massive surge in open source development focusing on privacy respecting software that does not follow or enable this disgusting behavior by the eu
Software which may be made illegal.
How would such a ban ever be enforceable?
If you are using Windows or mac, they will be first in line to implement "protection" against "insecure software" :)
Or Android with Google Play. It already does this BS, even if you disable scanning.
Lineage/Graphene/DivestOS here I come.
That's like already the thing, if I modify my little "secure encrypted sharing protocol" windows will flag it as a virus if I send it (the software) to someone ... Then after some time it's ok. Guess it's about those antivirus heuristics, but it's not like it's not putting a big stick in my bicycle wheel.
Just imagine the headline we'd see in the west if this was happening in China.
This is almost definitely not going through the ECJ. If they pass this directive I'm gonna take my chances.
Thanks to the Matrix protocol there is no chance of getting rid of E2EE communication anyway. There is no feasible way to stop decentralized communication like that, no without killing the internet.
Also I would add, not like this is unanimously supported in EU among memberstates. So this isn't a done deal, this is a legislative proposal. Ofcourse everyone should activate and campaign on this, but its not like this is "Privacy activists vs all of EU and all the member state governments" situation. Some official government positions on this one are "this should not pass like it is, breaking the encryption is bad idea".
Wouldn't be first time EU commission proposal falls. Plus as you said ECJ would most likely rule it as being against the Charter of Rights of European Union as too wide breach of right to privacy.
If apps would turn off e2e encryption, how would it be? Would it affect bordering regions? Users of VPNs inside EU?
My country proposed a ban on VPN software (targeting appstores providibg them), it can also target messengers. If I get a EU version of this app, or if I use a european VPN to connect via it, would I be less safe sending political memes?
I wonder if openPGP will ever gain popularity.
The only ones I have seen that even publish a key for me to use are a few famous internet individuals (people like Richard stallman, (I don't know if he specifically uses it)), a few companies like mullvad, a few orgs like EFF, whistleblowers, and a few governmental organisations like the Financial Supervisory Authority in my country.
@lud @makeasnek With more government controls and intervention, its possible. I learned how to use PGP pretty efficiently but there is absolutely no one in my daily life that also uses it.
Manual encryption with personal keys may become the norm if less and less services are able to use it.
Can this be circumvented somehow? And how would apps with end to end encryption work if a person in a non-EU state spoke to someone inside the EU?
Anything can be circumvented, VPNs, Tor, I2P, and some other more unknown apps like briar. The issue will become will using those services become illegal too, and the barrier of entry becoming too high for those outside of the technical world. Signal will definitely just pull support for the EU, so you'll have to trick it into thinking you're not in the EU. But now you're at risk of running a foul with the law.
Would a way to legally bypass this be an app that can "encrypt" your text before your send it. The government would be able to see all of your messages but it would be scrambled in a way that they couldn't read it.
Something where both people would install the same text scrambling app and generate the same key to scramble all text (would need to do in person). They would then type all their text into the app and it would scramble it. The user would then copy The Scrambled text and send it over any messaging platform they want. The recipient would need to copy the text and put it back into the scrambling app to descramble it.
This is how PGP works and is pretty widely used. https://en.m.wikipedia.org/wiki/Pretty_Good_Privacy
Although some US corporations such as Meta are already scanning European messages for previously classified CSAM ‚only‘
This is news to me, does anyone have any more detail?
I wonder if projects like Signal could make a community run and certified hash database that could be included in Signal et al without threat of governments and self-interested actors putting malicious entries in. It definitely doesn't solve every problem with the client side scanning, but it does solve some.
But... an open, verifiable database of CSAM hashes has its own serious problems :-S Maybe an open, audited AI tool that in turn makes the database? Perhaps there's some clever trick to make it verifiable that all the hashes are for CSAM without requiring extra people to audit the CSAM itself.
You're unfortunately also handing people distributing csam a way to verify whether their content would be detected by checking it against the database
Yeah... Because hampering legal encryption will totally hamper all those who just continue to use the methods we have today.