App-exit
February 24, 2025 1:12 PM Subscribe
"Three questions about Apple [disabling Advanced Data Protection for UK customers]" in responce to a secret “Technical Capability Notice” under the UK's “Snooper’s Charter.”
I'd missed that the "FBI Warns iPhone, Android Users—We Want ‘Lawful Access’ To All Your Encrypted Data" before posting this.
Appears this conflict with the FBI and CISA recommending end-to-end encryption and even ephemeral messaging, due to China’s salt typhoon spies having semi-permenently hacked all US telecoms.
posted by jeffburdges at 1:20 PM on February 24 [2 favorites]
Appears this conflict with the FBI and CISA recommending end-to-end encryption and even ephemeral messaging, due to China’s salt typhoon spies having semi-permenently hacked all US telecoms.
posted by jeffburdges at 1:20 PM on February 24 [2 favorites]
The Uk and the United States work together as part of a larger data sharing agreement, which also calls into question the extent to which data are safe from vindictive eyes (disabled in one, disabled for all, etc).
posted by They sucked his brains out! at 1:20 PM on February 24 [3 favorites]
posted by They sucked his brains out! at 1:20 PM on February 24 [3 favorites]
It seems to me that almost every story about tech these days can be viewed as an illustration of why consolidation in the industry is a bad thing.
In this particular case Apple (and Google) are big fat easy targets for governments that see individual privacy and national security as fundamentally incompatible. It would be a lot harder for such governments to target a bunch of smaller players without raising louder alarms.
(Also, open source deserves a plug here, though realistically it's only the really hardcore folks that don't use binaries provided but at least some companies. And Ken Thompson's classic Turing lecture shows some simultaneously amusing and disturbing limits on the effectiveness of only trusting source.)
posted by Pemdas at 1:37 PM on February 24 [6 favorites]
In this particular case Apple (and Google) are big fat easy targets for governments that see individual privacy and national security as fundamentally incompatible. It would be a lot harder for such governments to target a bunch of smaller players without raising louder alarms.
(Also, open source deserves a plug here, though realistically it's only the really hardcore folks that don't use binaries provided but at least some companies. And Ken Thompson's classic Turing lecture shows some simultaneously amusing and disturbing limits on the effectiveness of only trusting source.)
posted by Pemdas at 1:37 PM on February 24 [6 favorites]
It would be a lot harder for such governments to target a bunch of smaller players without raising louder alarms.
Conversely,
I didn't hear much in the way of
posted by zamboni at 1:49 PM on February 24 [8 favorites]
Conversely,
a bunch of smaller playershave less resources and clout to resist such mandates, and less legitimacy that means they may end up serving dodgy clients and end up being prosecuted out of business, if they're not already secretly a law enforcement sting.
I didn't hear much in the way of
loud alarmsover EncroChat, Ghost, Phantom Secure, or Sky Global…
posted by zamboni at 1:49 PM on February 24 [8 favorites]
At least historically, Apple has tried to position itself as "we keep your stuff secure" company, which many clueful people trust about as far as they can throw Tim Cook. Of course, a huge swathe of users are not equipped to evaluate the security of Apple's products and just hope for the best.
The FBI/CISA recommendation doesn't appear too conflicting when viewed through the pragmatic lens of "we want to make it easier to convict criminals." I imagine there exist clueful criminals who aren't trusting iMessage to transmit the locations of their drug drop-offs or whatever. But for the rest, certainly the FBI's life would be easier if it could back-door its way into their communications. FBI/CISA recommendations to use e2e encryption make sense; the group of people who don't already understand its importance are probably not going to see the light because of the best practices recommendation. They can't really make a recommendation like "nah don't bother with e2e everything will be fine" or else they'd get shouted at by an angry mob of experts.
posted by axiom at 2:05 PM on February 24 [1 favorite]
The FBI/CISA recommendation doesn't appear too conflicting when viewed through the pragmatic lens of "we want to make it easier to convict criminals." I imagine there exist clueful criminals who aren't trusting iMessage to transmit the locations of their drug drop-offs or whatever. But for the rest, certainly the FBI's life would be easier if it could back-door its way into their communications. FBI/CISA recommendations to use e2e encryption make sense; the group of people who don't already understand its importance are probably not going to see the light because of the best practices recommendation. They can't really make a recommendation like "nah don't bother with e2e everything will be fine" or else they'd get shouted at by an angry mob of experts.
posted by axiom at 2:05 PM on February 24 [1 favorite]
It seems fairly obvious that "the government should be able to secretly access basically anything you write, read, photograph or video" would be a losing political position, but apparently it is not, at least in the UK.
The dystopian fiction of last century had to imagine how we might be able to read people's minds, but now we have the next best thing in the form of a cell phone and it's somehow a debate whether this should be private or not. Strange times.
posted by ssg at 2:37 PM on February 24 [4 favorites]
The dystopian fiction of last century had to imagine how we might be able to read people's minds, but now we have the next best thing in the form of a cell phone and it's somehow a debate whether this should be private or not. Strange times.
posted by ssg at 2:37 PM on February 24 [4 favorites]
They can't really make a recommendation like "nah don't bother with e2e everything will be fine" or else they'd get shouted at by an angry mob of experts.
You mean the experts the current regime universally ignores and/or fires?
posted by Thorzdad at 2:38 PM on February 24
You mean the experts the current regime universally ignores and/or fires?
posted by Thorzdad at 2:38 PM on February 24
"It seems fairly obvious that "the government should be able to secretly access basically anything you write, read, photograph or video" would be a losing political position..."
Naah. It's sold as only with the "appropriate access".
People want to believe.
posted by aleph at 2:59 PM on February 24 [2 favorites]
Naah. It's sold as only with the "appropriate access".
People want to believe.
posted by aleph at 2:59 PM on February 24 [2 favorites]
Since the 1990s, the job of Home Secretary has been given to the most rabid anti-freedom politician sitting on the front bench. I’m not sure if the politician starts out that way, or if they’re shown a hypnotic “infinite jest” style video that convinces them that they must act in the most illiberal way possible to save all of mankind (but especially the bit with the British accent).
It also helps that most MPs are not technically literate. This is changing over time, and tools like email and Twitter are seen as valuable for communicating with constituents (yes I deliberately picked two outmoded forms of communication). As pointed out above, it’s very likely this is a five eyes thing for getting information into a big system, but it’s also part of a drive by the current British government that has no interest in appearing “soft on crime”. This is a terrible idea, won’t achieve what they want, and will make some people very angry.
posted by The River Ivel at 3:00 PM on February 24 [5 favorites]
It also helps that most MPs are not technically literate. This is changing over time, and tools like email and Twitter are seen as valuable for communicating with constituents (yes I deliberately picked two outmoded forms of communication). As pointed out above, it’s very likely this is a five eyes thing for getting information into a big system, but it’s also part of a drive by the current British government that has no interest in appearing “soft on crime”. This is a terrible idea, won’t achieve what they want, and will make some people very angry.
posted by The River Ivel at 3:00 PM on February 24 [5 favorites]
It also helps that most MPs are not technically literate.
Okay, this gave me a big laugh until I figured out that I think you meant “technologically literate.”
posted by fimbulvetr at 3:13 PM on February 24 [15 favorites]
Okay, this gave me a big laugh until I figured out that I think you meant “technologically literate.”
posted by fimbulvetr at 3:13 PM on February 24 [15 favorites]
It's true those FBI comments occured under different administrations, but the FBI wanted to spy upon all Americans like forever, so that's not new.
It's new that the FBI recommended e2ee-e messaging apps, and likely different FBI people made those recommendations, but right now China sees single SMS message in the US, and the US cannot stop China doing this, so the FBI has no real choice but to suggest encryption too.
Importantly, the FBI has never understood that, if the FBI could decrypt your messages then China could decrypt them too, because China shall compromise whatever keys they hold.
It's likely the FBI believes in "nobody but us" (NOBUS) fantasies since they know the NSA gains special access sometimes, but they never understood how hard the NSA works for that access: The NSA budget is only $3.6 billion, but already 1/3rd of the FBI budget. The NSA accesses all those spy satellites etc paid for by the overall $73 billion intelligence budget. The NSA budget gets subsidized by "selling" evil maid tools (media.ccc.de) to the CIA, DoD, etc.
Around NOBUS fantasies, we think China exfiltrated all the SF86 data during the OPM hack. Moxie Marlinspike argues the OPM hack might've exploited the Dual EC_DRB backdoor created by the NSA. If true, this makes the NSA's clever NOBUS backdoor responsible for one of the worst intelligence debacles in U.S. history (previously). lol
posted by jeffburdges at 3:17 PM on February 24 [5 favorites]
It's new that the FBI recommended e2ee-e messaging apps, and likely different FBI people made those recommendations, but right now China sees single SMS message in the US, and the US cannot stop China doing this, so the FBI has no real choice but to suggest encryption too.
Importantly, the FBI has never understood that, if the FBI could decrypt your messages then China could decrypt them too, because China shall compromise whatever keys they hold.
It's likely the FBI believes in "nobody but us" (NOBUS) fantasies since they know the NSA gains special access sometimes, but they never understood how hard the NSA works for that access: The NSA budget is only $3.6 billion, but already 1/3rd of the FBI budget. The NSA accesses all those spy satellites etc paid for by the overall $73 billion intelligence budget. The NSA budget gets subsidized by "selling" evil maid tools (media.ccc.de) to the CIA, DoD, etc.
Around NOBUS fantasies, we think China exfiltrated all the SF86 data during the OPM hack. Moxie Marlinspike argues the OPM hack might've exploited the Dual EC_DRB backdoor created by the NSA. If true, this makes the NSA's clever NOBUS backdoor responsible for one of the worst intelligence debacles in U.S. history (previously). lol
posted by jeffburdges at 3:17 PM on February 24 [5 favorites]
I wonder if the Fascists and the Libertarians split over this.
posted by aleph at 3:22 PM on February 24
posted by aleph at 3:22 PM on February 24
Importantly, the FBI has never understood that, if the FBI could decrypt your messages then China could decrypt them too…
I have to disagree here. The FBI may be a lot of things, but I really doubt they’re so far up their own asses as to believe they have better juice than the largest surveillance state on the planet. I think it’s more like they keep wanting to play with the big kids, but pesky stuff like democracy and private sector business keep getting in the way. I fear that may be about to change, though.
posted by Thorzdad at 3:45 PM on February 24 [1 favorite]
I have to disagree here. The FBI may be a lot of things, but I really doubt they’re so far up their own asses as to believe they have better juice than the largest surveillance state on the planet. I think it’s more like they keep wanting to play with the big kids, but pesky stuff like democracy and private sector business keep getting in the way. I fear that may be about to change, though.
posted by Thorzdad at 3:45 PM on February 24 [1 favorite]
Install Signal now.
Regarding Apple, I tend to trust them more than most other companies, for two reasons. One is that they're not in the business of selling your data to advertisers or others in the same way that Google, Facebook, etc., are, they're a hardware company first, so their incentives to protect their clients are different. Secondly, I've read a fair bit of whitepapers on what Apple is doing for security, and it's honestly pretty impressive, they obviously control a larger part of the technology stack themselves than most any other company, everything from the apps to the OS to various bits of the hardware, and the way the secure enclave on their CPUs works, combined with full encryption of all storage on iOS devices, etc., seems like pretty solid security practice.
They've also been diligent about closing whatever security holes there are whenever they're found, and specifically the thing this post is about, Advanced Data Protection, is a end to end encrypted mode for your cloud data where no one, not even Apple, can access your data (this is why it's optional, you get prompted to set up a backup recovery key and some other stuff, and you do risk losing access to your data if you fuck up). iOS also offers a "Lockdown Mode" for people who have special security needs, like journalists likely to be targeted by APTs (essentially, state actors or equivalent), which disables a bunch of potential attack vectors at the cost of quite a bit of functionality, and that also seems quite solid for a standard option on a mainstream OS.
In short, Apple seems to take this more seriously than most.
posted by Joakim Ziegler at 3:50 PM on February 24 [17 favorites]
Regarding Apple, I tend to trust them more than most other companies, for two reasons. One is that they're not in the business of selling your data to advertisers or others in the same way that Google, Facebook, etc., are, they're a hardware company first, so their incentives to protect their clients are different. Secondly, I've read a fair bit of whitepapers on what Apple is doing for security, and it's honestly pretty impressive, they obviously control a larger part of the technology stack themselves than most any other company, everything from the apps to the OS to various bits of the hardware, and the way the secure enclave on their CPUs works, combined with full encryption of all storage on iOS devices, etc., seems like pretty solid security practice.
They've also been diligent about closing whatever security holes there are whenever they're found, and specifically the thing this post is about, Advanced Data Protection, is a end to end encrypted mode for your cloud data where no one, not even Apple, can access your data (this is why it's optional, you get prompted to set up a backup recovery key and some other stuff, and you do risk losing access to your data if you fuck up). iOS also offers a "Lockdown Mode" for people who have special security needs, like journalists likely to be targeted by APTs (essentially, state actors or equivalent), which disables a bunch of potential attack vectors at the cost of quite a bit of functionality, and that also seems quite solid for a standard option on a mainstream OS.
In short, Apple seems to take this more seriously than most.
posted by Joakim Ziegler at 3:50 PM on February 24 [17 favorites]
Install Signal now.
Which, last I heard anyway, provides no encryption when communicating with anyone who isn't also using Signal. If that's still true, good luck getting all your non-techie friends and family to switch over.
posted by Greg_Ace at 4:28 PM on February 24
Which, last I heard anyway, provides no encryption when communicating with anyone who isn't also using Signal. If that's still true, good luck getting all your non-techie friends and family to switch over.
posted by Greg_Ace at 4:28 PM on February 24
The FBI/CISA recommendation doesn't appear too conflicting when viewed through the pragmatic lens of "we want to make it easier to convict criminals."
The FBI of which era, though? With what definition of “criminals?”
posted by rokusan at 4:48 PM on February 24 [1 favorite]
The FBI of which era, though? With what definition of “criminals?”
posted by rokusan at 4:48 PM on February 24 [1 favorite]
Well who knows where the current atmosphere will take the FBI, but the following things can all be true at once: (1) The FBI would find it easier to gather evidence if a back door is available to them (even if only against less tech-savvy individuals) (2) The FBI would like to avoid making a recommendation that would make them look like idiots and (3) The more tech-savvy individuals are going to be harder to prosecute due to the increased difficulty of gathering evidence (and likely will remain that way regardless of what the FBI recommends because they have independent knowledge of the value of good encryption). In fact, they can make the correct recommendation regarding encryption because they know it won't alter the behavior of their tech-savvy target, and minimally alter the behavior of the less tech-savvy ones (because by definition they're not really paying attention).
posted by axiom at 4:58 PM on February 24 [1 favorite]
posted by axiom at 4:58 PM on February 24 [1 favorite]
Which, last I heard anyway, provides no encryption when communicating with anyone who isn't also using Signal. If that's still true, good luck getting all your non-techie friends and family to switch over.
Yes, this is the case with literally all messaging apps. And the way to get your non-techie friends and family to switch over is to switch yourself and then nag them to do it.
posted by Joakim Ziegler at 5:08 PM on February 24 [11 favorites]
Yes, this is the case with literally all messaging apps. And the way to get your non-techie friends and family to switch over is to switch yourself and then nag them to do it.
posted by Joakim Ziegler at 5:08 PM on February 24 [11 favorites]
The FBI would like to avoid making a recommendation that would make them look like idiots
If only they hadn't spent the last X years screaming from the rooftops about "a backdoor that only we can access" because "think of the children"...
That ship has long-since sailed.
posted by tubedogg at 5:13 PM on February 24 [2 favorites]
If only they hadn't spent the last X years screaming from the rooftops about "a backdoor that only we can access" because "think of the children"...
That ship has long-since sailed.
posted by tubedogg at 5:13 PM on February 24 [2 favorites]
And the way to get your non-techie friends and family to switch over is to switch yourself and then nag them to do it.
TBH I don't see that going very successfully for most people. Again, good luck to those who try this.
posted by Greg_Ace at 5:15 PM on February 24 [1 favorite]
TBH I don't see that going very successfully for most people. Again, good luck to those who try this.
posted by Greg_Ace at 5:15 PM on February 24 [1 favorite]
ARLEAS by Matthew Green et al from this post establishes some formal difficulty metrics for secure legitimate law enforcement:
- Prospective access looks possible, but I think only given a secure blockchain with fancy tools like threshold encryption.
- Retrospective access looks impossible without "extractable witness encryption", which looks impossible at full generality, but maybe exists in extremely restrictive settings.
Around messnagers choices:
Signal is good, but requires a phone number. Also, many people dislike US companies and walled gardens.
Around this, Signal CEO Meredith Whittaker increasingly promotes freaky deeply flawed conclusions regarding past political progress towards encryption, so not a great sign for their future. Moxie pissed everyone off too though, so who knows. David Bowie explained Signal's big problem.
Wire seems quite solid, stays outside the US, and never required a phone number, but afaik still imposes a walled garden. Signal might handle specific metadata better, but really not so sure. All the paranoid cipherpunk kids choose Wire over Signal.
Element/Matrix seems pretty good, requires no phone number, and works federated. Authentication suffered vulnerabilities, often now fixed, but their bridging necessitates unencrypted rooms. It handles multi-device better than most messangers, so good for messaging yourself, which maybe reduces the authentication risks. It'll handle metadata worse.
Briar maybe pretty good, maybe handles metadata better too, but unsure how well those defenses hold up today. It burns battery like crazy.
SimpleX has become the new metadata hotness, but unsure how well their claims hold up. Increasingly the paranoid cipherpunk kids explore SimpleX.
Session makes big metadata claims too, but again unclear how truthful or. clueful, especially given their crypto-currency involvement. Try SimpleX first.
Afaik WhatsApp remains sufficent when metadata leakage, nationality, etc matters little, but really depends upon your threat model.
Telegram remains a bullshit dumpster fire.
posted by jeffburdges at 5:36 PM on February 24 [9 favorites]
- Prospective access looks possible, but I think only given a secure blockchain with fancy tools like threshold encryption.
- Retrospective access looks impossible without "extractable witness encryption", which looks impossible at full generality, but maybe exists in extremely restrictive settings.
Around messnagers choices:
Signal is good, but requires a phone number. Also, many people dislike US companies and walled gardens.
Around this, Signal CEO Meredith Whittaker increasingly promotes freaky deeply flawed conclusions regarding past political progress towards encryption, so not a great sign for their future. Moxie pissed everyone off too though, so who knows. David Bowie explained Signal's big problem.
Wire seems quite solid, stays outside the US, and never required a phone number, but afaik still imposes a walled garden. Signal might handle specific metadata better, but really not so sure. All the paranoid cipherpunk kids choose Wire over Signal.
Element/Matrix seems pretty good, requires no phone number, and works federated. Authentication suffered vulnerabilities, often now fixed, but their bridging necessitates unencrypted rooms. It handles multi-device better than most messangers, so good for messaging yourself, which maybe reduces the authentication risks. It'll handle metadata worse.
Briar maybe pretty good, maybe handles metadata better too, but unsure how well those defenses hold up today. It burns battery like crazy.
SimpleX has become the new metadata hotness, but unsure how well their claims hold up. Increasingly the paranoid cipherpunk kids explore SimpleX.
Session makes big metadata claims too, but again unclear how truthful or. clueful, especially given their crypto-currency involvement. Try SimpleX first.
Afaik WhatsApp remains sufficent when metadata leakage, nationality, etc matters little, but really depends upon your threat model.
Telegram remains a bullshit dumpster fire.
posted by jeffburdges at 5:36 PM on February 24 [9 favorites]
I'm kind of curious to see whether the UK declares victory at "Apple disables users fully encrypting their iCloud data for UK customers" (which is, by its nature, something that Apple can only prohibit starting, but can't undo from their end — the whole point is, after all, that the data is being fully encrypted in a way that they can't access anymore) and gives up on the frankly completely insane push to be able to do completely secret surveillance on literally anyone in the world. Kind of wondering if this is going to be yet another one of those "government officials need to have it explained very slowly that you cannot create a backdoor that won't also then be exploited by governments and other actors you consider hostile" situations.
posted by DoctorFedora at 6:25 PM on February 24 [2 favorites]
posted by DoctorFedora at 6:25 PM on February 24 [2 favorites]
jeffburdges: you missed Threema, which is based in Switzerland, has great E2EE, and not only doesn't require a phone number, it doesn't even actually require a stable account, meaning you can have one-off comms without tying in any of your PII at all. (I'm a fan.)
posted by adrienneleigh at 6:42 PM on February 24 [3 favorites]
posted by adrienneleigh at 6:42 PM on February 24 [3 favorites]
There's some criticism of Threema that seems substantive to me. (This same person is pretty negative on everything they've looked at besides Signal, and readily admits that Signal isn't suitable for every use case either.)
posted by NMcCoy at 7:25 PM on February 24
posted by NMcCoy at 7:25 PM on February 24
Yeah, soatok is pretty cool (we have mutual friends) but (a) i believe that Threema sorted out at least some of the issues that soatok wrote about, although not all of them; and (b) the best cryptographic messenger is the one you and your contacts are willing to use. Signal is a non-starter for some folks, because of the phone-number requirement and the US-based corporate structure. (I refused to get on Signal myself for years because of their early fuckups with misusing people's contact data; i still preferentially use Threema and Wire, although i do finally have a Signal account as well.) Threema is a pretty decent alternative.
Neither is completely protective against every possible threat model; nor is any other secure messenger app. If nothing else, you are always going to be vulnerable to rubber-hose cryptography.
posted by adrienneleigh at 7:42 PM on February 24 [1 favorite]
Neither is completely protective against every possible threat model; nor is any other secure messenger app. If nothing else, you are always going to be vulnerable to rubber-hose cryptography.
posted by adrienneleigh at 7:42 PM on February 24 [1 favorite]
It seems fairly obvious that "the government should be able to secretly access basically anything you write, read, photograph or video" would be a losing political position, but apparently it is not, at least in the UK.
The reason it’s not a losing political position is that it is always reported in the context of being able to prosecute people for possession and manufacture of child sex abuse images.
posted by plonkee at 12:41 AM on February 25 [1 favorite]
The reason it’s not a losing political position is that it is always reported in the context of being able to prosecute people for possession and manufacture of child sex abuse images.
posted by plonkee at 12:41 AM on February 25 [1 favorite]
The reason it’s not a losing political position is that it is always reported in the context of being able to prosecute people for possession and manufacture of child sex abuse images.
This. It was "terrorism" for a while, and also "drug dealers" and "gangs", but the pendulum seems to have swung back to CSAM again now, it's the good old standby that shuts down any discussion or protest, or you might just be a pedo yourself.
posted by Joakim Ziegler at 1:17 AM on February 25 [1 favorite]
This. It was "terrorism" for a while, and also "drug dealers" and "gangs", but the pendulum seems to have swung back to CSAM again now, it's the good old standby that shuts down any discussion or protest, or you might just be a pedo yourself.
posted by Joakim Ziegler at 1:17 AM on February 25 [1 favorite]
FWIW, and for the sake of accuracy, Signal requires a phone number to sign up, but no longer requires exchanging phone numbers with your contacts to be able to talk to them, you can use nicknames now. Whether or not that's acceptable to you is your decision, but I still think it's a lot better than most other mainstream messaging apps, and I've had reasonable success with getting non-technical people onto Signal, because the client is reasonably polished (a friend of mine in Norway managed the impressive feat of getting basically all his friends and family onto it, annoying friends and family group chats and the like included).
So yeah, the best secure messaging app is the one you can actually use (which in practice means the one you can get most of your contacts to use).
posted by Joakim Ziegler at 1:22 AM on February 25 [2 favorites]
So yeah, the best secure messaging app is the one you can actually use (which in practice means the one you can get most of your contacts to use).
posted by Joakim Ziegler at 1:22 AM on February 25 [2 favorites]
Why does this apply only to iCloud backups and not (at least it does not appear to) to say, iMessage, which is also E2E encrypted? Is it because Apple stores iCloud backups but not iMessages?
posted by modernnomad at 3:03 AM on February 25
posted by modernnomad at 3:03 AM on February 25
Apple stores iMessages before you download them, maybe longer depending upon the user experience, like say Matrix, but regardless the Snooper’s Charter clearly targets end-to-end encrypted messnagers like iMessage, WhatsApp, etc.
iCloud has only recently become end-to-end encrypted, and Apple themselves explored perceptual hashing, so they're clearly the softest real target here. If the UK wins here, then they'll pursue other services and iMessage next.
Afaik Apple has not fully complied by removing ADP in the UK, since the UK wants this for industrial espionage too. If the UK pushes this, then Apple might pull iMessage from their UK product line too.
Independent e2ee messangers like Signal, Wire, etc cannot comply without some a protocol overhaul that discredits their service, so they'd simply tell the UK to fuck off since they conduct no buisness there. Any enforcement action then looks draconian, probably only AppStore, DNS, or IP censorship, or maybe "extraordinary rendition" of developers.
As a technical matter, we've many messaging "standards" that either predate e2ee or seek compatibility with non-e2ee use cases, so likely all have serious downgrade attacks in some situations: RCS like Google and iMessage, MQTT and XMPP like Facebook Messanger, and Matrix/Element. At least some of these could likely comply via downgrade attacks, so Apple fighting this really matters.
About the funniest future timeline: A company like Facebook or Google complies, which not only improves Chinese espionage against the UK and US, but also improves Chinese CI against UK espionage, since that US company observes what the UK requests.
In 2016, China executed an MI6 spy of unrevealed nationality. In 2009, China jailed for 8 years an Australian mining executive of the British-Australian mining conglomerate Rio Tinto. About the most fun usage would be planting disinformation though, like signing cheap steal contracts based upon faked discussions of Chinese steal plants starting construction. lol
posted by jeffburdges at 4:39 AM on February 25 [1 favorite]
iCloud has only recently become end-to-end encrypted, and Apple themselves explored perceptual hashing, so they're clearly the softest real target here. If the UK wins here, then they'll pursue other services and iMessage next.
Afaik Apple has not fully complied by removing ADP in the UK, since the UK wants this for industrial espionage too. If the UK pushes this, then Apple might pull iMessage from their UK product line too.
Independent e2ee messangers like Signal, Wire, etc cannot comply without some a protocol overhaul that discredits their service, so they'd simply tell the UK to fuck off since they conduct no buisness there. Any enforcement action then looks draconian, probably only AppStore, DNS, or IP censorship, or maybe "extraordinary rendition" of developers.
As a technical matter, we've many messaging "standards" that either predate e2ee or seek compatibility with non-e2ee use cases, so likely all have serious downgrade attacks in some situations: RCS like Google and iMessage, MQTT and XMPP like Facebook Messanger, and Matrix/Element. At least some of these could likely comply via downgrade attacks, so Apple fighting this really matters.
About the funniest future timeline: A company like Facebook or Google complies, which not only improves Chinese espionage against the UK and US, but also improves Chinese CI against UK espionage, since that US company observes what the UK requests.
In 2016, China executed an MI6 spy of unrevealed nationality. In 2009, China jailed for 8 years an Australian mining executive of the British-Australian mining conglomerate Rio Tinto. About the most fun usage would be planting disinformation though, like signing cheap steal contracts based upon faked discussions of Chinese steal plants starting construction. lol
posted by jeffburdges at 4:39 AM on February 25 [1 favorite]
@modern - yes, ADP, and hence, this issue will affect imessages - if - you were backing them up with icloud. If you don't use icloud, no messages in the cloud, then they're only ever stored on your phone. (Your carrier might have metadata regarding your Messages, maybe?)
posted by bitterkitten at 4:40 AM on February 25
posted by bitterkitten at 4:40 AM on February 25
To me, US based privacy and data security efforts, especially those lead by corporate tech companies from Google to Apple (those that claim Apple doesn't profit from selling user data to advertisers or by sneakily spying on private conversations— hah), is dead as an idea. It's a face, for reasons that I haven't yet fully formulated, including:
The US, and, by extension, its citizens, has zero issues sucking up every piece of data on the planet whether it's done by corporations or by government. Worse than that, this is encouraged by the US government. We outsiders have zero rights under US law. But US companies have been selling us software and devices with the impression that we do.
Further:
Anonymous Internet usage, including encrypted chats that, say, European law enforcement agencies, do not have access to — but US corporations and likely governments do have access to — have been an abysmal failure for democracy and personal safety.
At this point, I am certain that the damage caused by both criminals and state agents is far greater for personal freedom due the particular way that encryption technology is used. From Russian troll farms to US based hate speech 'enthusiasts' of things like 'strange salutes', it's been a disaster. The benefits — not so great in comparison at all.
Australia was right to ban social media for the youth. Likewise I fully support ideas floated in Europe to ban anonymous posting online. Law enforcement should have access to chats as long as they are following legal procedures to do so.
posted by UN at 5:02 AM on February 25
The US, and, by extension, its citizens, has zero issues sucking up every piece of data on the planet whether it's done by corporations or by government. Worse than that, this is encouraged by the US government. We outsiders have zero rights under US law. But US companies have been selling us software and devices with the impression that we do.
Further:
Anonymous Internet usage, including encrypted chats that, say, European law enforcement agencies, do not have access to — but US corporations and likely governments do have access to — have been an abysmal failure for democracy and personal safety.
At this point, I am certain that the damage caused by both criminals and state agents is far greater for personal freedom due the particular way that encryption technology is used. From Russian troll farms to US based hate speech 'enthusiasts' of things like 'strange salutes', it's been a disaster. The benefits — not so great in comparison at all.
Australia was right to ban social media for the youth. Likewise I fully support ideas floated in Europe to ban anonymous posting online. Law enforcement should have access to chats as long as they are following legal procedures to do so.
posted by UN at 5:02 AM on February 25
ARLEAS is the only serious proposal to impose "following legal procedures". It shows that prospective access looks possible, but extremely expensive, while retrospective access looks impossible under current knowledge, maybe just mathematically impossible.
ARLEAS cannot prevent a fascist president appointing judges who spy upon everyone, but merely makes the courts keep honest records. It's a bare minimum for law enforcement access a nation that faces serious espionage concerns.
In reality, we've better methods for obtaining legal access, like those in the NSA ANT catalog I linked above, but they require some physical effort by officers, ala evil maid attacks, side channel attacks, lasers pointed at windows, etc. All these leave some semblance of a paper trail because someone pays those officers for their time. We do end up with SPYCOPS where officers maintain deceptive relationship, but that's better than the alterantive of unrestriucted access.
posted by jeffburdges at 5:11 AM on February 25 [1 favorite]
ARLEAS cannot prevent a fascist president appointing judges who spy upon everyone, but merely makes the courts keep honest records. It's a bare minimum for law enforcement access a nation that faces serious espionage concerns.
In reality, we've better methods for obtaining legal access, like those in the NSA ANT catalog I linked above, but they require some physical effort by officers, ala evil maid attacks, side channel attacks, lasers pointed at windows, etc. All these leave some semblance of a paper trail because someone pays those officers for their time. We do end up with SPYCOPS where officers maintain deceptive relationship, but that's better than the alterantive of unrestriucted access.
posted by jeffburdges at 5:11 AM on February 25 [1 favorite]
Signal: We'd leave Sweden if Sweden requires retaining messages
Amusingly, the Swedish Armed Forces argued "[the proposal cannot be realized] without introducing vulnerabilities and backdoors that can be exploited by third parties", meaning Russia, Mafia, etc)
posted by jeffburdges at 5:28 AM on February 25
Amusingly, the Swedish Armed Forces argued "[the proposal cannot be realized] without introducing vulnerabilities and backdoors that can be exploited by third parties", meaning Russia, Mafia, etc)
posted by jeffburdges at 5:28 AM on February 25
(those that claim Apple doesn't profit from selling user data to advertisers or by sneakily spying on private conversations— hah)
I can put you directly in touch with people authorized to approve up to even figure payments if you have the inclination to put your money in your mouth is and provide any proof of the possibility this is happening.
But personally, I'd start with actually reading the actual article you linked.
posted by Back At It Again At Krispy Kreme at 9:10 AM on February 25
I can put you directly in touch with people authorized to approve up to even figure payments if you have the inclination to put your money in your mouth is and provide any proof of the possibility this is happening.
But personally, I'd start with actually reading the actual article you linked.
posted by Back At It Again At Krispy Kreme at 9:10 AM on February 25
if you have the inclination to put your money in your mouth
Is this some kind of threat?
posted by UN at 11:13 AM on February 25 [1 favorite]
Is this some kind of threat?
posted by UN at 11:13 AM on February 25 [1 favorite]
I think the idiom is "put your money WHERE your mouth is" -- I bet iPhone autocorrect is trying to start a fight.
posted by axiom at 12:24 PM on February 25 [2 favorites]
posted by axiom at 12:24 PM on February 25 [2 favorites]
Is this some kind of threat?
This is a general reflection inspired by this comment but not directed to it: boy, paranoia sure strikes deep.
posted by DeepSeaHaggis at 12:31 PM on February 25 [1 favorite]
This is a general reflection inspired by this comment but not directed to it: boy, paranoia sure strikes deep.
posted by DeepSeaHaggis at 12:31 PM on February 25 [1 favorite]
Greg_Ace, Signal dropped SMS fallback more than 2 years ago.
posted by ChrisR at 2:07 PM on February 25 [3 favorites]
posted by ChrisR at 2:07 PM on February 25 [3 favorites]
Law enforcement should have access to chats as long as they are following legal procedures to do so.I do not share your confidence in either the ethics of law enforcement and their ability to prevent any bad actors from getting access to the same back door they're using.
-- UN
posted by ChrisR at 2:13 PM on February 25 [2 favorites]
This is a general reflection inspired by this comment but not directed to it: boy, paranoia sure strikes deep.
Lately I push back on those kinds of comments. Anonymous posting encourages people to make tough guy comments like this, but if it's autocorrect then I'd be happy to hear from the poster.
Otherwise, some poster is telling me to gag on my money. Do I need to accept this?
posted by UN at 2:42 PM on February 25 [1 favorite]
Lately I push back on those kinds of comments. Anonymous posting encourages people to make tough guy comments like this, but if it's autocorrect then I'd be happy to hear from the poster.
Otherwise, some poster is telling me to gag on my money. Do I need to accept this?
posted by UN at 2:42 PM on February 25 [1 favorite]
I really don't think they were telling you to choke on your money. My comment *really* wasn't directed at you. It was more an outgrowth of my own experience and seeing how people are dealing with the fake-out Trumpian barrage of bullshit - which is meant to destabilize and terrorize, to cause doubt of fundamental things, to invoke paranoia and fear.
posted by DeepSeaHaggis at 3:05 PM on February 25 [1 favorite]
posted by DeepSeaHaggis at 3:05 PM on February 25 [1 favorite]
Sure, in some ways Trump and Musk have normalized a kind of aggressive speech. But they're also a product of anonymity/encryption culture. What people say online, they take into the real world.
Musk: a walking, talking internet meme.
I think the money thing it's perfectly illustrative of the problem. Here, we're anonymous, safe, behind encryption...me and the other poster will never meet each other. Anything goes. In real life? Tell a cashier to put money somewhere and see what happens.
This little side show is one thing but what about the millions of real threats and hate people receive every day from others hiding behind encryption and anonymity? I think we'd have a better, more civilized world if we didn't place the rights of dictators, nazis and criminals above public welfare and safety of individuals. Google and Apple and Meta and X are not here to protect our rights.
posted by UN at 3:56 PM on February 25 [1 favorite]
Musk: a walking, talking internet meme.
I think the money thing it's perfectly illustrative of the problem. Here, we're anonymous, safe, behind encryption...me and the other poster will never meet each other. Anything goes. In real life? Tell a cashier to put money somewhere and see what happens.
This little side show is one thing but what about the millions of real threats and hate people receive every day from others hiding behind encryption and anonymity? I think we'd have a better, more civilized world if we didn't place the rights of dictators, nazis and criminals above public welfare and safety of individuals. Google and Apple and Meta and X are not here to protect our rights.
posted by UN at 3:56 PM on February 25 [1 favorite]
Frankly, I'm a little confused, UN, by the Krispy Kreme's use of that idiom. I'm not sure what contacting people in some anonymous organization who make "[s]even figure payments" would have to do with verifying that Apple does or doesn't profit from their customers information. That said, I do agree with the general analysis above that - of the big tech companies - my inclination would be to trust Apple's handling of it more than the others - though I don't have any information either way.
However, this line in your earlier comment is troubling: Law enforcement should have access to chats as long as they are following legal procedures to do so.
That sounds like approval for pervasive and constant surveillance such that, once we've ceded our digital privacy, what argument would we have for privacy in person regardless of the venue? Like, there has to be a reason - in theory at least - to perform that request legally (caveats galore depending on your jurisdiction).
posted by DeepSeaHaggis at 4:18 PM on February 25 [3 favorites]
However, this line in your earlier comment is troubling: Law enforcement should have access to chats as long as they are following legal procedures to do so.
That sounds like approval for pervasive and constant surveillance such that, once we've ceded our digital privacy, what argument would we have for privacy in person regardless of the venue? Like, there has to be a reason - in theory at least - to perform that request legally (caveats galore depending on your jurisdiction).
posted by DeepSeaHaggis at 4:18 PM on February 25 [3 favorites]
If law enforcement worked in any way similar to what media and law enforcement itself wants you to think it works, then such a position might be reasonable. However, real world examples show again and again that law enforcement can absolutely not be trusted, are utterly corrupt, ignore rules and regulations, frame people, use whatever tools at their disposal to stalk and harass their ex-wives, or just straight up sell information to organized crime, leading to people getting tortured and murdered. Not all countries' law enforcement has all of these problems, but some of them happens in every country, even in countries you think of as very civilized and developed. All law enforcement agencies are to an extent corrupt, no exceptions. Given this, I'll keep my communication private, thank you.
posted by Joakim Ziegler at 4:52 PM on February 25 [2 favorites]
posted by Joakim Ziegler at 4:52 PM on February 25 [2 favorites]
Agreed, Joakim. Though I get the impulse behind the original suggestion.
posted by DeepSeaHaggis at 4:54 PM on February 25
posted by DeepSeaHaggis at 4:54 PM on February 25
Sure, in some ways Trump and Musk have normalized a kind of aggressive speech. But they're also a product of anonymity/encryption culture. What people say online, they take into the real world.
The absolute most cursory look at LinkedIn or Facebook would serve to disabuse you of this notion. People are perfectly happy to spew hate and harassment behind their real names all fucking day long. Including, fucking constantly, people who are in law enforcement. And you want to let them destroy everyone's privacy permanently for whatever "legal reasons" they can make up on any given day? Absolutely fuck that.
posted by adrienneleigh at 5:15 PM on February 25 [3 favorites]
The absolute most cursory look at LinkedIn or Facebook would serve to disabuse you of this notion. People are perfectly happy to spew hate and harassment behind their real names all fucking day long. Including, fucking constantly, people who are in law enforcement. And you want to let them destroy everyone's privacy permanently for whatever "legal reasons" they can make up on any given day? Absolutely fuck that.
posted by adrienneleigh at 5:15 PM on February 25 [3 favorites]
honestly I just like "put your money in your mouth" as a malaprop version of "put your money where your mouth is" and plan to use it at my earliest possible convenience
posted by DoctorFedora at 5:36 PM on February 25 [2 favorites]
posted by DoctorFedora at 5:36 PM on February 25 [2 favorites]
We Should All Have Something To Hide by Moxie addresses the comments by UN. As Moxie said elsewhere, “I think law enforcement should be difficult. And it should actually be possible to break the law.”
We cannot have semi-effective protests, effective unions, drug legalization, gay rights, abortion access, womens' rights, etc etc unless people organize them in secret, including partially normalizing them by breaking norms or laws.
We have laws etc to structure society, not to protect innocent people from harm, threats, etc. In fact police, social services, etc have no specific obligation to protect innocent people, abused children, etc, which frankly sounds like the only viable legal option.
Anecdotally, I've never personally encountered an "ugly" chat on proper e2ee messangers, like Signal or WhatsApp, because those private spaces mostly serve real life contacts. It's public spaces on-line like 4chan, mefi, reddit, twitter, facebook, linkedin, etc, or semi-public spaces without room encryption like Telegram, where people seek attention by denigrating others, doxing, etc.
Aside: KryptEY works like an Android keyboard, but encrypts using Axolotl just like Signal, so one-to-one e2ee messages over insecure or backdoored messangers. lol
posted by jeffburdges at 6:08 PM on February 25 [3 favorites]
We cannot have semi-effective protests, effective unions, drug legalization, gay rights, abortion access, womens' rights, etc etc unless people organize them in secret, including partially normalizing them by breaking norms or laws.
We have laws etc to structure society, not to protect innocent people from harm, threats, etc. In fact police, social services, etc have no specific obligation to protect innocent people, abused children, etc, which frankly sounds like the only viable legal option.
Anecdotally, I've never personally encountered an "ugly" chat on proper e2ee messangers, like Signal or WhatsApp, because those private spaces mostly serve real life contacts. It's public spaces on-line like 4chan, mefi, reddit, twitter, facebook, linkedin, etc, or semi-public spaces without room encryption like Telegram, where people seek attention by denigrating others, doxing, etc.
Aside: KryptEY works like an Android keyboard, but encrypts using Axolotl just like Signal, so one-to-one e2ee messages over insecure or backdoored messangers. lol
posted by jeffburdges at 6:08 PM on February 25 [3 favorites]
The problem with iMessage is that it falls back to sms if the recipient's phone is off, and you have no control over that, so your secret message to your affair/drug dealer/local terrorist, er political group could end up being sent in the clear. Turning sms fallback off on your phone doesn't mean that everyone else in the conversation hasi it turned off as well eirher.
For the paranoid, theres a datacenter in Utah that has enough storage to store your encrypted messages until they create quantum computers capable of decrypting them.
posted by fragmede at 10:47 PM on February 25
For the paranoid, theres a datacenter in Utah that has enough storage to store your encrypted messages until they create quantum computers capable of decrypting them.
posted by fragmede at 10:47 PM on February 25
Keybase still works well. It's the only messaging app I use, because I am a curmudgeon, a Luddite and retired, and perfectly happy to take the position that if what you want to communicate with me about is private enough to benefit from e2ee than you can either talk to me in person or use the app I prefer. Gotta say, this policy cuts down on a lot of pesky notification bells.
Works cross-platform, nice smooth multiple device support, password-free device-based login, uses an arbitrary account handle rather than a phone number. Only real restriction on account handles is that having been used and lost they can never then be re-used by anybody. This entirely kills spoofing, which I like. Mine won't be lost until Zoom eventually gets round to yeeting the whole service, because one of my multiple Keybase-authorized "devices" is a paper key that I keep in my password manager.
Tell you what, some days the self-righteousness builds up in here to levels that would power a city.
posted by flabdablet at 6:54 AM on February 26 [1 favorite]
Works cross-platform, nice smooth multiple device support, password-free device-based login, uses an arbitrary account handle rather than a phone number. Only real restriction on account handles is that having been used and lost they can never then be re-used by anybody. This entirely kills spoofing, which I like. Mine won't be lost until Zoom eventually gets round to yeeting the whole service, because one of my multiple Keybase-authorized "devices" is a paper key that I keep in my password manager.
Tell you what, some days the self-righteousness builds up in here to levels that would power a city.
posted by flabdablet at 6:54 AM on February 26 [1 favorite]
theres a datacenter in Utah that has enough storage to store your encrypted messages until they create quantum computers capable of decrypting them.
Not expecting that capability to exist until after I'm dead. On the fence about whether or not it will arrive before industrial civilization collapses and cuts the legs out from under all the infrastructure required to deploy and maintain it.
posted by flabdablet at 6:59 AM on February 26 [1 favorite]
Not expecting that capability to exist until after I'm dead. On the fence about whether or not it will arrive before industrial civilization collapses and cuts the legs out from under all the infrastructure required to deploy and maintain it.
posted by flabdablet at 6:59 AM on February 26 [1 favorite]
I don't know where most of you are from (yay anonymity) so it's impossible to have a proper discussion. Your police may not be my police. Are you in Moscow, or Milwaukee? Your reasoning may work where you are — but it certainly is not universal.
Where I am in Germany — and please I know it's not perfect so whataboutism will not be educational — someone using their real name on LinkedIn or Facebook can indeed face legal consequences for hate speech and threats. If you live in a "free speech" country, you have other problems, sure. If it's legal to call someone a "pedo" or whatever, ok, you can defend that. But this isn't where I am and it's seriously not a culture I would want to see adopted here...No matter how many times Vance comes to Munich to lecture people on freedom of speech for American corporations and billionaires.
posted by UN at 7:55 AM on February 26
Where I am in Germany — and please I know it's not perfect so whataboutism will not be educational — someone using their real name on LinkedIn or Facebook can indeed face legal consequences for hate speech and threats. If you live in a "free speech" country, you have other problems, sure. If it's legal to call someone a "pedo" or whatever, ok, you can defend that. But this isn't where I am and it's seriously not a culture I would want to see adopted here...No matter how many times Vance comes to Munich to lecture people on freedom of speech for American corporations and billionaires.
posted by UN at 7:55 AM on February 26
honestly I just like "put your money in your mouth" as a malaprop version of "put your money where your mouth is" and plan to use it at my earliest possible convenience
Link to the TikTok videos or it didn't happen!
posted by UN at 8:02 AM on February 26
Link to the TikTok videos or it didn't happen!
posted by UN at 8:02 AM on February 26
Where I am in Germany — and please I know it's not perfect so whataboutism will not be educational — someone using their real name on LinkedIn or Facebook can indeed face legal consequences for hate speech and threats.
Yes, and "hate speech" in Germany is so broadly conceived that criticizing certain countries for their genocidal behavior can get you arrested, so why on earth would anyone want privacy of communications there?
posted by Joakim Ziegler at 11:58 AM on February 26 [2 favorites]
Yes, and "hate speech" in Germany is so broadly conceived that criticizing certain countries for their genocidal behavior can get you arrested, so why on earth would anyone want privacy of communications there?
posted by Joakim Ziegler at 11:58 AM on February 26 [2 favorites]
"hate speech"
Yes, activists making genocidal chants against Jews will get arrested and/or fined, and they were. Likewise, so have been people who do the same against Muslims. You may consider this too broad for "hate speech" but I am against protecting genocidal remarks personally.
posted by UN at 12:22 PM on February 26
Yes, activists making genocidal chants against Jews will get arrested and/or fined, and they were. Likewise, so have been people who do the same against Muslims. You may consider this too broad for "hate speech" but I am against protecting genocidal remarks personally.
posted by UN at 12:22 PM on February 26
Yes, activists making genocidal chants against Jews will get arrested and/or fined, and they were. Likewise, so have been people who do the same against Muslims. You may consider this too broad for "hate speech" but I am against protecting genocidal remarks personally.
Police intervened, citing an Arabic music ban, and demanded that it be stopped.
An announcement from a police vehicle then stated that chanting in Arabic or giving speeches has been prohibited, and due to the violation, the demonstration must end now. Authorities instructed the protesters to leave the square.
Clearly.
posted by Joakim Ziegler at 12:47 PM on February 26 [2 favorites]
Police intervened, citing an Arabic music ban, and demanded that it be stopped.
An announcement from a police vehicle then stated that chanting in Arabic or giving speeches has been prohibited, and due to the violation, the demonstration must end now. Authorities instructed the protesters to leave the square.
Clearly.
posted by Joakim Ziegler at 12:47 PM on February 26 [2 favorites]
Insults communicated in private are an extremely poor justification for making social progress impossible.
Germany only legalized cannabis in 2024. This would not have happened unless people used cannabis, which really requires e2ee messaging given modern police technologies.
"Le manifeste des 343 salopes" and "Wir haben abgetrieben!" in 1971 would be impossible unless people had communicated about abortions and had abortions while abortions were illegal. Ireland only legalized abortion in 2018, but abortion remains very illegal in Northern Ireland. Abortion remains illegal in Poland, Malta, and all-ish EU microstates, so women must use e2ee encryption to discuss obtaining abortions elsewhere in Europe.
Hungary bans "the portrayal or promotion of homosexuality", same-sex marriage, and adoption by same-sex couples, so Hungarian homosexuals should seriously consider e2ee messangers.
Also, how can anyone think that because their nation afords some social sanity now that everything remains hunky dory?
Antifa activists should use e2ee messangers in Germany [1, 2, 3, 4, 5]. In fact, AfD could easily keep growing stronger for global economic reasons. AfD does not afaik reject "remigration" like Le Pen's RN does. We're decades away but remigration could eventually become German policy.
All-ish natiopns with HDI above say 0.5, including Germany, China, India, etc actively commit genocide against all tropical natons, in the form of CO2 emissions. Yet, Germany now charges climate activists with ‘forming a criminal organisation’, so clearly e2ee messangers matter right now.
Around speech restrictions..
All nations have some restrictions upon speech, including restrictions upon "incitement", but an ocean between public and private speech here: Incitement would typically conver public speech. In particular, Section 130 of the German Criminal Code only outlaws holocaust denial that's public or directed at minors, so you'll never see convictions when using PTSN, email, or e2ee messangers anyways, becuase the defendent would not be speaking publically.
Also, remarks on two derails..
- Trump has violated even US speech laws through incitement, not sure about Vance. He will not be prosecuted because the US is a plutocracy, not because he has not broken the law.
- Joakim's first point stands: Germany suppresses speech seeking recognition of Israel's genocide in Gaza. The fact that Israel is committing genocide does not excuse or counter the fact that the Palestinian Authority and Hamas wish to commit genocide against Israelis (codefied by the PA's first two charters). Genocidewatch handles this detail correctly btw.
posted by jeffburdges at 4:26 PM on February 26 [1 favorite]
Germany only legalized cannabis in 2024. This would not have happened unless people used cannabis, which really requires e2ee messaging given modern police technologies.
"Le manifeste des 343 salopes" and "Wir haben abgetrieben!" in 1971 would be impossible unless people had communicated about abortions and had abortions while abortions were illegal. Ireland only legalized abortion in 2018, but abortion remains very illegal in Northern Ireland. Abortion remains illegal in Poland, Malta, and all-ish EU microstates, so women must use e2ee encryption to discuss obtaining abortions elsewhere in Europe.
Hungary bans "the portrayal or promotion of homosexuality", same-sex marriage, and adoption by same-sex couples, so Hungarian homosexuals should seriously consider e2ee messangers.
Also, how can anyone think that because their nation afords some social sanity now that everything remains hunky dory?
Antifa activists should use e2ee messangers in Germany [1, 2, 3, 4, 5]. In fact, AfD could easily keep growing stronger for global economic reasons. AfD does not afaik reject "remigration" like Le Pen's RN does. We're decades away but remigration could eventually become German policy.
All-ish natiopns with HDI above say 0.5, including Germany, China, India, etc actively commit genocide against all tropical natons, in the form of CO2 emissions. Yet, Germany now charges climate activists with ‘forming a criminal organisation’, so clearly e2ee messangers matter right now.
Around speech restrictions..
All nations have some restrictions upon speech, including restrictions upon "incitement", but an ocean between public and private speech here: Incitement would typically conver public speech. In particular, Section 130 of the German Criminal Code only outlaws holocaust denial that's public or directed at minors, so you'll never see convictions when using PTSN, email, or e2ee messangers anyways, becuase the defendent would not be speaking publically.
Also, remarks on two derails..
- Trump has violated even US speech laws through incitement, not sure about Vance. He will not be prosecuted because the US is a plutocracy, not because he has not broken the law.
- Joakim's first point stands: Germany suppresses speech seeking recognition of Israel's genocide in Gaza. The fact that Israel is committing genocide does not excuse or counter the fact that the Palestinian Authority and Hamas wish to commit genocide against Israelis (codefied by the PA's first two charters). Genocidewatch handles this detail correctly btw.
posted by jeffburdges at 4:26 PM on February 26 [1 favorite]
Joakim's first point stands
Joakim reposted an item from Erdogan's news manipulation agency. It only exists to write clickbait articles which cement his right-wing authoritarian agenda. And attacking Germany has been on his agenda for years (decades?). Like I said, I anticipated some whataboutism. Someone quickly needs some filler content to make a point and AA is one resource for that, with their nicely SEO'd articles. It's lazy but it is effective.
This is why encryption culture, as propagated by US corporations and their supporters, isn't about protecting people or their privacy. They don't care.
The place that is actually dangerous for freedom? Türkiye under Erdogan. They arrest and intimidate journalists on a massive scale — unless one is a writer for an outlet pushing for continued authoritarian rule by Erdogan, like the kind that Joakim posted above.
So, I don't know, jeffburdges, I appreciate your post but if supporting Apple here means taking advantage of manipulative media outlets from countries with functionally no press freedom...then, what's the point?
posted by UN at 10:11 PM on February 26
Joakim reposted an item from Erdogan's news manipulation agency. It only exists to write clickbait articles which cement his right-wing authoritarian agenda. And attacking Germany has been on his agenda for years (decades?). Like I said, I anticipated some whataboutism. Someone quickly needs some filler content to make a point and AA is one resource for that, with their nicely SEO'd articles. It's lazy but it is effective.
This is why encryption culture, as propagated by US corporations and their supporters, isn't about protecting people or their privacy. They don't care.
The place that is actually dangerous for freedom? Türkiye under Erdogan. They arrest and intimidate journalists on a massive scale — unless one is a writer for an outlet pushing for continued authoritarian rule by Erdogan, like the kind that Joakim posted above.
So, I don't know, jeffburdges, I appreciate your post but if supporting Apple here means taking advantage of manipulative media outlets from countries with functionally no press freedom...then, what's the point?
posted by UN at 10:11 PM on February 26
All-ish natiopns with HDI above say 0.5, including Germany, China, India, etc actively commit genocide against all tropical natons, in the form of CO2 emissions. Yet, Germany now charges climate activists with ‘forming a criminal organisation’, so clearly e2ee messangers matter right now.
The German organization you're referring to has already recognized that their behavior was placing people's lives in danger and has long since declared that they will no longer pursue their protests — which were illegal. What do you call an organization calling for criminal activities? A criminal organization. Of course they were against people blocking dozens of ambulances and fire trucks from getting to their destination. But, according to crypto ideology, these people should be able to secretly continue putting other people's lives in danger with no accountability to the public with the help of these tools. The fact that their actions cause more harm than good for climate change activism is a different topic for a different thread, but worth mentioning.
posted by UN at 1:13 AM on February 27
The German organization you're referring to has already recognized that their behavior was placing people's lives in danger and has long since declared that they will no longer pursue their protests — which were illegal. What do you call an organization calling for criminal activities? A criminal organization. Of course they were against people blocking dozens of ambulances and fire trucks from getting to their destination. But, according to crypto ideology, these people should be able to secretly continue putting other people's lives in danger with no accountability to the public with the help of these tools. The fact that their actions cause more harm than good for climate change activism is a different topic for a different thread, but worth mentioning.
posted by UN at 1:13 AM on February 27
It'll take much worse tha road blocks before high HDI nations change their behavior, so the road blocks by Letzte Generation were hopefully just the beginning. Inevitably governments will sometimes be so horrifically wrong that some crime always remains necessary.
There is a reasonable expectation of privacy when saving a document or having a conversation, so either we enforce this privacy using cryptography or else the expectation gets violated, and then people go elsewhere.
It's definitely true corporations do what benefits them, not what's right, but they're constrained by what their employees propose (often good), what other companies do, and by legacy technologies (usually bad).
Apple and Google provide RCP messangers for example, which suck because of the downgrade attacks, even to unencrypted SMS, so that's legacy technologies screwing everything up. Apple clearly lags Wire, Signal, WhatsApp, etc here, probably they believe the RCS standard, shared with Google, benefits them more than stronger e2ee assurances, in part because stronger e2ee messangers lack both interoperability and Apple & Google's market share. Apple & Google are definitely the bad guys here, but because of too little encryption, not too much.
Apple tried perceptual hashing first in this cases, so that's very evil but also extremely hard if not impossible. I'd expect some managers & engineers were entertained by fancy proposals for perceptual hashing, which Apple thought simplified handling regulators, but then when perceptual hashing failed badly, those people changed their minds or became discredited. Apple tried being the bad guy here.
Apple instead rolled out ADP without perceptual hashing as the simplest scheme that silences cloud storage critics, pleases their employees, and pleases their buisness clients, possibly including health care providers. ADP might've bad downgrade attacks, NSA backdoors, etc, not sure yet.
Apple Private Relay has a 2 hop architecture that's better than your average VPN, but worse than the 3 hops in Tor, but much faster. It's arguably worse than a VPN paid for in cash like ExpressVPN, NordVPN, CyberGhost, or PureVPN, or a VPN paid for in Monero or Zcash. In theory, the VPN providers plus Tor would develop some anonymously paid fast enough 3 hop standard similar to Private Relay, but that's extremely expensive for smalltime players. Interestingly, internet services often who block Tor exist and VPN often unblock Private Relay exist, just because Apple users are big spender. That's maybe good if those services then begin thinking about Tor & VPN users as possible customers or product, instead of just as trolls or whatever. Apple seems overall benefitial here, if only through side effects, and if only becuase they needed to outdo the VPNs somehow.
All together, Apple really tries being the bad guy, either becuase that serves their interests as vertical monopolist, or else becuase that's desired by other malicious actors like law enforcement, but the technical constraints sometimes push them towards doing good, with ADP being one example. Apple being close sources remains horrible of course.
Google winds up much worse for data security and privacy, since they're an surveillance advertising company. Android being open source makes graphene OS possible though, an essential alternative to iOS, and good inspiration for Lineage OS. Integration winds up necessary for good systems security, but requires a bigger team than available for independent open source efforts.
Around this..
Journalists publish so by then encryption stops being relevant, so alone that's slightly off-topic here. Journalists should always employ e2ee when talking to sources of course, but realistically technologies only help so much there. Anonymity & metadata wind up being kinda intractible formally speaking, unlike cryptography, and journalist often botch source protection themselves, so asylum elsewhere remains the ultimate defense. We likely need services like wikileaks that work with journalists but restrict journalists access to underlying documents, so that watermarks and stylometry cannot identify the source.
posted by jeffburdges at 4:35 AM on February 27 [1 favorite]
There is a reasonable expectation of privacy when saving a document or having a conversation, so either we enforce this privacy using cryptography or else the expectation gets violated, and then people go elsewhere.
It's definitely true corporations do what benefits them, not what's right, but they're constrained by what their employees propose (often good), what other companies do, and by legacy technologies (usually bad).
Apple and Google provide RCP messangers for example, which suck because of the downgrade attacks, even to unencrypted SMS, so that's legacy technologies screwing everything up. Apple clearly lags Wire, Signal, WhatsApp, etc here, probably they believe the RCS standard, shared with Google, benefits them more than stronger e2ee assurances, in part because stronger e2ee messangers lack both interoperability and Apple & Google's market share. Apple & Google are definitely the bad guys here, but because of too little encryption, not too much.
Apple tried perceptual hashing first in this cases, so that's very evil but also extremely hard if not impossible. I'd expect some managers & engineers were entertained by fancy proposals for perceptual hashing, which Apple thought simplified handling regulators, but then when perceptual hashing failed badly, those people changed their minds or became discredited. Apple tried being the bad guy here.
Apple instead rolled out ADP without perceptual hashing as the simplest scheme that silences cloud storage critics, pleases their employees, and pleases their buisness clients, possibly including health care providers. ADP might've bad downgrade attacks, NSA backdoors, etc, not sure yet.
Apple Private Relay has a 2 hop architecture that's better than your average VPN, but worse than the 3 hops in Tor, but much faster. It's arguably worse than a VPN paid for in cash like ExpressVPN, NordVPN, CyberGhost, or PureVPN, or a VPN paid for in Monero or Zcash. In theory, the VPN providers plus Tor would develop some anonymously paid fast enough 3 hop standard similar to Private Relay, but that's extremely expensive for smalltime players. Interestingly, internet services often who block Tor exist and VPN often unblock Private Relay exist, just because Apple users are big spender. That's maybe good if those services then begin thinking about Tor & VPN users as possible customers or product, instead of just as trolls or whatever. Apple seems overall benefitial here, if only through side effects, and if only becuase they needed to outdo the VPNs somehow.
All together, Apple really tries being the bad guy, either becuase that serves their interests as vertical monopolist, or else becuase that's desired by other malicious actors like law enforcement, but the technical constraints sometimes push them towards doing good, with ADP being one example. Apple being close sources remains horrible of course.
Google winds up much worse for data security and privacy, since they're an surveillance advertising company. Android being open source makes graphene OS possible though, an essential alternative to iOS, and good inspiration for Lineage OS. Integration winds up necessary for good systems security, but requires a bigger team than available for independent open source efforts.
Around this..
Journalists publish so by then encryption stops being relevant, so alone that's slightly off-topic here. Journalists should always employ e2ee when talking to sources of course, but realistically technologies only help so much there. Anonymity & metadata wind up being kinda intractible formally speaking, unlike cryptography, and journalist often botch source protection themselves, so asylum elsewhere remains the ultimate defense. We likely need services like wikileaks that work with journalists but restrict journalists access to underlying documents, so that watermarks and stylometry cannot identify the source.
posted by jeffburdges at 4:35 AM on February 27 [1 favorite]
It'll take much worse tha road blocks before high HDI nations change their behavior, so the road blocks by Letzte Generation were hopefully just the beginning. Inevitably governments will sometimes be so horrifically wrong that some crime always remains necessary.
Your link goes to a man who publicly expressed "astonishment and joy" in the kidnapping, murder and rape of civilians. What a techno dystopian future. But I get it. Everyone needs encryption, of course, when killing and destruction is encouraged. One needs to hide everything from their neighbors because who knows if you're next. Sigh.
Of course it's a privileged white guy with a comfortable university life calling for this.
posted by UN at 5:22 AM on February 27
Your link goes to a man who publicly expressed "astonishment and joy" in the kidnapping, murder and rape of civilians. What a techno dystopian future. But I get it. Everyone needs encryption, of course, when killing and destruction is encouraged. One needs to hide everything from their neighbors because who knows if you're next. Sigh.
Of course it's a privileged white guy with a comfortable university life calling for this.
posted by UN at 5:22 AM on February 27
arguably worse than a VPN paid for in cash like ExpressVPN, NordVPN, CyberGhost, or PureVPN, or a VPN paid for in Monero or Zcash
If I needed a VPN for privacy reasons, I would go with Mullvad and send them physical banknotes accompanied by the randomly generated account number that's the only thing they use for both account identification and authentication.
Mullvad doesn't log anything. All they know is how many months of service remain available for each anonymous account ID they've ever generated. Send them any form of money accompanied by some existing account ID, and that account's number of available service months gets bumped by one per €5 when the payment hits their bank account.
That's the entire business model. They don't record or maintain any business relationship with their actual customers, only with the account numbers that they themselves hand out freely and anonymously on initial account creation.
And of course they oppose intercepting encrypted communication.
posted by flabdablet at 5:26 AM on February 27 [2 favorites]
If I needed a VPN for privacy reasons, I would go with Mullvad and send them physical banknotes accompanied by the randomly generated account number that's the only thing they use for both account identification and authentication.
Mullvad doesn't log anything. All they know is how many months of service remain available for each anonymous account ID they've ever generated. Send them any form of money accompanied by some existing account ID, and that account's number of available service months gets bumped by one per €5 when the payment hits their bank account.
That's the entire business model. They don't record or maintain any business relationship with their actual customers, only with the account numbers that they themselves hand out freely and anonymously on initial account creation.
And of course they oppose intercepting encrypted communication.
posted by flabdablet at 5:26 AM on February 27 [2 favorites]
Joakim reposted an item from Erdogan's news manipulation agency. It only exists to write clickbait articles which cement his right-wing authoritarian agenda. And attacking Germany has been on his agenda for years (decades?). Like I said, I anticipated some whataboutism.
The news I linked to has been widely reported in all sorts of news media. Here's The Independent. You seem to be unwilling to engage with the substance of the banning of speech in Germany, though, so you instead attack the source, which was merely the first I found when looking for a news item I'd read previously.
posted by Joakim Ziegler at 12:47 PM on February 27 [1 favorite]
The news I linked to has been widely reported in all sorts of news media. Here's The Independent. You seem to be unwilling to engage with the substance of the banning of speech in Germany, though, so you instead attack the source, which was merely the first I found when looking for a news item I'd read previously.
posted by Joakim Ziegler at 12:47 PM on February 27 [1 favorite]
Germany has also banned red triangles as a general symbol (against the protest of political prisoners of Nazi camps in WWII), German schools have banned Palestinian flags and keffiyehs, and many Jewish people from explicitly Jewish pro-Palestinian organizations have been arrested for protesting.
posted by Joakim Ziegler at 12:49 PM on February 27 [1 favorite]
posted by Joakim Ziegler at 12:49 PM on February 27 [1 favorite]
The German organization you're referring to has already recognized that their behavior was placing people's lives in danger and has long since declared that they will no longer pursue their protests — which were illegal. What do you call an organization calling for criminal activities? A criminal organization.
The mind boggles at a German, of all people (and I'm half German myself) being unable to comprehend that breaking unjust laws to achieve a moral good is actually virtuous. You might want to ask yourself who was criminal and who was upholding the law in certain periods of recent German history.
posted by Joakim Ziegler at 12:53 PM on February 27 [2 favorites]
The mind boggles at a German, of all people (and I'm half German myself) being unable to comprehend that breaking unjust laws to achieve a moral good is actually virtuous. You might want to ask yourself who was criminal and who was upholding the law in certain periods of recent German history.
posted by Joakim Ziegler at 12:53 PM on February 27 [2 favorites]
If you walk around punching people in the face while shouting "Climate!", is that justice?
Is blocking an ambulance with a patient in need of urgent medical assistance justice? Is it a courageous act if you also shout "Climate!" while doing it?
You're deflecting from points I made about encryption and anonymity protected by encryption culture — but I didn't bring these other unrelated topics into the conversation. Whataboutism is a scourge designed to protect ideological extremism. Anything can and will be justified, the criticism raised always deflected.
posted by UN at 1:11 AM on February 28
Is blocking an ambulance with a patient in need of urgent medical assistance justice? Is it a courageous act if you also shout "Climate!" while doing it?
You're deflecting from points I made about encryption and anonymity protected by encryption culture — but I didn't bring these other unrelated topics into the conversation. Whataboutism is a scourge designed to protect ideological extremism. Anything can and will be justified, the criticism raised always deflected.
posted by UN at 1:11 AM on February 28
The mind boggles at a German, of all people
I exposed an aspect of my life on the internets so naturally you jump on it to build out an argument. But really you don't know anything about me, my situation, my ancestry. You don't actually know anything about me.
If I had said I'm from France or Japan or the United States, I'm sure you could cut me down too. There's always something.
posted by UN at 1:22 AM on February 28
I exposed an aspect of my life on the internets so naturally you jump on it to build out an argument. But really you don't know anything about me, my situation, my ancestry. You don't actually know anything about me.
If I had said I'm from France or Japan or the United States, I'm sure you could cut me down too. There's always something.
posted by UN at 1:22 AM on February 28
Anonymity is a fundamental human right, regardless.
posted by adrienneleigh at 2:17 AM on February 28
posted by adrienneleigh at 2:17 AM on February 28
Anonymity isn't a fundamental human right. Anonymity is not the same as privacy. Which legal framework are you referring to? If you're referring to UDHR Article 12, privacy is explicitly named — anonymity isn't used a single time in the declaration. The same article explicitly states that everyone has the right to defend themselves legally against attacks on their reputation. This seriously conflicts with what people are advocating here. How do you defend against an anonymous attack on one's reputation, when that person is using technology to hide their identity from the law?
posted by UN at 2:51 AM on February 28
posted by UN at 2:51 AM on February 28
I'm not talking about a legal framework; I'm talking about fundmental human rights. You've made some kind of fetish of the law.
posted by adrienneleigh at 3:05 AM on February 28
posted by adrienneleigh at 3:05 AM on February 28
Law is fetish but one man's opinion is the word of god.
It is no surprise that the US is ruled by a technofascist. Right wing authoritarianism has fully merged with Marxist ideology. When Musk and Weidel declared Nazis to have been Communist, I did not immediately recognize what this meant. Putin built a cathedral, the foundation made of Wehrmacht tanks, melted down. A perfect symbol for this new era. The Hammer, the Sickle, the Hakenkreuz.
The nuisance of law. Who cares then what the UK forces Apple to do? It's a fetish, a law.
posted by UN at 4:49 AM on February 28
It is no surprise that the US is ruled by a technofascist. Right wing authoritarianism has fully merged with Marxist ideology. When Musk and Weidel declared Nazis to have been Communist, I did not immediately recognize what this meant. Putin built a cathedral, the foundation made of Wehrmacht tanks, melted down. A perfect symbol for this new era. The Hammer, the Sickle, the Hakenkreuz.
The nuisance of law. Who cares then what the UK forces Apple to do? It's a fetish, a law.
posted by UN at 4:49 AM on February 28
Is it really your position that humans don't have fundamental rights until and unless they are granted them by some governmental body? Because that is, in fact, making a fetish of the law. As an anarchist, my position is that humans have rights because we are human, not because some lawmakers grudgingly admit in writing that we do.
Also if anonymity isn't a human right, you should provide me with your full name and address because you've arguably just defamed me.
posted by adrienneleigh at 10:41 AM on February 28 [1 favorite]
Also if anonymity isn't a human right, you should provide me with your full name and address because you've arguably just defamed me.
posted by adrienneleigh at 10:41 AM on February 28 [1 favorite]
"The requirement to show your E-ID on platform services makes it child's play for authoritarians to persecute opposition members and critical journalists!"
posted by jeffburdges at 6:38 AM on March 3 [1 favorite]
posted by jeffburdges at 6:38 AM on March 3 [1 favorite]
« Older Do you name your stuff? It's your weekly free... | Built for sound Newer »
This thread has been archived and is closed to new comments
posted by jeffburdges at 1:13 PM on February 24 [1 favorite]