Signal: Will leave the EU market rather than undermine our privacy guarantees
twitter.com
twitter.com
----
According to the latest draft regulation dated 28 May (Council document 9093/24), which is presented as “upload moderation”, users of apps and services with chat functions are to be asked whether they accept the indiscriminate and error-prone scanning and possibly reporting of their privately shared images, photos and videos. Previously unknown images and videos are also to be scrutinised using “artificial intelligence” technology. If a user refuses the scanning, they would be blocked from sending or receiving images, photos, videos and links (Article 10). End-to-end encrypted services such as Whatsapp or Signal would have to implement the automated searches “prior to transmission” of a message (so-called client-side scanning, Article 10a). The initially proposed scanning of text messages for indications of grooming, which is hardly being used to date, is to be scrapped, as is the scanning of voice communication, which has never been done before. Probably as a concession to France, the chats of employees of security authorities and the military are also to be exempted from chat control.
----
Strange times we live in. Entertaining, but strange.
[1] - https://www.patrick-breyer.de/en/majority-for-chat-control-p...
Half of the reason Microsoft is pushing "AI PCs" with special hardware is so they can push their spying to on-device and reduce all the extra costs the data processing they're imagining for things like automatic-screenshot-analysis-every-x-seconds will need.
And they're pretty much experts on spying on users. They've been collecting so much data for so long that apparently they've found a way to utilize what they collect in a way that makes the costs balance out in the end. Whether thats with government access, preferential antitrust treatment, or some actual financial method that directly affects the bottom line, I don't know. Somehow it's worthwhile for them. BUT -- when even Microsoft is looking for more efficient ways to spy on people, and forcing new hardware to support that effort, you know the data collection and analysis technique is definitely not ready to be made a legal mandate.
It doesn't make sense at all for some EU decision makers to decide it's acceptable for their citizens to bear the cost of so much data processing.
....wait, how much do large players in AI contribute to these politicians campaigns? Or if not them, who is really pushing this? It seems like someone should really try following the money on this one.
We don’t own our devices anymore and we now have very limited control of what is executed or not so there is nothing stopping developers to run those legal spywares on the device since our only option if we don’t like what an app does is to not use it.
The problem is not going away, we in tech are partly responsible and we should promote good ways to deal with it. If we don't then a solution will be found anyway, it'll just be a bad one.
We have linux phones these days, caly, and grapheneos. There really isn't reason to give up on general computing. (Ignoring the propriety baseband blobs.)
Sadly, nothing else comes even close to Apple in terms of security and privacy, especially for someone who is not an infosec specialist and doesn't have time to read CVEs all day.
The slope is so slippery that it's ot worth the risk, imo. It paves the way to reduce general computing even further, which is already quite restricted on apple devices to begin with.
Even for someone that is not an infosec specialist, they should be using something like Graphene for phones and something like Qubes for their OS.
Apple isn't great at all honestly, at least in terms of MacOS security - they mostly benefit from not being worth the time to target.
It's just a matter of lesser evil in my humble opinion.
At least on a mass scale, if we worry about back doors.
This SaaS fad is the underlying technical enabler of the spying and need to go away.
I guess Google is the main culprit by making P2P coms hard.
Asking faceless corps to open their users' mailboxes willy nilly is way easier then asking the voters to.
I want to see the riots when EU cell phone consumers have to pay for text messages again.
Some men just want to watch the world burn...
Edit: I am *obviously* not talking about surcharges for roaming but cost in plans, which I think is the point of the OP when he asks who pays for texts. Pricing is not regulated and has nothing to do with the EU.
> €0.022 per minute of voice calls made
> €0.004 per text message
> €2 per GB of data (cap in 2022, decreasing over time to €1 / GB, which will be the maximum surcharge from 2027 onwards) https://www.google.com/amp/s/europa.eu/youreurope/citizens/c...
They are free to say texts are free (included in plan), or texts are charged at 10 euros each, whatever.
The EU only limits surcharges when roaming to other EU countries.
Jeez, guys.
Edit:
I am not backing away from anything, I was rephrasing to sustain your strange cross-examination. You guys are being unecessarily aggressive and argumentative over a simple point.
"Please respond to the strongest plausible interpretation of what someone says, not a weaker one that's easier to criticize. Assume good faith."
"don't cross-examine."
It's Sunday, guys. Do something positive with your time. Bye.
"I don't think the EU says anything about how much texts should cost."
Into a weaker form of "The EU only limits surcharges when roaming to other EU countries.". This was my only comment because your first position is factually incorrect, there are situations in which the EU defines how much texts can cost.
edit: not sure where you see the aggressiveness
Occasional war here and there not directly involving any of the member states is incomparably better than what came before.
Thats a LOT of compute.
In fact, most of the protests seem to neatly fall into the "police violence" (usually against minorities) and "austerity" buckets.
But the Internet is largely a magic box and at this point the common understanding seems to be that it is both private and also under massive corporate and state surveillance at the same time. And that's not even mostly wrong.
Ban all “non-intelligible” content?
Who can stop me from hiding information in very normal looking sentences?
If you want privacy, there will always be a way.
You can just send anyone you want an encrypted e-mail or message, but Signal can't facilitate that without the required provisions set out in those laws. If these dumb laws get enacted, Signal cannot get away with just pretending you are sending gibberish whilst providing true end-to-end encryption without any client-side scanning or whatever to you, but you are well within your rights do so yourself on top of Signal (if that's even possible); they just can't provide an automated means to do that for you.
What I'm wondering is whether two separate applications can be set up to communicate automatically, with one handling messaging and the other being responsible for encrypting and decrypting the data.
What would be against the law in that case? The messaging app? The encryption app? Or the interaction you are doing in that moment?
That might be the next step. Banning encryption. We live in a strange world right now.
What some law-and-order types (globally) want, is the means to scan, peek, or otherwise access private communication, especially if that communication is provided by a service used by millions. You can encrypt all you like, but if you use WhatsApp or Signal, laws like these force those services to create a way to eavesdrop. How is probably not defined in the law. Client-side scanning before encryption, having those services act as men-in-the-middle for each conversation; this is all fine, and can use encryption as usual. As long as certain agencies get to have a peek somewhere between those strongly encrypted tunnels.
Of course these laws are dumb, but that doesn't mean they can't be (mis)used to get the desired effect.
Does Android facilitates IPC and services?
You can already install a mail client with PGP-support. Will K-9 Mail get in to trouble if a million users in the EU started privately exchanging keys and using GPG with K-9 Mail? Who knows. These laws are not about such practical details. This is about unlocking massive amounts of signal intelligence to do… who knows what, and those large communication platforms are juicy targets. All it needs is a law to coerce them to cooperate.
Don't expect reasonable arguments from the proponents of such laws, and don't expect to be able to avoid them for millions of users with clever tricks; you'll still fall foul of the spirit of the law, if not the letter.
Actually police and various agencies do, because when most people aren't encrypting, the few that do are suddenly interesting. Some of them will turn out to be organized crime, but some of them are just adults who want to communicate privately.
I understand Signal is handicapped now, but I couldn’t care less about Signal. I only care about being able to communicate in private. Why don’t we implement this stuff at a lower layer?
Surely the guys on top must see this is an endless game that they will never win? It’s not an arm’s race, it’s fundamentally impossible.
This is about making it hard (or impossible) for some perceived group of miscreants to communicate privately. People sharing CSAM (however you define that) or dealing drugs, and stuff like that. Anyone can encrypt their communication, but most people don't do this consciously; the masses just use WhatsApp and Signal and what have you.
You and your special keyboard are not of interest, and unless you start selling these along with a service to route the encrypted messages to thousands of users, you are not the target of this legislation. Take away Signal and WhatsApp and sending an end-to-end encrypted message to your drug dealer without exchanging keys and agreeing on a protocol suddenly isn't as easy as just opening an app. That's the point of this law.
It's a dumb law, but you won't make it go away by playing silly semantic games.
They may be coming down the pipe, after the soft version gets people macerated.
> at which point you won't be living in a democracy
But you will be hearing from talking heads that you are, and Russia and North Korea are the real dictatorships.
And maybe they will be right, because what is democracy? The word has different meanings to different people, and it won't be difficult to shape the discussion about what our liberal democracy is all about. Maybe it's about accepting who has power now and about protecting the vulnerable. We have seen a bit of this stance and real capabilities in recent years.
Point is that dangerous people will use specialty devices/services and being legal is certainly not one of the requirements.
How can you maintain such a position? At some point you’ll have to explain your reasons for draconian measures like this.
That’s why I’m spamming people with “it won’t work” because so many seem fooled by this. You will catch exactly zero people with this. The only people you’ll catch will be the ones that you would have caught anyway, because of their nonchalance.
I don’t know anything about law but I know tech.
Why a law is enacted is more complex than just the here and now. Some of these law-and-order types dream of the day they can order Apple or Samsung to completely lock down their smartphones and forbid any user controlled cryptography. Some just want to be able to feel that they are doing everything in their power to prevent children from being harmed, even if the measures only cover naive users. Some just want people to know that they are being watched, and have these laws act as deterrent.
And as a bonus: some parents really like the idea that none of their children or any of their mates are sharing (their own) underage nudes and that this is enforced automatically.
The law will likely work for some of these points, to some extent. It's still a bad law, but the people pushing it aren't idiots; just dangerous.
This world confused me sometimes.
Or ... they develop their own darknet webrtc based chat lol, like its silly to enforce this on the general populace when its so obviously circumvented by the people looking to do scary shit.
“The semester begins in three more weeks. We've obtained 19 confirmations for studies in the faculty of law, the faculty of urban planning, the faculty of fine arts and the faculty of engineering.” — Mohamed Atta
“Two sticks, a dash and a cake with a stick down. What is it?”[2] — Mohamed Atta
“The first semester commences in three weeks. Two high schools and two universities. ... This summer will surely be hot ...19 certificates for private education and four exams. Regards to the professor. Goodbye.”[2] — Abu Abdul Rahman
Even in China with extreme surveillance and censorship in place, Chinese people have been quite creative in their ways of circumventing censorship. An example approach is cutting and pasting official political videos together in a way that changes their meaning ever so slightly. Automatic censorship algorithms are fooled, and human analysis and censorship are necessary and very expensive to carry out. Other examples are playing with the sounds of words, or using memes or rapidly-changing euphemisms.[3] It's too difficult to automatically censor stuff where people have taken a normal word such as "chair" and send each other images of chairs as a sign of protest. An image of a chair and a birthday cake with a number of candles could indicate a date of protest. Or a chair in a picture with a number of ducks in the background, or a number of chairs stacked on top of each other. And if censors start blocking all chairs, everyone just shifts to buses, or pieces of paper, or bananas, or whatever.
[1] https://community.apan.org/cfs-file/__key/docpreview-s/00-00...
[2] https://www.nytimes.com/2004/12/20/business/technology/on-th...
[3] https://en.wikipedia.org/wiki/2022_COVID-19_protests_in_Chin...
If this sort of surveillance stuff gets accepted, in time, you're gonna get noticed, put into database, and maybe called for questioning. Why are you using encryption, people that have nothing to hide do not use it.
Seems to be targeting platforms. Will it be illegal to send encrypted texts, what is keeping anyone from using crypto on top of existing messaging?
While I do not want to dive into any details on adverse effects of such stupidities, the EU seems to be actually taking a strange road to tech dependent overengineered regulation. It seems that this mostly driven by lobbyists that want to sell compliance services. Also it seems that there is more value in creating regulation rather than making sure it is enforcible.
Seems about right for the EU.
Maybe there's an unintended upside to all this regressive business legislation. With all the focus on the "platforms", then maybe, just maybe, this will be yet another nail among the thousands of nails needed to finally kill them off.
Strange times indeed.
Finally, free from WhatsApp voice notes, stickers and images clogging my phone storage. Adieu.
If this law passes, bye bye.
dont misrepresent
dont misrepresent
And I disagree. You take for granted all the good regulating and all the things enabled by the EU, and focus on the one bad regulation we're discussing, which is not even a law yet. I, personally, am not looking forward to the future without EU (I remember my country before it joined and the progress is immense).
Try the largest German-speaking subreddit, for example.
I think elsewhere online this may happen.
Also, some public broadcasters use the "far right" word group suspiciously often, almost as if it was some kind of effort to softly suggest to people how not to vote, but I must be imagining things, because they would never do that:)
No one shall be subjected to arbitrary interference with his privacy, family, home or correspondence, nor to attacks upon his honour and reputation. Everyone has the right to the protection of the law against such interference or attacks.
Bugging communications by investigators with special approval is already an exception to this principle. Government bodies that make sure that laws conform to the constitution should veto any exception broader than that, so this draft should basically be pointless.
It feels like there are social/political mechanisms at work that allow that to however happen. They pave the road to Hell little by little, one stone at a time, and this is neither strange nor entertaining. To me, the beginning of this century has similarities with the beginning of the previous, which is quite worrying.
the reality is, if anyone is seriously determined to commit what they know are crimes then there are many solutions, of admittedly varying quality, for having private communications outside of the mainstream apps available on the app store. even signal itself has an apk you can install on android from their website.
so, it's unlikely this will indeed help in the fight against CSAM or whatever else is purportedly motivating this legislation. the end result will be mass surveillance 24/7 on the vast majority of the population who aren't commiting any crimes at all. it seems to me like big brother's wet dream. ironic that this is exactly the thing the US/EU political leadership have been bashing the chinese for since forever.
there's a good reason for that. it's not controlled by and for the benefit of our oligarchs.
It could be text, audio, video, raw signal bitstream from an IoT sensor, or a full duplex async combination of anyone of those.
It wouldn't be a "chat service" to an outside observer, it would just be seemingly random, opaque bits between two endpoints.
At end of day, if someone wants to do this, there is no way, afaik, it can be detected. so, all these laws won't really help combating serious criminals who have some savvy.
https://en.wikipedia.org/wiki/Analog_hole
If you're running a criminal organization, a bigger threat than a wiretap can be someone wearing a wire, so to speak. Talking about anything over text creates a ton of evidence about the criminal conspiracy that you are currently engaged in. That evidence can be screencapped or recorded or whatever else by the person at the other end of the conversation. Since you don't have physical control over that person, it's possible they could be compromised.
If you keep everything in-person, even if someone becomes a snitch, you can still check them for hidden recording devices. At best, this means the evidence against you is that person's recollection of your conversation.
This is the same reason why it's much harder to pirate a movie in theatres than one released on streaming. Physical control over the environment that information is disseminated in is the gold standard, just look at the US military:
https://en.wikipedia.org/wiki/Sensitive_compartmented_inform...
Of course. Your "privacy" is very important for Microsoft, Google and Apple because of the "geopolitical situation". /s
As far as I know, most messaging platforms allow you to send regular files too. Wouldn't "the bad guys" simply use that as a loophole and continue with their day?
I know the real reason behind the law isn't to actually protect children, but, you know...
So it won't stop CP, or any other criminal activity that's in the slightest bit cluefull.
They must know this, so I'm left scratching my head wondering what they are actually up to.
Shit criminals will just meet and swap usb drives lol, like i don't get how this solves the crime issue. This is like banning monero or crypto because its used illegally.. meanwhile CP and other crimes have used Euro and USD paper money for long before crypto lol but yet "crypto seems shady" is enough reason to point at it as the reason crime exists lol.
I took that as a given and therefore described what I would see as scan-creep of the gov implementation regardless of the exact verbiage of the law.
My point was that anyone expecting to use the file type as a loophole would likely ne compromised, and the only way to ensure bypass of the scan would be to locally encrypt before transmission, as any text or binary entered into an app affected by this law should be assumed to be fully mined, scanned, and reported to the gov regardless of its contents.
Additionally, it says photos, videos, links, but you can make any data represented as other files e.g. text, slowscan, steganography, etc.
If true, then it seems unnecessary to "leave the EU market" with respect to text messages and voice calls.
[1] https://volteuropa.org/policies/european-democracy-act/open-...
Transform the Declaration on European Digital Rights and Principles for the Digital Decade into a binding legal instrument, so that the Declaration is upheld at every step of policy making.
The Declaration that they mention is not from Volt, it's from the EU itself and can be found here: https://digital-strategy.ec.europa.eu/en/library/european-de...
Privacy and individual control over data
17. Everyone has the right to privacy and to the protection of their personal data. The latter right includes the control by individuals on how their personal data are used and with whom they are shared.
18. Everyone has the right to the confidentiality of their communications and the information on their electronic devices, and not to be subjected to unlawful online surveillance, unlawful pervasive tracking or interception measures.
Of course, given that this Declaration is signed by the same parties that are currently pushing the ChatControl measures being discussed doesn't fill me with much confidence.
1. https://en.m.wikipedia.org/wiki/Greens%E2%80%93European_Free...
Also, if I correctly understand this table [2], then "Renew" (formerly "ALDE") is also opposed, so you don't need to adopt the leftist political ideology of the Greens as a package, just to get pro-privacy representation in the European Parliament. "Renew" does seem to be a viable "libertarian" alternative there. They also make some pro-privacy representations on their website. I don't follow European politics much, so I may be mistaken here. For example, I haven't looked into their voting record.
[1] https://www.patrick-breyer.de/en/posts/chat-control/ [2] https://www.patrick-breyer.de/en/posts/chat-control/#negotia...
[1] For example, while being the Vice Commissioner for Human Rights (vice ombudswoman) in Poland, she stated that "It is worth, first of all, stating a few facts. First, violence has a gender, whether we want it to or not. Women and children are the victims, and men are the perpetrators." (video transcript translated with https://www.deepl.com, source in Polish: https://wiadomosci.onet.pl/kraj/dr-sylwia-spurek-przemoc-ma-...).
> men and women were equally likely to experience nonconsensual sex, and most male victims reported female perpetrators. [1]
[1] https://www.scientificamerican.com/article/sexual-victimizat...
[1]: https://mepwatch.eu/9/vote.html?v=134463
[2]: https://mepwatch.eu/9/vote.html?v=167712
However, its not that easy to find these results. I was looking quite a while to find this one.
Also - there is the question of EU legitimacy. Its structure is highly problematic, as are its politics vis-a-vis the US, NATO, Russia, Arab countries etc - and I'll naturally not open that whole discussion; my point is that I would also consider supporting dissolution of and/or secession from the EU. Not because friendly and cooperative inter-relations are bad for European countries - of course they are - but because the EU is not a good vehicle for that, it's a vehicle for realizing elite-minority political and economic interests.
Excuse the confusing mistype :-(
Voting for a party is a signal for other people and for the party itself. It may not be today but next time that they get that seat.
- tell you they couldn’t have know it would end this way
- they really were right, except for this one unpredictable thing that broke their master plan
- hide/pretend they were never pushing for this
- ask for help
- tell the rest to take a hike (the ones that managed to still benefit)
And there is no way for people in the present, who see this coming to prevent it or to ensure proponents are help accountable on the future. You will end up with lawsuits that take 20 years, watered down verdicts, weasel politics, etc.
cite? I somewhat kid, of course, but this generally seems the last, if ever, step forward considered.
XMPP FTW.
That page in particular is a pile of FUD; it keeps banging on about "impressive collection of private data being sent to Matrix central servers, even when you use your own instance" which is simply categorically untrue; it looks like they misread the privacy policy of the Matrix.org server at https://github.com/element-hq/policies/blob/master/docs/matr... and somehow assumed it applied to everyone's server instances. It doesn't, any more than https://www.w3.org/policies/privacy applies to a given random webserver on the internet :|
[1]: But like I said in another thread, who knows if they would directly complain to me.
I believe its this post here, but someone correct me if this is the incorrect link: https://signal.org/blog/the-ecosystem-is-moving/
Protocols, not platforms, people!
Therefore even if your chat log is leaked by one member, it isn't possible to probe person A sent the message. If person B was the leaker, anyone that person B has ever communicated with on Signal could have sent the message appearing to be from person A.
Not sure when you last looked at the landscape.
Servers: Synapse, dendrite, conduit
Clients: (just off the top of my head)
Element, fluffychat, cinny, neochat, cyphon, nheko, schildichat
Clients outside mobile OSes are not interesting if you are considering Signal replacements. On mobile, you have element and maybe fluffychat.
It is still a messaging thingie that lacks a decent server implementation, and lacks a good client app.
If you want all the voip bits in place and all the latest features, you have to run a specific combination of synapse, sliding-proxy and element as the client. The xmpp ecosystem has similar problems but it gives a bit more leeway with various combinations of servers and clients that work well.
Matrix has more focus on IRC-like rooms, has a lot more features for that purpose and is much nicer to use than any conference xmpp extension.
https://matrix.org/ecosystem/servers/
The designers of matrix decided to shift more of the burden of the protocol to the server so that clients would be easier to implement. Therefore there are few servers and many clients. e2ee makes the client more complicated, that's why not all clients support e2ee
It doesn’t matter if the relay service is centralized or federated. Apple can ban apps that don’t comply with the new law. Even self-distributed apps under the new sideloading provisions of the DMA can be censored by Apple by revoking the notarization.
So I guess it didn't, and they'll find a reason why this won't either.
All meaningless talk.
Their strategy then as it seems to be now, is to do nothing but say they disagree and wait for the regulators to forcibly remove them from the market.
That is if they did themselves non-compliant with a countries laws, they'll do nothing and wait to be evicted rather then comply or voluntarily leave.
My understanding is that the law empowers the regulator (Ofcom) to require the use of accredited scanning technology if they consider it necessary and proportionate. No further changes to the law are necessary for that to happen.
But as of now, no such accredited technology exists. It seems likely that any client-side scanning technology that the EU mandates would also get accreditation in the UK.
https://www.gov.uk/government/publications/end-to-end-encryp...
All that happened is the government accepted that it was not currently practical to implement what they desired. So 'promised' not to require any providers to do so yet. If they deem it practical one can expect them to instruct providers.
Hence Apple and Signal both ignored their prior statements, and continue to provide their respective encrypted message and speech services.
postnote: this comment was Authored on Firefox under Wayland running on Linux 6.
As far as the mainstream I believe Gnutella, the protocol, had massive success with the LimeWire client.
https://gtk-gnutella.sourceforge.io/#:~:text=gtk%2Dgnutella%....
Yeah, that's why Windows has been by far the most used OS by the mainstream
https://gs.statcounter.com/os-market-share#monthly-200901-20...
Laws can be ammended faster than implementations.
It's extremely possible to solve political issues using technology. If you consider the government infringing people's right to put whatever substance they want into their body to be a political issue, it's been pretty much entirely solved by crypto and darknet markets for drugs.
True.
> Laws can be ammended faster than implementations.
Really, really false.
Now, with an eye toward the social dynamics of village life, I've always found the notion quite alienating to try to immigrate in a country where petty grievances held against me by my fellow villagers might block my path towards naturalization.
The picture is probably slightly different in more urbanized places, but, in those, it probably boils down more to a question of money.
I'm not sure what to make of your "a quarter are immigrant" statistic. Do you mean they live there, without being citizens? Is that number high precisely because the path to naturalization is so difficult? The number of non-citizen permanent residents, for example, is also extremely high in certain rich Arab countries (like the UAE), but they are effectively an underclass of indentured servants. So "immigration-friendly" is not what that kind of a statistic is saying at all.
If one stays employed in the long term, citizenship is not needed, and IME only a small proportion of ex-pats attempt to achieve it - either because their career and life plans are likely to eventually lead them to move elsewhere, or because there's no incentive in their personal case, or disinterest, or because of the perceived difficulties.
You're right that parts of the system for achieving citizenship may sometimes be problematic, and the Swiss have somewhat of a reputation for racism, especially in the less metropolitan areas. (Of course, you could also say the same for many countries.). There have been anecdotes of people repeatedly failing to achieve citizenship through exactly the issue you originally raised.
That said, the overall approach to citizenship taken by the Swiss is mostly praiseworthy, as some of the more impressive aspects of Switzerland (e.g. its direct democracy, and the engagement of citizens in politics and the democratic process) are embedded within the shared culture of its citizens, and the citizenship process takes a decent shot at preserving this culture - requiring, for example, proof of significant language skills and knowledge of current affairs and politics.
> And who will you message then? I assume most of your contacts will stay where they are.
You are out of luck if you can't convince people to install PGP/GnuPG in their favorite e-mail clients. And e-mail doesn't scale for spontaneous communication like chat does.
- Safe Harbour - Privacy Shield - Data Privacy Framework
Can I get my data back? Can I retroactively avoid surveillance by US intelligence services? Has the data transfer stopped?
If the answer is "no" eact time, then please explain how the court ruling impacts me.
I take it this should apply to any web comments and messaging platform, and therefore require that all websites and web services comply if they can be accessed within the EU?
I’m not sure how that’s even remotely doable.
I don't rely on Signals encryption, since there is no way to verify that it works in the way that it does, and even if, there is no way to know that the recipients are as careful as you are. If there is something I don't want others to find out, I just don't write it down. No encryption is fool proof.
Independence from known data harvesters is the only reason I got pretty much all of my contacts to switch.
This is a serious question
My take is the following: we have governments because we tolerate them. Constitutions are nothing more than a social agreement, and they could be torn apart and remade at any point in time.
Politicians are our employees - we hire them, we pay them, we can fire them. Sadly in the past 80 years we have started seeing them as our saviors and forgot their power emanates from us.
I don’t want my employee (the government) telling me what to do and tracking me. It’s irrelevant whether I have or not something to hide.
The OP, and that’s how it started, said he switched to signal due to “data harvesters” like Meta.
I feel like the conversation here diverged from that to something different.
PS: I absolutely follow the logic of restricting politicians. Unfortunately these people are versed with power and how to use it. Otherwise they would have not ended at the top…
1. This is default expectation (to have privacy, to have doors)
2. If you go abstract, it’s not too useful (its good to have of control of information sharing/ it’s good having control who access your house)
3. It seems impractical to go into details, due to very many different scenarios, details, expectations. Take a set of different “motivations” (incompetence+personal gain+for terror+for ideology push), multiply it by types of actors (phone manufacturer, government, enemy state, criminals), mix in the possibility that law and approach can be changed/ expanded, while keeping in mind that motivations and actors will change year to year. (One thing when such tool is available for consertive gov., other thing when such tool is available for extreeme right/left gov.)
Parallels do diverge eventually, with door if somebody breaks it you most probably can see it immediately. While negative effects of privacy breach can take years to surface.
Doors and how they’re used is highly cultural and has evolved. There’s nothing “fundamental” you can derive from your mental model of today.
Same goes with bike locks and the like. I used to live in a student town where people simply never locked their bikes. It was a custom of that time and place.
It has already happened btw.
Good point
[2] Documentary: "The Great Hack" (2019) https://www.imdb.com/title/tt4736550/
This isn’t rigging an election because real votes were cast and counted. However is it still a fair election if the electorate doesn’t have access to sufficient information so as to make an informed choice? That is the issue at stake here.
We know that Meta tracks everything you do in a pretty invasive manner. We know they use this data to target ads, and while they claim not to share data with advertisers, we do know that people have figured out ways to leak some of that data.
Since they share data with a lot of 3rd party tracking companies, we would have to trust all of them to keep our data safe. It is highly likely that some of these companies employ malicious actors.
Now, maybe you think you have nothing to hide. But the political landscape changes all the time, and things that were legal one day might be criminalised the next day, or some terrorist organisation gets a hand on your data and figures that you are an enemy of their god for some reason, ...
The only way to protect against these things is to not store the data in the first place.
Specifically, I am interested in tangible examples.
The one thing I got from your post is: Meta can target you to deliver better ads.
If you have other specific examples of what else can happen, please elaborate. I am curious
I can see that happening in the future albeit with a low probability in the Western World at least. Of course you never know
Western democracy doesn't help much when a higher up wants to get you.
And then there are all the crazy bastards beating up people for their religion or their sexual orientation. It's been shown that Facebook leaks some personal data to advertisers with carefully crafted campaigns.
And if that doesn't worry you, there's also all the fraud that is spread via Facebook ads: "Better Ads" means "More convincing cons". Con men use ad targeting to deliver exactly the kind of fraud you are most likely to fall for. A relative of mine fell for a finance scam -- it seemed perfectly legit, and thanks to Facebooks accurate targeting the campaign was delivered exactly to the right person that would fall for it.
Don't give them your data.
Ok, a specific example: by a weird twist of fate, my country outlawed abortion (in most cases). Currently it's easy for affected women to travel somewhere and get help. Some people don't like it. With widespread tracking, it will be possible to target and punish women for breaking the law by getting abortion.
I want no ads in my life, ever.
When I need to buy something I look for research, reviews, competition, people who actually used the thing for some time and comment on the thing's weaknesses.
I want to control when I start being interested in something, and when I stop also.
When I need to buy something I need knowledge (weaknesses) and control. Advertisements are exactly the opposite of that.
So... no ad can ever be a good ad for me. Period.
Currently, only issue I face is, due to unlimited text/calls benefit in Germany, I also receive a lot of scam/phishing sms or random sales sms about some random agency offering digital marketing, webdev, wordpress etc irrelevant service unsolicited. I noticed that, somehow when such sms arrives, I am very proactive in immediately blocking those numbers, but may be by evening, I start seeing adverts all around the web creepily related to those same sms(mostly different vendors but related business area).
Thanks to the garbage that LLM is, now I suspect Google SMS as well as other Android based sms apps are also scanned and profiled to feed to advertisers, which I can't prove but my experience above is definitely not the Frequency Fallacy.
Long-term: hard to say.
Makes sense
Since we're specifically talking about Signal, I think that it's worth mentioning that Signal is uniquely predictable here. They published their entire cryptosystem, it's been extensively inspected by the cryptography community, there are multiple open-source implementations that agree with the published mathematics, and I strongly suspect that more than a few people have sat down to verify that the bytes coming out of the app are actually produced by the published protocols. Claiming that that's not "working the way it does" is reaching out into territory along the lines of Trusting Trust, the unproven existence of trapdoor functions, and the Problem of Induction.
I still use the app, because I trust Signal more than Facebook, but the encryption isn't why I trust them.
No. Signal locks not not just third party software but also builds of their own "open source" code via timebombed forced updates. It's somewhat impractical to use signal except via blinding accepting updates from them.
As a result every signal user is sadly quite vulnerable to getting pushed a bad update, particular since app store policy changed to require the app store itself being able to sign updates.
Signal could mitigate this by allowing third party clients and/or not timebombing support.
Passwords aren't as critical in my opinion, because I can always change them. Sure, it would suck if someone broke into my hosting account or my bank account, but I could probably fix it somehow. I was more thinking about secrets that I don't want people to find out, because there is no way to make people forget something they learned about me that I wanted to hide.
I’m joking around but I did get your point. I just think secrets cannot be categorised simply in “stuff I don’t want anyone ever to learn about” (why would someone use signal for that though) and “stuff I don’t care if anyone learns about”. 99% of the information I send over signal is actually neither, it’s in-between. I don’t want the whole world to see pictures and names of my family. I do want other members of my family to have them. Hence I use Signal for this, because I trust them most (or I distrust them least, depending on the point of view).
It’s all about trade-offs, as you said.
End it end encryption make me worry less about this. I’m not a very trustful person simply put.
But I agree that everyone need to evaluate their convenience vs. risk ratio individually. I use VPNs, I wouldn’t dare to ask my family to do the same, it’s highly inconvenient.
Totally. Not everyone is a cryptographer to review the code and ensure the app they're downloading is what was compiled by the aforementioned vetted code. That's what F-Droid and cybersecurity audits attempt to solve (and Apple's vetting process, though I think their mandatory $100/yr developer license is what drives malware off the platform).
The one reason to use Signal is privacy, and its replacement of Meta apps is under that umbrella.
The EU has shot itself in the foot with demanding alternate app store exist, and then Signal has shot itself in the foot by not being open enough to be distributed on any app store by anybody.
The answer to these encryption laws, is to use their other laws against them. You want the iPhone to be an open platform? Great, here's a bunch of open platform chat apps that cannot be banned because they are decentralised.
Perhaps Matrix will be the future after all?
They have been building a walled garden for a decade. They talk about "market": they want to make Signal profitable.
Which I find very naive and destructive, but that's how it is.
The second phone will be very basic with open source hardware and self installed open source software, simple enough that you could build it yourself if you wanted. Its sole purpose will be secure communications and it would just use your phone as the communications medium.
Bonus: you get a real keyboard.
Terrible Shannon's Limit although.
A quick search didn’t lead me to any proof of concepts about this idea but on the surface (I don’t have any knowledge of the hashing algorithm used in these content filters) it seems like a plausible idea, depending on a lot of factors.
Also something where features work? Since this week my Signal "Something went wrong with you username, it no longer is connected to you. You can try to get a new one"
EDIT: Switzerland is not a member of E.U.
switzerland is NOT in EU
Excerpt from their main web page:
Threema is 100% Swiss Made, hosts its own servers in Switzerland*, and, unlike US services (which are subject to the CLOUD Act, for example), it is fully GDPR-compliant.
(Need more coffee)
Still GDPR is unrelated to what we are talking about
Developers could start to employ software activism and dis-allow licenses for software they develop by European governments citing the reasons.
Perhaps Signal can deploy a version for Europe that is licensed for use only by governments and scans the hell out of them looking for corruption using AI.
It just means you only store the data you need, you track how the data is used, and you allow data subjects the possibility to modify/remove said data.
They poke a hole in signal and all secure messaging /communication is screwed. it wont matter what "other" product you use.
Decentralized protocols
Of these, https://simplex.chat/ seems the most promising, thanks to a level of decentralization.
But, I'm in Europe (France) and I wonder who actually uses Signal? There was a move a couple of years ago to quit WhatsApp and go to Signal. Some groups did make the move, and then everyone went back. Today I have dozens of WhatsApp groups, and just one Signal group (and it's dying).
If no one uses Signal in Europe then obviously this threat is moot.
Signal has become the default video conferencing app for several of my larger groups, and it works surprisingly well! This is a trick WhatsApp currently can't do.
Signal has been great but they won't be able to stop it.
Or we could encrypt the messages before pasting them in the messaging app so the CSS will be neutered.
Either way, I won't have the EU stasi look over my shoulder each time I send a message to a loved one.
Very understandable, but not particularly interesting.
Just send the image as a base64 encoded text string.
Decode when received.
Signal developers really seem to have some misconceptions about the priorities of their users…
[0] It‘s not a limitation of iOS itself but that Signal doesn‘t want to allow to store data and keys in a way that would ‚leak’ them to Apple - not even if I, the user, wouldn’t mind that.
Signal without the privacy obsession has no reason to exist. If you don’t value privacy, it is just a niche, hard to use messenger.
Not a serious WhatsApp user either, so my comparison is FB messenger.
There are plenty of viable security models where the app data could be securely protected from Apple or Google by using a key that I own and can use on other devices.
I'd have to give my name and address and potentially put me with 1 foot in jail because I have viewed the images and have them in my browser's cache.
If they really wanted to protect children from sexual abuse, they would've created easy to report online services. But it's not and never was about pedophilia.
Oh no, I wish there was a way to obfuscate links
//news .ycombinator .com/item?id=40551260
They try to surveil people. You can post all the links you want, but you can't be sure that they will only be seen by your intended recipient.
>If a user refuses the scanning, they would be blocked from sending or receiving images, photos, videos and links
Ohh, wait…
The cost of products and manufacturing is so low that a significant part of the final price is made up of overhead costs such as tax, tariffs, and transport. All of these will go up by stepping out of the EU due to increased friction.
If anything, we should go a lot further into embracing the EU. In the current political landscape we are committed.
Prices of energy and basically everything in EU is so ridiculous high. Free marked is crippled because of centrally planed economics pushed by EU grants.
They also pay towards EU funds.
They are also part of Schengen.
What frustrate me most is how EU sponsor their business from our taxes in name of care about environment. Ie grants on photovoltaic panels that are made from 95% in China or donated EV's that ruin traditional car manufacturing in EU.
This is partially because coordinating more countries is inherently more difficult if everyone can veto. But cultural diversity also plays a role. Deepening coordination means letting the EU decide more. Letting a more similar culture decide more will feeo better. beyond that, they are probably more likely to decide what you would have decided anyway. That is how a wider EU works against a deeper EU.
Leaving the EU doesn't automatically make a country not right/left/whatever. Even before the EU most countries had the same thing. The UK left and still have left/right/whatever. You need to change a lot more than EU membership status to avoid the whole left/right issue.
I'm probably wrong, but my gut feeling is that euro bureaucracy is playing it's own game. And it has little in common with democracy, citizen rights and citizen will at large. Infamous Juncker's phrase about how to push through unpopular regulations is the modus operandi of those people.
But hey gotta deny the EU is not working even after hitting the wall and your face is dangling from the other side right?
Im not sure why someone in Brusell should vote about regulations for entire Europe.
You cannot imply same rules for entire nations like all are the same. They are not. They have different cultures, different values, different taxes, different wealth, etc...
I'm not implying anything. I'm stating the fact that partisanship is not only dictated by EU membership. Maybe you're correct, maybe not, I dont really care, but it has nothing to do with my comment. Please try again with someone else who cares as much as you do.
That means power taken from the committee and brought to parliament. So the decision-making becomes more politicized, and thus more public. Politicizing isn't great, but without it the committee van fly under the radar. Moreover, without it the committee is fully beholden to the national governments, who won't be held to account for their decisions.
The only way forward is to not participate and/or burn it all down and start from scratch. And we all know what a polite and neutered society we are currently because things are relatively "okay" for us, so we're not at threat, so we're not willing to do the drastic measures necessary for correction here. That includes me, as I will not be sending my sons to the slaughter.
You can't honestly suggest that. From where? "village or small community" level?
It's also a case of "picking your poison". So if the recent war wasn't happening, I'd be moving straight to Russia as right now it seems to be the sanest when it comes to these specific things. But that comes with dealing with some of the "negatives" as I'm sure you all can imagine.
If money wasn't a problem, personally I'd fund some sort of island or floating-island community to promote self-sustainable practices whilst staying as far as practically possible from the craziness going on in the west.
This is far too forgiving a representation, they are surveillance wolves disingenuously wearing the sheeps' wool of protecting children to further their eventual thought-policing goals of "total information awareness."
Doing anything to protect children is difficult to object to. Using the children as their pretense for monitoring dissidents is really the heart of the matter. It's important to differentiate between the two.
I get that this difference could be subtly implicit in that comment, but let's please make it explicit.
Both the commission and the parliament are controlled by socialists (of various kinds).
The EU election is important though to ensure that the EU Parliament doesn't enact such a horrid proposal into law.
Then of course there’s the non-democratic structure of the union itself where the non voted commission decide the laws.
Also, the Commission only proposes legislation, it doesn't enact it. Only the EU Parliament can enact legislation. The comission is similar to the Government of most democratic countries, also in the fact that it's not directly democratically elected. However, you still have plenty of democratic control over it, just not in EU specific elections, but in your own country's elections.
Edit: mistook the Council for the Commission. Corrected in line.
The EU structure is democratic, you can see a summary of each body and how its formed at https://european-union.europa.eu/institutions-law-budget/lea...
The OP refers to a document discussed during ST 9093 2024 INIT, it's part of the same package of legislation priorities (2022/0155(COD)) and it's currently awaiting the opinion of Parliament [1].
I know these make for very click-baity titles, but this is the moment when one can follow the feed and publications of their MEPs and contact them when one doesn't agree with some of their positions. Logs of all meetings are available online.
[0] https://en.wikipedia.org/wiki/Regulation_to_Prevent_and_Comb...
[1] https://oeil.secure.europarl.europa.eu/oeil/popups/ficheproc...
https://fortune.com/europe/2023/10/26/eu-chat-control-csam-e...
Back in May last year, the European Commission proposed what security maven Matthew Green described as “the most terrifying thing I’ve ever seen”—a law that would force everyone from Facebook to Signal to scan everyone’s messages
These heads of states also got elected in their respective countries. You don't want to see "chat control" proposals coming from the council of Europe? Then don't elect the likes of Orban/Melonie/Geert Wilders!
Next week we're voting for the EU Parliament where MEPs are responsible for discussing and accepting/rejecting proposals from the EU Council.
As for the others, why do you think these laws come from the council? EU law never comes from the council, it's always proposed by the Commission. There's a list of people who are most responsible for this specific law here:
https://www.reddit.com/r/europe/s/Q4fRGd1a2e
None of the people on the list are heads of state, as per usual. They are senior members of the Commission and the usual assortment of lobbyists who feed them ideas.
Meanwhile, Canada lets me vote by mail, no fuss, and they even send the ballot to my home address automatically every election.
Would that really be so hard to do for EU or national elections?
Here in Germany they even actively inform you of that choice. I got a letter both from the dutch government and the German government that I can make a decision to either vote in Germany or in Netherlands
If you’re so curious, yes, on top of being pro/Russia I’m also a Mets fan. LGFM! How does knowing more about me help bring this conversation forward? Should I in turn ask about your favorite MLB team?
Moreover the EU Parliament is controlled by social democrat (left) parties. There currently a bunch of stories in the press freaking out over the possibility that the EU Parliament might actually become majority right wing for the first time ever, example:
https://www.google.com/amp/s/ecfr.eu/publication/a-sharp-rig...
So it's very unclear how you reached your conclusions about who people should stop electing and what effect that would have.
https://www.svt.se/nyheter/ylva-johansson-ifragasatts-om-lob...
I don't like mass-surveillance or "dragnets" which are actually considered unconstitutional in the US (see https://en.wikipedia.org/wiki/Dragnet_(policing) ), where you make an extraordinary amount of people suspects in order to catch a single suspect.
In medicine there is a number called NNT (Number Needed to Treat) which is a really good comparision to this. It's how many you have to treat with a medicine or procedure in order to help one patient. If that number goes up too large it's a bad sign, like if you would have to feed 1 million people a pill every day to avoid 1 heart attack per year.
Here you have mass surveillance and an incredible breach of privacy of 500M citizens, in order to catch how many pedos? If they would even be caught by this at all to start with.
I doubt it. Teenagers sending each other naked pics, maybe (but after the law passes they will know they have no privacy and will stop doing that. I fear what awareness of constant surveillance does to a young brain). The actual pedophiles were always on top of their opsec game. In this case it sounds like they just need to opt-out of scanning and send each other obfuscated links or base64 encoded encrypted zip files in text? This is child's play, there were highly sophiasticated pedophile groups using tor-only infrastructure with forced opsec and rotating identifies every month. They never trusted mainstream chat apps, and they won't be affected. This only makes it possible to track regular people.
This is ridiculous.
I told you then, that end-to-end encryption is far more worrying for politicians, than mere cryptographic signatures. And that they’ll be coming for it next. Because it can hide billion-dollar transfers, or CSAM, or gasp seditious material against the king.
Well, it’s not just Europe, it’s all over the world:
https://community.qbix.com/t/the-global-war-on-end-to-end-en...
The above chronicles many cases even in your own country!
Today regular people are just as clueless about end-to-end encryption as many on HN are about web3 and decentralized network innovations. Think of the children!
And then they will come for the regular person, and by then there will be no one left making tools that could have helped them.
As for me and my views, I have come to believe that end-to-end encryption vs state actors is a band-aid, that if you are reduced to sneaking around then your government and agencies need fixing. Whereas digital signatures and smart contracts and decentralized networks are useful as they allow everyone to be in control of their own identity, voting, balances etc. without relying on a third party. It’s done in the open. But the difference is that it can be limited to “benign” things and enforces the rules, while everyone gets to make their own decisions and one party can’t corrupt the system.
To me, the transparency and resilience to corruption is the main thing. The sneaking around, I can see how governments can declare war on that.
Crypto has probably done more to undermine privacy than Hoover’s FBI. Its proponents are ambitiously unlikeable, relishing their distastefulness to burnish outsider credentials. Its damage is easy to quantify in a way troublesome speech is not. And because a broad set of the population either doesn’t like it or, much more prominently, doesn’t care, it serves as a stalking horse for advancing general anti-privacy laws.
Signal is a great example. They should be a unifier for the notoriously-apathetic privacy crowd. But it isn’t. In part due to its crypto crossover. I genuinely can’t seriously take Signal as a canary of anything, because it’s unclear what motivates its leadership.
If you ask the average person, they’d say that people on HN and their snarky attitudes are far more unlikable than the people building decentralized networks that empower people.
Vitalik Buterin. Tim Berners-Lee. Ian Clarke. The teams at IPFS, MaidSAFE, Freenet. I have interviewed many of them and spoken w them. They are humble, good people trying to make the world a better place. You just enjoy shitting on anything that has the word “web3”. Actually that keyword attracts automatic downvotes on HN since 2021, as in 3 seconds after you post.
Try visiting, say, https://forum.autonomi.community/ or https://ethereum-magicians.org/ and see now nice, courteous and constructive nearly every participant and post is. They are solving hard problems. Not shooting down snarkily anything in a cargo-cult fashion.
Here is an interview I made with Ian Clarke for instance. Unlikeable? https://www.youtube.com/watch?v=JWrRqUkJpMQ
I don’t know Europe’s polling. But in America, the majority is against [1][2]. (The only ones showing marginal favour ability are industry polls [3] by low-quality pollsters [4].)
> You just enjoy shitting on anything that has the word “web3”
I’ve made a lot of money from investing in companies that do things around crypto. Its users are a population willing to pay high fees for nebulous ideological points, almost uniquely so outside religion and politics.
[1] https://www.cnbc.com/2022/12/07/just-8percent-of-americans-h...
[2] https://www.pewresearch.org/short-reads/2023/04/10/majority-...
[3] https://projects.fivethirtyeight.com/pollster-ratings/ Harris
[4] https://www.businesswire.com/news/home/20240507551232/en/DCG...
Oh wait that part is awesome and people should just atop worrying and learn to love the bomb…
I just don’t like the selective double standard of these arguments. Far less people are worried about blockchain than about AI, and the public is CORRECT. Because with Web3 even with the shittiest of shitcoins people only stand to risk what they voluntarily put at risk. While AI can harm millions of people who never opted in, and wanted nothing to do with it, across the entire world, their lives are going to change kicking and screaming, and you say “they should get used to it”.
It is the politicians and banks looking to ban things because they are worried about competition to, say, CBDCs. And if you cheer them on then don’t get upset when they ban end to end encryption by the same reasoning. People actually want the freedom to choose their own digital assets. They aren’t sneaking around, they just want choice and the Republican party has come around to supporting crypto for instance. Even DT.
Declining but better than crypto, though the recency of the polling leaves much to be desired [1][2].
> taking away everyone’s jobs, including and especially with OpenAI
Honestly, an AI that writes and launches web3 projects would be hilarious.
Also, I’d single out AI—and Altman, specifically—as demonstrating that same unlikeability. The two industries currently clamouring for harsh regulation are AI and crypto.
> politicians and banks looking to ban things because they are worried about competition to, say, CBDCs
Banks lobby for crypto. It’s insanely profitable compared to regulated fare.
Who do you think has been pushing the ETF and custody rules?
> While AI can harm millions of people who never opted in
The entire thread is about crypto trashing everyone’s privacy.
[1] https://news.gallup.com/poll/329666/views-big-tech-worsen-pu...
[2] https://www.brookings.edu/articles/how-americans-confidence-...
To me that is why I consider AI far more dangerous than cryptocurrnecies of any kind. And smart contracts can do far more than cryptocurrencies… while decentralized byzantine-fault-tolerant networks can do even more.
The public fears AI far more than they fear Web3. As for the banks, they couldn’t have exposure to these assets until the ETFs came about, because of laws. And these assets only became interesting because millions of regular people around the world bought into that ecosystem and started using it. The innovation in DeFi was far greater than in regulated FinTech, and without all the arcane needs for interoperability with legacy stuff that still uses fax machines and COBOL. Similarly to how packed switched decentralized VoIP completely eclipsed switchboard operators and legacy telephone networks and trusting the operators like Ma Bell! The costs dropped nearlh overnight to zero and the quality increased, while decades of government antitrust couldn’t achieve anything close to that!
has harmed
Cryptocurrencies are taxable assets. While private communication enjoys some legal protections in many countries, trading taxable assets does not.
If an app allows you to trade taxable financial assets, it means that tax authorities have every right to demand access, even if it's just to confirm your claim that you didn't use the feature.
Cryptographic signatures are heavily used in these networks. People sign the transactions using elliptic-curve cryptography (or they are moving to some quantum-resistant thing). Then a blockchain or other decentralized network stores the transactions while a programming language is used to make sure that everyone and every node is following the rules.
Being able to finally trust the code instead of a middleman has the potential to be extremely useful despite your insistence that it cannot possibly have any uses because you personally don’t like it. Because trust is costly, and being able to reduce the attack surface enables much larger coordination and larger value to be managed collectively, with far less corruption.
And for things like voting, it is hundreds of times easier to verify if a paper ballot election is rigged than it is to verify if a crypto based election is rigged.
First of all, there are many more applications than commerce with physical goods. There’s global payments for services, recurring subscription models, gated access to content, contests, voting, governance, UBI, and much more. Check out https://intercoin.org/applications for a more comprehensive list.
I wrote this article in 2020 after multiple voting debacles in Iowa etc. Paper ballots and hand counting is what lost Al Gore the election for instance and George W Bush got elected, leading to a lot of wars and destruction. With all those paper butterly ballots and other things, it was actually NOT easier at all. People had to recount throughkut multiple days until the Supreme Court simply stopped them:
https://www.coindesk.com/in-defense-of-blockchain-voting/
And now a large proportion of the country believes the 2020 election was rigged due to mail-in ballots arriving and being counted in the middle of the night. Go tell them they’re wrong. You may think they’re crazy but cryptographic signatures and valid IDs could have made it FAR more secure. Unlinkability is the only thing that is hard, for that we could have given everyone a token and used a zero-knowledge proof mixer.
In fact, that is what Google now does with its “privacy sandbox”. But you have to trust Google :-)
No it wouldn’t, it would make attacks at scale easier. The gold standard is physical ballots with electronic scanning.
With paper ballots around the world there are already attacks at scale. Take the latest national election in the USA. Republicans claim that Democrats shipped in fake mail-in ballots or harvested them from old people, and said “trust us”. Democrats claim that Republicans closed polling stations and disenfranchised many voters at scale in districts that historically voted Democratic.
Witness all the rigged elections around the world, some strongmen getting 99% of the vote at scale. What good are the paper ballots in, say, Belarus if Lukashenko says he won? Is an average person going to be able to somehow know what happened in their own pollung station after they left, let alone across the entire country?
Having mutually distrusting parties have access to each other’s work is the very thing that enforces byzantine consensus but it can be checked and verified on-chain as each party signs off on the result, so anyone can check that 1) they looked at it and 2) they were satisfied. That’s far far better than hearing someone say “it went fine” about paper ballot recounts.
Furthermore, everyone being able to make sure their vote was counted by eg checking Merkle Proof is far more secure.
None of the above failure modes would be an issue if everyone who wanted to, could vote from their computer, scanned the QR code with their phone to verify their choice, and signed with their private cryptographic keys derived from their IDs.
Claims won’t change with a tech fix.
The point is there still isn’t evidence of wide-scale disruption. Electronic-only voting changes that from a verifiable problem to an inherently-unverifiable one. You only know the code voted, not the person.
> What good are the paper ballots in, say, Belarus if Lukashenko says he won?
Crypto ballots wouldn’t change this. If anything, I expect crypto voting to soon feature in authoritarians’ elections.
People in rural areas whose polling station closed thanks to Republicans, and who can’t drive 30 miles to the next one wanted to use the mail-in ballots. And Democrats were very happy to allow it. But then Republicans pointed out all the ways the mailing system and ballot harvesting was very unreliable. And both sides have a point. Taken to the extreme, both disenfranchisement and physical mail suck for voting.
In contrast, people could have an option to vote from their computer and use their phone to scan the QR code and confirm their vote and sign it. They can then verify their vote was included correctly!
I have explained at length how crypto would make it a lot more verifiable and reliable.
Everyone would be able to check:
1) their own vote was counted in their district
2) their own district was counted in the total
3) the number of votes and turnout in each district, matching the number of signed checkins
4) mutually distrusting parties in each district saw each ballot being cast (or a random sample) and were satisfied that the electronic record matches whatever receipt was generated
None of these can be directly verified by nearly anyone participating in a paper election.
Besides destroying the secret ballot, you can do this now! You look at the paper and the electronic count. If you’ve been a poll worker or observer, you know there are hundreds more checks a well-designed system has.
> Everyone would be able to check
Few people would be able to check any of this. (Fewer than can observe a poll today.) And it’s much easier to invent a “hack” that makes people distrust an electronic ledger than a paper one folks can audit ex post facto [1].
There is no similar audit capability for a blockchain. Did the person actually vote that way? Or was their phone hacked? Short of re-polling everyone, you cannot know.
Remotely coordinating a poll attack on paper ballots where every precinct has its own system is impossible. Crypto voting is a textbook tragedy of trying to solve a social problem with a band-aid of technology.
[1] https://en.m.wikipedia.org/wiki/2021_Maricopa_County_preside...
1) even if so, can I check my vote recorded at the district vote collection center is the same as the vote I meant to send?
More importantly, can I check the resulting numbers announced on TV/radio/online are the same as the sum of all legitimate votes, and not influenced by illegitimate votes, and not doctored?
This is all impossible, in any system of voting.
Ultimately, you do need to rely on your co-citizens to help verify that the elections are valid (in a simple to verify system, i.e. paper voting), just like you need to rely on them to vote coherently and to abide by the results of the election.
And for elections: if you think for a second that a crypto voting machine wouldn't have been cast doubt on by the people who brought you "Hugo Chavez stole the election through Dominion voting machines", then I have no idea on what planet you live.
On a separate topic, the USA is almost uniquely bad in the world, at least for rich democratic countries, in having such problems carrying out elections.
In my own, incomparably poorer, country, with a 50% rural population, we just don't have these problems. You have a 90% physical voting system: you come to the polling station, they check your ID in an electronic system to make sure you meet the voting age and haven't voted before in this election, they give you a stamp and a ballot, you stamp the ballot in a private booth, typically in a local school. You fold the ballot, and put it in a big urn. At the end of the voting day, representatives of all parties and anyone else who registered as an observer opens the urn and they all count the votes. They report the counts higher up electronically, and safely store the physical ballots. Elections happen on a Sunday, from 8 AM to 8 PM, sometimes with local extensions where a polling station is still full at the close. Preliminary results from exit polls are announced immediately at 8PM by the media. The electoral officials announce the first official preliminary results by 22PM, and then throughout the night. By 12 PM the next day, the vote count and official final results are typically out.
No "hanging chads", etc. There are plenty of other electoral issues (busing, paying for votes, strong local cliques where even representatives of different parties conspire to steal votes for a single party, bad education leading to people not knowing their rights or who to vote for, etc). But not procedural problems, and no machines that make it easy to hide systematic stealing.
What you describe is exactly what happens in byzantine-fault-tolerant networks, and much more. But because it is done by machines, the cost is brought down by orders of magnitude so now many groups can have decision making and votes about many things every day, rather than spending billions once every few years and manually counting. This technology is made available to all, as opposed to, say, trusting the operators of a StackExchange site to not rig the periodic elections for moderators and those who will run the site. And it allows the communities eg DAOs to collectively manage larger amounts of money without worrying some director will abscond with it.
The REAL conflation has been by crypto-haters of decentralized protocols with centralized entities like FTX or Celsius. The only thing they have in common with crypto is that you can send crypto to the address they control. And then, they pinky promise they’ll take care of it. Crypto has been developed exactly to remove the need for such middlemen! While FTX fell, UniSwap and Aave Protocol didnt miss a beat. No one worries a UniSwap smart contract will rugpull then one day. Government regulation isnt needed when the code has been battle tested with billions of dollars. Just like government regulation of HTTP isnt needed even though it was needed for physical mail delivery. That’s the kind of building blocks we need for a future system — for voting too. Cheaper faster better.
It is a bit like arguing email and the world wide web is worse than the gold standard of regular mail. Look at how much innovation it has unleashed once given the chance to build on top. Sure we had chain letters and scams and phishing etc. But we also enabled trillions of dollars in ecommerce and SaaS and much more!
UniSwap is a great example. No one ever worries that a UniSwap instance will do something nefarious. That's how the decentralized software SHOULD be. We don't need everyone to verify, but just allow ANY AUDITORS IN THE WORLD to do it.
And again, in any fully electronic system, you need to take into account the whole system, not just one part of it. Maybe Bitcoin or Ethereum or whichever blockchain you like is indeed perfectly safe and very trust-worthy. But if I'm connecting to it to vote from a Windows PC that I last updated 5 years ago, then I'm still extremely likely to lose my private key to my money or have my vote cast for whoever Microsoft or the writers of all the malware I'm running likes best.
There is no way to make electronic voting safe. There will never be any way to make electronic voting safe. Any country doing it is playing with fire. Blockchain does nothing at all to change this one iota.
and that was the perfect opportunity to use it as a stepping stone to dictate what consenting adults can and can't do in the privacy of their own computing devices.
now encrypted communications ("think of the children!") and local AI ("think of the environment!", which is exactly the same angle they've been using with crypto) are next, and within a few decades - general purpose computers. a few years of propaganda in the media, a cyberpandemic or two, and I'll be reading essayesque comments around here about why is it actually a good idea to ban those unethical, unsafe, environmentally-unfriendly machines and let us all subscribe to a cloud offering instead.
The Web was the one anomaly in the Matrix. Where it’s just too big for more countries (except China, North Korea, and soon Rusia) to bring to heel.
Browser makers are really your last line of defense. And rather than making MORE decentralized ecosystems, the geeks on HN spent a decade fighting against anything that smelled of decentralized encryption and digital signatures. Which is sad! We could have had far more innovation and reached critical mass same as the Web did. Instead, small teams working on Freenet or MaidSafe (Autonomi) are our best hope for a privacy future.
And it can be banned at the protocol level.
I guess Matrix and Tor might be considered the only successful projects for privacy, and Tor kinda sucks for real privacy because it’s basically still a web host.
If the states aren't the bigger fish, the bad actors would be.
They can ban that as well.
The only way anything can continue working in practice is if it’s decentralized, and served by different websites secured bu https rather than one app in one app store. Hard to take them all down.
Perhaps Moxie Marlinspike now better appreciates decentralization behind messengers. I have written here years ago as a response to him exactly this scenario: https://community.intercoin.app/t/web3-moxie-signal-telegram...
The thing with https of course is that the governments can insist that browsers include their backdoored certificates. But the browsers are large enough that it’s difficult to get them to do it. China’s Great Firewall probably can. But in order for that to happen they have to prevent packets encrypted with the non-backdoored certificate chain from being routed. That requires serious control over all the networks.
This is partly why I started Qbix. So people can host whatever they want on computers of their choice. Without this decentralization, the governments are two steps away from mandating ALL your voice conversations are scanned, transcribed and analyzed by AI at the edge. Microsoft Recall + message and voice scanning = 1 step away from total panopticon of everyone everywhere. And with superintelligent AIs doing precrime based on everyone’s conversations!
You’d need to roll your own mesh network — definitely doable in local areas but the question is how to connect them over wider distances without going through the Great Firewall. Satellites?
I use grapheneos and can create storage scopes so that the scanning app would only have access to files I deliberately allow.
Doesn't solve traffic analysis. Maybe some more advanced methods that encrypt over https could work.
Go make a protocol that fools all the AIs from every angle, that are scanning 24/7. They can get you on the metadata pattern alone, nevermind even the content.
Now, three years later, Telegram is following in Signal's footsteps with another shitty crypto integration. I don't know the details of that one, but I wouldn't be surprised to learn that its another cash grab.
Their stated design goal was to create an actual usable payments system; not a speculative asset .
Edit : Urrgh got that wrong . Fixed distribution of coins and yes the founders control most of them
Any privacy protections for speech are unlikely to apply to financial transactions anywhere in the world.
This is a disastrous mistake.