Hacker News new | past | comments | ask | show | jobs | submit login
Ask HN: What are your arguments in favor of end-to-end encryption?
190 points by rahuldottech on Oct 4, 2019 | hide | past | favorite | 245 comments
Also, how do you respond when someone brings up concerns of E2EE platforms being used for child sexual abuse imagery or terrorism?

Keep in mind that these arguments have to be made to laypersons who aren't necessarily from the United States, and who don't usually have a lot of technical knowledge.




Politicians propose to forbid all buildings from having doors. After all "bad people/stuff etc." could lock the doors and hide behind them. Anyone arguing against that is obviously against safety.

Counterpoints:

- Do we currently have a big door problem?

- Wait, don't doors also serve an important function?

- Won't that make everybody much more insecure and basically do nothing against "bad stuff"?

- What if I put a wooden plank in front of the hole in my building? Wouldn't that be a "door"? Making doors illegal is not going to stop people from making "doors".

Now, people like to spin this analogy further and revise their proposal and say "Fine, keep your doors, but I get a spare key for every door made".

Problems with this:

- Yes, you and everyone in your office can grab the spare key and steal all my stuff (see TSA locks and basically any time in history that was tried).

- Remember the wooden plank above? That guy will not give you a spare key and can still hide "bad stuff".

- Fine, we will just use magical (blockchain) keys that nobody can steal and not make things insecure, but have an officer visit and inspect every room you have every 5 minutes. You have nothing to hide, do you?


I'm not sure this is a great analogy as yes, we permit people to have doors and locks but society also provides a mechanism for the government to lawfully get access to them. If the Police have a legit reason to access a property they go to court and get a warrent, and if they need to they'll kick the door in to get in.

The current government requests to be able to access encrypted info with a warrent are an extension of what currently happens in physical space.


"If the Police have a legit reason to access a property they go to court and get a warrent, and if they need to they'll kick the door in to get in." That's what currently takes, place, Government doesn't have the keys, they have to use force to get in, or other methods. (However there are physical limits to materials, so there is usually a way to break in)

But, by having a special key that opens all the doors, anyone could copy it - yes rules can put in place to who as access, etc, etc, but by knowing there is a "hole" in each device, every possible malicious agent will try and break it as soon as possible. Then what?

We have seen examples by Law Enforcement officers using accesses to gather data that would required a court order, but they didn't have one, and it was for personal reasons. So, how does that work out?


The police are not the only ones who can get a battering ram.

>But, by having a special key that opens all the doors, anyone could copy it - yes rules can put in place to who as access, etc, etc, but by knowing there is a "hole" in each device, every possible malicious agent will try and break it as soon as possible.

This is true in theory but it this a risk in practice?

>We have seen examples by Law Enforcement officers using accesses to gather data that would required a court order, but they didn't have one, and it was for personal reasons. So, how does that work out?

You sue for damages under section 1983.


> This is true in theory but it this a risk in practice?

https://en.wikipedia.org/wiki/Data_Encryption_Standard

TLDR: yes. Especially for companies and political dissidents (because countries, including the US, have used their secret and not-so-secret services to go after these. China vs Dalai Lama seems to be a rather well-known example, as is the theft of Airbus secrets by the NSA (not that the EU didn't do the same to Boeing). And if you can't trust the NSA with those keys, who exactly do you suggest we trust ?)

> You sue for damages under section 1983.

Ok, well let's keep in mind that this police officer was not convicted:

https://en.wikipedia.org/wiki/Shooting_of_Michael_Brown

So unless you've got better cause for complaint than 12 bullets in your back and more than one witness, why even bother trying ?

I don't get where people get the idea that cops are somehow above ridiculous abuse of the system. When it comes to direct abuse of surveillance:

https://jezebel.com/cop-previously-charged-with-stalking-sho...

https://www.seattletimes.com/nation-world/prosecutors-cop-us...

Note the duration of time these police officers were allowed to proceed, even after complaints were filed. Years.

The problem with any system that consists of people, is that people can be total immoral and criminal. Including, of course, Law enforcement, even judges. That means that we should make such systems safe even if groups of people within them conspire to commit crimes. Failure to do so can result in incredible damage to people. For a very recent example:

https://www.thelocal.it/20190628/italian-police-uncover-gang...

TLDR: the major, police, social workers, youth services and psychiatrists conspired to kidnap children and sell them to brothels, sex shop owners, and whoever else paid them ... out of hundreds of children stolen in this way, 2 have been returned after these people got caught.

Of course it was subsequently revealed that there are multiple dozen municipalities where such conspiracies existed. The state immediately intervened to stop all investigations except the one that had already made the paper "la Republica".

There is not a single European country where members of youth services haven't been caught doing the same, from Romania, to Sweden, to France, to the Netherlands.


A police officer does not need to be convicted criminally for you to get money from the state. If they've treated you unconstitutionally or unlawfully you're within you're rights to sue for damages under section 1983.


A police officer does not need to be convicted criminally for you to get money from the relevant government. If they've treated you unconstitutionally or unlawfully you're within you're rights to sue for damages under section 1983.


How do you know nobody has a copy of your house key? I live in an apartment building and it's actually mandatory for the super to be able to enter my apartment in emergencies so he has a key.


That's not the argument they made.

I do not know that there is no one out there in the world who has a key to my house. Even if there was and someone found that key on a city street they would likely not be able to figure out which house it opened.

I know there is no legally mandated key to everyone's house that would allow anyone to enter whomever's house they please.


well, there is kinda a key is that lets anyone in - in the UK they call it 'the enforcer' https://en.wikipedia.org/wiki/Enforcer_(battering_ram)

If an officer does something that should require a court order and don't have one then they end up prosecuted in the same way a criminal would be. You put checks and balances in place to make sure that they are caught.


The problem is using "the enforcer," breaking in, and taking file cabinets is loud and obvious. Accessing your gmail account and dumping its entire history takes seconds and is entirely unnoticeable.

You can't compare physical and digital privacy, why are people still trying it?


> The current government requests to be able to access encrypted info with a warrent are an extension of what currently happens in physical space.

The key difference, to me, is that the current setup where the police can kick in the door to get in does not require subjects to make it any easier / more convenient for the police. If they have to raid and break in and get an approval, they will, but I am not required to arrange my locks or my furniture to help.

In fact, I am free to do the opposite. For example, I can put the things I do not want to share (private photos, detailed plans to become the world dictator, etc.), in an incinerator safe and try to destroy them if the doors are flying in. My 2c.


Shouldn’t they come to me then and look into my phone instead of constantly looking into my messages on the server? I think the door is a great analogy.


Right. I believe it’s just laziness on their part. If the crime is abusing children, go catch the guys doing the abuse. If you’re worried someone is in possession of illegal materials go get a warrant and search their home/computer, etc.


and if you say "no", they're screwed. Whereas with a door, they can just push you out of the way and kick it down.

I'm opposed to back doors, but the door analogy is a bad one.


There's no such thing as a perfect analogy because the entire point of an analogy is it takes an argument and reframes it in a different context. Different contexts have different edge cases and thus no analogy fits an argument perfectly.

Given this door analogy works for the majority of the arguments being presented (which is impressive in itself given how different the physical and electronic worlds are), I'd say it's actually a pretty good analogy.


> and if you say "no", they're screwed

This is false. If it's ever true, the crime is confined to the perpetrator's mind.


Any analogy has its limitations, but I think it is helpful for talking about things like "back doors" (and how that is no different from not having doors at all) or how a proposal is basically only "unintended" consequences and no gain. Feel free to suggest a better analogy.

The main difference where this analogy breaks down is that it is much easier to build practically unbreakable encryption (assuming P != NP), versus practically unbreakable doors or safes.


If you say no, then you're arrested for contempt of court or similar.


They can't kick it down and push me out of the way if I have built an underground bunker.

And surely we all deserve an underground bunker.


no, if you say "no", you're screwed. they jail you until you cooperate with the investigation.


Warrants give the government the legal right to access private materials or information. It allows them to use measures that would normally be illegal, to gain that access.

This is equally true for doors or encryption. If the government has a warrant for some data, they can attack the computing system that holds the data--just like trying to kick down a door.

They do this successfully all the time. Encryption is math in theory, but in practice it is implemented in hardware and software, neither of which are perfect. They are usually breakable.

The FBI made a big stink about forcing Apple to help them break the encryption on an iPhone. The FBI's own inspector general said that the FBI did not try hard enough to break into the phone before they went to court. And ultimately the FBI did break into that phone and access the data!

There is no need for a special law weakening encryption.


You don't have to go down to your police station with a copy of your key every time you change you lock, which some of the "solutions" imply. Further, there are no laws for how strong of a door you can build: you're more than welcome to have a safe with a 3-ft thick steel door and an unpickable lock, that'd take a professional a month to get through.


Police can request access to your phone and if you say "no" then they can send it off to forensics to try and break their way into it.

Some buildings are barricaded to make forced entry harder, some phones are more secure which makes hacking into them harder.


If the government of a wealthy nation state decides to read messages a given group of people have been sending to each other using user-friendly consumer chat services, it will succeed.

It just can't do so casually, with minimal resources, with a low probability of detection like it can when those messages are sent in the clear. A targeted cyberattack authorized by a warrant is the digital equivalent of sending a SWAT team to kick in a door.


They can get a warrant and have a court compel you to provide passwords already. That's equivalent to locked doors. What they want is the ability to go through peoples stuff without them knowing (via court order or not isn't even the point). Its not at all like the physical world.


The police, the government, the intelligence agencies and so on are not abstract entities, they are composed by people at all levels, in a capitalist economy, with human biases and wishes. There are plenty of documented examples of abuse of this kind of access for fun and profit.

And besides those not-so-abstract entities, they have contractors from private companies and corporations that aren't abstract neither, but even in abstract mode are driven by profit, not respecting your privacy/security/economy.


> (see TSA locks and basically any time in history that was tried).

For anyone unaware, the TSA lock master key was leaked by including a photo of an actual master key in a newspaper article about said locks. I don't think encryption keys shared with police/govt. will be any safer.


Also, IIRC some of the keys were reverse engineered even with no government negligence necessary.

https://www.google.com/amp/s/ctovswild.com/2016/07/25/safesk...


Everyone knows that encryption master keys will go exactly the same way -- they'll leak eventually (maybe there'll be a newspaper article with a picture of the master key).


Reminds me of the concept of 'Perfect Security' from the 1800s

https://99percentinvisible.org/episode/perfect-security/

The pursuit of lock-picking is as old as the lock, which is itself as old as civilization. But in the entire history of the world, there was only one brief moment, lasting about 70 years, where you could put something under lock and key—a chest, a safe, your home—and have complete, unwavering certainty that no intruder could get to it.

This is a feeling that security experts call “perfect security.” Since we lost perfect security in the 1850s, it has remained elusive. Despite tremendous leaps forward in security technology, we have never been able to get perfect security back


To counter that metaphor, what would the objection be to doors that lock, but the police are given a master key?

There are a few obvious issues with centralisation and the possibility of bad actors on the police, but I’m not sure how persuasive it is against “think of the children!!”


Every power any government has ever been given has been abused. Best to limit any government as much as reasonable.

Most places where child endangerment is/would happen is already encrypted, and it doesn't seem to be significantly hindering investigation. Beyond this, requiring a master key won't stop independent implementations that don't have such a thing.

It's like criminals are willing to break the law or something. Areas with strict gun control still have gun crimes, and people willing to endanger children would still use encryption without said back door.


> Every power any government has ever been given has been abused. Best to limit any government as much as reasonable.

Do you really think this is sellable to the average voter? That isn't a mainstream opinion.


Which is pretty sad. It's part of what this country (USA) was founded on.


The objection is they'll lose it, and locks will be useless. See: TSA locks are now useless because the TSA leaked images of the master keys, which anyone can create now.


I support it 100%, because I have everything to hide as my life is mine and doesn't belong to anyone else, including governments or improbable divinities. If for some people in power this mean I'm either a murderer, a rapist, a drug dealer, a pedophile, a terrorist, or whatever, they're free to spend taxpayers money to find out how wrong their assumptions were, then get voted out of their seats. Anyone using the "if you have nothing to hide" argument is just pushing you into relinquishing your privacy rights to gain power over you. Just try asking them their own passwords and hear the very predictable reply.

Intelligence does exist for the purpose of catching people doing nasty things even when they do it behind the curtain. Making curtains illegal would be the obvious stupid response which would harm everyone. Nobody ever said that democracy is either free or easy; a bunch more criminals at large sometimes somewhere is a price we have to pay to have billions of people, including us, enjoying what remains of their freedom.

Just to avoid the most predictable counter argument: I'd keep defending this principle even in case one of those criminals would exterminate my entire family.


“ If for some people in power this mean I'm either a murderer, a rapist, a drug dealer, a pedophile, a terrorist, or whatever, they're free to spend taxpayers money to find out how wrong their assumptions were, then get voted out of their seats. ”

They don’t believe this; it’s an argument framed in a bad faith so that they can strip peoples rights and jam laws down our throats. Their mastery is in framing. Never use Or repeat their frame.

See George Lakoff’s work in framing. It’s essential in environment of heavy propaganda.


"See George Lakoff’s work in framing. It’s essential in environment of heavy propaganda."

A bit late but thanks for suggesting Lakoff. I'm 1/3 through the video linked by another user and am loving it; it should be dubbed in other languages and spread around.


What work by George Lakoff would you recommend? The guy has like 15 books published ^_^


His framelab podcasts are informal and easily digestable.

https://framelab.us/podcast/

I highly recommend

* truth sandwich time (if you only listen to one make it this one)

* how republicans really think (if you only listen to one make it this one, too)

* how trump uses twitter to control the media (very eye opening)

* guns over people (on how to frame the gun debate)

Also, this lecture on political language exposes the leverage hooks politicians and propagandists use to hook and manipulate us. You will never listen/read political speech the same.

https://www.youtube.com/watch?v=5f9R9MtkpqM&t=28


I love this argument. I would also add that the individual is sovereign. Meaning, in the US at least, our view of the origin of government is that government is granted its powers by the people. A government cannot inherit a right that it’s citizens don’t possess. Therefore if governments have a right to free speech, bear arms, etc.. so must it’s citizens. Other western democracies do not trace the origin of government power to the people... The UK and the larger British Empire for example trace the origin back to God as manifest in the monarchy. The modern German and French welfare states trace their origins to the state — a nameless collective organized to benefit its citizen’s welfare (with any rights conveyed to citizens a matter of convenience rather than a source of power). Yes I might be expressing a rather neo-con / superior attitude but if you simply equate the origin of individual rights in programming terms - In the US, individual rights are the global variable from which everything originates. The French and German versions are essentially undeclared variables and the UK inherits it’s rights externally from a black box. Now you tell me, from a programming point of view, which is preferred?


The "I have nothing to hide" argument is silly, but:

> Just try asking them their own passwords and hear the very predictable reply.

Is equally silly. Having nothing to hide is very different from having nothing to steal.


lack of end to end encryption means MITM is possible

MITM means that somebody can steal your passwords (including your bitwallet)

So if you have something to steal, then end to end encryption is important.


Like Data?


> I'd keep defending this principle even in case one of those criminals would exterminate my entire family.

I think that's a bit too far... but I get your point.

When having a discussion around privacy, I had no response to "you shouldn't have anything to hide" because I know privacy should somewhat be a human right (especially given its commoditization) but didn't know exactly why it's so important given that most Gen Z kids are sharing every aspect of their lives on social media.


Maybe you and I have different understandings of what a "right" is. I define a "right" as something that cannot be taken away, and there are very few of these. Your story, your thoughts, and your will, are all you have a right to - while you are alive.

Every other nicety in life is due to mutual respect, agreements and the ability to use force should those agreements be broken.

If I am using a restroom, I don't have a "right" to privacy. Tell that to a prisoner who has to take a shit in front of their cellmates... Even in comfort of your own home, someone could kick the door open. The fact that they don't kick in the door, is due to mutual respect for boundaries. This is what I would call a privilege, which has been mutually _agreed upon by_ and _granted to_ all parties involved.

Privileges make up our freedoms. They are the things that we fight for, and should continue to do so.

We should make an effort to not conflate the two, as it tends to blur the lines and give people a false understanding of what they have a right to intrinsically, vs what they must fight for.


Although I agree with what you're saying, I always thought that a right was something the government gave us after taking it away in the first place, proving that a right is a political term, at least now days.

I've always used intrinsic right as you suggest to describe what you mention, to differentiate the two.

Because the problem lies in the political domain, it's not unexpected that these two ideas (intrinsic rights vs privilege) are deliberately conflated precisely to blur the boundary, making their agenda achievable: the control of people.


My response to the "I have nothing to hide" argument:

i) do you wear clothes? You are hiding yourself! Why not walk naked down the street? You have something to hide.

ii) do you have curtains on your house? Why? (The answer is almost never "to keep out there light") Most people walk fully clothed in their own house. You have something to hide.

I also liken dragnet surveillance (a major reason on why we need E2EE) to upskirting. People have a basic right to assume some privacy even when in public... Otherwise the objectionable practice of upskirting should be legal too.


Why not walk down the street naked? I'd love to, but then I'd get arrested. Irony...

Cheekiness aside ( Pun ;) ), I second your point. "Having something to hide" is frequently conflated with "not wanting to share something with everyone that I don't need to".


> > I'd keep defending this principle even in case one of those criminals would exterminate my entire family.

>I think that's a bit too far... but I get your point.

Another way to say this is "I'd uphold this principle if it were your family, and I'd expect you to do the same if it were my family." It's understandable for principles to break down for individuals in extreme (contrived) circumstances, so long as most people abide by them.


> how do you respond when someone brings up concerns of E2EE platforms being used for child sexual abuse imagery or terrorism?

These are only a tiny part of uses of encryption. Ask anyone if he would like to have his bank transfers, or his credit card credentials in plain text. End to end encryption allows the whole internet to act as a commerce platform.

Encryption allows journalists and activists in strict, controlled regimes to let facts out. It allows an abuse victim to safely expose the abuser. It allows at a broader spectrum to maintain secrecy when secrecy is the only way a subject has to distantiate himself from harm.

Disabling end to end encryption requires an implicit good faith on those who look at our communications, and the history is full of abuse from those figures.


You are confusing E2EE encryption with encryption in transit/rest in the commerce example. The majority of transactions today are encrypted in transit and (you would hope) encrypted at rest so that the bank and selected parties can access the data (including the customer). There is no bank that would encrypt financial data using E2EE so that only the customer and merchant could access it, which is the analogy here on E2EE with messaging.

Sure, now we are looking at tokenization which reduces the risk merchants store your details insecurely, but commerce will always require a bank to store your information and share it with legislators for anti money laundering purposes etc.


> You are confusing E2E encryption with encryption in transit in the commerce example

I think he meant to do that. E2EE between two people has the same kind of requirements as E2EE between a person and a server. If you're trying to say point-to-point encryption, where the server is just a relay between the points, and it handles the data unencrypted, then I think all the arguments for E2EE apply here as well.


I think it would be entirely reasonable to have communications between a person and their bank end-to-end encrypted (isn't that the goal of SSL?) as well as communications between a person and a vendor or a vendor and their bank. Wouldn't this cut down on the instances of credit card information and other data being intercepted while in transit?


Correct. Nice catch.

I still think that full E2E is a fundamental human right.


Many governments agree with you. Sometimes hypocritically.

https://en.wikipedia.org/wiki/Right_to_privacy


They still catch them, usually by posing as a "bad guy" and infiltrating their group. That's how it's been done forever, and it still works that way.


Much like crimes using a gun are against the law doesn't stop criminals from using guns. Laws against backdoor-less encryption won't stop criminals from using encryption without a backdoor.

I'd be surprised if most of the "child sex abuse" and "terrorism" traffic isn't already encrypted.


Twofold: one, criminals are, generally, stupid. They're not going to be perfect, and when they slip up we'll get them.

Two, people are sex trafficked in cars and in planes as well, should we stop using those? "But we can patrol and monitor planes and cars and catch the bad guys!" Okay, but then why do they still do it? Did any of that stop sex trafficking? No.


Because encryption is math and knowledge. Banning it will only stop legitimate users while bad actors can still just go ahead and encrypt their stuff.

If politicians consider leaving everybody vulnerable to catch criminals, this is a incredibly high price to pay. I’d argue that the price is so high that even with evidence that this would help catch criminals we should still consider not doing it. However there is no evidence for that and my argument above explains why criminals would still be able to encrypt.

We should really stop implementing any security legislation without checking whether it actually achieves the stated goals.


Blackstone's ratio¹ is a cornerstone of our legal system. We forget it at our peril, for that way lies tyranny.

¹https://en.wikipedia.org/wiki/Blackstone%27s_ratio


I agree -- this is my fundamental disagreement with many laws that are in place. When they penalty to the good-actor is so severe to catch a small minority of bad-actors, it's a poor choice.

I do believe we should search for solutions, I don't believe that we should let a small % of bad actors control our lives.


Counterpoint (playing devil's advocate) - if we ban e2e encryption platforms (or require a backdoor), then anyone found to be using a non backdoored tool is suspicious, reducing the effort required for law enforcement investigations.


but then how am i going to keep my ssh server safe? i get break-in attempts every second. if ssh gets a backdoor, then i guarantee you it will be exploited.

intruders may not care about my communication, but they do care about being able to access my servers, so you can not force me to use encryption with a backdoor without putting me and my company at risk.

if encryption without a backdoor gets outlawed entirely i'll go out of business because i will no longer be able to run any servers.


This would be only true if this was a international law. In all other cases you will have a ton of people just using what the other side under a different jurisdiction uses without even knowing it has no backdoor in it. The increase in false positives that comes with this will make it an unusable heuristic to identify criminals.


* If it's really about few really bad crimes, then nothing needs to change. In addition to the traditional methods, Governments already have ways to hack a few people. It's just that the more people they hack the more likely it is that the hack gets discovered and they want to spy on the masses.

* We leak tons of metadata. Even with encryption it will be available to governments and gives them tons of ways to pin down people. Eg. in some cases police used location information of cell phones to create a list of suspects. A lot of that metadata is very hard to avoid so it's likely going to stay.

* You don't just protect yourself from the government, but also the provider. Recently a report surfaced about a yahoo employee searching his colleauge's yahoo accounts for naked pictures.

* Providers can also get hacked. If the data is in encrypted form at the provider, the hackers would have to issue an update of the client which is usually harder than "just" hacking some servers. Those hackers can even be foreign governments.

* Safe deletion gets much harder when you have to worry about data on your provider as well. There were stories about providers not deleting data that users explicitly wanted to be deleted. There's also the problem of safe hardware decomissioning. Although most big shops are handling this problem more professionally than most individuals who just run format on their laptop's hdd and then offer it on ebay, you still have to take them by their word and rely that they do their job well.


Just because someone can abuse a thing doesn't make the thing bad, it makes the person who commits the abuse bad. We don't ban cars to fight drunk driving and we shouldn't eliminate the spirit of the 4th Amendment to go after child pornographers, terrorists, money launderers and drug dealers. Even with E2E encrypted communications the fact that user A is communicating with user B, when, and for how long is knowable, and that metadata alone can be sufficient to get the warrants necessary to effect legal, invasive searches without disturbing the rights of everyone else.


[flagged]


I see these comparisons made so, so frequently and it bothers me. Guns are not the same as encryption or cars. Yet they're so often made in apples to apples comparisons that it's mind boggling to me.

Weapons are uniquely special in that they are specifically designed to maim and kill. Via defense or justified actions is irrelevant; it's a tool of war. Arguably, if there was E2E software that was specifically designed to maim and kill it might be received in a similar manner as guns.

I'm not saying guns don't have legitimate uses or the right to ownership in the hands of legal, sane owners.

You don't think if people started using impaling spike strips for the front of cars that there might be similar discussions about banning said strips?

Many who advocate for tighter gun control make exceptions to hunting rifles. Those very clearly have a use other than the death of humans. Could they be abused? Certainly. But tools can be abused all over the place.

However when someone takes a weapon, designed for slaughtering, and slaughters with it.. well, can you blame people for questioning the validity of owning these items?


The argument is: If you (USA) accept that kids are harmed due to lack of gun control, then do not use harm to kids as an argument against E2E encryption. It is hypocritical.


Just because the victim is the same class of people does not make those equivalent or make us hypocritical.


"Those very clearly have a use other than the death of humans."

"Via defense or justified actions is irrelevant; it's a tool of war."

Your two statements above conflict. All types of firearms have been used in war, yet you want to make exceptions for hunting rifles. How do you explain this? Also, how do you differentiate a weapon designed for slaughtering versus a tool as you use both in relation to firearms?


It is exactly the same with guns. Mind you i come from country with relatively hard to get gun licenses.

What about sports shooting? Collecting? Personal defence in dangerous areas? Hunting(which because we fucked up ecosystems in some areas, culling is necessary)?

Also over here modern black-powder guns are legal, without license. And they are both VERY dangerous(way more dangerous in a crowds) and relatively cheap. There is a legal requirement that you have to load the bullet as separate parts(gunpowder, bullet etc).. but what's going to stop a criminal from going on rampage and from preparing them in advance?

Gun violence is a symptom of a worse issue in the society, banning guns will just hiding the symptom of the issue. Why they go on rampage? Why some people need it for personal defence(dangerous neighbourhoods? work-related?)? Why do we need to cull the wild animals from time to time?

Heck, if someone wants to go on rampage people they don't need guns, in a big crowd chef knife will be as deadly. And you can legally buy a machete too, or chainsaw, or axe, or whatever.

Bombs can be made from household items and there are plenty of instructions online. There is a schematic of timed detonator on Wikipedia on Casio watch page (google Casio terrorist watch).

It all boils down to proper culture of handling weapons, and not treating them as toys.

The difference between impaling strips and guns is simple: one is used, legally, in specified areas(shooting range, countryside for hunting, at home for defence etc.), while other is mounted permanently and used in public space. One shouldn't keep the gun assembled while transporting it - except if it is for personal defence.

I seriously have no issue with people using impaling spikes in wreck racing, as long as they are within regulation of the race. but on public road? hell no.

In a perfect would we wouldn't need guns at all, as there would be no reason for them to exist.


> What about sports shooting? Collecting? Personal defence in dangerous areas? Hunting(which because we fucked up ecosystems in some areas, culling is necessary)?

I covered that in hunting rifles. Various types of rifles have legitimate uses. However, it's an argument not in good faith to say that anything with a possible sport should be legal.

I can't make a rocket launcher sport and demand that rocket launchers become ~freely~ fully legal because it has a sport. This is a bad argument.

> Gun violence is a symptom of a worse issue in the society, banning guns will just hiding the symptom of the issue.

I agree entirely. You can have both however, mental health and restrictions. See: most first world countries other than the US.

The funny thing in these discussion is we already do have tons of regulation. The line is already drawn, we're not discussing drawing it, we're discussing whether or not we should move it.

Your arguments could be made about various rocket launchers or, hell, missiles and bombs. The line is already drawn there however, and the same argument for and against various rocket launchers (some legal and some illegal I believe), missiles, bombs and etc could be used in both cases.

Neither argument for or against guns inherently wins the argument; there's subtly in both. However it is my belief that the same reason we don't let people own larger scale weapons of destruction is valid for the larger scale automatic / semiautomatic weapons.

I am in full support of hunting rifles. Less so AKs and the like. I don't care if you have a sport around AKs - in the same way that I wouldn't care if you had a missile "sport".

edit: words


AKs and ARs are used for hunting and use the same rounds as other non "assault rifle" weapons. There is no ballistic difference. Both are just as deadly. Moreover, many more people are killed with knifes than rifles[1].

1. https://ucr.fbi.gov/crime-in-the-u.s/2017/crime-in-the-u.s.-...


> Moreover, many more people are killed with knifes than rifles

I'm sure. Just like I expect cars to be more dangerous than guns, too. But you're drawing odd conclusions. My point was that tools have a place. A car is a tool. A knife is a tool. A hunting rifle is a tool.

A rifle with the capability of mowing down herds (or people) with a high rate of fire has little merit in my mind. I speak generally, because I don't explicitly mean automatic/semi/etc because that's a whole other debate. Hunting rifles don't need "mow down herds" capability. Likewise, if you can walk into a store and shoot 50 people with ease, I question if you really need that capability for hunting.

How many people in a crowd do you think you can kill with bolt action hunting rifles? Likewise, how many people in a crowd do you think you can kill with a knife?

I despise these arguments of "but I have sports with X guns!" or "but I use X gun to hunt!". You can fish with explosives but it's not needed nor is it legal in many places.

I support rifles for hunting, but there are limitations on the types of rifles, rate of fire, real use cases and etc.


"I support rifles for hunting, but there are limitations on the types of rifles, rate of fire, real use cases and etc."

Can you explain what those limitations are? Your mention of use cases and what is neccessary may conflict with others'. For example, quick follow up shots are necessary when hunting multiple feral hogs to reduce their environmental impact.


Can you explain why a black-powder gun would be more dangerous? I don't see what would make them so much more dangerous than a typical rifle.


You basically load the cartridge in by hand every time. If you leave some space between the powder and projectile, you risk the gun blowing up.


> Weapons are uniquely special in that they are specifically designed to maim and kill. Via defense or justified actions is irrelevant; it's a tool of war. Arguably, if there was E2E software that was specifically designed to maim and kill it might be received in a similar manner as guns.

This is nothing more than a politically motivated lie.

You cannot escape the fact that guns are overwhelmingly used for peaceful purposes that do not include maiming and killing. If this were not the case, Americans would all be dead or maimed by the guns that outnumber people in our country.

Even where the evidence strictly supports your claim, it counters the intent you imply. FBI standards for selecting ammunition, for example, test penetration through clothing and material designed to simulate a human body, but the intent is to stop lethal threats with a minimum of collateral damage. Quite opposite to being "designed for slaughtering", they are designed to minimize harm, while serving a defensive purpose.

> Via defense or justified actions is irrelevant

I think you'd find the opposite to be the case if a person were threatening your own life.


I'm against most restrictions on gun ownership as I assume you are, but I can't agree with your analysis here.

Though I'm currently living somewhere it's not legally possible, I have carried a pistol for self defense in the past. I never had to draw it or fire it at anybody. Nobody is dead or maimed because of my pistol. When carrying a pistol, I was always especially careful to try to de-escalate any potential conflicts, because I do not want to maim or kill anyone.

Its designed purpose, however is 100% to maim or kill other people. I carried it in case I needed to maim or kill someone (or more likely, use the threat of doing so) to prevent harm to myself. It isn't a piece of sporting equipment that's only incidentally deadly, like a target pistol, but a purpose-built defensive weapon.

Claims that the subset of firearms designed primarily to be antipersonnel weapons are something else come across as disingenuous to neutral observers. I hold pro-gun positions because I believe individual armed self-defense is a good thing, not because I think we should consider guns primarily as sporting equipment and only incidentally as weapons.


Even then... outlawing guns won't stop criminals from using them.


guns have legitimate uses such as defense and hunting.


Maybe you missed the part where I discussed defense and hunting.


They're not designed to maim or kill, just to accelerate a piece of mass. Police regularly use beanbags and target shooting is an olympic sport. Designing firearms spans all of STEM and keeps people employed well.

If the US government wanted to reduce the lethality of firearms, they would ban calibers, not accessories. Even so, a .22LR olympic pistol is enough to take down a bodybuilder with one critical hit. So olympic shooters could become murderers overnight, or have their weapons stolen. If not, why suspect that average people would instead?


This line of argument is disingenuous.

Blades are, at one level of abstraction, designed to sever fibers and occasionally other materials. A straight razor is designed for a human to use to shave hair. A nakiri is designed for a human to use to slice vegetables. An executioner sword is designed for a human to use to kill another human by decapitation.

Likewise, many firearms are designed primarily to be good for shooting other people to incapacitate or kill them. I do believe most people should be able to obtain such weapons, but I don't find it difficult to imagine why someone might think otherwise.


If that's the case why do such laws exist as foldable knives and switchblades being illegal to carry but sturdy full-length ones are fine, in some countries? Why is banning pistol grips considered having prevented or hindered lethality?


I think bans on types of weapons, and on tools that can be used as weapons tend to be based on public perception of who uses them, and for what purpose. Politicians do not consult masters of knife-based martial arts or designers of fighting knives when drafting legislation about knives. Politicians backing gun restrictions in the US famously tend to be unable to explain the function of features banned by their legislation.


You can do the same with e2e encryption. It’s not secrecy, it’s literal 1s and 0s.


If the encryption was successful and 'unbreakable' it better be just 1s and 0s.


Guns are directly linked to the actions of those bad actors. A private tunnel of communication is not so directly linked to the actions of child abusers (nor the images they share on these platforms).


If you use E2E as a means to sell or auction a person against their will, wouldn't that directly link the technology to their illegal action?

Also, distributing child porn is itself a crime, separate from the abuse. So you would be directly using E2E in a crime that way. Are you implying that some laws hold less moral or legal value? If so, what are the differentiating factors in that decision?


(Don’t) Try to use the sole function of a gun on yourself without harming yourself. Now use WhatsApp on yourself and see what happens. Do you do nothing because you have to think up something to write? The act of writing up the auction is the first part of the crime. Even if you don’t go through with selling a human you may or may not have, you may still be charged for having written that message and sharing it somehow.


I don't see the point you are trying to make.

Using the function of a gun on oneself is not a lawful use case, just as selling a human is not a lawful use case for WhatsApp. A more apt comparison using your example of not writing anything to encrypt would be the possession of a firearm compared to the possession of an E2E system. Both have lawful as well as unlawful uses.

On the part about writing the message being the first part of the crime and comparing that to committing suicide with a gun, the gun is the means by which the crime was committed, just as the means for the crime of selling the person would have been the medium through which it was transacted - WhatsApp in this case.

Perhaps you where trying to explain something else?


They are both tools that can be used for good or evil.


Guns can be controlled without eliminating them from the hands of the public. E2E encryption cannot be "controlled" without undermining it's nature and purpose.


What if the government decided that you can use E2E encryption, but only using encryption protocols they are capable of cracking? Like, you could only use DES for your E2E encryption. That'd be similar to how gun control is now; you're allowed to have them, but only if the government approves them. If you need stronger than DES, you have to send in an application to the federal government, just like people who want automatic weapons or suppressors.


I love this devil's advocation. I certainly don't agree with it but it makes a great conversation.

Stir that pot.


> I certainly don't agree with it but it makes a great conversation.

Does it though? It seems like a fallacious comparation for reasons that other comments have already explained. And as such, it makes a confuse, meaningless conversation.


Yeah I guess that's fair. It's a fairly shallow attempt to evoke a response.

At the same time, I still enjoy it because it did create a lot of responses.

I find discussions these days end up being an echo chamber of the same opinion. Something different and something to argue against is more interest than everyone just confirming each other.


The only antidote is an emotional connection with history and the reality of oppresion around the world today. No one who feels like they "have nothing to hide" can be convinced of the value of privacy until they have made an emotional connection with the oppressed and see themselves as potential victims.

Anything these people think of as "normal" activities has at one point or another been made illegal by a government, but without 1. Knowledge of specific cases 2. An emotional connection to those who suffered / are suffering and 3. A willingness to go beyond the fantasy of perpetual personal exceptionalism there can be no appreciation of the value of privacy over law, or privacy weighed against inevitable concomitant harms.


Relatedly is to bluntly tell them "You don't get to decide that you have nothing to hide - they do.". What was legal, expected, or even required is not guaranteed that it won't be judged negatively in the future.


Governments have a long history of doing bad things (e.g. hundreds of millions killed in the last 100 years by USSR/China/Germany but many lesser offenses such as the war on drugs in the US). You often don't get to roll back government powers as a government becomes more corrupt or authoritarian; so once you're in, you're in. Thus; even if giving people privacy allows some crime, it is probably not as bad as all the good that comes from not enabling an authoritarian regime by giving up all your privacy.


Cars have a long history of killing people, so do planes, so does AIDS, so does... everything, really. So we make changes, we improve, and now AIDs related deaths have dropped off significantly, we haven't had a fatal plane crash in the US in 10 years, and car related deaths in the US have decreased steadily since the 1960s.

Yes, governments have a history of being unsafe to their citizens, but it's not anything like what it once was, and it's getting steadily better, despite what the MSM wants you to think.

Now I'm not saying it's okay they backdoor all encryption, I just don't think the argument "Government evil" is going to hold water for the average person, nor should it.

A much better argument should come from the, "we prefer guilty people go free than innocent people get convicted, let's apply that policy to privacy" school of thought.


Comparing governments as bad actors (malevolent groups of people trying to retain and increase their power yielding already disproportionate amounts of power) to cars and diseases (inanimate objects or, well, diseases) is not a fair argument.

On one hand, organized crime, observable in most countries where governments are present, on the other hand everyday objects and a disease.

Doesn’t look like an argument made in good faith.


You say it's not a good argument but you don't say why. I think it's appropriate, insofar as it's the very government that's made these things safer, improved the lives of their citizens by getting involved.

The exact same mechanisms are available to fight both car deaths and malicious actors. Why do we trust the government to do one but not the other?

(Keep in mind I'm NOT in favor of backdooring crypto, I just don't think "but the government is corrupt" is a good argument against it)


Governments, including current one(s) do have a history of targeting activists and whistleblowers using legal and surveillance tools intended for targeting terrorism.

This does not benefit the population, it only benefits organized crime organizations entrenched in government.

How do cars benefit organized crime as disproportionally as abovementioned tools?


At this point I would actually prefer a criminal street gang to physically protect me. Because they don't care about my private life as long as I pay up. Government does care about my private life, even if I pay up.


Government today might not be too bad but that has no bearing on government tomorrow.

Anne Frank's father had nothing to hide when he filled in the official forms asking his family religion and we all know how that turned out...


Cars don't kill people and spoons don't make them fat; car drivers kill people.


An argument I saw recently that I liked:

“Because a citizenry’s freedoms are interdependent, to surrender your own privacy is really to surrender everyone’s. Saying that you don’t need or want privacy because you have nothing to hide is to assume that no-one should have or could have to hide anything.”

So while I'm not currently rebelling against my government, I'm sure as hell glad the protestors in Hong Kong can get their hands on E2E encrypted chat.


For me I think we will really get to a world where thought is augmented digitally in addition to just communication. My thoughts and my communications are private and just because it is possible to monitor them doesn’t mean it should. Mostly deontological as it’s wrong to invade privacy, but also utilitarian as to allow creativity and construction privacy is essential.

So I look at this through a lens of what would be allowed on my thoughts and speech. Would it be ok to read everyone’s mind to prevent a terrorist act? No because the damage caused is greater than the damage prevented. Not to mention it would most likely be used to charge for IP infraction or speeding tickets or some other banal infraction.


Compare it to an envelope in the regular mail. How would they feel if every post office along the way opened their mail, made a photocopy, and put it back in a new envelope before passing it on?

Because that's the way things currently are with e.g. Facebook Messenger, Gmail, etc.

E2E is when your envelopes are only opened by their final recipient.


But, I think the government should, with a warrant, be able to open peoples mail in transit. And they currently do. E2E encryption with no backdoor removes this ability from them.


It's really a question of scale. Would you be as okay with the government's ability to do this if they could flip a switch and suddenly do it for all of a person's mail immediately and without detection?

What about making that system available to anyone, irrevocably, who managed to get access to that system at one point? And would you put penalties in place for people who, when their mail is opened, are found to be using a cypher of their own? Is it illegal now to speak in code at all?


Yes, and that's a debate we should have as a society. I personally think privacy is more important than government's ability to peek at private conversations, but this is something we should collectively decide.


I'm with you, but as a critique for your metaphor:

Does the layperson receive meaningful mail anymore? With the exception of my W-2 and the occasional jury summons, I feel like nothing about my life would change if the post office just threw away my envelopes.


Yes, I get bills, banking records, payment slips, voting papers etc all per mail.

I also have a shredder to destroy it before throwing them away.


Rarely important stuff passed through the mail as everything has moved to email... Thus, making the issue even more prominent.


Encryption is math. Can we really make a form of math illegal?

I feel privacy is a basic human right regardless of what country you live in.

I’m not fan of punishing the majority because of a screwed up minority.

People who commit illegal acts as horrible as child abuse and terrorism are not going to respect the law when it comes to encryption.

Again, you can’t stop people from doing math. The idea of making it illegal is silly.


Actually they've already made some numbers illegal in the past [0], and exporting maths had been illegal in the US [1].

[0] https://en.wikipedia.org/wiki/Illegal_number

[1] https://en.wikipedia.org/wiki/Export_of_cryptography_from_th...


Yes, and the silly people are often in power.

"Well the laws of Australia prevail in Australia, I can assure you of that. The laws of mathematics are very commendable, but the only law that applies in Australia is the law of Australia."

https://www.theguardian.com/technology/2017/jul/14/forcing-f...


Wow, that’s a real shit argument.


> Again, you can’t stop people from doing math. The idea of making it illegal is silly.

I don't think anybody is suggesting two individuals should not be allowed to use math to protect their conversations. Even if Facebook adds a way for law enforcement to access communications individuals are still free to talk in code or encrypt their messages before putting it on the wire. With your old telephone, your carrier can wiretap your line but you can still use a scrambler or talk in code and the tap will reveal only metadata.

How is Facebook (or other internet services) being required to provide wire tap access any different from a telecom company?


Such a law would serve no reasonable purpose, though. Criminals can use one-time pads and it's also not hard to make a little encryption program based on existing cryptographic primitives. In fact, drug cartels have specialists for that who could probably even develop and implement their own secure-enough Feistel cipher if they wanted to.

The only purposes such a law seems to serve is to catch clueless idiots who will be caught anyway, and to enable mass-surveillance of law-abiding citizens.


Do the telephone wiretap laws serve any reasonable purpose?


Yes, because hardware devices for encrypting phone calls in real-time are not as easy to produce as text encryption software or stick-it notes with random numbers on them.


What does that have to do with whether or not a wiretap serves a reasonable purpose? Today, it would be incredibly easy for Apple to have encrypted voice calls as well.


A law must be enforceable, otherwise it is useless. A law for wiretapping voice phones is enforceable, because only few criminals have the capability to build their own hardware encryption devices for secure real-time voice scrambling. A law for wiretapping into text chat software is not enforceable, because anyone halfway skilled in cryptography can produce his own encryption layer on top of the wiretapped text chat. The worst inconvenience a criminal would suffer from such a law is that they would need to use the copy&paste function of their device.

A law that by design is not enforceable, serves no reasonable purpose.


But using it is applying math, so yes you could make its application illegal, says devil’s advocate because I am pro encryption.


Smarter bad actors could still do it without being detected. Hiding an encrypted message in unsuspicious messages isn't that difficult. I really don't see the point of having such a law.


Back to Devil's Advocate, You could say that about most laws, people breaking them will find more clever ways to avoid getting caught. The fact that you can be more clever, does not mean it should be legal.


I think one of the simplest arguments is that criminals who need privacy will move to their own platforms. Any law that weakens encryption only weakens the privacy of regular citizens.

People make a variant of this argument about guns, but there is an important distinction with encryption: encryption is purely defensive, doesn't escalate situations, and doesn't accidentally (or otherwise) kill anyone.

This framing makes it abundantly clear that any law against encryption is about one thing only: Spying on law abiding citizens.


Those who would give up essential Liberty

For a little temporary Safety

Deserve neither Liberty nor Safety

Edit: Also, when you "think of the children" you have to think not only of their immediate safety but to think of their future ability to freely and safely converse with their peers, no matter what the current government deems "acceptable".


The security and safety of almost everything relies on strong, uncompromised encryption.

There’s no way to reasonably draw, much less enforce, a line dividing licit and illicit uses.

If you compromise some subset of messages, illicit uses will just move to a non-compromised technology.

So instead of drawing a line, which is impossible (and also comes down to human judgements about things like whether gay people should be killed) the only choice left, if you insist on being able to decrypt messages, is to legislate the ability to decrypt all of them.

First of all, good luck enforcing that; second, in so doing you will sweep in a lot of legitimate uses of encryption and make people and businesses less safe by endangering their finances, their privacy, and even their physical safety.

Because once you give governments the ability to read messages even assuming key escrow entities can protect the integrity of the system (unlikely) this ability will be abused by bad governments who have records of inflicting human rights abuse on citizens for “crimes” as minor as being gay, being trans, or saying the wrong words about god.

And in addition to being accessed by the bad people in government and the bad people drawn like flies to honey to work in the key escrow organization, the escrow keys will get out and be abused by more bad people which will be an entire other level of problems.


Not sure if this outweighs concerns with E2EE, but governments unfairly discriminate against people with reasonable viewpoints I.e. government isn't perfect. So people with contrarian views should have a way to express views/organize. Historically governments couldn't watch what people were saying/doing at all times and E2EE allows that to continue in a digital world.


I always recall that statement Eric Schmidt once made about if you've got nothing to hide, you've got nothing to fear. It's not about fear of having my messages read, it's that you shouldn't have the right to read them. I guess at the end of the day, regardless of anyone else's behavior, I don't want my private communications being readable by outside parties. Should everyone be forced to wear a microphone and video camera so their private face-to-face communications can be monitored by a "trusted authority"? Of the volume of communications going back and forth constantly, I doubt "sexual abuse imagery or terrorism" combined makes up less than 0.01% of messages.

If respecting individuals privacy makes law enforcement more difficult, so be it. I'm sorry you have your work cut out for you.


You cannot remove your personal data once it is released (except via a time machine...) and your government and state can use this information for political motives that are as questionable as child sexual abuse and terrorism. In particular, you can never discard the rise of terrorist states.


Bruce Schneier articulated the backdoor problem best:

‘We can design beautiful locks but we can’t keep the master key safe’.

If we can’t keep other nations from stealing the nuclear bomb plans, how do we expect to keep the master spy key safe?


Encryption is just math. You can't outlaw it. If you do, I'll choose (or make) another chat app that uses the same widely known and secure crypto. If you try to pressure Apple to remove any secure chat from their app store, all you do is make the tiny number of people who still need security use jalbroken phones.

So my argument is: because it's a war that can't be won. The criminals will use secure communication regardless. All we can do is decide on whether we also want to make everyone elses communicastion insecure.

Law enforcement simply have to adjust to a reality where eavesdropping on communication is difficult or impossible.


Crime is a people problem which needs a people solution — officers on the beat, detectives securing convictions, courts bringing justice.

The fight against E2E is a political red herring to win votes. Politicians abrogate their responsibility to uphold law and order by playing with emotions instead. The current news cycle is absolutely symptomatic of that.

It’s a positive message: funding real police work instead can actually solve important crimes, if you recruit and train them. Let’s focus on that instead of a digital dragnet. I’d rather have real detectives on the streets cracking people trafficking gangs, than a database cluster.


The short answer: "None of your god damn business", which is the point.

The only counterpoint to end-to-end is "we want to be able to access your private conversations", which isn't really a counterpoint unless you agree with spying on citizens and would like to also allow the government to come into your house and place listening devices as they please, listen to your phone calls whenever they please, open up your mail whenever they please, so on. Hell, actually require you to wear a device at all times so all conversations can be recorded. No, just no.


> Hell, actually require you to wear a device at all times so all conversations can be recorded.

The government could similarly demand backdoors into people's private devices, so people can be listened to and their usage of the device recorded, in case they might be up to no good.

I see essentially no moral difference between banning E2EE and banning security of devices. If you have no right to communicate secretly with a person, why should you have any right to communicate secretly with a possession?


Exactly


There are already existing E2EE encryption services (Telegram, Signal, etc). Those engaged in illegal activities would switch or continue to use those if you degrade the security of other services.

You don't stop child abusers etc. They move to a different platform and you make everyone else less safe.


You can't tell criminals not to use confidentiality, they won't listen, but if you deny lawful people to use confidentiality, you effectively punish lawful people and not criminals.


How about the 4th amendment? Or even the principle of it if you aren’t in the US. No other argument is needed. If you argue against this you seriously need to re-evaluate your motives.

Ridiculous question.


You dismiss the question as ridiculous by pointing to the 4th Amendment. But you then seem to hand-wave away all the nuances that are intrinsic to your own argument, and thus make this question not ridiculous at all.

If you believe the 4th Amendment should be the answer to the question, then what about the flip side of the 4th Amendment: that it does allow reasonable searches with a warrant. This was the justification for "key escrow" systems in which master keys could only be unlocked with a court order. Do you support this approach? If not, why not?

Another question: If you believe the 4A's exclusive role, then do you also agree with the Supreme Court's interpretation that in ''national security cases'' electronic surveillance upon the authorization of the President or the Attorney General could be permissible without prior judicial approval? (See Katz v. United States)

If not, why do you believe so strongly in constitutional protections but not the equally-constitutionally defined role of the SCOTUS to interpret it? And if you do agree with SCOTUS interpretation, why should E2EE prevent a lawful intercept if directed by the President for national security matters?

For the record, I support E2EE, but these are serious issues that can't be hand-waved away. The question is anything but ridiculous.


How does the requirement for telecom companies to provide wiretapping capabilities square with your view of the 4th amendment?


I really don’t grok your question. Indiscriminate (“unreasonable”) use, without a warrant, is unconstitutional.


The 4th Amendment both implicitly creates (or, rather, assumes) a general warrant requirement (for which it sets a probable cause requirement) and bans unreasonable searches and seizures; it doesn't allow warrants for unreasonable use.


So as long as the same legal hurdles are in place, you don't have a problem with Facebook (for example) being required to provide law enforcement with access to unencrypted comms?


Don’t put words in my mouth. Your example is not the same thing to me.


I didn't intend to put words in your mouth.

I'm trying to understand the difference between a conversation over Facebook and a conversation on a telephone. Legally they are treated differently and I don't see why that should be.


You can kill someone with a hammer or a chair. Doesn’t mean we shouldn’t have them.


A computer can be used as a weapon.

Just ask anyone who has been hit over the head with a laptop.

Ban all computers.


My main reason to use end-to-end encryption is to protect people whose life might depend on it: Journalists and their sources, activists etc.

If everyone uses encryption by default, those people can not that easily be picked out from the sea of information and targeted in other ways.


Funny how the same people who argue that "you can't ban guns, bad people will get guns anyway" are now in favor of banning encryption.


Pre-telephone, almost all real time conversations were not available to law enforcement. That is the historical default. There was a brief time where phone and internet conversations were easily accessible to law enforcement. With the implementation of reasonable privacy provisions that is no longer the case and things have returned to the normal state of affairs.


Just as E2EE can be used for crime, channels without E2EE can also be utilized for crime - mostly for blackmail, and especially if it gets compromised.

Even if you trust all actors involved in non-E2EE communication channel you can never assume that:

* This channel won't be compromised(hacking, wiretapping etc)

* That all actors involved(ISP, VPN host) will always stay trustworthy

Latter part is also related to laws - if you cannot prove that law cannot be abused by a bad actor then it shouldn't be a law.

Also banning encryption won't change the fact that it will be used. Criminals will still use it to hide their action, plus there is always steganography.

Also one of basic rules of law is "Innocent until proven guilty", banning E2EE basically reverses that.

I love the "nothing to fear, nothing to hide" argument, just reverse it and instead of applying to general populace - apply it to government as whole. Rules should work both ways - if citizens have nothing to fear if they have nothing to hide, the same should apply to all politicians and all government agencies.


The most compelling reason I've heard, yet one I rarely use due to its complexity is about unrecoverable government capture. It goes like this:

In the past, governments could be overthrown by internal revolutionaries or external forces.

In the near future, governments will be able to surveil and anticipate their citizenry so as to make revolution impossible. They will do this because governments (political parties) have a self-preservation instinct. And with nuclear weapons in play, external overthrow is increasingly suicidal (excepting small countries).

Furthermore, that internal surveillance department can be turned on the government staff itself, leaving a small group of (unelected) officials with power over the rest of the government. Eventually one of them will gain the upper hand.

That means there could come a point of stasis, where governments become unassailably entrenched that humankind is stuck in a local maximum with whatever governments existed then.

Let's hope our current dictator for life is beneficent.


> how do you respond when someone brings up concerns of E2EE platforms being used for child sexual abuse imagery or terrorism?

The majority of criminals caught in transit doesn't warrant me giving up my privacy. They will still be caught in the same manners they are now, and it still offers them little protection over what law enforcement typically does.


I believe the federal government's concern (and those of various law enforcement agencies, etc.) is not with E2EE in general but with their desire for a specific (and, in my opinion, deeply flawed) implementation where they have an ability to read these messages. While law enforcement might be happy with a system that requires a warrant or some other paperwork, the US federal government appears to be demanding unfettered access to these messages.

In my opinion, the federal government's unfettered access to people's messages is entirely new with the advent of the internet. They didn't enjoy this level of access when people communicated by written letters nor when they spoke to each other over analog telephones. I believe the questions is less about the mechanism (E2EE) and more about the reach of the federal government and law enforcement and how comfortable we, as citizens, are with them having this kind of access to all of our communications.

In terms of people who are willingly breaking the law, they will always have access to communication methods that the federal government and law enforcement cannot easily surveil. Right now many E2EE mechanisms are the easiest way for these people to communicate privately. If the federal government gets their way and gains access to their communication, and starts to crack down on these crimes then these people will move to another communication medium. Perhaps even back to traditional letters.

There are many reasons to oppose an E2EE system where the federal government and law enforcement have a "backdoor" that lets them read all of these messages. For instance, it won't be long before another organization (perhaps even foreign) figures out how the mechanism works and gains access to every person's communications; the security provided by such a system will have a limited term and we may not know when that terms ends.

In my opinion, the most important issue is granting this level of power to the government and law enforcement. I think this could really be an existential threat to democracy in the US.


> They didn't enjoy this level of access when people communicated by written letters nor when they spoke to each other over analog telephones.

I would think the appropriate comparison is neither of those, but rather "when people met in person". Usage of the internet today is much closer to what people did when meeting in person than when writing letters or even when talking on the phone, it is replacing a lot of direct face-to-face contact.

The demand to forbid E2E encryption is analogous to the demand that every citizen always has to make sure that the government can listen in to every personal conversation they have, and not only right now, but retroactively.


If the right to bear arms is required for protection against a potentially corrupt or abusive federal government, then so is the right to use end-to-end encryption.


An argument propping child abuse as the reason to strip everyone of their right to private conversations (which are essential in the need to balance assymetry in a government’s powers and knowledge and an important tool for activism, organizing and keeping government in check) is not made in good faith.

It creates a false dichotomy framing the argument in order to predetermine its outcome.

When made by the very powers who are known to seek to punish And remove the people seeking accountability and change, it is very suspicious.

If the government wanted to prevent sexual abuse of children, they would address such abuse everywhere, including among its own ranks. This is not the highest priority of governments. Their higher priority seems to increase their powers.


Encryption is intangible, but it's a tool like many other objects surrounding us. Let's compare it to a hammer.

You can use it to do good things (hammer down nails to create a building to shelter people) or bad things (hurt people with it, smashing toes, etc). If someone does bad things with it, banning it stops people to do good things with it, and everyone lose.

Encryption ensure everyone can speak their mind freely, without worrying that someone with unclear motives can snoop around and read legitimate, but private discussions between two persons.

Not having this ability to speak freely hurts everyone, simply to remove a tool that could be used for bad things. Don't fight the tool, fight the bad actors with all the means at your disposition.


What are your arguments in favor of knives? How do you respond when someone brings up concerns of knives being used to stab people?


In my country knives are heavily restricted. They are not for sale to young people, and having a blade in a public place without a good reason is a crime. (And no "for self defence" isn't a good reason)

I was literally sat in a Crown Court on Wednesday for a trial where two guys were on trial for knives and GBH. Cops chased one and he had a blade in his back pocket when they caught him. Why? Well based on the call to the police and the witness evidence I expect if I'd spent a couple more days in court the story would be that he'd just stabbed somebody and so that's why - but even if he'd been caught on his way to stab somebody and never got there it's the same story. Nobody who'd come to play PS4 needed a knife. Nobody who'd come to play hide the sausage, or watch TV, or just sit around and get drunk needed a knife. They had knives so they could "defend themselves" when shit kicks off, which is why shit kicks off, which is why we have a law so they get locked up before they kill each other. Among the witnesses I didn't miss (because they refused to say anything) were the stabbing victims. Code of the streets see, it's OK to try to murder one another, but you mustn't tell the cops anything, this massive slit in my stomach must have been from being clumsy with nail scissors. (The medics unsurprisingly take the view that wounds are instead consistent with getting stabbed by somebody with a bladed weapon...)

The calculus for knives probably looks pretty different if the majority of nearby large mammals are Starbucks employees versus if they're Grizzly bears, or indeed Sheep, and so I don't pretend to think these laws make sense everywhere.

But the calculus for encryption is the same everywhere. We definitely don't want most people to be able to attack this stuff. But it turns out "Not most people" wasn't on the menu. "Nobody" and "Basically any motivated bad guy" are our available options, so let's pick "Nobody" and deal with the social consequences of that.


Curious if I choose to publish pictures of myself as a child when I was naked. For example bathtub pictures my parents might have taken, etc. Would I have committed a crime? Who exactly is the victim? I frankly wouldn’t have a problem with it. How does it harm me? I’d even be willing to release naked pictures of my children (suitable anonymized, faces blurred it heads cropped, etc.) Why do I care what a stranger is doing with an image of my kid? Go to town if it’s your thing. Just don’t actually harm real children and you’re fine.


The reason for using end-to-end encryption, instead of encryption which is not end-to-end, it to protect against the service provider. That is, if Whatsapp's encryption is really end-to-end, you don't have to fear that the Facebook servers might have been invaded by evil hackers intending to leak your most private communications to the whole world; the evil hackers would have to invade your personal device directly (and they can't invade everyone's personal devices, since that risks exposing their evil misdeeds to security researchers).


Imagine saying: two people should never be able to whisper to each other. To whisper something to someone prevents the police from having the ability to know if you’re possibly planning to do something dangerous. Something that is dangerous like planning another 911. Or planning to kidnap a child. These are very real possible crimes that affect real people. We must give investigators the tools they need to keep us safe therefore whispering privately should not be permitted.


Is this about adding E2EE to the common platforms?

Pedophiles and terrorists are already using E2EE I would think, so this is really about government being able to spy on everyone.

They don't have that ability IRL, why should they online?

More importantly, what are the macro consequences of government access to everyone's private communications, and especially, the oppressive effect on free speech etc when everyone is aware they are being monitored (I do sometimes wonder if Snowden was more 'deliberate leak' than 'whistleblower').


My go to about a government backdoor is that the NSA hacking tools are now leaked and the leading tool for Crypto Ransoms;

If CIA and NSA can't keep dangerous tools safe and secure from the bad actors; if the FBI (commonly thought of as less cover) or local police have a ready backdoor access to my phone, messages, credit cards, or anything else, then they're practically already in bad actor's hands.

The similar argument is that my state has lost my personally identifiable information in no less than 3 security incidents.


Not all crime is bad and some “crime” is essential for progress.

What is illegal follows fashions. For example in the UK homosexuality used to be illegal. Our hero Alan Turing was imprisoned for it. There needs to be some latitude for people to do illegal things because the state doesn’t always get it right.

A perfect survellience state is not in ideal in this regard.

You probably want fairly good law enforcement to protect us from crimes but just for it not to be too damn good.


Shorter encryption debate:

  Them: Terrible things are terrible

  Us: Yes they are

  Them: Stop the terrible things

  Us: We don't know how to do that without side effects that would be even more terrible.

  Them: Just do it without causing the side effects.
Source: https://twitter.com/mattblaze/status/1180092773975953409


Would not having E2EE platforms remove child abuse imagery and/or terrorism? The answer of course is no. I always get reminded of a story about terrorist using video games to communicate with each other and giggle a little bit.

Currently the government uses E2EE to safe guard themselves, then the American people should also have access to it to safe guard themselves. If the government allows us to purchase guns for our safety, why not encryption? You going to say encryption kills more people then guns?

Plus E2EE isn't some super secret thing the government only has access to. Any one can create a E2EE platform and the government would be hard press to stop it. You might not be able to commercialize it, but it won't stop it from existing.

I believe arguing over if something should be legal/illegal is a pointless distraction. E2EE exist now embrace it or move on, but don't think banning it or making it illegal will some how make it disappear.


I'm not stating that this is my opinion, rather a reasonable position would be based on the 4th Amendment.

>>>The right of the people to be secure in their persons, houses, papers, and effects, against unreasonable searches and seizures, shall not be violated, and no Warrants shall issue, but upon probable cause, supported by Oath or affirmation, and particularly describing the place to be searched, and the persons or things to be seized.

Under the 4th, It could be argued that when the government has demonstrated that they have met the standard for reasonable, technology should allow them to have access to that data. Therefore, it's unreasonable that access to data in question is controlled by potential co-conspirators; those with perverse incentives to withhold compliance. It's also unreasonable for entities that operate within the governments jurisdiction to circumvent this constitutional requirement.


Strong cryptography is critical for e-commerce. It is part of what protects your bank and credit card information form others.


Because making it illegal will remove benefits for 99.9999% normal people. Cryminals will keep using it when it's illegal.


It's nice to know that if some information I may send to my spouse, credit cards, accouunt information, photos of my passport or license needed for foreign travel, aren't sitting on some corporate server uunencrypted waiting for a data leak (caused by anything from a hacker to careless disposal of obsolete disk drives).


I worry that this is a case of seemingly good policy having bad effects.

My research indicates that smart criminals tend to communicate in code. Because of the codes used and the frequency at which they change, the existence of communication is often of more probative value than the words used. Companies currently share this meta data with law enforcement.

If the veil of E2EE is lifted, smart criminals will move their communications elsewhere. They will find services owned by foreign companies in regimes that are not friendly to US law enforcement. Or they will move to low tech solutions that make collecting meta data more difficult.

Basically, I’m afraid that changing E2EE will catch criminals who make a myriad of mistakes that will get them caught anyways. Meanwhile, it will drive the intelligent criminals further underground, onto services owned and hosted in hostile (or less friendly) countries.


I'd ask to spell out the particular concerns. It doesn't make much sense to try to respond without the other person giving more details.

Otherwise you're going to be in the role of making propositions and the other side will be shooting them down. Make them argue their case and poke little nagging holes into it.


As an American, we can start with: The People's 4th Amendment rights trump the Government's.

I'm always bothered by the sense of entitlement inherent in governmental campaigns against encryption. A properly-executed warrant allows the government to search for evidence and seize it. It does not create an obligation for the target to tell the government where the evidence is and how to make use of it.

Also inherent in our justice system is the concept that not all criminals get to be caught and convicted. Presumption of Innocence, Blackstone's Ratio, 5th Amendment, etc.

I don't think any of us want to live in a society where every law-breaker can be caught. We all break laws. I've barely left my home for 10 minutes today and am not entirely certain I haven't broken any.


The argument for privacy measures in general that's very convincing to me personally is imagining yourself as someone important. Imagine you were running for president in opposition to current government policies: would you want the government to have all your texts and emails, your entire browser history, the contents of your harddrive? Even if you've done nothing illegal, immoral or socially unacceptable, certainly you can think of something you've privately said or searched for that could be misconstrued to make you look bad.

In a democratic world, information is power. The more you know about someone, the more there is you can use against them; the more ways there are for you to lie.


I like having private conversations. Just because somebody happens to be in a different room during one of these conversations, doesn't mean it's ok for my private conversation to be logged in a db somewhere, mined, searched, leaked, sold and used against me at will.


Because I have a fundamental right to privacy, and encrypted communications are an appropriate way to fulfill that right. While that right can be suspended at times, such as if a person were the subject of a criminal investigation after reasonable suspicion, a blanket prohibition of secure communication is not justified.

People act differently when they are being watched. This is not a bad thing, and is not an accusation of immoral behavior. People are more likely to pick their nose while in private. People are also less likely to express morally correct but unpopular beliefs, such as supporting gay rights a few decades ago, if they believe that it will have negative social consequences. By having privacy, social movements can slowly grow over time.


If two people wisphered secret messages between each other,should that be allowed? Should a policeman be privy to all whisperings? E2EE is just wisphering except much more efficient and can happen at large distances.

Should you be allowed to send mesages over snail mail using code words understood by only the recipient and no one else?

These are political questions. Governments having the authority to listen in on all private conversations implies they have that authority. Do you accept that authority where you are unable to express yourself to other humans without government employees logging and monitoring your expressions of thought? Maybe you really have nothing to hide now,but if ever you are given a reason to disagree and dissent with societal norms,your expressions of dissent will be monitored by the very people that have a lot to lose by allowing your thoughts to be expressed. If you can accept regulation of your speech and this authority over your life and liberty then it makes sense to oppose E2EE.

The problem is that the people whose communication is being monitored never accepted this authority,E2EE is just a way of enforcing my expectation that my communication to someone will be read only by that person. Removal of this right or privilege must be done via due process and full transparency without which justice and fairness would be very difficult.

Last point: E2EE prevents mass monitoring of communication. For warrantful intercepts,law enforcement benefits the most out of having access to the whole device. One approach would be to force a transparent backdoor that will side-load rootkits that come with a device specific certificate with a certificate transparency log maintained by a watchdog gov agency that enforces requirement of a warrant for each cert and criminal penalty for mis-issuing of certs or tampeting of CT logs. What if someone roots their phone and removes the backdoor? Make it illegal much like silencers and bullet-proof vests are illegal. It does sound very unpleadant and uncomfortable but much saner than weakening protocols. Like it or not you won't be able to convince elected politicians there is no way to securely gain access to a suspected criminal's phone even with a warrant.


Let's be clear about something, the threats from exposing our information are not hypothetical, the last 10 years of repeated hacks into banks and services that expose people's financial and personal information (CC numbers, SSN numbers, etc) is proof that there are adversarial actors actively trying to get and exploit our information for financial gain. Right now, a database with structured data is useful (and amazing that its not encrypted in a way where it would be useless to steal at rest), but if you were able to get a treasure trove of unstructured messages we may not be far off from being able to extract a ton of information from that too.

And that's just financial stuff. The current generation has repeatedly proven that they want to send revealing photos on these chat platforms. Remember the iCloud leaks of revealing photos? These were done with phishing attacks, but once again proves that there are malicious actors looking to take what most of us would consider to be private personal property. Today it was phishing attacks, but without encryption, tomorrow it might be an actual massive data dump of every photo ever sent on Messenger. Again, we currently have AI models that can do facial recognition and that can do nudity detection (as employed on YouTube, etc.), so access to the data set of photos sent on Messenger could then be analyzed by a computer to extract all nudes of key people (if targeted), or just all nudes (if not targeted). If your response to this is "they shouldn't be using it that way" -- again, consider that you might have second-order exposure to this problem. You may be smart enough to not send compromising information on Messenger, but maybe a close family member isn't and now you can be blackmailed or extorted to prevent revealing something of theirs. Or let's say everyone in your family is smart enough not to use Messenger this way. Your representative or senator's relatives might not though, and now they can be blackmailed too, and there's not much you can do about that since you may not even find out. All these problems similarly exist with respect to corporate privacy as well (trade secrets vs. potentially malicious foreign companies, people trying to get inside information for trading, etc.)

At the end of the day, to me the question of whether the US is trustworthy is besides the point: the lack of encryption exists for anyone trying to get in, and we know there are bad people trying to get in. If you take the lock off the door you might trust your friendly neighborhood policeman but the cat burglar can just as easily turn your doorknob.


I see the need of the police to access personal communication to fight child abuse. However, if the police can access it, then so can NSA, China, Mafia, and random hackers. A backdoor is not restricted for long. I consider this risk higher than child pornography.


Quite simple really. The government is a terrorist crime syndicate that happens to own the monopoly on the legitimate use of violence and no one should give them access to their personal lives, lest they be locked in a cage or treated with pointless violence.


A counter argument for blocking e2ee because of sharing CP/Terrorism can be split in two parts:

1) If you have proof that they are sharing it then you simply do a criminal trial base based on that proof. No need to block e2ee because you already have proof.

2) If you do not have proof then you are assuming guilt without proof, and that is the opposite of how our justice system should operate. Innocent until proven guilty. No need to block e2ee, because you have not shown that any concrete person is breaking the law. And if you did show it, then look at point 1)

And thus we have exhausted both possible options, and in both cases there is no need to block e2ee.


I think that's the wrong question because there are many arguments in favor of e2ee. However, only some against: 1) totalitarian governments (like in China) or governments who want to watch over their citizenz (and non-citizenz) because of 2) criminals, who want do their stuff in secret - you may force whatsapp to stop using e2ee but you can't stop criminals using open source software 3) convenience because it's harder to build e2ee apps in many cases than without e2ee because you can't use some services (like algolia for search etc). At least, there are couchbase and realm.io, but their hosting isn't hat cheap


People committed these crimes before encryption and they'll find a way to commit them after encryption. Being against E2EE means trading your privacy and security but it won't stop these crimes from occurring.


>Also, how do you respond when someone brings up concerns of E2EE platforms being used for child sexual abuse imagery or terrorism?

By not caring. Privacy is worth more than forcing criminals to put a small bit of extra effort.


Guns can be used for crime, including child sexual abuse and terrorism, so why shouldn't we ban them too?

Right to bear arms is in the constitution, and so is the right to unreasonable search/seizure.


E2EE can be banned in ne country but not the whole world. There will always be places that will support it, so criminals will go there and use those networks and we will he left without doors.


Because I'm an anarchist and believe that the only two people that can police communication between me and another person, are me and that other person. Live and let live.


I don't need arguments in favor of it, you need arguments against it. The burden should never be on me to justify my freedom, but on you to justify your oppression.


There is one argument that many people are missing here. End-to-end encryption is really quite widespread in a number of products today. The WebRTC protocol, for example, is commonly used for videoconferencing. It is natively supported by most browsers and provides a connection between two browsers that is end-to-end encrypted.

Since this functionality is so widespread and popular, the onus of proof should be on people who want to forbid it.


Not really. WebRTC could work just fine without the encryption. The fact that it exists and people use it not in and of itself an argument in favour of E2E.


Its important that enforcing the law be difficult and expensive. It prevents tyranny by keeping the governments tools of oppression tied up dealing with necessities. It creates a cost for enforcing every new hypothetical restriction.

E2e encryption being prevalent makes law enforcements job much more difficult.

Child sexual abuse and terrorism being completely solved are incompatible with free society. Those kids need to take one for the team.


In public toilets we lock the door. That's dignity.


I don't understand the question. E2E encryption used in what? Consumer social-network software? High-security government communications?

Bad actors will always have access to E2E encryption so any argument which discusses this is misleading. So the question is then should the governments have access to the communications of the general population? No.


Banning any type of mathematical or technological advancement will never bring good things. I don't know why I feel like that, but that's how I feel like. Banning building things like nuclear reactors is fine, but banning people from knowing information relevant to building nuclear reactors can avoid safe technological advancements in energy generation, for example.


That freedom means accepting some degree of injustice but it pales in comparison with the injustice of an unfree society.


It's simple really, everyone has a right to privacy. The argument of having 'nothing to hide' is in bad faith.


Maby if they could actually start acting on intelligence when dozens of people report that a kid is likely to conduct a school shooting I'd believe them. Even then, we all know this type of rhetoric from law enforcement is just posturing to force their way in through the front door. This is still a good exercise (documenting why end-to-end encryption is necessary), but don't kid yourselves. They will whine just like Trump until they get what they want. If nothing changes and they stop whining it's time to start digging, that probably means they got what they wanted in secret.


Sometimes I don't want people to see my stuff. If I use end-to-end encryption, people can't see my stuff. QED


In the spirit of writing a simple and condensed answer, and assuming e2e encryption would remain with a government backdoor, there are three main problems (I don’t see any other):

1. Government abuses their power

2. Government gets hacked and hacker abuses their power

3. You have something to hide

Now we can debate on each of these points. Tell me if I’m missing something.


My main concern isn't the 'Big Bad Government' but just good old fashioned incompetence and corruption.

If law enforcement can read my messages so can engineers at the company, or anyone a hacker or disgruntled employee sells the data to.

Those messages may contain sensitive information like financial details, passwords etc.


Terrorism is a particularly weak argument for e2ee because terrorists can and do exploit systems WITHOUT e2ee.


I think the best argument is that it is impossible to regulate. It's *ing math! Anyone can look up how it works. It will be implemented everywhere and always by the people who need it.


Specifically for politicians: Ask them how important it is that the media not read their texts and emails.


If I were arguing by analogy I would ask why we allow door locks. Door locks let people do bad things inside their houses. Yet we are all safer from criminals because of them, overall. And it also helps keep police honest about getting a warrant first before they disturb your house.


The counter argument I've heard to that is that there is no such thing as an unbreakable lock. If someone is doing something illegal in a building, the government can eventually get in. Strong encryption is effectively unbreakable, and basically free for anyone to use. Trying to make a faciliy even remotely as secure is going to take millions of dollars because you need to not only secure the lock, but the entire facility has to be hardened.


Strong encryption may be unbreakable in a mathematical sense but encrypted communications are not unbreakable in practice. Key extraction through side channels or compromise of communications by physical surveillance or evil maid attacks is practical. It just can't be done to a billion people at the same time. Read here https://github.com/maqp/tfc/wiki/Threat-model for an overview of all the ways an all-out, unusually secure encryption system (encryption and decryption done on separate computers with data diodes, 100% reproducible build) can be broken.


True. I would say that the government can still compel individuals to surrender access to encrypted files with physical force.

I would also say that, similarly to how you can’t do all your criminal work inside a self-destructing safe, you can’t do all your criminal work in one e2e chat. Data will still be entering and exiting it somewhere, and if multiple people are involved, the relationships between them are weak points. But that’s getting too into the weeds. I think talking about something as simple as a lock would reframe the discussion for all but the most sycophantic.


The benefit of cryptography is that you don't need to argue in favor of it to use it.


Argument? Its a trade off freedom vs security. Traditionally patriots have chosen freedom.


CGP Grey's "Should all locks have keys?" says it better than I ever could: https://www.youtube.com/watch?v=VPBH1eW28mo (4m)


I think we should fight for private communication to be a human right, nothing less than that. So if terrorists have right for a fair trial, they should also have a right to communicate privately.


It’s none of your business.


If an encryption back door exists, one can assume that it will be exploited. The same applies to private key encryption where a company holds private keys instead of individuals holding their own.


Besides all the obvious privacy/freedom reasons, banning things NEVER works. Think about how hard we try to ban physical things (drugs, guns, etc). Now imagine trying to limit encryption.


Freedom. Nobody, and least of all a government, should be able to decide what software you use. If their will stands above yours, you are a slave. Do you like slavery? Do you love yourself?


> If their will stands above yours, you are a slave.

I'm not making an argument about encryption, but you know there are these things called "laws", right?


Yes Mr. Kissinger. Those are an attack on the freedom of individual.


I’d rather have crime than a government that can outlaw math.


My position is that I have a right to privacy, so I don't need an argument. You need an argument for infringing on my right to privacy.


Personal opinions (even ones grounded in science) that run contrary to prevailing norms have become weaponized. Until that goes away, I want my privacy.


What argument in favor? There doesn’t need to be one: it’s the right thing to do. It’s why I use iMessage. It’s why I trust Apple.


One comparison I don't see yet, which is the easiest and most non-technical I know: E2EE communication is just a long-distance version of speech. The usual comparison for E2EE is physical mail, but the entire argument happens over the flaws of the metaphor. The lack of bulk mail analysis or systematic mail fraud means that the good and bad parts of encryption are both mostly hypothetical.

Talking make a much better comparison. When you say something, someone can listen or record you, just like E2EE doesn't protect against shoulder-surfing or a compromised device. But once you've said a thing, it's gone. It's not just inadmissable but inaccessible. No police tactic in the world can physically reconstruct it, and the Fifth Amendment says you can't be forced to confess anything incriminating that you've said. (The comparison for encrypting illegal media is messier, but a spoken threat is a crime composed only of words, so we could compare that to an encrypted picture.)

And vitally, all the things governments warn about E2EE apply to speech. People use speech to plot all sorts of heinous acts. Criminals gravitate towards in-person speech instead of using letters or phone calls. Whether it's clergy covering up child abuse or terrorists plotting bombings, talking is the standard method of coordinating crimes without leaving evidence. There's speech which is itself criminal, like threatening bodily injury, which leaves no evidence after it's said. When people resort to speech instead of calls or letters, the job of the police gets harder. If everyone had to carry a running voice recorder or make phone calls, it would be much easier to convict criminals, and bulk analysis could be used to be proactive about terrorism and abuse instead of investigating after the fact.

It's hopefully intuitive to most people why "all speech needs to be recorded for police use" is unacceptable. "Nothing to hide" doesn't justify letting the police in on your pillow talk. Bulk analysis of who's talking about what is abhorrent, but warrant-only access isn't tolerable either. The government would abuse the system, private people would try to break into the logs, and the breach of privacy is fundamentally out of bounds regardless. And policing still happens just fine without such a log. Officers listen as people speak, just like they can monitor a device before it sends a message. People who hear bad things said report them. When physical crimes are plotted, the crimes leave evidence. And for speech like threats, we can still collect witness accounts or convict over follow-through. The government doesn't need a log of everything we say.

In the same way that all the horrors of cryptocurrency are grandfathered into cash, the menace of encrypted texts is already present in everyday speech, but the world keeps turning.


My argument is simple: I want it for myself.


I don't think there are multiple arguments here to beat around, despite people going on like it's a many-sided story. It all comes down to two conflicting principles:

- People's privacy is inviolable

- State's right to surveil people's actions must be unlimited

Before now, the balance was kept by surveillance being too expensive. But it was already pretty obvious in the 80s that we're quickly going full cyberpunk: communication and processing of info become dirt cheap, everyone is moving to digital comms for ease of use, and suddenly vastly expanded surveillance is easy, both on the net and in the physical world.

In ten years, net connection will be ubiquitous like electricity, all info about the world will be processed in real time, minds will directly control computers, and the agencies will ask why they should give up vacuuming it all if someone might plan a crime somewhere in there. Why draw the line at the datacenter instead of personal computers if the boundary is barely there? Why must there be a limit? The argument of “there might be something unlawful on there” doesn't have a limit.

If you think that a discussion between people, or their actions, should be private like they were before, you gotta ask where the firm line is. But I don't really see anyone doing a cost-benefit analysis on privacy vs surveillance, since conveniently for the agencies it's a ethics issue, and measuring ethics with numbers is frowned upon. So it's gonna be “X crimes prevented and Y solved” vs some indeterminate inconvenience caused by data leaks and corrupt officials.

As a bonus exercise, ask yourself: if to beat criminals the police has by principle to have criminals' tools―violence and disregard for privacy―then what stops police from turning into criminals on the side? These two markets are for the same skills. For some countries, it's not an idle question. And obviously, if a tool is available to police, it becomes available to criminals too.

But personally, I don't think privacy advocates will ultimately have much weight in the decision on this dilemma. People like to pretend that they highly value personal freedom, but the whole shtick of society is that it has a net benefit for a population by limiting individuals. Band together with other people, lose the freedom to be as gross as you want as loud as you want, have to do favors to keep connections. Pay some organized bullies to defend from other ones, concentrate on your own job instead. Move to the city, be highly visible to many people but have a variety of decent food, and sewers. We were giving up freedom for security and convenience for thousands of years, and I doubt we're going to stop now.

(BTW, afaik the cliché quote about giving up liberty for safety is used completely wrong and originally had exactly the opposite context.)


Why ?

Because Fuck You, that's why.


First of all, break the assumption that encryption is for paranoid people. Ask the opposing side to defend regulation over E2EE.

You're in luck because there are no objective arguments against it. When they inevitably turn to emotionalisms like "terrorism" and "sexual abuse", cite how insignificant of a percentage "terrorists" and "abusers" are of all E2EE usage. Explain that a ban for one is a ban for all, them included, and that encryption in fact protects from people's spying on and planning over one's significant other/children/etc. Ask why politicians like Trump or Clinton can seek protection from aggressors but you, an honest-working tax-paying citizen unentitled to a private security force, should not.

Explain that criminals overtly show their psychological traits every living moment and it is the failure of the authorities to help rectify their behaviour lest they commit a crime; that it is a well-paid police proffession to monitor people for such traits. Such a profession that is gladly and frugally assisted by artificial intelligence which can be tied to any camera that sees you, any website that you visit; that the government and companies can make deterministic psychological profiles from metadata alone and some graph theory.

You can also reference absurdity by stating that, to avoid "terrorism" among E2EE, the government should simply ban "terrorists" from using E2EE. However, the Wars-On-.* have been proven not to achieve the original goal in US history but rather to cause collateral damage, much more drastic than foreign subversion could. So banning or regulating E2EE is an ambiguous goal which will fail.

Suspicious, maybe it was foreign subversion indeed. Would you like E2EE when you pay taxes and go vote? So why not for more close-to-home data such as intimate details that could be used against you by an enemy or in court of law?

And finally, the police force and government authority use and _develop_ E2EE. They ought to have hidden back doors in it. For the hundreds of millions to billions of dollars law enforcement receives in funding, they ought to have. So even if we assume they could catch "terrorists" and "abusers" more efficiently. Well, then they don't need such giant budgets from your wallets. Would you consistently pay dozens of dollars a month for private investigators to aimlessly roam the country, not even saying what they are looking for? So why let the government do it? You could purchase many sources of joy with that money.


In the long term it would cause more harm then good.


It's free speech, plain and simple.


E2E encryption doesn't need an argument for it, it has specific, valuable and demonstrated uses, and I reject the premise of the question that the technical and business use cases for it need an accompanying rhetorical justification. The people asking for the arguments are not people who can be persuaded by argument, they are looking for ways to drive another agenda. It's disingenuous and not a matter of reason.

To respond to the question itself, let's start with what we actually do. We make the stuff people actually want, and thanks to abuses by authorities around the world, today they want privacy and trustworthy tools. We build things that facilitate growth and massive improvements in quality of life for literally billions of people around the world. That growth comes from building the things they both want and trust, and use each day to improve the quality of their own lives and of their families. I would encourage governments to get better at offering the same things.

The extreme cases cited in the OP are abused by people with agendas to use them as levers to assert their narrow interests, and not because they want to solve those particular problems. Parading victims of abuse and violence to bolster a narrow surveillance agenda is the rhetorical equivalent of using human shields. Hardly anyone is actually stupid, and everyone sees it. Further, why would you ask technologists to presume good, altruistic and aligned intentions in governments who want to conduct surveillance, yet not among ourselves and our users of encryption services? We can't make that altruism generalization about our own governments, let alone ones in other markets. I would reject this particular premise in being asked to make an argument "for," as well.

The question, "I need you to justify your view to me, and with it, these objectively terrible things" is disingenuous.

The short answer is technologists do not have the solutions to niche social and political problems any more so than anyone else. Terrorism, abuse, and porn exist independently of tech. The "arguments," against E2E encryption are made by people who don't have responsibility for the outcomes of their efforts, and are using these threats to deflect that and make others responsible for them.

If we all gave up E2E encryption, the value people entrust to networks would be reduced to where it would derail and destroy the economic growth trajectory which that trust facilitates to improve peoples lives. The solution is not for tech to do less of what people demonstrably want and willingly pay for, it's for governments to be smarter about their own roles and responsibilities.

If you want to solve the problems of abuse and terrorism directly, there are a ton of solutions that don't involve destroying the trust people have in each other that has improved our collective quality of life immeasurably in the last 30 years.


I am working on an application that will allow chat and a shared file system (cross-OS). It will feature end-to-end encryption through key exchange and it will be mostly peer-to-peer.

The basic idea is that users should have privacy. Real privacy would disqualify a service in the middle from intercepting and retaining user traffic. There must be some compromise though because the current internet model makes actual peer-to-peer without a middle service incredibly challenging. This is the problem I am attempting to solve, a client-to-client model instead of a client-server-client model. There will likely have to be a service in the middle to provide routing via DNS and tunneling via port 80 to get around things like firewalls and non-routable addressing, but traffic should be encrypted so that the middle service only provides a tunnel for encrypted data.

When I get far enough that I can turn this into a business I would not be able to serve advertisements to users, because their traffic would be encrypted. The disadvantage there is that I would have to find an alternate revenue model. The advantage here is that law enforcement could issue legal requests for user data and the only thing I could give them are account or billing details. I could not give out user contributed data, because you cannot give what you don't have.

I have also thought of a scheme to anonymize users in the system so that users are known to each other, but to everybody else the user ID is just some 128 character hash string bound to a private IP address. I haven't really thought through discovery yet, such as a user looking for their friend to exchange keys. With an anonymous user scheme in place user would have even more privacy. Users should never be anonymous to each other, because should be anonymous to those without access to their encryption. I will solve for this once I get to it.

As a service provider I would retain the power to disallow traffic via certain keys or anonymous IDs provided a proper legal request from a legal authority. If there is evidence of illegal activity gathered from regular police work I should be able to discontinue access to specifically identified accounts in accordance with the law, but it would require evidence I could not provide to law enforcement.

So far the shared file system operations are mostly built. I would like for this work as a Window-like GUI in the browser, which is built, and a command driven application from the terminal which is half built. I haven't started work on the security model or key exchange yet but I have a plan on how these should work. Once I debug copy/paste/delete from a file system on one computer to the file system on another computer from within the browser I will move on from the technical tasks to more revenue worthy tasks. I am almost there, but still have some work to do. This is taking long to write and test than I originally imagined.


1) Because I want it and what is this, soviet Russia?

Dead serious. The mentality that everything you want to have needs to be explicitly justified to society before you are permitted to have it is a sick twisted authoritarian mindset. I thought our society was better than this

2) The same reason I support the second amendment. The government is gigantic and powerful and scary. Even if it acts in the most benevolent way possible, it is gigantic and powerful and that is _intrinsically_ scary. The government can _fuck up_ and destroy ten thousand lives before anyone even notices. Consequently, people need ways to defend themselves from the government proactively. Encryption is one such way.

2b) If someone wants to argue that "what if criminals use it to do crime", remember that marijuana is still a federal crime, and some absurd percentage like 30% of all Americans have smoked it at least once. It is well within the government's power to just spider through all social media to see all references to marijuana, use that as probable cause, and do raids on _MILLIONS_ of people. Will this happen? Almost certainly not. COULD this happen? Absolutely. Unless, of course, all those communications were encrypted such that nobody could access them. I don't think "I pinkie swear I won't do it" is a good enough protection for me against that possibility

3) the cynical answer: we already have ample evidence of actual child sexual abuse rings, but for some bizarre reason the authorities lost interest in following up on that once the ONE guy they got hung himself. If they aren't willing to do the police work on this issue that they already can, I don't see what the argument is to give them full access to all crypto systems.

4) Technical answer: Just because you make a backdoor and give the government the only key, doesn't mean the government is the only people who are going to use that door. Maybe they lose the key. Maybe they give the key to someone who turns out not to be trustworthy. Maybe someone makes a secret copy of the key. Maybe a burglar doesn't actually get the key, but he's really really good at picking locks and so the backdoor makes it that much easier for him to get in. Security is a hard problem and every single compromise increases your risk surface area. The first lesson of security is "assume the worst possible thing happens, and then prepare for something worse than that". Such a back door (or, alternatively, legal prohibition of e2e encryption), dramatically compromises security simply by existing.

5) The tinfoil hat answer: The fact that they want it so badly tells me that they shouldn't have it

6) The current year answer: Do you want Donald Trump to personally have the ability to spy on anything that you, specifically, do? Y'know, if he's bored one day and wants to find something stupid to tweet? Do you want him to have that power? I don't


i'm going to go against the grain here and propose an alternative arrangement

medium term, i don't see how democracy can function if E2EE becomes the norm (esp in the context of cryptocurrency). influence-buying, disinformation, collusion, bribes, bullying, etc become much much easier, and policing would become nearly impossible

instead, ban E2EE but allow each person to have multiple identities (with technical means to prevent them from being tied together or expose personal info - a nontrivial but solvable problem), ie Privacy via Multiple Identity or PvMI

this scheme would provide many of the benefits of E2EE (eg, preventing an employer from punishing your for political speech) while allowing policing of many illegal activities. one exception is that if the people became fed up with the govt and wanted to stage an armed rebellion, PvMI wouldn't help (though it would help get to the point of consensus that rebellion is needed). I'm not sure how practical the concept of armed rebellion is today, but I haven't written it off either. So this is a downside.

Can anyone think of any other not-harmful-to-society activity that E2EE helps with that PvMI wouldn't ?


End to end encryption allows for the ends to exchange information without fear of the intermediaries leaking the information to others.

Even if it weren't connected to your identity, you may send pictures you wouldn't want seen by anyone you didn't send them to.

You wouldn't want to send forbidden thoughts if your local government was known to repress them. A government could certainly track down your multiple identities and jail you.

I'm more likely to be harmed by government corruption or poor security practices of a messaging service than by terrorism; I would rather be safe from the first two, than maybe have slightly less of the third.


in the 1st world, I agree that terrorism is a negligible risk. but at least anecdotally, that math appears to be less sound in the rest of the world - i at least imagine that in much of the middle east, expressing a nominally legal but unpopular idea would likely result in you being killed. and i think that it's fairly accepted that in mexico speaking out against the drug cartels is risky

i'm thinking of MvPI for the USA (and presumably similar places). and it would require a society-level commitment to transparency for it to be sufficient (which may not be practical).

as for pictures, there would be technical means to obscure faces, tattoos, voices, etc.

as for the govt tracking you down, there would need to be an elaborate system of checks and balances - access to the unobscured data would require blockchain-like keys from multiple parties and would be publicly visible




Consider applying for YC's W25 batch! Applications are open till Nov 12.

Guidelines | FAQ | Lists | API | Security | Legal | Apply to YC | Contact

Search: