zlacker

Can someone explain how they could read my e2e Signal chat messages to my wife about what I'm cooking for dinner?

Can someone explain how they could read my e2e Sessions chat message sent via TOR to my wife about what I'm cooking for dinner?

Genuinely curious. Can those that are in power break this encryption?

>>andrew+(OP)
Making it illegal to use "non-compliant" e2ee services and prosecuting those who does. Realistically, they couldn't, but could ban such apps in EU stores, making them less popular.

They can break encryption by stealing keys from your device, or by pwning your device, or by introducing backdoor into the chat client for every user.

>>andrew+(OP)
They can fine apple and google for offering signal in their app stores, until nobody has it installed.

That doesn’t break your comms today - but later, you replace your phone, can you get a current copy of the app?

>>andrew+(OP)
The idea isn't to break encryption, it's to have apps implement client-side scanning "pre-encryption".

>>andrew+(OP)
No, but many political figures have proposed banning the distribution/possession/operation of tools (e.g. Signal, Tor) which can be used to circumvent surveillance.

>>andrew+(OP)
Definitely wouldn’t break the encryption itself.

I think the way it could work is to send a letter to each of the messaging apps saying that they are now legally required to use the EU’s encryption keys and make the messages available to the EU.

Then they would make it so that the apps that don’t comply are not available in the app stores by pressuring google and apple respectively.

I think this is the reason why for example telegram is not end to end encrypted by default - as some regions require them to be able to access users info.

Software you’re using on your own wouldn’t be effected, but wouldn’t necessarily be legal either.

People who are technically savvy could get around it, but the vast majority of people just assume that their private messages are private.

>>andrew+(OP)
The proposed regulation is about imposing requirements on service providers, as defined by the Digital Services Act, for messaging and other services, effectively requiring them to implement backdoors in their software.

Purely P2P communication isn’t affected.

>>daniel+v
Not quite. It would be illegal for Signal to continue operating in the EU if they don’t implement the required scanning functionality. And Signal has already stated that they’d rather leave the EU.

>>andrew+(OP)
The app that decrypts the message, will have the capability to provide that message, now decrypted, to the government.

>>ymir_e+W1
Telegram is not E2EE because it's easier and faster to sync and transmit messages between millions of people. The scale of Telegram groups and channels is massive. Telegram, for a long time, has not complied with law enforcement requests and has made it hard for authorities to get data because of their architecture. You still have Secret Chats for E2EE messaging as an option.

>>rkomor+K
Yes, what is proposed is breaking the end-to-end security model, not breaking the encryption itself.

Effectively it causes the same loss of security and trust as if they broke the encryption, but it allows them the fig-leaf of pretending that you're still secure because they "haven't broken the encryption".

>>stephe+eq
I like your wording.

I wasn't expressing an opinion in that comment but I do find the whole concept terrible.

>>coldbl+gd
Not sure what your point is. Telegram is not an example when it comes to privacy. Anyone who has access to the server has access to pretty much everything. Nothing can tell you that governments (or bad actors) are not already reading your Telegram messages.

>>rkomor+K
> The idea isn't to break encryption

That comes later with ProtectEU.

"Technical experts call on Commissioner Virkkunen for a seat on the table of the European Commission’s Technology Roadmap on encryption"

https://edri.org/our-work/technical-experts-call-on-virkkune...

>>layer8+w5
If the one western nation passes this then it's only a matter of time until the other ones do to. At that point Signal "leaving" means they may as well stop doing business. Companies like to say they won't bend the knee if it gets them support now but in the end they always do.

>>daniel+v
I can download the Signal APK from their site.

>>accoun+T91
I wouldn't believe a for-profit company claiming it'd stand firm.

Signal is a 501c3 nonprofit. There isn't capital to lose