New branding, same scanning: Upload moderation undermines end-to-end encryption [pdf]

[Centigonal]

I just want to express how much I appreciate Meredith Whittaker. She helped organize the Google walkouts, She's been working on AI safety since at least 2016, She advised Lina Khan at the FTC, and new she's out here advocating for preserving E2EE. A lot of people online give her flak for her opinions, but she's been consistently very loud and occasionally influential.

She's done some cool uncontroversial tech work too (like helping start M-Lab), but her advocacy is what is most interesting to me. I don't agree with all of her positions, but I like that there are still people in the tech world who are willing to take strong and sometimes radical stances on moral issues against the current of capitalism. I feel like she's the closest thing we have to an rms-type figure today.

[squigz]

Isn't RMS the closest thing we have to an RMS-type figure?

[rrr_oh_man]

RMS - https://en.m.wikipedia.org/wiki/Richard_Stallman

[t0bia_s]

Why those moderation attempts are not considered as national security threat? I can imagine how foreign power could take advantage of this.

[eterps]

I'm wondering if this proposal is enforced, and you opt out, how would it be known whether you're sending someone a URL? How would a URL even be distinguished from other text when you have opted out?

I suppose you could detect some patterns, and it definitely wouldn't be clickable. But is the text google.com considered a URL for example? I guess it isn't?

(yeah I know, it's a stupid law anyway, but just wondering)

[throwaway22032]

It's like the oldschool scam days on MMO's.

g3tfr33g0ld DOT сом

[Sephr]

If you 'opt out', service providers can prevent you from sending anything under these new rules. You might not even be able to reach out to support to complain without consenting to your messages being scanned.

[pera]

It wont be perfect and it will fail in stupid ways, by design.

[mihaic]

After losing my phone and not having a way to recover a lot of data, I've come to the realization that I don't want end to end encryption. I just want a responsible entity to store all my data in a secure way, and they'd only make money from what I'd pay them. If I lose everything, I still want access to my data, even if a proof of identity costs me.

Of course incentive systems make that very hard in today's corporate world, but I can still wish for my ideal world.

[squigz]

This is not just idealistic - it's bordering on naive. Tech companies have proven, repeatedly, over decades, that they are not responsible with our data.

[scotty79]

I don't think end-to-end encryption prevents server backup. It means that decryption keys is in your mind and at most on your personal device.

[Retr0id]

I'm pretty sure you just described iMessage + iCloud backup (among other setups)

[lxgr]

I too wish that encryption wasn't necessary, and people could just be nice to each other (or, in grown-up speak, incentives between literally every person and group were always perfectly aligned).

Until somebody figures out a non-dystopian way to achieve that, I'll stick with end-to-end encryption, though.

If you want to opt out of that, I can't stop you – I bet you'll be able to find an entity that will take both your money and your encryption keys. I just don't want that to become the default, or even only, way of doing things.

[dijit]

Your ideal situation is likely federation.

But Signal doesn't want that, and most people are too cowardly to trust anyone other than the people who absolutely must make a profit running such a system.