Stop playing games with online security, Signal president warns EU lawmakers | TechCrunch
techcrunch.comA controversial European Union legislative proposal to scan the private messages of citizens in a bid to detect child sexual abuse material (CSAM) is a
Follow-up to last week’s story:
https://lemmy.ml/post/16672524
EDIT1: Politicians expect to be be exempt.
EDIT2: Good news: Vote has been postponed due to disagreements.
You must log in or register to comment.
A place to discuss privacy and freedom in the digital world.
Privacy has become a very important issue in modern society, with companies and governments constantly abusing their power, more and more people are waking up to the importance of digital privacy.
In this community everyone is welcome to post links and discuss topics related to privacy.
Some Rules
- Posting a link to a website containing tracking isn’t great, if contents of the website are behind a paywall maybe copy them into the post
- Don’t promote proprietary software
- Try to keep things on topic
- If you have a question, please try searching for previous discussions, maybe it has already been answered
- Reposts are fine, but should have at least a couple of weeks in between so that the post can reach a new audience
- Be nice :)
Related communities
Chat rooms
-
[Matrix/Element]Dead
much thanks to @gary_host_laptop for the logo design :)
- 0 users online
- 57 users / day
- 383 users / week
- 1.5K users / month
- 5.7K users / 6 months
- 1 subscriber
- 2.97K Posts
- 74.6K Comments
- Modlog
This is what I guessed the other day when a post here didn’t clarify what the censorship meant.
While I’m not a fan of this stupid regulation, it doesn’t sound like being the armageddon that turns e2ee into ashes.
(Given that Signal doesn’t like it, I might be wrong though.)
As long as we trust, say, Signal, it will possibly be able to do the scan without sending a good chunk of the image data that the user is sending. URLs can be hashed before sending it to the scanner.
The remaining piece for privacy is to use open source and to guarantee that the binaries are free of modification from the original. This problem always existed on the Apple ecosystem btw.
The images that are flagged by such scanning, local or server side, will have to be manually verified to avoid false persecution. Someone will have to look at the private images you’ve sent that might get flagged.
These systems have huge margins of error and are incredibly inaccurate, so there will be a significant task in manually verifying everything. And do you trust some government random employee (or just the departments general IT practices or ability to not be hacked) with not leaking your nudes or personal images? I sure as hell don’t.
And even if this is handled perfectly and all government employees are super super honorable standup citizens that never do anything slightly wrong ever…There are still malicious governments that persecute minorities, I doubt they will handle these backdoors in digital privacy very well.
They say they the images are merely matched to pre-determined images found on the web. You’re talking about a different scenario where AI detects inappropriate contents in an image.
It will detect known images and potential new images…how do you think it will the potential new and unknown images?
Source? Does the law require that? That’s not my impression.
Literally the article linked in the OP…
Article 10a, which contains the upload moderation plan, states that these technologies would be expected “to detect, prior to transmission, the dissemination of known child sexual abuse material or of new child sexual abuse material.”
My bad. But that phrasing is super stupid, honestly. What company would want to promise to detect new child sex abuse material? Impossible to avoid false negatives.
So if I send a photo of our kids playing naked in a baby pool to my wife through signal, some slimy-ass eurocrat in some IT center will be able to ‘manually verify’ the photo of my naked kids?? Are you mentally sound??
I hate pedos just as much as every other sane parent, perhaps even more so (I’d love to wear “Why, Garry, why?!” t-shirt all day every day). But to hell with this stupid idea that some slimy scumbags will be able to browse my own photos of my own kids. Hell, even any random photo I take, it’s my business and nobody elses! Go catch pedos the proper way instead, work a little, we don’t need Gestapo or Stasi to hover over everything we do or photograph.
Its a slippery slope thing. Sure, technically it doesn’t break e2ee, but it basically forces app developers to integrate a trojan into their app that scans messages before they are encrypted and send. Right now it is “only” for images, but once this is in place and generally accepted, what is stopping lawmakers to extend it to scanning all messages?
** for some unorthodox definition of e2ee
If the “endpoints” are defined as being somewhere outside the end users’ control, because for example the client software they have is designed to betray their secrets, then the system is no longer end-to-end encrypted in the way that both cryptographers and normal people would usually understand the concept.
I think the parent is distinguishing between messages & the attachments as they are stored differently & often in different places in many systems. But I agree with you in assuming that the goal would ultimately be to then start scanning messages too.
Imagine governments used something like SHA1 that has conflicts & now you have collision potential–you could even fabricate attachments that could cause a collision to get someone throw in jail since all you have to rely on is the file hashes. If you can’t scan the actually content & you are just using hashes, then you also don’t prevent new content that those in power deem ‘bad’ from being flagged either which doesn’t really stop the proliferation of the ‘bad thing’ just specific known ‘bad things’. If I were implementing clients, I would start adding random bits to the metadata so the hashes always change.
The only way this system even works is if there are centralized points the governments/corporations can control. Chalk this up as another point for supporting decentralization & lightweight self-hosting since it would be impossible to have oversight over such a system if anyone can spin up a personal server in their bedroom.
Yes, I agree it is dangerous. I just wanted to assess the actual threat (current and future) before jumping onto the wagon.
How about the false positives? You want your name permanently associated with child porn because someone fucked up and ruined your life? https://www.eff.org/deeplinks/2022/08/googles-scans-private-photos-led-false-accusations-child-abuse
The whole system is so flawed that it has like 20-25% success rate.
Or how about this system being adopted for anything else? Guns? Abortion? LGBT related issues? Once something gets implemented, it’s there forever and expansion is inevitable. And each subsequent government will use it for their personal agenda.
They say they the images are merely matched to pre-determined images found on the web. You’re talking about a different scenario where AI detects inappropriate contents in an image.
Matched using perceptual hash algorithms that have an accuracy between 20% and 40%.
Is there a source stating that they’re going to require these?
Unfourtunately, I couldn’t find a source stating it would be required. AFAIK it’s been assumed that they would use perceptual hashes, since that’s what various companies have been suggesting/presenting. Like Apple’s NeuralHash, which was reverse engineered. It’s also the only somewhat practical solution, since exact matches would be easily be circumvented by changing one pixel or mirroring the image.
Patrick Breyer’s page on Chat Control has a lot of general information about the EU’s proposal.
Stupid regulation, honestly. Exact matches are implementable but further than that… Aren’t they basically banning e2ee at this point?
Now I see why Signal will close in EU.
change one pixel and suddenly it doesn’tmatch. Do the comparison based on similarity instead and now you’re back to false positives
My guess was that this law was going to permit something as simple as pixel matching. Honestly I don’t imagine they can codify in the law something more sophisticated. Companies don’t want false positives either, at the very least due to profits.
But you can’t detect such things without either server side scanning (kills E2EE dead) or client side scanning (will always be limited in what it can detect, and it’s easy to patch out of clients, AND there’s still the risk of govs maliciously pushing detection of banned media)