Have you seen this news?

[benpate@mastodon.social]

@jaz @earth_walker

I'm certainly not a lawyer or expert on this, and I'm sure it varies between legal jurisdictions... but I thought that US law has (some?) liability protections for "common carriers" who pass data but are unable to read it.

Your ISP isn't liable for stuff you download over a secure HTTPS/SSL connection. In theory, the same *should* apply here. But still, someone may try to test it in court.

[benpate@mastodon.social]

@hiker

It's fully backwards compatible. If you don't support encrypted messages, you can still send/receive regular ones.

Here's a *very* short version:

Your device makes two encryption keys: one is public and one is private

The private key never leaves your device

The public key is published in your ActivityPub profile

If I want to send you a message, I check your profile to see if you've published encryption keys.

Have keys? send encrypted messages
No keys? send plaintext messages

[benpate@mastodon.social]

Thank you, and yes. Syncing key packages to a public server might get tedious for everyone.

BTW: We had a video conference today, and you came up (along with the issue you linked)

We were running out of time (because W3C meetings) but want to keep open the possibility of implementing this in the future.

We're meeting again in two weeks. Wanna come?

@soatok @bluewinds @GroupNebula563

[soatok@furry.engineer]

@benpate @bluewinds @GroupNebula563 Sure! My signal is soatok.45 if you'd like to coordinate

[jaz@toot.wales]

@benpate

US law is certainly one jurisdiction, one which routinely compels the sharing of metadata of E2EE users and their conversations, and one which is trying very hard to remove a number of protections currently enjoyed by US-based service providers through legislation such as KOSA and EARN-IT.

Also, social media companies are not common carriers. That's a very different thing (like ISPs, telcos, and railroads.)

Also...

https://umap.openstreetmap.fr/en/map/fediverse-near-me_828094#3/25.799891/29.794922

[rapsneezy2@mastodon.social]

@benpate

sadly i'm not qualified to audit cryptogrpahic function enforcing code

but I do recall RSA being open source and being promoted by NIST and the US gov

whilst having known vulnerabilities

https://grahamcluley.com/nsa-bribe-rsa-encryption/

https://www.cnet.com/news/privacy/security-firm-rsa-took-millions-from-nsa-report/

[jaz@toot.wales]

@benpate

Also, even if I enjoyed all the protections in the world, I am not in the E2EE business.

I am not in the patio installation business.

I am not in the porn business.

I am not in the banana peel recycling business.

I operate a public-facing social networking service for charitable purposes, with various liabilities I have chosen to take on, and various regulatory requirements I have chosen to comply with.

E2EE is not in my mission, nor in my wheelhouse, nor in my business plan.

[vmstan@vmst.io]

@jaz @benpate this an excellent point, and something I learned in my brief time running a Matrix server as part of vmst.io -- it's nearly impossible to moderate what you can't see.

[benpate@mastodon.social]

@rapsneezy2 Yup. And, most vulnerabilities have nothing to do with the encryption, but all of the architecture around it that leaks, injects, or lets adversaries circumvent your encryption.

I'm gonna share this image *so many times* today :)

https://xkcd.com/538/

At the end of the day, I don't think we're building something to keep out the NSA or the Mossad. I think we're thwarting nosy admins, data harvesters, and the same. And that's a good step forward.

Use Signal to do illegal stuff.

[jaz@toot.wales]

@benpate

To be clear, I am very happy E2EE services, patio installers, porn services, and banana peel recyclers exist.

I simply do not want to operate one of these businesses.

[benpate@mastodon.social]

@jaz I can only say "yes" so many times before I dig up the Meg Ryan gif.

Do you want me to dig up the Meg Ryan gif?

[tchambers@indieweb.social]

@benpate @earth_walker

I'd say watch @delta too!

[evan@cosocial.ca]

@jaz @benpate thanks for bringing this up, Jaz. I think one way to consider this is that people like me, Ben, Bonfire, and Mastodon can provide this technology, and communities and individuals will make decisions about how and when they use it.

[benpate@mastodon.social]

@vmstan @jaz

Yup. I've heard some discussion about allowing users to "Flag" content to admins. But then there's the question of how to prove that the message is authentic (and I didn't just use a screenshot maker to frame someone)

Right now, I don't know how that'll play out. But I'm glad Mastodon is going to be asking those questions.

[rapsneezy2@mastodon.social]

@benpate

I may be wrong but I understood the RSA issue to be a deliberately chosen random number generator which wasn't quote so random - so algorithmic.

https://www.researchgate.net/publication/354700058_RSA_Weaknesses_Caused_by_the_Specifics_of_Random_Number_Generation

(but i'm no expert)

[jaz@toot.wales]

@benpate I'd appreciate the gesture 😜

[rapsneezy2@mastodon.social]

@benpate I would also say

use Signal (or other) to do good stuff which western governments like Germany don't want you to do

not just illegal stuff

good stuff on the right side of history

[jaz@toot.wales]

@evan @benpate that's all I'm saying, allow me to opt-in if desired

[jaz@toot.wales]

@benpate @vmstan speaking in behalf of the large number of Lemmy admins who had to turn off services due to two successive floods of maliciously-federated CSAM severely impacting their mental health, this is a very large and complex conversation to consider.

[evan@cosocial.ca]

@jaz @benpate I should also say that the interviews I've done about having more people bring their personal connections, family and friends, to the Fediverse, they repeated again and again that they needed to have private messaging to do that, and this warning keeps them from doing it. If people don't connect with real-world relationships here, they aren't going to stay. This is existential.