<story><title>EU Commission doesn&apos;t understand what&apos;s written in its own chat control bill</title><url>https://mullvad.net/en/blog/2023/3/28/the-european-commission-does-not-understand-what-is-written-in-its-own-chat-control-bill/</url></story><parent_chain><item><author>jll29</author><text>Don&amp;#x27;t believe vendors&amp;#x27; lies about &amp;quot;end-to-end&amp;quot; encryption.&lt;p&gt;If caught red handed, they will always say it depends on how you define where both &amp;quot;ends&amp;quot; begin.&lt;p&gt;Do not trust a cloud service that you have not developed and deployed yourself.&lt;p&gt;You may trust untrusted hardware with your encrypted content, but only if you have given it your content pre-encrypted by yourself, not trusted a third party to encrypt it on your behalf.  Obviously, this excludes mobile devices.&lt;p&gt;Do not trust a tree of certificates if you cannot trust the root certificate because it belongs to an organization that is in a jurisdiction where people may be interested in what you have written and said in your encrypted message.&lt;p&gt;Don&amp;#x27;t trust old-school typewriters and the postal system either. Letters are routinely opened and typewriters can be matched. For example, the Stasi (secret police of the former GDR - German &amp;quot;Democratic&amp;quot; Republic) had an archive of type samples of all sold models of typewriters for re-identification of political pamphlets.&lt;p&gt;You can trust a few things: You can trust your Linux box with your self-compiled kernel (no 3rd party drivers), at least as long as it is not on a network. To build a safe environment, you could start there, taking a defensive approach.
Remember, last time the paranoid turned out to be naive when Snowden revealed the real status quo in 2013 (ten years ago, when I couldn&amp;#x27;t buy a 1 TB USB stick).</text></item></parent_chain><comment><author>tablespoon</author><text>&amp;gt; Don&amp;#x27;t trust old-school typewriters and the postal system either. Letters are routinely opened and typewriters can be matched. For example, the Stasi (secret police of the former GDR - German &amp;quot;Democratic&amp;quot; Republic) had an archive of type samples of all sold models of typewriters for re-identification of political pamphlets.&lt;p&gt;That&amp;#x27;s theoretical.  I highly doubt &lt;i&gt;anyone&lt;/i&gt; extends that much effort to target typewriters anymore.  The best they could probably do is match a series of messages to the same typewriter.  Though they might not even be able to do that, because the law-enforcement skills to match typewriter documents to each other have also probably nearly completely atrophied.&lt;p&gt;You&amp;#x27;re probably more likely to be caught by being the weirdo still buying typewriter ribbons.</text></comment>
<story><title>EU Commission doesn&apos;t understand what&apos;s written in its own chat control bill</title><url>https://mullvad.net/en/blog/2023/3/28/the-european-commission-does-not-understand-what-is-written-in-its-own-chat-control-bill/</url></story><parent_chain><item><author>jll29</author><text>Don&amp;#x27;t believe vendors&amp;#x27; lies about &amp;quot;end-to-end&amp;quot; encryption.&lt;p&gt;If caught red handed, they will always say it depends on how you define where both &amp;quot;ends&amp;quot; begin.&lt;p&gt;Do not trust a cloud service that you have not developed and deployed yourself.&lt;p&gt;You may trust untrusted hardware with your encrypted content, but only if you have given it your content pre-encrypted by yourself, not trusted a third party to encrypt it on your behalf.  Obviously, this excludes mobile devices.&lt;p&gt;Do not trust a tree of certificates if you cannot trust the root certificate because it belongs to an organization that is in a jurisdiction where people may be interested in what you have written and said in your encrypted message.&lt;p&gt;Don&amp;#x27;t trust old-school typewriters and the postal system either. Letters are routinely opened and typewriters can be matched. For example, the Stasi (secret police of the former GDR - German &amp;quot;Democratic&amp;quot; Republic) had an archive of type samples of all sold models of typewriters for re-identification of political pamphlets.&lt;p&gt;You can trust a few things: You can trust your Linux box with your self-compiled kernel (no 3rd party drivers), at least as long as it is not on a network. To build a safe environment, you could start there, taking a defensive approach.
Remember, last time the paranoid turned out to be naive when Snowden revealed the real status quo in 2013 (ten years ago, when I couldn&amp;#x27;t buy a 1 TB USB stick).</text></item></parent_chain><comment><author>gizmo</author><text>Do you trust your bios? Your usb stack? Your network card firmware?&lt;p&gt;I get the desire to control the entire chain, but nowadays you’re surrounded by cameras and microphones 24&amp;#x2F;7, every smart device is a surveillance sleeper agent waiting for the magic word. Certificate chains are the least of your worries.</text></comment>