<story><title>Facebook, WhatsApp Will Have to Share Messages With U.K.?</title><url>https://www.bloomberg.com/news/articles/2019-09-28/facebook-whatsapp-will-have-to-share-messages-with-u-k-police</url></story><parent_chain><item><author>brenden2</author><text>Relying on laws leaves a lot of wiggle room for bad actors, slippery slopes, and political opinions changing over time. Laws are based on trust in institutions (do you _really_ trust large governments?).&lt;p&gt;Laws are probabilistic, whereas math &amp;amp; source code is deterministic. You can verify that computer code does what it says it does. Laws depend on enforcement and complicated judicial systems (based on humans) to interpret and apply the laws, which means they can effectively change over time, and the goalposts are never stationary.</text></item><item><author>dessant</author><text>&amp;gt; If I can compile the code from source myself, without any backdoors, then I can be reasonably assured there aren&amp;#x27;t any backdoors&lt;p&gt;Where does that leave the rest of society? Having open source software and hardware is not enough, we also need laws that prohibit mass surveillance and support our efforts to uphold human rights.</text></item><item><author>brenden2</author><text>If I can compile audited code from source myself, without any backdoors, then I can be reasonably assured there aren&amp;#x27;t any backdoors (excluding perhaps hardware level backdoors--but that&amp;#x27;s why we do the encryption in software).&lt;p&gt;Implementing hardware backdoors that are opaque to end users is theoretically possible, but more difficult in practice. You could, for example, build a screen&amp;#x2F;monitor that just captures everything on the screen and forwards it to some other entity, but in practice it&amp;#x27;s not so easy because of bandwidth limitations, etc. I suppose it would be much easier to create a physical keyboard that phones home over a mobile network, although it would only give you half the conversation.&lt;p&gt;*edit: added the word &amp;quot;audited&amp;quot;.</text></item><item><author>deogeo</author><text>&amp;gt; If the source code isn&amp;#x27;t available for audit by 3rd parties (or yourself), and you can&amp;#x27;t build it from source, then it was never really &amp;quot;secure&amp;quot; anyway. What lawmakers do or don&amp;#x27;t say is just noise.&lt;p&gt;Careful - you&amp;#x27;re right that WhatsApp is untrustworthy, but laws that force them to add backdoors could well be applied to open-source code as well. Or make possession of non-backdoored software, open or not, illegal. Or compel OS&amp;#x2F;hardware manufacturers on which the code runs. The law is a dangerous thing to ignore.</text></item><item><author>brenden2</author><text>If the source code isn&amp;#x27;t available for audit by 3rd parties (or yourself), and you can&amp;#x27;t build it from source, then it was never really &amp;quot;secure&amp;quot; anyway. What lawmakers do or don&amp;#x27;t say is just noise.&lt;p&gt;Platforms that rely on trust (in this case, trusting that FB isn&amp;#x27;t doing bad things) provide very weak guarantees about privacy&amp;#x2F;security. They could easily include a keylogger in WhatsApp and bypass the e2e encryption, for example, and us regular folk have no way of knowing.</text></item></parent_chain><comment><author>dessant</author><text>I agree that laws are not enough, independent verification must be possible. But your right to use secure software, and to audit it without risking to spend your life in prison or being killed, is ensured by laws.&lt;p&gt;This is why moving the goalposts and further normalizing surveillance is extremely dangerous. The rights that you enjoy today are not universal, and can obviously be eradicated in less than a generation.</text></comment>
<story><title>Facebook, WhatsApp Will Have to Share Messages With U.K.?</title><url>https://www.bloomberg.com/news/articles/2019-09-28/facebook-whatsapp-will-have-to-share-messages-with-u-k-police</url></story><parent_chain><item><author>brenden2</author><text>Relying on laws leaves a lot of wiggle room for bad actors, slippery slopes, and political opinions changing over time. Laws are based on trust in institutions (do you _really_ trust large governments?).&lt;p&gt;Laws are probabilistic, whereas math &amp;amp; source code is deterministic. You can verify that computer code does what it says it does. Laws depend on enforcement and complicated judicial systems (based on humans) to interpret and apply the laws, which means they can effectively change over time, and the goalposts are never stationary.</text></item><item><author>dessant</author><text>&amp;gt; If I can compile the code from source myself, without any backdoors, then I can be reasonably assured there aren&amp;#x27;t any backdoors&lt;p&gt;Where does that leave the rest of society? Having open source software and hardware is not enough, we also need laws that prohibit mass surveillance and support our efforts to uphold human rights.</text></item><item><author>brenden2</author><text>If I can compile audited code from source myself, without any backdoors, then I can be reasonably assured there aren&amp;#x27;t any backdoors (excluding perhaps hardware level backdoors--but that&amp;#x27;s why we do the encryption in software).&lt;p&gt;Implementing hardware backdoors that are opaque to end users is theoretically possible, but more difficult in practice. You could, for example, build a screen&amp;#x2F;monitor that just captures everything on the screen and forwards it to some other entity, but in practice it&amp;#x27;s not so easy because of bandwidth limitations, etc. I suppose it would be much easier to create a physical keyboard that phones home over a mobile network, although it would only give you half the conversation.&lt;p&gt;*edit: added the word &amp;quot;audited&amp;quot;.</text></item><item><author>deogeo</author><text>&amp;gt; If the source code isn&amp;#x27;t available for audit by 3rd parties (or yourself), and you can&amp;#x27;t build it from source, then it was never really &amp;quot;secure&amp;quot; anyway. What lawmakers do or don&amp;#x27;t say is just noise.&lt;p&gt;Careful - you&amp;#x27;re right that WhatsApp is untrustworthy, but laws that force them to add backdoors could well be applied to open-source code as well. Or make possession of non-backdoored software, open or not, illegal. Or compel OS&amp;#x2F;hardware manufacturers on which the code runs. The law is a dangerous thing to ignore.</text></item><item><author>brenden2</author><text>If the source code isn&amp;#x27;t available for audit by 3rd parties (or yourself), and you can&amp;#x27;t build it from source, then it was never really &amp;quot;secure&amp;quot; anyway. What lawmakers do or don&amp;#x27;t say is just noise.&lt;p&gt;Platforms that rely on trust (in this case, trusting that FB isn&amp;#x27;t doing bad things) provide very weak guarantees about privacy&amp;#x2F;security. They could easily include a keylogger in WhatsApp and bypass the e2e encryption, for example, and us regular folk have no way of knowing.</text></item></parent_chain><comment><author>psv1</author><text>It isn&amp;#x27;t &lt;i&gt;either-or&lt;/i&gt;. You can have reasonable laws that protect people&amp;#x27;s rights and privacy, and compile and check the source if you wish to do so.</text></comment>