| > That means there are still problems for you and me to solve. This was my last sentence. With which I tried to say that we have to still solve the problem and come up with the solution. My comment "that's a perfect solution" was about the answer "software that can effectively monitor communications with proper privacy" to the question about properly reconciling privacy and security, in a situation where the people are okay with their communications being monitored. But are you are expecting a answer to the question, "How will the software work?" from me. I have no clue as so how it'll exactly work. But since you're so interested, I'll take a stab: > Who is doing the monitoring? The software. No humans will ever see the raw communications which haven't been flagged. Now this is obviously the tricky part. This is not a backdoored system with a magic decryption key. What I had in mind was a software possibly in-built with the communications protocol, which will, with near perfect accuracy flag suspicious communications. This is will need a leap of tech in Machine learning with NLP. > What or who is being monitored? All the communications (through the node) are being monitored. > For example are we talking about monitoring the authorities to see if their access is done properly? 'They' have no access. Only the software does. How that is done is up to the "engineers/experts" to figure out. This will obviously need a change in communications architecture. When it comes to properly securing the physical part (the servers), I'm sure something can be figured out there. > As long as you're being super vague, you don't have a solution at all. See my first line in this comment. I don't have a solution, but I do believe that a solution exists to a problem. They're very different things. As an analogy, in mathematics, that's similar to me saying the problem is solvable, but you're talking about the actual solution. And sure, this is a 'perfect' solution where monitoring communications is even a possibility. I don't even support that possibility. The first comment I replied to does, which said: "If I have to choose one from end-to-end encryption and security, I will choose security. I don't mind my WhatsApp chats are scanned by police's software, if it can reduce terrorism. Of course, we need to make sure it is used for anti-terrorism only." So in the first place, monitoring is something that will be done. Now in that scenario, there's a solution (In retrospect, I don't think I should've said perfect). I don't think you are going to be happy with this solution. I don't expect everyone to be. I probably will be, because while I want privacy, I'm amenable to a solution I can trust in a situation where there has to be some kind of monitoring. Since we live in a democracy (I hope you don't live in an oppressive monarchy), it can happen when the majority of the people (senators, actually, because it is a Republic) agree with a situation when monitoring is okay. Your opinion or my opinion is not enough to change everyone else's opinions. So we might have to learn to live with it. |
Any proposed solution has to deal with that reality, not with the little bubble of one democracy which may arguably in the questionable opinions of some subset of people have a good government.
The reality includes police states where the police are truly evil.
It also includes police states where the software is written by truly evil people, to do evil things, with evil experts overseeing it all and approving evil behavior in the software they are checking.
Please tell me how you can be confident that there can be a solution that addresses this reality while protecting the privacy of users. Sometimes all the user wants to do is send a message to their boyfriend, without getting thrown off a building, burned, flogged, or killed, possibly having several generations of your family killed as well (see North Korea).
The system has to work for this reality. I'm pretty sure that simply drawing a line and fully protecting the privacy of users' messages, full stop, is a better solution than whatever you and your senators will come up with.
And yes, the security of a crypto system can be verified. If it's designed to be secure. Not if it's designed to be monitored. Even if the experts are perfect angels and absolutely competent, if there is a way to monitor, hackers will find a way to get access to it.
>When it comes to properly securing the physical part (the servers), I'm sure something can be figured out there.
You're dreaming. Remember, the authorities will have full power over that system, and even in countries where the authorities are not evil, the authorities as a rule are inevitably corruptible if not corrupt. This isn't just cynicism, it's reality. Look around.