[palata]

> it's not like internet is made of a few select providers

In practice it is. Almost all messaging happens on a few apps.

> also the most widely available apps already comply to the single police request to access conversations from suspects

That is not true: Signal is widely available and doesn't do that. WhatsApp probably doesn't do it either.

Don't get me wrong: I am against ChatControl as well. I believe that security comes at the cost of freedom, and it is a choice to be made on a case-per-case basis. Removing E2EE for everybody is not worth it, because criminals will always be able to use encryption one way or another. The problem is that politicians don't seem to understand it.

[wolvoleo]

They do understand it but what they want is not just criminals' data but all of us.

[throwawayffffas]

They want to pick the easy fruit. The dumb criminals that would do that sort of thing over whatsapp.

[soulofmischief]

Yes, but this easy fruit has a flavor of the week:

https://stateofsurveillance.org/news/ben-werdmuller-signal-z...

https://www.whitehouse.gov/presidential-actions/2025/09/coun...

> Common threads animating this violent conduct include anti-Americanism, anti-capitalism, and anti-Christianity; support for the overthrow of the United States Government; extremism on migration, race, and gender; and hostility towards those who hold traditional American views on family, religion, and morality.

Like, you can get 30 years in prison now for moving some boxes with zines in them, just because you are anti-fascist.

Yes, this is American politics; but don't think that the benevolent overloads of the EU don't plan for this same outcome: Already in many European countries, I can go to prison for just saying, "Free Palestine". They want it so that people cannot even say that in private.

[throwawayffffas]

Listen I agree, but the solution to this problem is not social media mediated pseudo-anonymity the operators know who you are and they are working with them.

The solution is keeping fascists of the levers of power which America has done an incredibly bad job at for the last 10 years.

If you really want to have free speech, you need to be in your own domain and that is going to be increasingly dangerous as you have noted too. So you know I see antifa tor services run out of servers in Europe in your future.

[soulofmischief]

I totally agree, the problem is difficult however because even if we create a perfectly anonymous system for registering with social media, modern LLMs make semantic analysis trivial. It's going to be impossible to remain anonymous without also using an LLM to strip the unique footprint of your text. Which leads to a very strange and monotonous culture for internet discussions. Might be unavoidable, though, at least for certain kinds of discussions.

[wolvoleo]

Yes this is indeed a problem. But this is even more reason to keep private conversations private. It will stop those LLMs learning your footprint from your private conversations.

It's an interesting thing what you're saying. I've been thinking about this happening (I think it's inevitable) and also about using an LLM to sanitise my semantic footprint.

[piltdownman]

WhatsApp already does it for unencrypted messages for about half of the EU under the purview of the rules of lawful interception obligations for NI-ICS, as well as Norway, Switzerland and the UK.

When they want to read encrypted messages they seize the phone and use Cellebrite or similar 3rd Party tooling to gain physical user-level access. No need for cert-pinning or esoteric MITM attacks.

N.B. China does not allow WeChat to have e2e encryption.

[palata]

> When they want to read encrypted messages they seize the phone

That is very, very different from mass surveillance.

[throwawayffffas]

The whole point of end to end encryption is that providers cannot comply with police request to access conversations. A properly secured system would make it impossible without compromise of your device. Now i don't know what signal does, but I am almost certain WhatsApp can just lie about your contacts keys and man in the middle the connection.

[palata]

> Now i don't know what signal does

That makes me question how much you know about end-to-end encrypted messengers, because Signal is the gold standard.

> I am almost certain WhatsApp can just lie about your contacts keys and man in the middle the connection.

The problem there is that WhatsApp is not open source, so you can't check. So obviously you have to trust. But there are many, many employees who have access to the WhatsApp sources, so if it was not implementing what it says it is, chances are that someone would have said it. Also thanks to the EU DMA we have some protocol published by WhatsApp.

[throwawayffffas]

> But there are many, many employees who have access to the WhatsApp sources, so if it was not implementing what it says it is, chances are that someone would have said it.

No one in Microsoft, Yahoo, Google, Facebook, AOL, Skype, or Apple said anything about PRISM. We had to wait for the NSA whistleblower. So the argument someone would say something does not really stand up to historical precedent.

I looked a bit into it and yeah they have a key transparency mechanism where they store a blockchain on s3.

So supposedly they can't just add a key for a user in secret. But still what if they do it in public does the client refuse to send messages to new keys?

It's not like we are all spending all our time going over a random s3 bucket to say `Aha, I am sure Bob didn't add this new key because he logged in from his desktop. It has to be a man in the middle`

Can they just siphon keys of your device? Can they just deploy a special version to just your device without the vast majority of engineers in meta even knowing about the compromised version? No one knows. Well no one in public.

The gold standard would be personally managed keys, exchanged and signed by your contacts in person, open source software that is not auto-updating, distributed over a channel that does not know your identity.

[palata]

> It's not like we are all spending all our time going over a random s3 bucket to say `Aha, I am sure Bob didn't add this new key because he logged in from his desktop. It has to be a man in the middle`

That's not how key transparency works. The whole point of key transparency is that you don't have to do that.

If you are into manually checking that you have the right key, you can do it by scanning a QR code (or exchanging the key manually through some trusted channel), both on Signal and WhatsApp.

> Can they just siphon keys of your device?

Whoever hacks your device can read the messages, end-to-end encryption protects the data in transit, not at rest.

> Can they just deploy a special version to just your device

If you get WhatsApp through the Play Store, they would need to collude with Google to do that. But it is technically possible. If you get WhatsApp on the web it's a lot easier though: they can just serve you a different codebase this one time. BTW ProtonMail can do that too, or any webapp. Which I assume is why Signal doesn't have a web version.

> The gold standard would be personally managed keys, exchanged and signed by your contacts in person, open source software that is not auto-updating, distributed over a channel that does not know your identity.

You can get the sources of Signal, audit them yourself, compile them yourself, and verify the key with your contacts through a trusted channel (in person if you like). That is already possible.

> No one in Microsoft, Yahoo, Google, Facebook, AOL, Skype, or Apple said anything about PRISM

I think it is pretty different. Was PRISM available in the code source in the mono repo of all those companies? WhatsApp is.

[layla5alive]

> The problem is that politicians don't seem to understand it.

The problem is that politicians were corrupted by power.

[palata]

This is an extremely naive view of politics in complex systems like the EU. We're not talking about the US of French president here. The people in the 27 EU countries elect their EU representatives, and nobody knows them. People usually vote for a party, and they usually don't care much about the EU, except for complaining.

It feels like people who are against the EU vote for far-right politicians (the ones that are against the EU).

EU politicians are elected by the people and they represent what the people from the 27 member countries voted. Which is different from e.g. the US president, where the people don't really have much choice. Same in France, where people voted against the far-right and not at all for Macron.