Ask HN: What are your arguments in favor of end-to-end encryption?

Just because someone can abuse a thing doesn't make the thing bad, it makes the person who commits the abuse bad. We don't ban cars to fight drunk driving and we shouldn't eliminate the spirit of the 4th Amendment to go after child pornographers, terrorists, money launderers and drug dealers. Even with E2E encrypted communications the fact that user A is communicating with user B, when, and for how long is knowable, and that metadata alone can be sufficient to get the warrants necessary to effect legal, invasive searches without disturbing the rights of everyone else.

For me I think we will really get to a world where thought is augmented digitally in addition to just communication. My thoughts and my communications are private and just because it is possible to monitor them doesn’t mean it should. Mostly deontological as it’s wrong to invade privacy, but also utilitarian as to allow creativity and construction privacy is essential.

So I look at this through a lens of what would be allowed on my thoughts and speech. Would it be ok to read everyone’s mind to prevent a terrorist act? No because the damage caused is greater than the damage prevented. Not to mention it would most likely be used to charge for IP infraction or speeding tickets or some other banal infraction.

It's the same fear mongering that you hear from gun control people. Facts and statistics say otherwise, sneaker liberals believe you are too stupid.

An argument I saw recently that I liked:

“Because a citizenry’s freedoms are interdependent, to surrender your own privacy is really to surrender everyone’s. Saying that you don’t need or want privacy because you have nothing to hide is to assume that no-one should have or could have to hide anything.”

So while I'm not currently rebelling against my government, I'm sure as hell glad the protestors in Hong Kong can get their hands on E2E encrypted chat.

You can kill someone with a hammer or a chair. Doesn’t mean we shouldn’t have them.

Freedom. Nobody, and least of all a government, should be able to decide what software you use. If their will stands above yours, you are a slave. Do you like slavery? Do you love yourself?

Is this about adding E2EE to the common platforms?

Pedophiles and terrorists are already using E2EE I would think, so this is really about government being able to spy on everyone.

They don't have that ability IRL, why should they online?

More importantly, what are the macro consequences of government access to everyone's private communications, and especially, the oppressive effect on free speech etc when everyone is aware they are being monitored (I do sometimes wonder if Snowden was more 'deliberate leak' than 'whistleblower').

What are your arguments in favor of knives? How do you respond when someone brings up concerns of knives being used to stab people?

> how do you respond when someone brings up concerns of E2EE platforms being used for child sexual abuse imagery or terrorism?

These are only a tiny part of uses of encryption. Ask anyone if he would like to have his bank transfers, or his credit card credentials in plain text. End to end encryption allows the whole internet to act as a commerce platform.

Encryption allows journalists and activists in strict, controlled regimes to let facts out. It allows an abuse victim to safely expose the abuser. It allows at a broader spectrum to maintain secrecy when secrecy is the only way a subject has to distantiate himself from harm.

Disabling end to end encryption requires an implicit good faith on those who look at our communications, and the history is full of abuse from those figures.

Encryption is math. Can we really make a form of math illegal?

I feel privacy is a basic human right regardless of what country you live in.

I’m not fan of punishing the majority because of a screwed up minority.

People who commit illegal acts as horrible as child abuse and terrorism are not going to respect the law when it comes to encryption.

Again, you can’t stop people from doing math. The idea of making it illegal is silly.

Because encryption is math and knowledge. Banning it will only stop legitimate users while bad actors can still just go ahead and encrypt their stuff.

If politicians consider leaving everybody vulnerable to catch criminals, this is a incredibly high price to pay. I’d argue that the price is so high that even with evidence that this would help catch criminals we should still consider not doing it. However there is no evidence for that and my argument above explains why criminals would still be able to encrypt.

We should really stop implementing any security legislation without checking whether it actually achieves the stated goals.

Not sure if this outweighs concerns with E2EE, but governments unfairly discriminate against people with reasonable viewpoints I.e. government isn't perfect. So people with contrarian views should have a way to express views/organize. Historically governments couldn't watch what people were saying/doing at all times and E2EE allows that to continue in a digital world.

> how do you respond when someone brings up concerns of E2EE platforms being used for child sexual abuse imagery or terrorism?

The majority of criminals caught in transit doesn't warrant me giving up my privacy. They will still be caught in the same manners they are now, and it still offers them little protection over what law enforcement typically does.

First of all, break the assumption that encryption is for paranoid people. Ask the opposing side to defend regulation over E2EE.

You're in luck because there are no objective arguments against it. When they inevitably turn to emotionalisms like "terrorism" and "sexual abuse", cite how insignificant of a percentage "terrorists" and "abusers" are of all E2EE usage. Explain that a ban for one is a ban for all, them included, and that encryption in fact protects from people's spying on and planning over one's significant other/children/etc. Ask why politicians like Trump or Clinton can seek protection from aggressors but you, an honest-working tax-paying citizen unentitled to a private security force, should not.

Explain that criminals overtly show their psychological traits every living moment and it is the failure of the authorities to help rectify their behaviour lest they commit a crime; that it is a well-paid police proffession to monitor people for such traits. Such a profession that is gladly and frugally assisted by artificial intelligence which can be tied to any camera that sees you, any website that you visit; that the government and companies can make deterministic psychological profiles from metadata alone and some graph theory.

You can also reference absurdity by stating that, to avoid "terrorism" among E2EE, the government should simply ban "terrorists" from using E2EE. However, the Wars-On-.* have been proven not to achieve the original goal in US history but rather to cause collateral damage, much more drastic than foreign subversion could. So banning or regulating E2EE is an ambiguous goal which will fail.

Suspicious, maybe it was foreign subversion indeed. Would you like E2EE when you pay taxes and go vote? So why not for more close-to-home data such as intimate details that could be used against you by an enemy or in court of law?

And finally, the police force and government authority use and _develop_ E2EE. They ought to have hidden back doors in it. For the hundreds of millions to billions of dollars law enforcement receives in funding, they ought to have. So even if we assume they could catch "terrorists" and "abusers" more efficiently. Well, then they don't need such giant budgets from your wallets. Would you consistently pay dozens of dollars a month for private investigators to aimlessly roam the country, not even saying what they are looking for? So why let the government do it? You could purchase many sources of joy with that money.

* If it's really about few really bad crimes, then nothing needs to change. In addition to the traditional methods, Governments already have ways to hack a few people. It's just that the more people they hack the more likely it is that the hack gets discovered and they want to spy on the masses.

* We leak tons of metadata. Even with encryption it will be available to governments and gives them tons of ways to pin down people. Eg. in some cases police used location information of cell phones to create a list of suspects. A lot of that metadata is very hard to avoid so it's likely going to stay.

* You don't just protect yourself from the government, but also the provider. Recently a report surfaced about a yahoo employee searching his colleauge's yahoo accounts for naked pictures.

* Providers can also get hacked. If the data is in encrypted form at the provider, the hackers would have to issue an update of the client which is usually harder than "just" hacking some servers. Those hackers can even be foreign governments.

* Safe deletion gets much harder when you have to worry about data on your provider as well. There were stories about providers not deleting data that users explicitly wanted to be deleted. There's also the problem of safe hardware decomissioning. Although most big shops are handling this problem more professionally than most individuals who just run format on their laptop's hdd and then offer it on ebay, you still have to take them by their word and rely that they do their job well.

You cannot remove your personal data once it is released (except via a time machine...) and your government and state can use this information for political motives that are as questionable as child sexual abuse and terrorism. In particular, you can never discard the rise of terrorist states.

Maby if they could actually start acting on intelligence when dozens of people report that a kid is likely to conduct a school shooting I'd believe them. Even then, we all know this type of rhetoric from law enforcement is just posturing to force their way in through the front door. This is still a good exercise (documenting why end-to-end encryption is necessary), but don't kid yourselves. They will whine just like Trump until they get what they want. If nothing changes and they stop whining it's time to start digging, that probably means they got what they wanted in secret.

>Also, how do you respond when someone brings up concerns of E2EE platforms being used for child sexual abuse imagery or terrorism?

By not caring. Privacy is worth more than forcing criminals to put a small bit of extra effort.

Those who would give up essential Liberty

For a little temporary Safety

Deserve neither Liberty nor Safety

Edit: Also, when you "think of the children" you have to think not only of their immediate safety but to think of their future ability to freely and safely converse with their peers, no matter what the current government deems "acceptable".

If the right to bear arms is required for protection against a potentially corrupt or abusive federal government, then so is the right to use end-to-end encryption.

The security and safety of almost everything relies on strong, uncompromised encryption.

There’s no way to reasonably draw, much less enforce, a line dividing licit and illicit uses.

If you compromise some subset of messages, illicit uses will just move to a non-compromised technology.

So instead of drawing a line, which is impossible (and also comes down to human judgements about things like whether gay people should be killed) the only choice left, if you insist on being able to decrypt messages, is to legislate the ability to decrypt all of them.

First of all, good luck enforcing that; second, in so doing you will sweep in a lot of legitimate uses of encryption and make people and businesses less safe by endangering their finances, their privacy, and even their physical safety.

Because once you give governments the ability to read messages even assuming key escrow entities can protect the integrity of the system (unlikely) this ability will be abused by bad governments who have records of inflicting human rights abuse on citizens for “crimes” as minor as being gay, being trans, or saying the wrong words about god.

And in addition to being accessed by the bad people in government and the bad people drawn like flies to honey to work in the key escrow organization, the escrow keys will get out and be abused by more bad people which will be an entire other level of problems.

Just as E2EE can be used for crime, channels without E2EE can also be utilized for crime - mostly for blackmail, and especially if it gets compromised.

Even if you trust all actors involved in non-E2EE communication channel you can never assume that:

* This channel won't be compromised(hacking, wiretapping etc)

* That all actors involved(ISP, VPN host) will always stay trustworthy

Latter part is also related to laws - if you cannot prove that law cannot be abused by a bad actor then it shouldn't be a law.

Also banning encryption won't change the fact that it will be used. Criminals will still use it to hide their action, plus there is always steganography.

Also one of basic rules of law is "Innocent until proven guilty", banning E2EE basically reverses that.

I love the "nothing to fear, nothing to hide" argument, just reverse it and instead of applying to general populace - apply it to government as whole. Rules should work both ways - if citizens have nothing to fear if they have nothing to hide, the same should apply to all politicians and all government agencies.

My go to about a government backdoor is that the NSA hacking tools are now leaked and the leading tool for Crypto Ransoms;

If CIA and NSA can't keep dangerous tools safe and secure from the bad actors; if the FBI (commonly thought of as less cover) or local police have a ready backdoor access to my phone, messages, credit cards, or anything else, then they're practically already in bad actor's hands.

The similar argument is that my state has lost my personally identifiable information in no less than 3 security incidents.

Because making it illegal will remove benefits for 99.9999% normal people. Cryminals will keep using it when it's illegal.