Before I say anything else, I should mention that this is nothing ground-breaking, neither is it terribly difficult to implement. This is simply how I envision a simple solution.

Basically, the EU and the UK want the secret keys to your encrypted media/messages. Which essentially breaks encryption completely, ending E2EE usage.

The alternative is, then, for the user to utilise their own form of E2EE. How though? The answer, in my opinion, is personal exchange of keys utilising asymmetrical encryption. Exchanging public keys in plaintext is fine as long as they don’t have your private key. Which means unencrypted services like SMS could also be secured using this method (for example, have the public key of a user in their profile). I believe QKSMS employed encryption for SMSes for as long as it lasted, but no idea about the kind of encryption).

Technically, if everyone started to use p2p messengers with asymmetrical encryption, the EU would have very little they could do without compromising every mobile in the region and preventing people from downloading APKs somehow (sorry iOS users but you’re never going to have privacy anyway).

However, this is only possible with a FOSS project, because a company would have to fork over the keys anyway to stay alive. A FOSS project can simply be forked once the OG maintainer stops working on it due to government pressure. That is where the problem comes, since FOSS projects can’t really run their own servers to store media, making p2p the only viable option. But with some people behind CG-NAT, that becomes harder for non-technical users.

I don’t have a way to solve this other than the general population becoming tech-savvy enough to give a damn.

Tl:dr; FOSS projects are best suited for implementing personal E2EE between users, but that makes p2p the only viable option without a back-end, which makes it difficult for people behind CG-NAT.

Cheers

  • Skull giver@popplesburger.hilciferous.nl
    2·
    1 year ago

    This is the government we’re talking about. Wiretapping is done every day of the week, and detecting encrypted communications is trivial. If you’re using something packaged into an easy to use app things will probably become even easier because the app you use is irrelevant when you don’t do the opsec required to safely send messages on adversarial networks.

    An E2EE ban can just as easily be followed by a Tor ban, or a foreign VPN ban. Volunteer run mesh networks that exist outside of the internet are harder to detect, but they too can be banned. P2P will make it harder for the government to catch everyone, but people will still get arrested for breaking the law.

    Hell, the government could just not enforce the law, let everyone except for a few token cases use secure messengers, and then arrest anyone they don’t like for their illegal behavior.

    There’s just no good solution for E2EE bans.