In most ways except one, the encryption debate is the same as it ever was. So what’s changed?The current administration has demonstrated that app store bans can be used as a hammer to implement policy, and you can bet these folks are paying attention. gov.uk/government/pub…
This is where a lot of these “you can’t ban math” and “anyone can implement encryption in a few lines of code” arguments really fall apart. These people don’t care about any of that, they want to make encryption tools inaccessible to the broader public.
Someone tweeted me a link to Signal’s official instructions for sideloading on an Android phone. Unfortunately, I use an iPhone, which turned it into a direct link to the App Store.
Anyway, one of the greatest features of mass-market encryption apps today is that *having one on your phone doesn’t make you look suspicious.* Nobody is going to assume you’re a criminal because you use WhatsApp.
The minute you have to jump through weird technical hoops to install a privacy app, that benefit of the doubt goes away. Not only will the numbers get smaller, and the network effect go away, but it will look like an unusual decision rather than the obvious one.

• • •

Missing some Tweet in this thread? You can try to force a refresh
 

Keep Current with Matthew Green

Matthew Green Profile picture

Stay in touch and get notified when new unrolls are available from this author!

Read all threads

This Thread may be Removed Anytime!

PDF

Twitter may remove this content at anytime! Save it as PDF for later use!

Try unrolling a thread yourself!

how to unroll video
  1. Follow @ThreadReaderApp to mention us!

  2. From a Twitter thread mention us with a keyword "unroll"
@threadreaderapp unroll

Practice here first or read more on our help page!

More from @matthew_d_green

9 Sep
Cool new attack on static (non-EC) Diffie-Hellman in OpenSSL. Takes advantage of a timing vulnerability on the server side to extract the connection pre-master secret. Crypto implementations are hard. raccoon-attack.com
This is such an insane attack. You literally get a tiny timing oracle that tells you whether the DH secret begins with a zero byte. And then you just repeat that experiment until you’ve got the whole key. We’re all doomed.
In practice this isn’t a terribly big deal. Static DH is rare and is going away in recent versions. This is further evidence that maybe it should go away faster.
Read 5 tweets
11 Aug
I know it feels a little like kicking someone while they’re down, but I wish Mozilla had just focused on improving their browser product to compete with Chrome during that critical period when Chrome ate all their marketshare.
I mean if you make one product and the biggest company in the world comes at you with a direct competitor, you have to step up. Not try to make another competitor from scratch that competes with the big company’s other products.
Also, Mozilla had $450m revenue in 2018. I guess I’m just a professor and maybe that’s what a couple of SF apartments cost now, but: that seems like a very respectable budget to invest in making your browser better.
Read 7 tweets
8 Jul
Signal has gone from merely annoying me to create a PIN, to outright refusing to let me use the app if I don’t create one. 😠
Apparently 0000 is no good.
I really liked Signal. And it bums me out that I’m going to have to stop using it. @moxie, this was the wrong decision.
Read 10 tweets
25 Jun
You should really just read Riana’s piece on the new crypto bill. But there are two parts of it I specifically want to call out. 1/
First: to the tech people who thought they could bargain with William Barr and Lindsey Graham and get a reasonable bill that confined itself to encrypted phones without trying to grab messaging, phone calls for desert: you’re all useful idiots. 2/
Seriously. I really, really need to reiterate this. There is no grand bargain to be made with these folks that leads to a reasonable law enforcement access policy in which security is ever going to be more than an afterthought. None. Zero. 3/
Read 9 tweets
3 Jun
There seems to be some renewed interest in selecting phone passcodes that are difficult to crack. I don’t know why! But here’s a tweet from a while back that might help.
I guess for people who aren’t deeply technical and are just coming to this, it might be helpful to explain the reasoning behind selecting phone passcodes. So here’s a thread. 1/
Modern phones (iPhones and recent Androids) encrypt much of the data on your device. This is done using your phone passcode. I think most people know this part. 2/
Read 14 tweets
3 Jun
Obviously I don’t think you should have to pay for E2E encryption.
So let me follow this up with some more detail, if you can handle a thread. The thing that’s really concerning me is that there’s a strong push from the US and other governments to block the deployment of new E2E encryption. 1/
You can see this in William Barr’s “open letter to Facebook”. But this is part of an older trend. Law enforcement and intelligence agencies can’t get Congress to ban E2E, so they’re using all the non-legislative tools they have to try to stop it. 2/ justice.gov/opa/pr/attorne…
Read 16 tweets

Did Thread Reader help you today?

Support us! We are indie developers!


This site is made by just two indie developers on a laptop doing marketing, support and development! Read more about the story.

Become a Premium Member ($3/month or $30/year) and get exclusive features!

Become Premium

Too expensive? Make a small donation by buying us coffee ($5) or help with server cost ($10)

Donate via Paypal Become our Patreon

Thank you for your support!

Follow Us on Twitter!