At least Florida’s SB 868/HB 743, “Social Media Use By Minors” bill isn’t beating around the bush when it states that it would require “social media platforms to provide a mechanism to decrypt end-to-end encryption when law enforcement obtains a subpoena.” Usually these sorts of sweeping mandates...
Mmmhmm. Apparently the Threadiverse is about to become illegal in Florida.
First, let’s generate a strong public-private GPG keypair for myself and some hypothetical other Threadiverse user, anotheruser@lemmy.today:
And show the tal@lemmy.today public key:
long keyblock
And then show an example of someone else importing it, pretending that they’re anotheruser@lemmy.today (though in my case, I’ve already got the tal@lemmy.today public key in my keyring):
another long keyblock
Not that I disagree with your point, but Florida law is only relevant within Florida and, to a limited extent, the United States. Admins of US-based instances could likely be subpoenaed and then held in contempt if they refused, assuming they don’t pull a PornHub and just block all of Florida.
That said, this is very worrying since subpoenas have a MUCH lower threshold of legal bearing than warrants. I suspect that Apple will likely challenge this in court or they stop selling iPhones there.
Oh, yeah, my concern isn’t really that Florida is planning to go after instance admins — I’m just being sardonic — so much as to point out that any practical enforceability of this is going to have a lot of issues.
I mean, do you mandate that Lemmy disallow third party clients? Try to force them to detect and block encrypted messages? What happens if I start dumping big PGP messages steganographically in images and simply send those? What happens if the image I’m sending is just a link to isn’t even uploaded to pict-rs on a Lemmy instance?
I don’t need to move a whole lot of bits to send messages, and it’s really hard to block people who can send any data at all from having software send data that cannot be read by intermediaries, use the existing social media channel to agree upon out-of-band communications channels that social media operators have no control over, and so forth. Like, okay. Say I am a child-molesting terrorist drug running money launderer or whatever. I know someone who uses Facebook.
Let’s even say that Facebook does a fantastic job of detecting and blocking any E2E-encrypted communications like PGP messages of the sort I mentioned in the above comment.
Okay. Now let’s say that there is some other non-social-media system that uses OTR. I use Facebook to send someone my identity on that OTR system, as well as – which doesn’t need to be in any kind of standardized format — the shared secret OTR uses to bootstrap trust between two parties. That shared secret becomes useless after the initial handshake completes. Is Florida going to figure out everything that I’m saying, manage to break into whatever other channel I’m using, and MITM the thing? Probably not, since even if they supoena Facebook and Facebook gives them that shared secret, it doesn’t let them later MITM the OTR communications.
That sounds complicated, but from a user standpoint it’s “Let’s talk on . I’m , and here’s .” The other person fires up their program, pastes string in, and unless Florida have already supoenaed and MITMed that channel, at that point, the deed is done – out-of-band E2E-encrypted communications are bootstrapped, and Mark Zuckerberg can’t read them or let anyone else read them even if he wants to do so.
And even then only to the extent those with the power to do so choose to enforce it. It might matter if you or I break the law; it will not matter in any meaningful way if Meta does.
Actually, on second thought, maybe the automated in-webpage decryption via the plugin thing I stuck at the end is a bad idea if it just inserts the decrypted stuff right into the page (not sure if this is the case). Like, I bet that a malicious or compromised instance could serve up Javascript in the webpage it provides to read and send the decrypted content from the web page.
But not a problem for the approach in general, just decrypting-in-place in a webpage. Would benefit from client support in general, though.
EDIT: Also would be nice to have user profile bios have enough space to actually fit a PGP public key, if that is to be used to distribute PGP public keys (rather than keyservers or something, though one issue with using Lemmy instances to distribute them is that a compromised instance could list bogus pubkeys for users who haven’t yet obtained a local copy of the pubkey for a given user). Presently, it looks like the character limit is extremely short on lemmy.today, which is presumably using the Lemmy default; 300 characters. I’d think that it could at least be boosted to the comment length limit of 10,000 characters.