So we know the UK, France, Sweden and Australia all have “pondered out loud” about getting platforms like Signal to allow backdoors into encrypted calls and messages.

This creates a sense of safety about these platforms being secure, because governments want to come after them.

Here’s a tinfoil hat take: Five Eyes is significantly reducing inter cooperation. The non-fascist parts of the alliance don’t want to share with the obvious authoritarian, but the authoritarian one used to share the fruits of their established backdoors with them, and now they don’t.

Note that the US isn’t asking signal for a backdoor. Why? Back in 2015-2016 (last years of Obama), Apple had a loud and visible feud with the FBI. Since the authoritarian came to power, this all disappeared from the media. Interestingly, 10 years have gone by since that moment, every single aspect of our lives has become more surveilled, and somehow the US govt has stopped trying to get into phones? *While the CEO is making hand deliveries of 24 karat gold bars to the Oval Office?

TLDR; I think a safe assumption that they are in our devices by now. Fundamentally people misunderstand encryption. Encryption is only as strong as the weakest link. If your signal chats are unencrypted for consumption on your device, then that’s when the unencrypted content can be captured.

For the longest time, Apple stored your iCloud backups encrypted. Looked good in marketing materials, until they casually admitted the decryption key is stored in the same cloud.

Combine this with ICE capturing citizens without due process. If you have a vanilla smart device, you’re doing the surveillance for them. /tinfoilhat

~this is OG content created by me, a Lemmy user. Please don’t go too .ml on me in the comments.~

  • mathemachristian[he]@lemmy.ml
    link
    fedilink
    arrow-up
    7
    ·
    1 day ago

    Lets be real the US govt effectively controls the certificate authority that almost everyone uses and therefore could mitm most connections anyway

    • kingofras@lemmy.worldOP
      link
      fedilink
      arrow-up
      4
      ·
      1 day ago

      Not sure that’s how it works. The certification and the encryption are two different things. Though encryption certification does require the private keys to be uploaded to the CA, a bunch of internal encryption for these type of apps would not necessarily be certified by that or a CA in order for the encryption to be effective.