Top
Best
New

Posted by 1659447091 6 hours ago

TikTok will not introduce end-to-end encryption, saying it makes users less safe(www.bbc.com)
187 points | 133 comments
krickelkrackel 27 seconds ago|
Just like door locks are making the world less free!
xeckr 3 hours ago||
Brilliant. They're repackaging the argument governments have long made about E2EE being dangerous to children.
debazel 3 hours ago||
Children are just too effect of a tool when building a surveillance state. We should have banned children from owning open computers a long time ago just like we do with Alcohol, Driving licenses, etc.

Instead children would own special devices that are locked down and tagged with a "underage" flag when interacting with online services, while adults could continue as normal. We already heavily restrict the freedom of children so there is plenty of precedent for this. Optionally we could provide service points to unlock devices when they turn 18 to avoid E-waste as well.

This way it's the point of sale where you provide your ID, instead of attaching it to the hardware itself and sending it out to every single SaaS on the planet to do what they wish.

azinman2 1 hour ago|||
Would be a nightmare to implement and achieve the goal, but I have to say I think it’s more right than wrong. All of the data is very clear about the harms.

China has restrictions for social media and screen time for kids — how do they implement this?

debazel 43 minutes ago|||
I actually think this would be easier to implement than many of the current ID verification methods I've seen being pushed. We already have the infrastructure for selling age restricted goods, this is nothing new. Manufacturers that are unable to restrict their hardware in a "child" mode don't have to do anything and could simply continue selling to adults only.

It's obvious we're moving in a direction where we are going to get these restrictions in one way or another, and this is the only way I've come up with that doesn't come with serious privacy implications.

Most importantly, this solution would be simple for anyone to understand. You don't need to be a cryptography expert to understand there are child safe devices and then there are unrestricted devices for adults.

k1musab1 1 hour ago|||
Passport /citizen ID linked to your WOW account, etc.
TkTech 53 minutes ago||
Which has never worked. Korea had a system to prevent kids from gaming after midnight for something like 15 years. All it did was make Korean kids very good at memorizing their parents ID.
MrToadMan 16 minutes ago||||
Locking down children’s devices doesn’t stop adults sharing illegal content with other adults though, so there would still be pressure to monitor communications between adults.
psychoslave 4 minutes ago|||
At some points, laws become an ineffective tool to prevent malevolent people to act in detrimental manners, no matter what it states. But prejudices of wicked states will always continue to impact more badly general public as ever more drastic laws lacking any balance become enacted.
hsbauauvhabzb 8 minutes ago|||
I don’t think they’re doing that on TikTok
eru 33 minutes ago||||
Parents are already allowed to restrict their children access to 'dangerous' things like open computers or knives.
jaapz 22 minutes ago|||
Parents are also allowed to restrict their children access to alcohol and cigarettes, but it seems a government ban on them buying those things works better
thaumasiotes 26 minutes ago|||
I don't think debazel was saying that children should have been banned from owning computers for the benefit of the children. He was saying that children should have been banned from owning computers so that the government would have no excuse to regulate what's allowed on computers.
greybcg 42 minutes ago||||
At the same time, I remember growing up in the internet's wild west and bad encounters weren't an issue for me because of the golden rule I was taught from the start: you don't give your personal information and you don't interact with complete strangers. Learning to navigate the web instead of being in a walled garden was helpful in many ways.

The better question to ask ourselves is, does the capability to gather more information also lead to more power to act on this information? If the investigative resources are spread thin already it's not like they're gonna catch more criminals with investing more there. Repelling questionable individuals off the platform with lots transparancy -is- an effective way, but just a specific tool for a symptom.

I think a part of a better solution is to give parents and children better tools to manage their social graph themselves. Essentially the real problem is discovery and warding off of social outliers in a way that doesnt out all responsibility on opaque algos or corporations.

A part of their e2e keys could be shared using an intentionally obtuse way like mailing an item or a physical "friend code". That way parents and vetted friends can have their privacy. You don't need to tie an id to someone's person to get positive confirmation on someone's poor behaviour. If someone crossed the line then parents can see it and escalate. In additon, what would happen to a child with abusive parents who can then arbitrarily restrict and deny a childs freedom to communicate? I did not have this myself, but without free access to other minds and information I would have been duller. Does a large information dragnet really serve our collective interests or are more precise tools needed?

debazel 18 minutes ago|||
> I think a part of a better solution is to give parents and children better tools to manage their social graph themselves. Essentially the real problem is discovery and warding off of social outliers in a way that doesnt out all responsibility on opaque algos or corporations.

This is actually a key consideration for the proposed implementation. The biggest issue for parents when restricting their children's online activity is that they simply don't understand the tool available for it.

By having a "child mode" iPhone, parents don't have to know any of that. They simply buy the iPhone Kids for their children and then get a plain iPhone for themselves.

If these restrictions were to actually be enforced by law as well, then it would make it very easy for teachers and other guardians to check if a device is appropriate for the child using it.

novok 15 minutes ago|||
From what I've seen, the bad effects don't necessarily just come from free access to the internet, but that everyone around them in their social group has a video camera that can covertly record, they're all immature children and thus you cannot slip up once or you get kid cancelled, and they start doing a collective dissociative freeze response in a self-imposed emergent panopticon as a result.

So if the teen phone turned into a restricted "call mom" device with no cameras and with neon yellow obvious fuck you coloring and a restricted set of apps, and police took away a full phone much like they take away cigs and beer it might be enough to break the critical mass to create this issue. They can have dedicated cameras for video club, use the family computer, have an xbox or switch and have whatever tech experience that millenials had, the last generation to not have exponential increases in anxiety , depression and sexlessness.

It's the covert camera + internet that it's the key issue.

chillfox 16 minutes ago||||
This honestly sounds like the best proposed solution I have heard.
fhd2 2 minutes ago||
Agreed. Putting the burden on parents is quite something:

1. You end up being the bad guy, other parents don't restrict their kids internet usage etc. Some folks would argue to just not set up restrictions and trust them. But it's a slippery slope and puts kids in a weird position. They start out with innocent YouTube videos, but pretty quickly a web search or even a comment can lead them to strange places. They want to play games online, but then creeps abuse that all the time. Even if you trust them to not do anything "wrong", it's a lot to put on their shoulders.

2. If you want to put restrictions in place, even if you're an expert, the tools out there are pretty wonky. You can set up a child protection DNS, but most home routers don't make it easy (or even allow you) to set a different DNS server. And that's not particularly hard to circumvent. I suppose a proxy would be a more solid solution, but setting that up would be major yak shaving. Any "family safety" features (especially those from Microsoft) are ridiculously complicated and often quite buggy. Right now, I got the problem on my plate that I need to migrate one of my kid's accounts from a local Windows account to a Microsoft account (without them loosing all their stuff), because for local accounts, it seems the button to add the device is just missing? Naturally, the docs don't mention that, I had to do research to arrive at that hypothesis. The amount of yak shaving, setup and configuration you have to do for a reasonable setup is just nuts.

3. If you're not good with tech - I don't see how you have _any_ chance in hell to set up meaningful restrictions.

Some countries are banning social media - sure, that's one thing. But there's a _lot_ of weird places on the internet, kids will find something else. I for one would appreciate dedicated devices or modes for kids < 18. Would solve all this stuff in a heartbeat.

jjmarr 1 hour ago||||
> Instead children would own special devices that are locked down and tagged with a "underage" flag when interacting with online services, while adults could continue as normal.

California is mandating OSes provide ages to app stores, and HN lost their mind because it's a ban on Linux.

consp 1 hour ago||
> California is mandating OSes provide ages to app stores,

They forgot to put in the provision which exempts apps which do not need an age rating? As in: everything os related.

Sounds like a good way to get rid of snap at least since that is where all the commercial bloat is located. Last time I did a fresh Debian install I do not remember installing any app from the os repository which would require age restrictions (afaik).

jjmarr 59 minutes ago||
> They forgot to put in the provision which exempts apps which do not need an age rating? As in: everything os related.

That's correct. You need to provide your age to install grep.

pinkmuffinere 1 hour ago||||
> We should have banned children

I see you Mr Quaker Oats

tayo42 2 hours ago|||
I can't tell if this is sarcasm or not
pants2 1 hour ago|||
TikTok has a drug-like effect on the brain. Multiple studies show a clear link between excessive TikTok engagement and increased levels of anxiety, depression, and stress. Maybe it is time we regulate it like a drug?
voidUpdate 25 minutes ago|||
Is that because of engaging with tiktok, or because of the content on tiktok? If the app was exclusively pictures of kittens and nice flowers you saw on your commute, would it have a detrimental effect?
Shitty-kitty 36 minutes ago|||
What do you mean exactly, tax it as a vice?!
travisgriggs 2 hours ago||||
Hyperbole of some sort. I think it works on both the positive and negative side of the axis too.
nandomrumber 2 hours ago||||
I’ll have a packet of cigarettes, a fifth of vodka, and an unrestricted personal electro device.

ID please.

Seems entirely reasonable.

Possibility entirely ineffective, but then again I don’t often see children walking around with bottle a of booze.

true_religion 1 hour ago|||
This is how the internet is run in countries where you need ID to connect to services. It’s not at all dystopian.
haritha-j 19 minutes ago|||
I don't understand why all teh child safety systems require age verification. Why not have a single setting on a smartphone that sends a 'child' flag to every single app or website, which then reacts accordingly? As long as you ensure that the browser can't be changed or modifed, it should be fine.
threatofrain 41 minutes ago|||
Ultimately your neighbors must buy the argument. The reason why this argument wins is not because framing is so tricky, but because it connects with the values of your neighbors. Trying to convince people that these aren't actually their values is swimming upriver.
Tepix 24 minutes ago||
The solution is simple: Take away the argument by blocking children's access to social media. Win-Win.
ThoAppelsin 2 hours ago||
DMs are akin to private conversations in real life. Thus, every DM feature should entail E2EE.

It’s ok for a platform to not feature private conversations. They should just have no DM feature at all, then; make all messages publicly visible.

Private conversations are indeed not for all ages. Parents should be able to grant access to that on individual basis.

bdamm 50 minutes ago||
Ah, but you see, soon TikTok will allow parents to spy on their children's DMs, and parents will love this.
Ekaros 39 minutes ago||
You could have reasonable legal system where privacy is guaranteed. But you do not need end to end encryption for that to be thing. It really is orthogonal issue.
computerex 3 hours ago||
TikTok is a front for government surveillance, so it's not really surprising that this is their position.
bbshfishe 2 hours ago|
[dead]
hexage1814 18 minutes ago||
It doesn't matter. Web-based cryptography is always snake oil

https://web.archive.org/web/https://www.devever.net/~hl/webc...

szmarczak 3 minutes ago||
> if the server operator was malicious, they could just push different client-side JavaScript

Same as with OS updates, browser updates, dependencies used by the OS, dependencies used by the browser. Also you can run malicious software such as keyloggers and you're compromised.

That argument doesn't mean E2E (even web based) is snake oil. Browsers just give you more points of failure.

tuxracer 8 minutes ago||
It's a native app what are you talking about
ranyume 4 hours ago||
This might be off-topic but on-topic about child safety... but I'm surprised people are being myopic about age verification. Age verification should be banned, but people ignore that nowadays most widely used online services already ask for your age and act accordingly: twitter, youtube, google in general, any online marketplace. They already got so much data on their users and optimize their algorithms for those groups in an opaque way.

So yeah, age verification should be taken down, as well as the datamining these companies do and the opaque tunning of their algorithms. It baffles me: people are concerned about their children's DMs but are not concerned about what companies serves them and what they do with their data.

nandomrumber 2 hours ago||
> people are concerned about their children's DMs but are not concerned about what companies serves them and what they do with their data.

Hogwash.

Where are these mythical people who aren’t concerned with both?

Dban1 1 hour ago|||
I thought it was common knowledge to just set your birthdate to 1970 or something
input_sh 14 minutes ago||
You can make it a nice round 2000 these days.
LoganDark 3 hours ago|||
Monitoring children's DMs is the responsibility of the parents, not megacorps. If a parent wants to install a keylogger or screen recorder on their child's PC, that's their decision. But Google should not be able to. Neither should... literally anyone else except maybe an employer on a work-provided device.
ranyume 3 hours ago|||
> Monitoring children's DMs is the responsibility of the parents, not megacorps

Absolutely. But what responsibilities do megacorps have? Right now, everyone seems to avoid this question, and make do with megacorps not being responsible. This means: "we'll allow megacorps to be as they are and not take any responsibilities for the effects they cause to society". Instead of them taking responsibilities, we're collecting everyone's data and calling it a day by banning children from social networks... and this is because there are many interests involved (not related to child development and safety).

j16sdiz 2 hours ago|||
> But what responsibilities do megacorps have?

fake and scam AD.

they literally profit from those ADs. When the AD distributes malware or make scam, they don't take any responsibility

acuozzo 3 hours ago||||
> But what responsibilities do megacorps have? Right now, everyone seems to avoid this question

Clear, simple, direct: Whatever was required of The Bell Telephone Company and nothing more.

da_chicken 2 hours ago|||
So there should be a human operator manually gatekeeping every individual request to connect with another endpoint?

It's a good thing those human operators couldn't listen in to whichever conversation they wanted.

acuozzo 1 hour ago||
Human operators were not required of The Bell Telephone Company by law. Bell switched to mechanical switching stations as soon as doing so was economically advantageous.

(Reconsider my post. I'm arguing for no regulation.)

ranyume 3 hours ago||||
I'd say that at minimum social networks need to be required to show how their algorithm works and allow users control over their data. They must be able to know why a content was served to them. Nowadays social networks are so pervasive in society, affecting it and molding it to unknown interests, that this is the bare minimum for a free society.

Ideally, users should be able to modify the algorithm, so they can get just what they want, while simultaneously maximizing free speech. If something isn't illegal, it shouldn't be hidden or removed.

acuozzo 2 hours ago||
> social networks need to be required to show how their algorithm works

Hypothetically speaking: What if it's a neural network in which each user has his/her own unique weights which are undergoing frequent retraining?

Would it not be an undue burden to necessitate the release of the weights every time they change?

Also, what value would the weights have? We haven't yet hit the point of having neural networks with interpretability.

Wouldn't enforcing algorithmic interpretability additionally be an undue burden?

> They must be able to know why a content was served to them.

What if the authors of the code are unable to tell you why?

BlueTemplar 22 minutes ago||
The use of black boxes like neural networks is already effectively illegal in some governments for this very reason.
techpression 1 hour ago|||
I don’t remember reading about ads in phone calls, nor the complete mapping of customers behaviors to use in contexts not being the phone call.

The apples to oranges in this comparison is probably top five on HN ever.

LoganDark 2 hours ago|||
> But what responsibilities do megacorps have?

They should have a responsibility of transparency, accountability and empathy towards users. They should work for the user and in the interests of the user. But multiple constraints make this impossible in practice.

baq 1 hour ago||||
Mega corps should be compelled to and rewarded for allowing parents to monitor their children’s dms.
DANmode 24 minutes ago||||
> maybe an employer on a work-provided device.

The children yearn for the mines(?).

duped 3 hours ago|||
Parents shouldn't give their child access to a device that allows DMs.

That said, these platforms are making it impossible for parents to monitor anything. They're literally designed to profit off addiction in children.

greygoo222 3 hours ago||
Why? Plenty of children benefit from talking to other people. Some children need careful monitoring, and some children shouldn't be allowed to use DMs, but it's not universal and should be up to the parents.
Nursie 2 hours ago||
> Age verification should be banned

Why?

> They already got so much data on their users

There are a variety of ways (see "Verifiable Credentials") that ages can be verified without handing over any data other than "Is old enough" to social media services.

shakna 1 hour ago|||
Age verification obliviates anonymity on the internet. If everything you do, _can_ be tracked by the government, it _will_ be.

Allowing for more effective propaganda, electrol control, and lights a fire on the concept of a government _representing_ anyone.

Nursie 1 hour ago|||
> Age verification obliviates anonymity on the internet.

How so?

Please explain in detail, because there are already schemes such as "verifiable credentials" which allow people to prove they are of age without handing over ID to online services.

afiori 15 minutes ago||
because most implementations are not going to be like that.
Nursie 3 minutes ago||
In the context of "Age verification should be banned" though, we're already talking about legislative intervention. If there's no particular problem with schemes that are like that then we don't necessarily need a blanket ban on age verification.

Perhaps what we're really saying is "Ban age verification that collects lots of personal information".

Or perhaps we could distil it down further to "Ban unnecessary collection and storage of PII". In which case, Congrats! You've arrived back at the GDPR :)

Which I think is a good thing, and should be strengthened further.

Almondsetat 1 hour ago|||
Ok, and? Presenting your ID at a number of IRL estamblishments also heavily reduces anonymity
gschizas 35 minutes ago||
The difference is that IRL establishments don't sell off that data to anyone else, nor do they have the ability to collate that data with data from other establishments to make a profile of you.

(at least not yet)

echelon 1 hour ago|||
It's a slippery slope.

This is the next two steps into 1984.

Once you start mandating this, there's no going back.

The next generation will start associating wrongthink with government IDs. (Wait, we already do that, right?)

Nursie 1 hour ago|||
> It's a slippery slope.

Is it? I thought that was a logical fallacy?

> This is the next two steps into 1984.

How so?

> Once you start mandating this, there's no going back. > The next generation will start associating wrongthink with government IDs.

Could you provide some more details on why you think this? For a start I talked about a scheme in which you don't hand over ID.

consp 1 hour ago||
Slippery slope can be argumental if you provide the actual argumental reasoning for it as I was thought it could be used as deductive argumentation (though that does not say much). On itself it is a fallacy.

I don't see how verifiable credentials with zero knowledge proofs provide that however.

sham1 1 hour ago||||
The Party doesn't care about the Proles, only the members of the Outer Party.

I think that it's rather funny that people like to appeal to 1984 as if the only point of Mr. Orwell was that surveillance is bad, missing the entire point about stuff like the control of the language or the idea that the only self-justification of the (Inner) Party is power for the sake of power (see also: The Theory and Practice of Oligarchical Collectivism).

I'd even go as far as to say that if "telescreens are horrible" is the only thing that someone takes away from 1984, they've frankly missed the point.

drawfloat 44 minutes ago|||
Read another book.
hd4 11 minutes ago||
I hate the BBC so much - "controversial privacy tech" "E2EE ... the best way to protect conversations from .. even repressive authorities" "End-to-end encryption has been criticised by governments, police forces"

They're saying this at the same time as they're clutching pearls over Iran's repression of protestors. Typical of the ethical consistency I would expect from them.

ronsor 4 hours ago||
Why would you use TikTok for private communications anyway? It's mostly a public short video sharing platform.
halapro 4 hours ago||
It's the kids' social network, you're just old.
wiseowise 1 hour ago||
> you just have intact brain

Fixed a bit.

LambdaComplex 17 minutes ago|||
As much as I want to agree with you, the people who like TikTok make up a significant amount of the population, and their opinions do matter--arguably more than yours, due to sheer numbers.

Smugly dismissing them doesn't do you any favors except for making you feel good about yourself for a few seconds.

huflungdung 37 minutes ago|||
[dead]
asveikau 3 hours ago|||
The way it starts is you pass videos back and forth with a friend. Then you find yourself chatting in the same app.

I'm mindful that it's less secure than other apps, but for a lot of chats it doesn't matter.

g947o 4 hours ago|||
Says someone who has never sent a message to a friend over DM on TikTok.
navigate8310 10 minutes ago|||
Thankfully
Barbing 2 hours ago||||
Hopefully
knallfrosch 2 hours ago|||
Exactly.
adventured 4 hours ago|||
You say that like the typical 18 year old has any idea what they're doing when it comes to proper encryption and communication safety. That is never going to be the case.

It's a communication channel attached to the most popular social network for young people. Obviously they're going to use it a lot. They use it for the extreme convenience.

Barbing 2 hours ago|||
>never going to be the case.

And in a perfect world essentially shouldn’t have to be, at least inside expensive walled garden app stores.

zadikian 2 hours ago|||
They might understand e2ee but not care.
m00dy 3 hours ago||
it's more than that.
sheept 4 hours ago||
I feel like this makes sense for a platform that targets teens. Plus, I wouldn't trust TikTok to implement E2E encryption properly—who knows what they've snuck into their client.
ranyume 4 hours ago||
What kind of application is not targeted at both teens and adults?

Youtube, twitter, bluesky, whatsapp? Every app with a social aspect will be used by teens. And no, tiktok is not "only for teens" or "specially targeted at teens", nowadays everyone uses it and creates content on it.

RajT88 3 hours ago||
Came here to post this.

If you run (say) a restaurant, you get big spikes in business from TikTok videos in ways you don't get from Facebook or Instagram or others.

TikTok is the platform everyone is one right now.

somenameforme 4 hours ago||
I think it's very safe to assume that no major US based platform has 'real' E2E encryption. They're almost certainly all a part of PRISM by now, and it'd contradict their obligations to enable government surveillance. So the only thing that's different is not lying about it. Though I expect the other platforms are, like when denying they were part of PRISM, telling half truths and just being intentionally misleading. 'We provide complete E2E encryption [using deterministically generated keys which can be recreated on demand].'
paulryanrogers 4 hours ago||
Signal is open source
Barbing 2 hours ago||
Snowden endorsed last I heard? He doesn’t email of course.
9864247888754 27 minutes ago|
And their target audience won't question it.
More comments...