Brussels Faces Privacy Crossroads Over Encryption Backdoors
Posted4 months agoActive4 months ago
theregister.comTechstory
heatednegative
Debate
85/100
EncryptionPrivacyEU Legislation
Key topics
Encryption
Privacy
EU Legislation
The EU is considering legislation that would require encrypted app makers to implement backdoors, sparking concerns about privacy and the potential for false positives, with commenters strongly opposing the move.
Snapshot generated from the HN discussion
Discussion Activity
Moderate engagementFirst comment
1h
Peak period
9
0-2h
Avg / period
4.4
Comment distribution31 data points
Loading chart...
Based on 31 loaded comments
Key moments
- 01Story posted
Sep 11, 2025 at 7:48 AM EDT
4 months ago
Step 01 - 02First comment
Sep 11, 2025 at 8:54 AM EDT
1h after posting
Step 02 - 03Peak activity
9 comments in 0-2h
Hottest window of the conversation
Step 03 - 04Latest activity
Sep 12, 2025 at 8:32 AM EDT
4 months ago
Step 04
Generating AI Summary...
Analyzing up to 500 comments to identify key contributors and discussion patterns
ID: 45210442Type: storyLast synced: 11/20/2025, 12:50:41 PM
Want the full context?
Jump to the original sources
Read the primary article or dive into the live Hacker News thread when you're ready.
100% they could add client side scanning, why do they think its impossible?
All you need to do to avoid it would be to encrypt outside the app, something most people would not bother to do, but criminals would be motivated to do.
2. Reliable client-side scanning of images is impossible (you cannot download illegal content to client devices for exact matches, so it will be only signatures and collisions are possible), so there will be false positives that will be reported, which will inevitably result in violation of privacy, possibly persecution etc.
2. You mean "Reliable classification of client-side scanned images is impossible", although you dont actually define reliable. This is besides the point, Im not talking about the actually feasibility of this on a political level, Im asserting a specific technical point that client-side scanning is 100% possible for e2e apps
The only acceptable scanning process here is the one that produces only true positives, no collateral damage. This is what I call reliable.
well then reliability is impossible, you must accept errors
Nobody should accept errors. Client-side scanning simply must not happen. It’s mathematically dumb idea.
I don't understand why someone would go through the trouble of using WhatApp to pass around separately-encrypted files instead of using anything else, though.
2. It's also "technically possible" to do the scanning server-side, on the encrypted stream, and flag anything that by chance matches a known hash.
Oh they do. They are excempted.
https://fightchatcontrol.eu/
https://european-pirateparty.eu/chatcontrol-eu-ministers-wan...
BTW the hash is a CRC32 one
>100% they could add client side scanning, why do they think its impossible?
I think you've misread that sentence. It's saying that they don't have the ability right now, as-in this is not a feature they've written in their software, and that further they do not wish to do so (in the same way that Apple did not want to write a backdoor for the FBI previously). Obviously as a matter of programming of course backdoors can be written and have been. But software developers don't want to be forced at gun point to do so like the EU proposes, which seems perfectly understandable.
And fwiw with open source software it actually would be arguable that they "don't have the ability" on a more technical level since that couldn't actually be enforced on the users and the EU's jurisdiction ends at its borders. Obviously many of the most popular messengers are proprietary, but not all. And even for the proprietary vendors that probably does factor into their arguments, as it'd put them at a commercial disadvantage.
I'm one of those people who over-share and never comfortable keeping secrets (other than login credentials) while also being paranoid that we are relying on a certificate authority based system that's supposed to protect us but is fundamentally designed to enable state surveillance - a suspicion I've always had despite certificate transparency, pinning, etc) - You can downvote me for having this suspicion, but it won't make me more trusting of the security theater business.
“the best estimates show around a 10 percent false positive rate for client-side scanning – which could see a huge number of people accused of crimes they didn't commit.”
Upsetting statistic for other reasons: Even if it's "10% of all flags are false, 90% are correct", if there's also no false negatives, then the 10% false positives alone gets you to about the current total incarceration rate — offenders are estimated to be a few % of the population, prison population is about 0.1% of the total population.
Germany is not supporting ChatControl – blocking minority secured
https://news.ycombinator.com/item?id=45209366
Chat Control Must Be Stopped
https://news.ycombinator.com/item?id=45173277