I think this is... fine? Am I just totally naive. I think it's fine to say "You don't really have privacy on this app" - as long as there are relatively good options of apps that do have privacy (and I think there are). TikTok is really a public by default type of social media, there's not much idea of mutual following or closed groups. So sure, you don't have privacy on tiktok, if you want it you can move to snapchat or signal or whatever platform of your choice.<p>Like, it's literally a platform that <i>was</i> run under the watchful eye of the CCP, and now the US version is some kleptocratic nightmare, so I just don't see the point in expecting some sort of principled stance out of them.<p>In some ways I think it's worse for places like Facebook to "care about privacy" and use E2EE but then massively under-resource policing of CSAM on their platform. If you're going to embrace 'privacy' I do think it's on you to also then put additional resources into tackling the downsides of that.
Tiktok has private messaging, and it is used by hundreds of millions of people.<p>IMO no consumer service should have private 1:1 messaging without e2e. Either only do public messaging (ie. Like a forum), or implement e2e.
In my experience most forums have private messaging.<p>Additionally I think it is fine to say "we don't support e2ee". I prefer honesty to a bad (leaky) e2ee implementation, at least the user can make an informed choice.
>In my experience most forums have private messaging.<p>Yeah but it's kind of accepted that the forum owner could read it all if they so chose. Maybe this is a hold over from back in the old days when encryption was nowhere near default during which forums arose.
I agree. At least take of "Yes messages are stored on our servers" is honest. And if they are accessed by anything else than limited subpoena is policy or legal issue.
Tiktok has direct messages, they don't even call them private.<p>It's better that they're honest about this, nobody should believe for a second that WhatsApp or FB messages are truly E2EE.<p>DM on social media shouldn't be used for anything remotely private. It's a convenience feature, nothing more.
> <i>Tiktok has direct messages, they don't even call them private.</i><p>It may not be called that, but what are users expecting? Some folks may later be surprised when a warrant gets issued (e.g., from a divorce judge).
> nobody should believe for a second that WhatsApp or FB messages are truly E2EE<p>That's interesting. You think all firms that audited WhatsApp and Signal protocol used by WhatsApp and all programmers who worked there for decades and can see a lie and leak if it was true are all crooks? valid opinion I guess, but I won't call it "no one should believe for a second<p>(curious you didn't mention Telegram, it is actually marketed as secure and e2e and it has completely gimped "secret chats" that are off by default and used by like almost nobody.)
I forget if its WhatsApp that technically lets you sync chats in unencrypted form to iCloud which is the “loophole” around this, though you can lockdown your iCloud even tighter, not sure it Apple can do much if you fully lock down your iCloud, not sure if this has been legally tested? Its not a very advertised feature its just a setting.
WhatsApp iPhone syncs to iCloud unencrypted by default[1].<p>iMessage also syncs to iCloud unencrypted by default[2].<p>[1] Depends on you paying for iCloud storage, so that you have space for a full phone backup to occur.<p>[2] Might be "free" with "iMessage in iCloud", an option to enable separately.
The Android version syncs all your chat logs to Google Drive without encryption by default. That's the backdoor.
Right now it got a switch to enable e2e for backups, but yeah I think default backup is probably a workaround...
The email protocols would like to have a chat with you.
No, saying that e2e encryption makes users _less_ safe is completely dishonest, nothing is fine about this.<p>The logic of "anything is better than before" is also fallacious.
Depends on your definition of "safe". Imagine an adult DMs a nude photo to a minor (or other kinds of predation).<p>If it's E2EE, no one except the sender and receiver know about this conversation. You <i>want</i> an MITM in this case to detect/block such things or at least keep record of what's going on for a subpoena.<p>I agree that <i>every</i> messaging platform in the world shouldn't be MITM'd, but <i>every</i> messaging platform doesn't need to be E2EE'd either.
The receiver has a proven and signed bundle, that they can upload to the abuse report. So the evidence has even stronger weight. They can already decrypt the message, they can still report it.
Yes, but this leaves the only way to identify this behavior as by reporting from a minor. I'm not saying I trust TikTok to only do good things with access to DMs, but I think it's a fair argument in this scenario to say that a platform has a better opportunity to protect minors if messages aren't encrypted.<p>I'm not saying no E2E messaging apps should exist, but maybe it doesn't need to for minors in social media apps. However, an alternative could be allowing the sharing of the encryption key with a parent so that there is the ability for <i>someone</i> to monitor messages.
> I think it's a fair argument in this scenario to say that a platform has a better opportunity to protect minors if messages aren't encrypted<p>Would it be a fair argument to say the police have a better opportunity to prevent crimes if they can enter your house without a warrant? People are paranoid about this sort of thing not because they think law enforcement is more effective when it is constrained. But how easily crimes can be prosecuted is only one dimension of safety.<p>> However, an alternative could be allowing the sharing of the encryption key with a parent<p>Right, but this is worlds apart from "sharing the encryption key with a private company", is it not?
Yes, that is a fair argument and most countries allow the use of surveillance cameras in public for this reason.
> Would it be a fair argument to say the police have a better opportunity to prevent crimes if they can enter your house without a warrant?<p>Police can access your home with a warrant.<p>Police cannot access your E2EE DMs with a warrant.
And they shouldn't be able to. Police accessing DMs is more like "listening to every conversation you ever had in your house (and outside)" than "entering your house".
>Police cannot access your E2EE DMs with a warrant.<p>Well the kind of can if they nab your cell phone or other device that has a valid access token.<p>I think it's kind of analogous to the police getting at one's safe. You might have removed the contents before they got there but that's your prerogative.<p>I think this results in acceptable tradeoffs.
SimpleX handles this by sending the decryption keys when the receiver reports the message.
Keeping children safe and prosecuting are too different concepts, only vaguely related. So no, being able to track pdfs doesn't make children safer. What keeps them safe is teaching them safe communication habits and keeping them away from things like Tiktok.<p>We shouldn't make the world a worse place for every one because some parents can't take care of their children.
Ugh. The kids aren't even safe from the people making, and enforcing laws. This argument should be long over for anyone with eyes or ears.
Imagine Hamas are your government and want to figure out who's gay. You don't want a MITM in case they can do this.<p>Pick your definition of safe.
In that case don't use Tiktok dm's to discuss your sexuality. I think it is strange that people feel like they have to be able to talk on sensitive topics over every interface they can get their hands on.<p>Similarly in "traditional" media you may not want to discuss such private conversation on a radio broadcast. Perhaps you would rather discuss it on the phone or over snail mail as there is more of an expectation of privacy on those medium.
This is fine if you have TLS encryption and the platform is not local.<p>Sure, they can fabricate some evidence and get access to your messages, in which case, valid point.
It makes certain users less safe in certain situations.<p>E2E makes political activists and anti-chinese dissidents safer, at the cost of making children less safe. Whether this is a worthwhile tradeoff is a political, not technical decision, but if we claim that there are any absolutes here, we just make sure that we'll never be taken seriously by anybody who matters.
well having no e2e encryption is safer than having a half-baked e2e encryption that have backdoor and can be decrypted by the provider.<p>and for tiktok's stance, I think they just don't want to get involved with the Chinese government related with encryption (and give false sense of privacy to user)
Brilliant. They're repackaging the argument governments have long made about E2EE being dangerous to children.
Children are just too effect of a tool when building a surveillance state. We should have banned children from owning open computers a long time ago just like we do with Alcohol, Driving licenses, etc.<p>Instead children would own special devices that are locked down and tagged with a "underage" flag when interacting with online services, while adults could continue as normal. We already heavily restrict the freedom of children so there is plenty of precedent for this. Optionally we could provide service points to unlock devices when they turn 18 to avoid E-waste as well.<p>This way it's the point of sale where you provide your ID, instead of attaching it to the hardware itself and sending it out to every single SaaS on the planet to do what they wish.
Would be a nightmare to implement and achieve the goal, but I have to say I think it’s more right than wrong. All of the data is very clear about the harms.<p>China has restrictions for social media and screen time for kids — how do they implement this?
I actually think this would be easier to implement than many of the current ID verification methods I've seen being pushed. We already have the infrastructure for selling age restricted goods, this is nothing new. Manufacturers that are unable to restrict their hardware in a "child" mode don't have to do anything and could simply continue selling to adults only.<p>It's obvious we're moving in a direction where we are going to get these restrictions in one way or another, and this is the only way I've come up with that doesn't come with serious privacy implications.<p>Most importantly, this solution would be simple for anyone to understand. You don't need to be a cryptography expert to understand there are child safe devices and then there are unrestricted devices for adults.
The new California law requires all operating systems to have a child mode.
Would the parents comply though? Many of the restrictions work because most adults agree is OK. For example for alcohol, children could drink as much as they want at home, if adults would permit it.<p>If most adults would be convinced there is an issue, one probably has enough lock-down modes even nowadays, not sure it is a "technical" problem.
I strongly believe that most would actually. All parents I've talked to have had issues with parenting their children's online activity. They know there are harmful things they want to prevent them from accessing but it is simply to hard to configure and set up existing tools for it. (Besides every single friend they have don't have any restrictions so it all seem pointless.)<p>I can also see also large support for uploading ID to various services when talking about kids, but when you re-frame the question to adults, most seems to really dislike the idea immensely.<p>Sure there will be children with access to unrestricted devices, just like we had kids with porn mags hidden in a forest somewhere back in the day, or how that one sketchy guy was buying alcohol, etc. But I think this is an acceptable level of risk for whatever harm people want to prevent.
Definitely makes it easier for parents. It also normalizes screen time limits for kids. When none of your kids' friends have screen time limits, it's harder to enforce. When at least there's a few of them, it's easier to get buy-in from your kids.
Children are not the property of their parents- the government can and does take over parental responsibility.
I don’t understand how id-ing the buyer helps? What is the age restricted good here?<p>Are you saying that kids now buy their phones with pocket money without their parents knowing?<p>> It's obvious we're moving in a direction where we are going to get these restrictions in one way or another<p>It’s not obvious, it’s just sad. I still hope reason will prevail in this.
It's a nightmare to some extent to prevent underage people from consuming alcohol if you want to phrase it that way. But we don't try to ban stores from selling alcohol because of concerns children will be drinking it. Instead we require the store checks for ID.
> China has restrictions for social media and screen time for kids — how do they implement this?<p>China is much more socially conservative, and less likely to abandon their kids to latest thing.
Passport /citizen ID linked to your WOW account, etc.
Parents are already allowed to restrict their children access to 'dangerous' things like open computers or knives.
Parents are also allowed to restrict their children access to alcohol and cigarettes, but it seems a government ban on them buying those things works better
Given the ease with which kids who want them can get any of those things in schools, it's not clear that the government ban is actually doing anything of significance or that the reduction in usage isn't more a result of convincing people that those things are actually bad for them so they choose not to partake despite the continued widespread availability.<p>Notice that consumption of those things is also down for adults even though adults are not banned from getting them.
Doesn't seem to be a universal truth to me. As a teenager I had rather easy access to both cigarettes and alcohol in spite of usual age-restrictions legally imposed. I didn't care what gov't thinks about it. I did care about what my parents would do if I caught drunk though. That was my real barrier.
I don't think debazel was saying that children should have been banned from owning computers for the benefit of the children. He was saying that children should have been banned from owning computers so that the government would have no excuse to regulate what's allowed on computers.
Indeed way past time. Though no CEO would admin publicly what the addiction to attention/social media, gaming, and general screen use, causes to children. Of course this should've been regulated similarly to Alcohol, but billions would dry and it's much easier to witch-hunt marijuana, and illegal raves, right?
Locking down children’s devices doesn’t stop adults sharing illegal content with other adults though, so there would still be pressure to monitor communications between adults.
At some points, laws become an ineffective tool to prevent malevolent people to act in detrimental manners, no matter what it states. But prejudices of wicked states will always continue to impact more badly general public as ever more drastic laws lacking any balance become enacted.
I don’t think they’re doing that on TikTok
At the same time, I remember growing up in the internet's wild west and bad encounters weren't an issue for me because of the golden rule I was taught from the start: you don't give your personal information and you don't interact with complete strangers. Learning to navigate the web instead of being in a walled garden was helpful in many ways.<p>The better question to ask ourselves is, does the capability to gather more information also lead to more power to act on this information? If the investigative resources are spread thin already it's not like they're gonna catch more criminals with investing more there. Repelling questionable individuals off the platform with lots transparancy -is- an effective way, but just a specific tool for a symptom.<p>I think a part of a better solution is to give parents and children better tools to manage their social graph themselves. Essentially the real problem is discovery and warding off of social outliers in a way that doesnt out all responsibility on opaque algos or corporations.<p>A part of their e2e keys could be shared using an intentionally obtuse way like mailing an item or a physical "friend code". That way parents and vetted friends can have their privacy.
You don't need to tie an id to someone's person to get positive confirmation on someone's poor behaviour. If someone crossed the line then parents can see it and escalate. In additon, what would happen to a child with abusive parents who can then arbitrarily restrict and deny a childs freedom to communicate? I did not have this myself, but without free access to other minds and information I would have been duller. Does a large information dragnet really serve our collective interests or are more precise tools needed?
> I think a part of a better solution is to give parents and children better tools to manage their social graph themselves. Essentially the real problem is discovery and warding off of social outliers in a way that doesnt out all responsibility on opaque algos or corporations.<p>This is actually a key consideration for the proposed implementation. The biggest issue for parents when restricting their children's online activity is that they simply don't understand the tool available for it.<p>By having a "child mode" iPhone, parents don't have to know any of that. They simply buy the iPhone Kids for their children and then get a plain iPhone for themselves.<p>If these restrictions were to actually be enforced by law as well, then it would make it very easy for teachers and other guardians to check if a device is appropriate for the child using it.
From what I've seen, the bad effects don't necessarily just come from free access to the internet, but that everyone around them in their social group has a video camera that can covertly record, they're all immature children and thus you cannot slip up once or you get kid cancelled, and they start doing a collective dissociative freeze response in a self-imposed emergent panopticon as a result.<p>So if the teen phone turned into a restricted "call mom" device with no cameras and with neon yellow obvious fuck you coloring and a restricted set of apps, and police took away a full phone much like they take away cigs and beer it might be enough to break the critical mass to create this issue. They can have dedicated cameras for video club, use the family computer, have an xbox or switch and have whatever tech experience that millenials had, the last generation to not have exponential increases in anxiety , depression and sexlessness.<p>It's the covert camera + internet that it's the key issue.
apple SDK already can return underage/adult
> Instead children would own special devices that are locked down and tagged with a "underage" flag when interacting with online services, while adults could continue as normal.<p>California is mandating OSes provide ages to app stores, and HN lost their mind because it's a ban on Linux.
> California is mandating OSes provide ages to app stores,<p>They forgot to put in the provision which exempts apps which do not need an age rating? As in: everything os related.<p>Sounds like a good way to get rid of snap at least since that is where all the commercial bloat is located. Last time I did a fresh Debian install I do not remember installing any app from the os repository which would require age restrictions (afaik).
This honestly sounds like the best proposed solution I have heard.
Agreed. Putting the burden on parents is quite something:<p>1. You end up being the bad guy, other parents don't restrict their kids internet usage etc. Some folks would argue to just not set up restrictions and trust them. But it's a slippery slope and puts kids in a weird position. They start out with innocent YouTube videos, but pretty quickly a web search or even a comment can lead them to strange places. They want to play games online, but then creeps abuse that all the time. Even if you trust them to not do anything "wrong", it's a lot to put on their shoulders.<p>2. If you want to put restrictions in place, even if you're an expert, the tools out there are pretty wonky. You can set up a child protection DNS, but most home routers don't make it easy (or even allow you) to set a different DNS server. And that's not particularly hard to circumvent. I suppose a proxy would be a more solid solution, but setting that up would be major yak shaving. Any "family safety" features (especially those from Microsoft) are ridiculously complicated and often quite buggy. Right now, I got the problem on my plate that I need to migrate one of my kid's accounts from a local Windows account to a Microsoft account (without them loosing all their stuff), because for local accounts, it seems the button to add the device is just missing? Naturally, the docs don't mention that, I had to do research to arrive at that hypothesis. The amount of yak shaving, setup and configuration you have to do for a reasonable setup is just nuts.<p>3. If you're not good with tech - I don't see how you have _any_ chance in hell to set up meaningful restrictions.<p>Some countries are banning social media - sure, that's one thing. But there's a _lot_ of weird places on the internet, kids will find something else. I for one would appreciate dedicated devices or modes for kids < 18. Would solve all this stuff in a heartbeat.
> We should have banned children<p>I see you Mr Quaker Oats
I can't tell if this is sarcasm or not
TikTok has a drug-like effect on the brain. Multiple studies show a clear link between excessive TikTok engagement and increased levels of anxiety, depression, and stress. Maybe it is time we regulate it like a drug?
Is that because of engaging with tiktok, or because of the content on tiktok? If the app was exclusively pictures of kittens and nice flowers you saw on your commute, would it have a detrimental effect?
What do you mean exactly, tax it as a vice?!
Hyperbole of some sort. I think it works on both the positive and negative side of the axis too.
I’ll have a packet of cigarettes, a fifth of vodka, and an unrestricted personal electro device.<p>ID please.<p>Seems entirely reasonable.<p>Possibility entirely ineffective, but then again I don’t often see children walking around with bottle a of booze.
This is how the internet is run in countries where you need ID to connect to services. It’s not at all dystopian.
I don't understand why all teh child safety systems require age verification. Why not have a single setting on a smartphone that sends a 'child' flag to every single app or website, which then reacts accordingly? As long as you ensure that the browser can't be changed or modifed, it should be fine.
The California law works this way, and it doesn't even have to require the browser can't be modified
Then adults could lie about their age and benefit from the data protection laws only granted to children for some reason.
Does it matter. It's just some arbitrary company. They do have the freedom to decide those things however they want, right? The customer can then decide whether to switch or not.
Ultimately your neighbors must buy the argument. The reason why this argument wins is not because framing is so tricky, but because it connects with the values of your neighbors. Trying to convince people that these aren't actually their values is swimming upriver.
The solution is simple: Take away the argument by blocking children's access to social media. Win-Win.
TikTok is the government, morealess
DMs are akin to private conversations in real life. Thus, every DM feature should entail E2EE.<p>It’s ok for a platform to not feature private conversations. They should just have no DM feature at all, then; make all messages publicly visible.<p>Private conversations are indeed not for all ages. Parents should be able to grant access to that on individual basis.
> They should just have no DM feature at all, then; make all messages publicly visible.<p>This makes no sense.<p>I can discuss something in a bar which is not a very private conversation, I wouldn't care if someone else hear what I'm saying. But I also don't want someone to record it and post it on the internet to be seen by the whole world.<p>Privacy is not just boolean you toggle somewhere.
I fail to see the link between private conversations/DM and E2EE.<p>To quote a comment I made some time ago:<p>- You can call your service e2e encrypted even if every client has the same key bundled into the binary, and rotate it from time to time when it's reversed.<p>- You can call your service e2e encrypted even if you have a server that stores and pushes client keys. That is how you could access your message history on multiple devices.<p>- You can call your service e2e encrypted and just retrieve or push client keys at will whenever you get a government request.<p>E2EE only prevents naive middlemen from reading your messages.
Fundamentally actual E2EE is complicated problem. And probably not very user friendly. It is full of technical trade-offs. And mistakes are very common. Or they lead to situations that people do not want. Like if you lost your phone or it break how do you get history back... What if you also forgot password? Or it was stored in local manager...<p>It is phrase that sounds good. But actually doing it effectively in way that average user understand and can use system with it with minimal effort is very hard.
no you couldn't. that wouldn't be considered end-to-end encrypted in any modern sense
Ah, but you see, soon TikTok will allow parents to spy on their children's DMs, and parents will love this.
You could have reasonable legal system where privacy is guaranteed. But you do not need end to end encryption for that to be thing. It really is orthogonal issue.
Sure, however kids these days often can't socialize irl - should kids be isolated from friends because they're unable to have any private conversations at all?<p>During times in which I was unable to socialize irl (eg school holidays), and unable to talk to my friends online, I can confirm that the isolation was not good for my mental health.
This might be off-topic but on-topic about child safety... but I'm surprised people are being myopic about age verification. Age verification should be banned, but people ignore that nowadays most widely used online services already ask for your age and act accordingly: twitter, youtube, google in general, any online marketplace. They already got so much data on their users and optimize their algorithms for those groups in an opaque way.<p>So yeah, age verification should be taken down, as well as the datamining these companies do and the opaque tunning of their algorithms. It baffles me: people are concerned about their children's DMs but are not concerned about what companies serves them and what they do with their data.
> people are concerned about their children's DMs but are not concerned about what companies serves them and what they do with their data.<p>Hogwash.<p>Where are these mythical people who aren’t concerned with both?
Monitoring children's DMs is the responsibility of the parents, not megacorps. If a parent wants to install a keylogger or screen recorder on their child's PC, that's their decision. But Google should not be able to. Neither should... literally anyone else except <i>maybe</i> an employer on a <i>work-provided</i> device.
> Monitoring children's DMs is the responsibility of the parents, not megacorps<p>Absolutely. But what responsibilities do megacorps have? Right now, everyone seems to avoid this question, and make do with megacorps not being responsible. This means: "we'll allow megacorps to be as they are and not take any responsibilities for the effects they cause to society". Instead of them taking responsibilities, we're collecting everyone's data and calling it a day by banning children from social networks... and this is because there are many interests involved (not related to child development and safety).
> But what responsibilities do megacorps have?<p>fake and scam AD.<p>they literally profit from those ADs. When the AD distributes malware or make scam, they don't take any responsibility
> But what responsibilities do megacorps have? Right now, everyone seems to avoid this question<p>Clear, simple, direct: Whatever was required of The Bell Telephone Company and nothing more.
So there should be a human operator manually gatekeeping every individual request to connect with another endpoint?<p>It's a good thing those human operators couldn't listen in to whichever conversation they wanted.
I'd say that at minimum social networks need to be required to show how their algorithm works and allow users control over their data. They must be able to know why a content was served to them. Nowadays social networks are so pervasive in society, affecting it and molding it to unknown interests, that this is the bare minimum for a free society.<p>Ideally, users should be able to modify the algorithm, so they can get just what they want, while simultaneously maximizing free speech. If something isn't illegal, it shouldn't be hidden or removed.
> social networks need to be required to show how their algorithm works<p>Hypothetically speaking: What if it's a neural network in which each user has his/her own unique weights which are undergoing frequent retraining?<p>Would it not be an undue burden to necessitate the release of the weights every time they change?<p>Also, what value would the weights have? We haven't yet hit the point of having neural networks with interpretability.<p>Wouldn't enforcing algorithmic interpretability additionally be an undue burden?<p>> They must be able to know why a content was served to them.<p>What if the authors of the code are unable to tell you why?
Whatever was required of the new york times and nothing more.<p>If the NYT publishes and advert or editorial, it's held accountable for the contents.
I don’t remember reading about ads in phone calls, nor the complete mapping of customers behaviors to use in contexts not being the phone call.<p>The apples to oranges in this comparison is probably top five on HN ever.
> But what responsibilities do megacorps have?<p>They <i>should</i> have a responsibility of transparency, accountability and empathy towards users. They should work for the user and in the interests of the user. But multiple constraints make this impossible in practice.
The simplest way that can work is for the child account to be linked to a parent account, and the parent account can see the child account's DMs.
> Monitoring children's DMs is the responsibility of the parents, not megacorps.<p>Yup, but the tools provided make that easy or hard.<p>But putting that emotive bit to one side, Megacorps have a vested interest in not being responsible to children. They need children's eye balls to drive advertising revenue. If that means sending them corrosive shit, then so be it.<p>Its a bigger issue than encryption, its editorial choice.
Mega corps should be compelled to and rewarded for allowing parents to monitor their children’s dms.
I'm all for helping parents to do this. Any site requiring age verification should indicate this as a http header or whatever, and the browser I allow my child to use should respect that and the parental controls should be easy for me to engage with<p>Many parental controls are massive pains to get working. Apple does fairly well (although I don't get a parental pin number to unlock the phone, which is normally fine as my child will tell me, but in some circumstances it wouldn't be), but does require the parent to be on the apple ecosystem too.<p>EA and Microsoft however are terrible, especially as it's likely the child will be playing fortnite/minecraft and the parent won't have ever touched it. I think with minecraft we had to make something like 5 or 6 accounts across three different sites to allow online minecraft play from a nintendo switch.
> maybe an employer on a work-provided device.<p>The children yearn for the mines(?).
Parents shouldn't give their child access to a device that allows DMs.<p>That said, these platforms are making it impossible for parents to monitor anything. They're literally designed to profit off addiction in children.
Why? Plenty of children benefit from talking to other people. Some children need careful monitoring, and some children shouldn't be allowed to use DMs, but it's not universal and should be up to the parents.
I thought it was common knowledge to just set your birthdate to 1970 or something
> Age verification should be banned<p>Why?<p>> They already got so much data on their users<p>There are a variety of ways (see "Verifiable Credentials") that ages can be verified without handing over any data other than "Is old enough" to social media services.
Age verification obliviates anonymity on the internet. If everything you do, _can_ be tracked by the government, it _will_ be.<p>Allowing for more effective propaganda, electrol control, and lights a fire on the concept of a government _representing_ anyone.
> Age verification obliviates anonymity on the internet.<p>How so?<p>Please explain in detail, because there are already schemes such as "verifiable credentials" which allow people to prove they are of age without handing over ID to online services.
Last time my government tried that, they failed. [0]<p>You need to 100% trust those verification services. And considering their success rate [1], you shouldn't.<p>[0] <a href="https://thinkingcybersecurity.com/DigitalID/" rel="nofollow">https://thinkingcybersecurity.com/DigitalID/</a><p>[1] <a href="https://discord.com/press-releases/update-on-security-incident-involving-third-party-customer-service" rel="nofollow">https://discord.com/press-releases/update-on-security-incide...</a>
> You need to 100% trust those verification services.<p>First link - mitigation: use a well supported standard like OIDC, not a home-cooked scheme. Duh.<p>Second link - this is part of the problem such schemes as verifiable credentials are designed to address, random third parties collecting ID they don't need.<p>Yes, any system needs to be executed well. Neither of these really display that.
If _the government_ can't be trusted not to use a dumbass scheme, then no, it isn't a duh moment. You don't exactly get to dictate how the government implements it!<p>The point is that systems today, aren't really well executed. So it is unreasonable to expect them to be well executed.<p>If you can't trust people not to build the bomb well - then don't let them build a bomb.
> You don't exactly get to dictate how the government implements it!<p>Who was talking about the government implementing it? I wasn't.<p>And also "This has been done poorly in the past so we should never attempt to do it again, better" seems an odd way to go about things. There are well put together schemes by international standards bodies in this area now. Neither of the above links followed them.
because most implementations are not going to be like that.
In the context of "Age verification should be banned" though, we're already talking about legislative intervention. If there's no particular problem with schemes that <i>are</i> like that then we don't necessarily need a blanket ban on age verification.<p>Perhaps what we're really saying is "Ban age verification that collects lots of personal information".<p>Or perhaps we could distil it down further to "Ban unnecessary collection and storage of PII". In which case, Congrats! You've arrived back at the GDPR :)<p>Which I think is a good thing, and should be strengthened further.<p>(Also the other response to "because most implementations are not going to be like that" is "why not?". People are already building such ecosystems.)
> If there's no particular problem with schemes that <i>are</i> like that then we don't necessarily need a blanket ban on age verification.<p>There <i>is</i> a problem with schemes like that.<p>The way computer security works is, attacks always get better, they never get worse. A scheme that nobody has found any privacy holes in when it's enacted will have one found a week after.<p>The way governments work is, the compromise bill passes if the people who care about privacy support it because then it has the votes of the people who care about privacy and the people who want to ID everyone. But then when the vulnerability is found, the people who care about privacy can't get it fixed because they can't pass a new bill without also having the votes of the people who want to ID everyone, and those people already have what they want. More specifically, many of them then have what they <i>really</i> want, which is to invade everyone's privacy, as they were hoping to do once the vulnerability was found.<p>Which means you need it to be perfect the first time or it's already ossified and can't be fixed. But the chances of that happening in practice are zero, which means it needs to not happen at all.
> There is a problem with schemes like that.<p>/goes on to discuss how government legislation of specific schemes is the issue, not the schemes themselves.<p>Then we don't legislate specific schemes? The GDPR doesn't do that, for instance, it spells out responsibilities and penalties but doesn't say "Though shalt use this specific algorithm".<p>Remember, this discussion started with a call to <i>ban all age checks</i>, which itself is a government action and restriction on the agency of private business.<p>There are ways that private entities can implement age checks both securely and without leaking much other information, so it seems very heavy-handed to ban them. Private entities are building such systems between themselves already, without government mandates on the specifics.
Ok, and? Presenting your ID at a number of IRL estamblishments also heavily reduces anonymity
The difference is that IRL establishments don't sell off that data to anyone else, nor do they have the ability to collate that data with data from other establishments to make a profile of you.<p>(at least not yet)
But to get that ID from the bottleo, you need to hold them at gunpoint.<p>To get it from Discord you need to sneeze.<p>The internet has scale and availability, that physical locations do not.
The problem with this discussion is that this is a wonk solution for wonkish times. You're trying to thread the needle between various reasonable compromises. Ironically due to social media, that is simply not how politics and lawmaking works any more. Instead it's an emotionally driven fight between various different sorts of moral panic, and the only option is to get people more mad about surveillance than "think of the children".<p>You <i>might</i> be able to get somewhere by getting a tech company on your side, but they generally also hate adult content and don't mind banning it entirely.<p>(people are not going to get age verification _banned_ any time soon! That's simply not going to happen!)
It's a slippery slope.<p>This is the next two steps into 1984.<p>Once you start mandating this, there's no going back.<p>The next generation will start associating wrongthink with government IDs. (Wait, we already do that, right?)
> It's a slippery slope.<p>Is it? I thought that was a logical fallacy?<p>> This is the next two steps into 1984.<p>How so?<p>> Once you start mandating this, there's no going back.
> The next generation will start associating wrongthink with government IDs.<p>Could you provide some more details on why you think this?
For a start I talked about a scheme in which you don't hand over ID.
The Party doesn't care about the Proles, only the members of the Outer Party.<p>I think that it's rather funny that people like to appeal to 1984 as if the only point of Mr. Orwell was that surveillance is bad, missing the entire point about stuff like the control of the language or the idea that the only self-justification of the (Inner) Party is power for the sake of power (see also: The Theory and Practice of Oligarchical Collectivism).<p>I'd even go as far as to say that if "telescreens are horrible" is the only thing that someone takes away from 1984, they've frankly missed the point.
Read another book.
TikTok is a front for government surveillance, so it's not really surprising that this is their position.
All social media should be considered a front for government surveillance
The government are able to access your conversations, data and connections with e2ee in place already. I don't see how not having e2ee would have an effect on that ability in any way.
Now it's a franchise too!<p>Once it gets big enough in your location you buy it for that sweet sweet intel.
[dead]
I don’t really understand how we are supposed to believe in e2ee in closed proprietary apps. Even if some trusted auditor confirms they have plumbed in libsignal correctly, we have no way of knowing that their rendering code is free of content scanning hooks.<p>We know the technology exists. Apple had it all polished and ready to go for image scanning. I suppose the only thing in which we can place our faith is that it would be such an enormous scandal to be caught in the act that WhatsApp et al daren’t even try it.<p>(There is <i>something</i> to be said for e2ee: it protects you against an attack on Meta’s servers. Anyone who gets a shell will have nothing more than random data. Anyone who finds a hard drive in the data centre dumpster will have nothing more than a paperweight.)
The unfortunate fact about E2EE messaging is that it is hard to do. Even if you do have reproducible builds, the user is likely to make some critical mistake. What proportion of, say, Signal users actually compare any "safety numbers" for example? There is no reason to worry about software integrity if the system is already insecure due to poor usability.<p>Sure, we should all be doing PGP on Tails with verified key fingerprints. But how many people can actually do that?
With e2ee please remember that it is important to define who are the ends.<p>Perhaps your e2ee is only securing your data in travel if their servers are considered the other end.<p>Also one thing people seem to misunderstand is that for most applications the conversation itself is not very interesting, the metadata (who to who, when, how many messages etc.) is 100x more valuable.
I've been making this argument for a long time, and it's never popular.<p>People <i>want to believe</i> in E2EE, it's almost like religion at this point.<p>Protecting people is synonymous with E2EE, even if you cant verify it, and it can be potentially broken.<p>I was even more controversial and singled out Signal as an example: <a href="https://blog.dijit.sh/i-don-t-trust-signal/" rel="nofollow">https://blog.dijit.sh/i-don-t-trust-signal/</a>
> the controversial privacy feature used by nearly all its rivals<p>"controversial" according to who? The NSA / GCHQ?
Listed in the article are the National Society for the Prevention of Cruelty to Children and the Internet Watch Foundation, which monitors and removes child sexual abuse material from the internet.<p>The recent Meta lawsuits also mention opposition from the National Center for Missing and Exploited Children and Meta's own executives: Monika Bickert (head of content policy) and Antigone Davis (global head of safety). Both executives mention the danger end-to-end encryption poses to children when attached to a social media graph.<p><a href="https://www.reuters.com/legal/government/meta-executive-warned-facebook-messenger-encryption-plan-was-so-irresponsible-2026-02-24/" rel="nofollow">https://www.reuters.com/legal/government/meta-executive-warn...</a>
Why would you use TikTok for private communications anyway? It's mostly a public short video sharing platform.
It's the kids' social network, you're just old.
The way it starts is you pass videos back and forth with a friend. Then you find yourself chatting in the same app.<p>I'm mindful that it's less secure than other apps, but for a lot of chats it doesn't matter.
Says someone who has never sent a message to a friend over DM on TikTok.
Hopefully
Exactly.
Thankfully
You say that like the typical 18 year old has any idea what they're doing when it comes to proper encryption and communication safety. That is never going to be the case.<p>It's a communication channel attached to the most popular social network for young people. Obviously they're going to use it a lot. They use it for the extreme convenience.
>never going to be the case.<p>And in a perfect world essentially shouldn’t have to be, at least inside expensive walled garden app stores.
They might understand e2ee but not care.
it's more than that.
It doesn't matter. Web-based cryptography is always snake oil<p><a href="https://web.archive.org/web/https://www.devever.net/~hl/webcrypto" rel="nofollow">https://web.archive.org/web/https://www.devever.net/~hl/webc...</a>
> if the server operator was malicious, they could just push different client-side JavaScript<p>Same as with OS updates, browser updates, dependencies used by the OS, dependencies used by the browser. Also you can run malicious software such as keyloggers and you're compromised.<p>That argument doesn't mean E2E (even web based) is snake oil. Browsers just give you more points of failure.
The difference is: in web based cryptography, you get the cipher text and the code to decrypt it from the same source. Hijacking OS updates is arguably much harder than hijacking one particular web server, and there is pretty much no effective defense against malicious OS updates.
Agree, but a significant point missed in the article is that of data vulnerability. with E2EE the company db is useless to an external attacker.<p>For some companies (eg facebook, google, tiktok) i would be mostly worried about the company itself being untrustworthy. For others I would be mostly worried about the company being vulnerable.
It's a native app what are you talking about
> It is worth noting that this law also applies to non-web applications where the service provider supposedly being secured against is also the client software distributor; thus, the “end-to-end encryption” offered by Whatsapp and Signal, amongst other proprietary services, is equally bogus. (Both Whatsapp and Signal ban use of third party clients, and enforce this policy.)
Since when is E2EE controversial? Not using E2EE should be controversial.
There is no way to do E2EE on a traditional social media platform with user-generated content and comply with existing US law.<p>You can’t moderate an E2EE platform.
All of Meta’s major properties (Messenger, Instagram, WhatsApp) support E2EE messaging.
Aside from the fact that you can get Metadata and that some communication frequently happens outside of E2EE - what US law do you believe mandates moderation? I'm curious.
What law do you believe supports your perspective?
Do you feel safer knowing DMs are not encrypted?
Nobody should feel safe using the TikTok client, period.
Not just the TikTok client, <i>anything</i> made by Oracle is risky.
Neither Instagram/Facebook's Messenger/WhatsApp.
Do you take "yes" for an answer?<p>It really depends on whether you think your government is more dangerous than, say, suicide trends, grooming, scamming.<p>I know the answer is pretty easy for US citizens to answer right now.
Just like door locks are making the world less free!
Another step in towards the endgame, mass surveillance state.
That's good, people who need E2EE shouldn't use TikTok either way, there are plenty of other secure apps for that.<p>TikTok is a social media app, and it gets heavily abused as it is.
Fun fact - there is a big correlation between World Wars and compulsory education. Of course governments and big corporations "care" about children. Of course!
This BBC article is insanely written.
I feel like this makes sense for a platform that targets teens. Plus, I wouldn't trust TikTok to implement E2E encryption properly—who knows what they've snuck into their client.
What kind of application is not targeted at both teens and adults?<p>Youtube, twitter, bluesky, whatsapp? Every app with a social aspect will be used by teens. And no, tiktok is not "only for teens" or "specially targeted at teens", nowadays everyone uses it and creates content on it.
I think it's very safe to assume that no major US based platform has 'real' E2E encryption. They're almost certainly all a part of PRISM by now, and it'd contradict their obligations to enable government surveillance. So the only thing that's different is not lying about it. Though I expect the other platforms are, like when denying they were part of PRISM, telling half truths and just being intentionally misleading. 'We provide complete E2E encryption [using deterministically generated keys which can be recreated on demand].'
unrelated but I'm always surprised by the number of people who don't know that instagram dms are not encrypted by default.
The Chinese spyware app won’t do E2EE? I can’t believe what I’m reading.
Yeah, about that: <a href="https://www.telegraph.co.uk/us/news/2025/10/10/barron-trump-tipped-top-tiktok-job/" rel="nofollow">https://www.telegraph.co.uk/us/news/2025/10/10/barron-trump-...</a>
Not so Chinese anymore. At least in the US.
Maybe just don't use TikTok. Shocking that adults use a platform for children.
I take privacy suggestions from social media companies on a daily basis.
The core tension here isn’t really about encryption itself, it’s about moderation models.<p>Most large platforms rely heavily on server-side visibility for abuse detection, spam filtering, recommendation systems, and safety tooling. End-to-end encryption removes that visibility by design. Once a platform is built around centralized analysis of user content, adding strong E2EE later isn’t just a feature toggle — it conflicts with large parts of the existing architecture.
> But critics have said E2EE makes it harder to stop harmful content spreading online, because it means tech firms and law enforcement have no way of viewing any material sent in direct messages.<p>Like they give a damn. I report accounts that explicitly sell fake credit cards, citing laws that make it illegal and 95% of the time "we checked and there is no violation here, we know that you're not happy but don't give a crap".<p>So the argument of security is utter bullshit and they just want to snoop.
And their target audience won't question it.
The actual headline is currently<p>> TikTok won't protect DMs with controversial privacy tech, saying it would put users at risk<p>Not sure if this was changed since first posting, I don't mind updates, but unless it'd redacting for legal purposes (which should then itself be clearly mentioned), the BBC should provide a public changelog like wikipedia
I hate the BBC so much - "controversial privacy tech" "E2EE ... the best way to protect conversations from .. even repressive authorities" "End-to-end encryption has been criticised by governments, police forces"<p>They're saying this at the same time as they're clutching pearls over Iran's repression of protestors. Typical of the ethical consistency I would expect from them.
A Chinese company saying you don't need encryption. Why should anyone waste time debunking their bad faith "arguments"?
Fascinating. What a time to be alive.
Reminder, Larry “citizens shouldn’t get any privacy” Ellison now owns tik tok. If you’re still using it or have friends and family using it you should stop immediately. It WILL eventually be used against you if this regime gets its way.<p><a href="https://digitaldemocracynow.org/2025/03/22/the-troubling-implications-of-larry-ellisons-vision-for-ai-and-social-control/" rel="nofollow">https://digitaldemocracynow.org/2025/03/22/the-troubling-imp...</a>
so we need no encryption?...at the end of the day we have nothing to hide right CIA,FBI? :D
Doublespeak. War is peace.
TikTok’s stance against end-to-end encryption is unsurprising but still concerning. TikTok is a source of information on many topics, such as the genocide in Gaza, which traditional media underreport and many governments try to suppress. The network effect of big social media platforms means many people will likely talk about these topics in TikTok DMs. No matter what legal controls TikTok claims to enforce, there is no substitute for technological barriers for preventing invasions of privacy and government overreach. This is yet another example where corporations and governments sacrifice people’s autonomy and privacy in the name of security.
It's a pretty terrifying world we live in now, where an unencrypted addictive short-form video platform is considered a source of information more than news agencies or even community-managed forums.
Of course you are the target audience for disinformation spread via this propaganda platform.
[dead]
It's the Max app for Americans, now with 900% more US and IL government spying.
<i>"The situation is made more complex because TikTok has long faced accusations that ties to the Chinese state may put users' data at risk."</i><p>And yet, it's even more complex than that, since it's now owned by cronies of the current US President. I've never had a TikTok account, but conceptually I was mostly pretty okay with being spied-upon by China. I'm never going to China.
This according to many researchers is the best case study example for corporations gaslighting users into accepting surveillance by companies and governments alike.
> Grooming and harassment risks are very real in DMs [direct messages] so TikTok now can credibly argue that it's prioritising 'proactive safety' over 'privacy absolutism' which is a pretty powerful soundbite<p>Means they read every message
clown emoji
why are we still wringing our hands around this? we’ve already determined that tiktok is bad for our health.<p>because tiktok is addicting, and they know it…
[dead]
> We know just how risky end-to-end-encrypted platforms can be for children<p>As opposed to doomscrolling and brainrot, which are not risky to expose children to at all. /s<p>If TikTok cared about children in the slightest, they would not exist.
BBC calling encryption "controversial privacy tech" is deeply disappointing and dangerous.
I wondered how it could be considered 'controversial', but they do quote at least a couple groups speaking against it. The NSPCC for instance, who incidentally also warned parents about a Harry Potter video game because their children might want to learn more about the game:<p>>“Parents should also be aware that players may want to find out more about the game using other platforms such as YouTube, Twitch, Reddit and Discord, where other game fans can discuss strategies and experiences.
It is controversial.. amongst people who have concerns about private communications and society, from a regulatory and governance perspective.<p>It's uncontroversial amongst people who value their privacy.<p>The tension between the two camps (there are obviously nuances and this is a false dichotomy) is at a current peak. It's an ongoing controversy. It's a matter of public debate.<p>You might have liked it better if the angle had been "...which the government, controversially, wants to clamp down on" or something.
Calling something controversial is a favorite propaganda technique employed by "news" outlets. It's another form of selective reporting and framing. It carries negative connotations, and has really no objective standard by which it can be wrong since you'll always find somebody against any issue.<p>After you notice it, you'll notice it everywhere.
> It carries negative connotations<p>Interesting I'm not a native English speaker but in news articles I have always interpreted "controversial" as meaning "under discussion" (perhaps even around a 50/50 divide) hence why they are writing an article about it.<p>I feel it is the news outlet trying to justify why the topic is important to read about since most people reading it will interpret the issue at hand as having a "common" stance. Usually it is used in topics that are very binary, for or against.
It does have negative connotations. And it does get used by news corporations to influence opinion. I have rarely if ever seen them feel the need to explain why a topic they report is important or newsworthy, and just stating without evidence that something is controversial really doesn't either.<p>> Usually it is used in topics that are very binary, for or against.<p>It can be for those topics, but very rarely to describe the side of such topics with which they align.
The UK government seems a lot more willing to embrace the panopticon in the name of protecting people from terrorists, child sex traffickers, human rights activists, Catholics, jaywalkers, you name it.
[flagged]