We do already have different implementations of TLS/HTTPS used for different purposes. They're called cipher suites. There are already weaker cipher suites in widespread use, which are the cause of most of the big security issues with TLS/SSL/HTTPS. (This is pretty good article on the subject: http://blog.cryptographyengineering.com/2015/03/attack-of-we...)

I'd guess all the UK government would do is insist that, by law, all secured P2P messaging goes via a given cipher suite (one with a government backdoor/decryption key and, I guess, no perfect forward secrecy).

It's pretty conclusive how bad an idea it is, when all of the leading security experts in the world have said that this is impossible without weakening the entire security of the system.

Presumably the government asks the bank what you're up to, and the bank tells them. Which is exactly what already happens today.

Do you think the reason you use HTTPS to talk to your bank is to prevent the government from seeing your account balance?

It's certainly not the only reason but sure it's one of them. Proof of that is Google forcing TLS encryption of all it's traffic after the NSA scandal.

The number of people that can implement secure communications without relying on third parties is close enough to zero that they basically don't count.

ISIS recruitment would plummet to zero if people had to get TLS working before joining.

I don't think that you understand that the TLS technology used for online banking (which would still be legal) is the very same technology that lets you create a secure communication channel with other users.

I don't know why you think that. Perhaps I was unclear.

The average prospective terrorist / criminal etc isn't going to be able to set up TLS. If they encrypt their communications, the odds are it's going to be going via a third party. Next time you send an email, tell the recipient that from now on you're going to communicate directly by TLS, and they'll need to set up a server before you can talk to them again. I believe that most people will have considerable difficulty doing that.

So, you're reliant on third parties who constitute single points of failure and potential targets of legal action.

Individuals who can securely set up TLS (or PGP or whatever) for their own communications are sufficiently rare that they effectively don't matter.

TLS is currently simply a matter of point and click on a graphical interface.

For hosting provider setup, to domain name registration and TSL certificate generation there are thousands of online tutorials.

You don't need to be an expert or a developer to know how to setup TLS on a Wordpress blog.

A Wordpress blog run by a third party does not constitute a secure messaging system, even if you have TLS enabled on it. And it's still a lot less easy than using WhatsApp.

Installing pidging, otr, starting a chat and confirming who you're talking too doesn't exactly require a comp sci degree.

This isn't really about stopping that though, it's about the snooping nanny state plain and simple.

Using PGP securely is as easy as downloading some software, typing in your message, and clicking a button. It's not something that requires any knowledge beyond basic computer usage. You aren't going to be able to stop people from sharing PGP software on the internet.

I think you're severely underestimating the intelligence of people in general. If we're talking about ISIS, all it takes is one moderately experienced computer user to show everyone else how to use PGP.

> Using PGP securely is as easy as downloading some software, typing in your message, and clicking a button. It's not something that requires any knowledge beyond basic computer usage. You aren't going to be able to stop people from sharing PGP software on the internet.

And yet we find a bunch of supposedly encrypted stuff where the user did something wrong, leaving the stuff effectively unencrypted.

See also people uploading keys to github etc.

What software are you talking about? I've seen very clever people struggle with PGP. In fact Ed Snowden famously screwed up when he first emailed Glenn Greenwald.

GPGTools, for example (https://gpgtools.org)

I suppose I omitted the step of copying and pasting your recipient's public key, but that's not especially conceptually difficult, either.

That does look quite nifty.

There's also keypair generation, which is the step that derails most people I think. Plus the fact that people have to grok the concept of public and private keys, and be able to distribute / not distribute them as appropriate. And revocation certificates. And public keyservers. And trust levels. Etc.

I do think an organised, disciplined group might manage to get PGP working as intended, but I doubt there are many such groups.

My point is, I doubt individuals implementing encryption have much to fear from whatever proposals may emerge from this. Maybe they will later. But it seems to me it's much more likely to target companies that offer/facilitate encrypted messaging.

Edit: Thanks to whoever just put my karma over 2000. Does anything exciting happen when you get to 2000 points?

Hmm. I guess my thought is that if it became well-known that using Whatsapp, iMessage, etc. to communicate about illegal activities frequently led to arrest, then knowledge of PGP and the like would spread because it's not too difficult to use. So then government would be able to read everyone's communications through those channels for no appreciable benefit.

Obviously, that's total conjecture, though.

Using PGP is as easy as understanding PKI, which is beyond most people that don't work in tech, and a substantial amount of people that do.