Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

The coming war on end-to-end encryption

community.qbix.com

Post reply on HN
Print view View original

21–30 of 58 posts

Re: The coming war on end-to-end encryption

#21

Post by lisper »

Eight years ago I took a whack at building a fully open source end-to-end encryption system. This is what I came up with at the time:

https://github.com/Spark-Innovations/SC4

It's a bit dated at this point. It doesn't have a ratchet. I did implement one, but never got around to integrating it:

https://github.com/rongarret/ratchet-js

I also had an MVP iOS app which was never launched.

The reason I gave up on the project was that no one seemed to be interested. I spent several years looking for customers and collaborators and basically found nothing. The conclusion I came to is that a lot of people complain about the impending end of E2EE but very few people are actually willing to do anything about it except whine.

Re: The coming war on end-to-end encryption

#22

Post by EGreg »

nomel wrote: post #18
EGreg wrote: post #13

Earlier quoted context omitted.

Well, HTTPS is not end-to-end. That latter term is reserved for encryption that encrypts the messages between clients so servers can’t parse them. When you have a centralized system like ICANN DNS, the governments know which IP addresses the domain points to. They can go and serve them National Security Letters or shake them down to install secret backdoors. WhatsApp and Facebook can lie to you that they’re end-to-en…

> Well, HTTPS is not end-to-end I'm not well versed for encryption, but isn't this a matter of perspective? If you're downloading a .midi file from a server, the other "end" is that server, isn't it? Will the forces pushing this make any nuanced distinction, outside of this?

The “end” in end-to-end encryption for regular users is never a server.

Servers are online 24/7 listening and can be found and raided and/or hacked by various forces.

Clients are harder to locate. Especially if all you need to authenticate is a public/private keypair you generated.

That is why governments are so frustrated with crypto.

Re: The coming war on end-to-end encryption

#23

Post by [deleted] »

normaler wrote: post #20
UpToTheSky wrote: post #6

Is the world becoming more and more Orwellian? Is this a long term trend? It got pretty much unnoticed on HN, that Europe recently voted to make all crypto payments illegal unless the seller collects the personal data of the buyer. Independent of the amount. So there will be a track record of everything bought via crypto. Is it only a matter of time until cash is going away globally, and states have access to everyth…

If I buy crypto and posess it in my own wallet afterwards I can usw it however. Atleast with monero.

[deleted]

Re: The coming war on end-to-end encryption

#24

Post by Karellen »

EGreg wrote: post #22
nomel wrote: post #18

Earlier quoted context omitted.

> Well, HTTPS is not end-to-end I'm not well versed for encryption, but isn't this a matter of perspective? If you're downloading a .midi file from a server, the other "end" is that server, isn't it? Will the forces pushing this make any nuanced distinction, outside of this?

The “end” in end-to-end encryption for regular users is never a server. Servers are online 24/7 listening and can be found and raided and/or hacked by various forces. Clients are harder to locate. Especially if all you need to authenticate is a public/private keypair you generated. That is why governments are so frustrated with crypto.

> The “end” in end-to-end encryption for regular users is never a server.

Why not? Are servers not communication endpoints?

Re: The coming war on end-to-end encryption

#25

Post by EGreg »

Karellen wrote: post #24
EGreg wrote: post #22

Earlier quoted context omitted.

The “end” in end-to-end encryption for regular users is never a server. Servers are online 24/7 listening and can be found and raided and/or hacked by various forces. Clients are harder to locate. Especially if all you need to authenticate is a public/private keypair you generated. That is why governments are so frustrated with crypto.

> The “end” in end-to-end encryption for regular users is never a server. Why not? Are servers not communication endpoints?

For the reason I just told you — they can be compromised much more easily, and are typically run by a party which isn’t fully aligned with your interests and those of the other participants in your conversation.

Re: The coming war on end-to-end encryption

#26

Post by wrs »

Karellen wrote: post #24
EGreg wrote: post #22

Earlier quoted context omitted.

The “end” in end-to-end encryption for regular users is never a server. Servers are online 24/7 listening and can be found and raided and/or hacked by various forces. Clients are harder to locate. Especially if all you need to authenticate is a public/private keypair you generated. That is why governments are so frustrated with crypto.

> The “end” in end-to-end encryption for regular users is never a server. Why not? Are servers not communication endpoints?

With that definition of “end”, “end-to-end encryption” isn’t different from just plain “encryption”. The significance of the phrase is that you don’t leak anything outside the ultimate ends of the communication, including to servers in the middle.

Re: The coming war on end-to-end encryption

#27

Post by unethical_ban »

UpToTheSky wrote: post #6

Is the world becoming more and more Orwellian? Is this a long term trend? It got pretty much unnoticed on HN, that Europe recently voted to make all crypto payments illegal unless the seller collects the personal data of the buyer. Independent of the amount. So there will be a track record of everything bought via crypto. Is it only a matter of time until cash is going away globally, and states have access to everyth…

>Regarding end-2-end encryption: It does not prevent a government from reading your messages anyhow

Yes, e2e in principle does. You are arguing that e2e on specific platforms could be wiretapped by government order, which is feasible.

I correct this because it's important to be technically correct when discussing this in public. E2e the technology is not broken.

Re: The coming war on end-to-end encryption

#28

Post by hammyhavoc »

EGreg wrote: post #13
Karellen wrote: post #9

The thing I don't get is... won't bans on end-to-end encryption ban https? If I go to a website and ask for a web page over https, isn't the request and response between my device and the web server, an end-to-end encrypted message? Because the endpoints are my device and the web server. If I can't send my credit card details to a payment provider over an end-to-end encrypted channel, doesn't all commerce on the web…

Well, HTTPS is not end-to-end. That latter term is reserved for encryption that encrypts the messages between clients so servers can’t parse them. When you have a centralized system like ICANN DNS, the governments know which IP addresses the domain points to. They can go and serve them National Security Letters or shake them down to install secret backdoors. WhatsApp and Facebook can lie to you that they’re end-to-en…

>When you have a centralized system like ICANN DNS, the governments know which IP addresses the domain points to. They can go and serve them National Security Letters or shake them down to install secret backdoors.

HN opinions on CloudFlare aside, CloudFlare Tunnels mean DNS records point at CloudFlare servers, and the IP address of the origin server isn't discoverable via DNS. Sure, it's a court order away from being figured out even with dynamic IPs and historical logs with ISPs, but it's an interesting thought.

Qbix certainly looks very interesting. How have you guys been around for ten years and flown under the radar?

Re: The coming war on end-to-end encryption

#29

Post by boomboomsubban »

EGreg wrote: post #25
Karellen wrote: post #24

Earlier quoted context omitted.

> The “end” in end-to-end encryption for regular users is never a server. Why not? Are servers not communication endpoints?

For the reason I just told you — they can be compromised much more easily, and are typically run by a party which isn’t fully aligned with your interests and those of the other participants in your conversation.

So what if I run my own server with a private guestbook. Is https not end to end encryption in that scenario?

I realize your point, that in most circumstances https is not being used as end to end encryption. But it can be, so wouldn't it also be attacked in this war?

Post reply on HN