Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

The coming war on end-to-end encryption

community.qbix.com

Post reply on HN
Print view View original

51–58 of 58 posts

Re: The coming war on end-to-end encryption

#51

Post by yarg »

nomel wrote: post #40
Karellen wrote: post #24

Earlier quoted context omitted.

> The “end” in end-to-end encryption for regular users is never a server. Why not? Are servers not communication endpoints?

I've found our problem. It appears the meaning has (apparently?) changed around 2014. Many search results you can find, including from IBM, and EFF, use the "old" (our) definition. See: https://en.wikipedia.org/wiki/End-to-end_encryption#Etymolog... > The term "end-to-end encryption" originally only meant that the communication is never decrypted during its transport from the sender to the receiver. > ... > Later, ar…

So we're expected to use the layman's definition just because the technology became popular?

Re: The coming war on end-to-end encryption

#53

Post by smitty1e »

UpToTheSky wrote: post #6

Is the world becoming more and more Orwellian? Is this a long term trend? It got pretty much unnoticed on HN, that Europe recently voted to make all crypto payments illegal unless the seller collects the personal data of the buyer. Independent of the amount. So there will be a track record of everything bought via crypto. Is it only a matter of time until cash is going away globally, and states have access to everyth…

The more dystopian the internet gets, the greater the offline growth in commerce and communication.

And, as Tim Berners-Lee's invention drowns in DeepFakes and ChatGPT dystopia, this hardly seems a bad thing.

Re: The coming war on end-to-end encryption

#54

Post by Haga »

smitty1e wrote: post #53
UpToTheSky wrote: post #6

Is the world becoming more and more Orwellian? Is this a long term trend? It got pretty much unnoticed on HN, that Europe recently voted to make all crypto payments illegal unless the seller collects the personal data of the buyer. Independent of the amount. So there will be a track record of everything bought via crypto. Is it only a matter of time until cash is going away globally, and states have access to everyth…

The more dystopian the internet gets, the greater the offline growth in commerce and communication. And, as Tim Berners-Lee's invention drowns in DeepFakes and ChatGPT dystopia, this hardly seems a bad thing.

[dead]

Re: The coming war on end-to-end encryption

#55

Post by lisper »

nelsonenzo wrote: post #46
lisper wrote: post #21

Eight years ago I took a whack at building a fully open source end-to-end encryption system. This is what I came up with at the time: https://github.com/Spark-Innovations/SC4 It's a bit dated at this point. It doesn't have a ratchet. I did implement one, but never got around to integrating it: https://github.com/rongarret/ratchet-js I also had an MVP iOS app which was never launched. The reason I gave up on the proje…

What is it? Seams like it's an implementation of ecc,but does what? A p2p chat? ::Shrugs:: I'm not sure the failure to adopt your one elusive product speaks for the entire pop.

Like it says right there in the README, in the very first sentence after the NEWS section:

"SC4 is a web application that provides secure encrypted communications and secure digital signatures. It is intended to eventually be a replacement for PGP/GPG."

I honestly don't know how it could possibly have been made any clearer.

Re: The coming war on end-to-end encryption

#56

Post by yencabulator »

UpToTheSky wrote: post #6

Is the world becoming more and more Orwellian? Is this a long term trend? It got pretty much unnoticed on HN, that Europe recently voted to make all crypto payments illegal unless the seller collects the personal data of the buyer. Independent of the amount. So there will be a track record of everything bought via crypto. Is it only a matter of time until cash is going away globally, and states have access to everyth…

> Regarding end-2-end encryption: It does not prevent a government from reading your messages anyhow. They could instruct Meta (or whichever company is in control of the app you use) to send them the the messages you write directly from your phone. Or from the phone of the receiver. Or to send them the private key from your phone. They could also ask Apple or Google to do so, since those have acceess to everything on your phone.

There is a huge difference between "use the encryption key you already have to decrypt this message" and "implement changes in your software that allow attacking this person".

Last I heard, US courts couldn't force companies into doing anything, only to reveal information, or to mandate secrecy. The idea of a warrant canary is 100% based on the idea that the government cannot force the company to publish a statement it does not wish to publish.

https://en.wikipedia.org/wiki/Warrant_canary

Re: The coming war on end-to-end encryption

#57

Post by cracked-behem »

pcthrowaway wrote: post #49
EGreg wrote: post #47

Earlier quoted context omitted.

How does a server run on the client? It runs on localhost! Right? It can show the user their own info back to them in iframes?

I'm not the creator of redact, but it sounds like you're under the impression that the iframe src is redact.ws in which case I'd understand your concern. My assumption is that the iframe src would be the local redact server, which would keep things as secure as the package the user installed (though there could be compromises at the network level I suppose)

Exactly. This section on the website should explain it with some more detail: https://redact.ws/how-it-works#client

Re: The coming war on end-to-end encryption

#58

Post by ranger_danger »

LinuxBender wrote: post #50
ranger_danger wrote: post #43

Earlier quoted context omitted.

> backdooring Name one attempt besides Dual_EC_DRBG. Also could you explain why that one took NIST 8 years to say "don't use it".

There are already legal backdoors not actually referred to as that legally and they are used by corporations to meet their regulatory requirements for things like DLP. Google for example supports this. HTTPS doesn't even matter, their site supports DLP appliances logging in and intercepting all corporate interactions on the platform. The same capabilities exist for non corporate but that is used by law enforcement. T…

What does this have to do with anything?
Post reply on HN