Global Encryption Day: Demand End-to-End Encryption in DMs

#1

Post by pabs3 » Sat, Oct 22, 2022, 8:44 AM UTC

Global Encryption Day: Demand End-to-End Encryption in DMs
blog.torproject.org

Re: Global Encryption Day: Demand End-to-End Encryption in DMs

#2

Post by pabs3 » Sat, Oct 22, 2022, 8:45 AM UTC

Kind of meaningless if you can't trust the software running on your device though, since it could be scanning locally or relaying to remote services.

Re: Global Encryption Day: Demand End-to-End Encryption in DMs

#3

Post by fsflover » Sat, Oct 22, 2022, 9:46 AM UTC

pabs3 wrote: post #2

Kind of meaningless if you can't trust the software running on your device though, since it could be scanning locally or relaying to remote services.

So run free software?

Re: Global Encryption Day: Demand End-to-End Encryption in DMs

#4

Post by sschueller » Sat, Oct 22, 2022, 10:13 AM UTC

fsflover wrote: post #3

pabs3 wrote: post #2

Kind of meaningless if you can't trust the software running on your device though, since it could be scanning locally or relaying to remote services.

So run free software?

Like signal that still refuses to put their client on fdroid?

Re: Global Encryption Day: Demand End-to-End Encryption in DMs

#5

Post by jv0010 » Sat, Oct 22, 2022, 10:17 AM UTC

It's mind blowing e2e is not a standard. I guess the equivalent is looking back and realising cars and homes did not have locks at one stage

Re: Global Encryption Day: Demand End-to-End Encryption in DMs

#6

Post by edf13 » Sat, Oct 22, 2022, 10:22 AM UTC

fsflover wrote: post #3

pabs3 wrote: post #2

Kind of meaningless if you can't trust the software running on your device though, since it could be scanning locally or relaying to remote services.

So run free software?

Are you confident enough to audit the free software yourself - or pushing the trust back to someone else?

Re: Global Encryption Day: Demand End-to-End Encryption in DMs

#7

Post by [deleted] » Sat, Oct 22, 2022, 10:25 AM UTC

[deleted]

Re: Global Encryption Day: Demand End-to-End Encryption in DMs

#8

Post by 100001_100011 » Sat, Oct 22, 2022, 10:26 AM UTC

How do you know if the Signal client running on your phone right now doesn't include a backdoor? Sure it's open source. But how do you know how it was compiled?

What if someone changed the open source before shipping it to the app store?

Re: Global Encryption Day: Demand End-to-End Encryption in DMs

#9

Post by einpoklum » Sat, Oct 22, 2022, 10:26 AM UTC

pabs3 wrote: post #2

Kind of meaningless if you can't trust the software running on your device though, since it could be scanning locally or relaying to remote services.

Exactly. Demand an open source for every encryption app - or at least those offered to the public en masse.

It's not enough that a FOSS alternative _exists_; it needs to be the case that closed-source encryption is not considered as an actual encryption "end".

Re: Global Encryption Day: Demand End-to-End Encryption in DMs

#10

Post by i_am_proteus » Sat, Oct 22, 2022, 10:28 AM UTC

100001_100011 wrote: post #8

How do you know if the Signal client running on your phone right now doesn't include a backdoor? Sure it's open source. But how do you know how it was compiled? What if someone changed the open source before shipping it to the app store?

How do you know that the AES instruction set on your device's processor doesn't include a backdoor? Sure, the algorithm is public, but how do you know how it was implemented?