> This is not just a theoretical either: Google Duo supports E2EE group calls on Android, iOS… and web! Google Duo does NOT support E2EE group calls on web... They actually don't support ANY group calls in the web app. Lack of good support for e2ee multiparty calls is probably why - the hope is that adoption of insertable streams will change that.
So You Want to Build an End-to-End Encrypted Web App
11–20 of 38 posts
Re: So You Want to Build an End-to-End Encrypted Web App
#12E2E is an illusion on anything other than a free Linux running on a free BIOS with no security enclave.
You can't have E2E on mobile devices, you can't have E2E on any other OS. (And you'll probably have a hard time finding the right combination of hardware and Linux distro to have it on Linux)
Re: So You Want to Build an End-to-End Encrypted Web App
#13E2E is an illusion on anything other than a free Linux running on a free BIOS with no security enclave. You can't have E2E on mobile devices, you can't have E2E on any other OS. (And you'll probably have a hard time finding the right combination of hardware and Linux distro to have it on Linux)
Any specific software and hardware that qualifies or comes close?
Re: So You Want to Build an End-to-End Encrypted Web App
#14E2E is an illusion on anything other than a free Linux running on a free BIOS with no security enclave. You can't have E2E on mobile devices, you can't have E2E on any other OS. (And you'll probably have a hard time finding the right combination of hardware and Linux distro to have it on Linux)
Any specific software and hardware that qualifies or comes close?
I really don't know which firmware nowadays qualifies as secure i.e. without backdoors.
The times where we had complete control over our hardware seem to be over.
Would also like to know about the current state of Open Hardware.
Re: So You Want to Build an End-to-End Encrypted Web App
#15> This is not just a theoretical either: Google Duo supports E2EE group calls on Android, iOS… and web! Google Duo does NOT support E2EE group calls on web... They actually don't support ANY group calls in the web app. Lack of good support for e2ee multiparty calls is probably why - the hope is that adoption of insertable streams will change that.
Check WhatsApp. There is very limited multi device support but all messages and calls are always e2ee.
Re: So You Want to Build an End-to-End Encrypted Web App
#16E2E is an illusion on anything other than a free Linux running on a free BIOS with no security enclave. You can't have E2E on mobile devices, you can't have E2E on any other OS. (And you'll probably have a hard time finding the right combination of hardware and Linux distro to have it on Linux)
E2E is a property of the software, not the software license.
Re: So You Want to Build an End-to-End Encrypted Web App
#17E2E is an illusion on anything other than a free Linux running on a free BIOS with no security enclave. You can't have E2E on mobile devices, you can't have E2E on any other OS. (And you'll probably have a hard time finding the right combination of hardware and Linux distro to have it on Linux)
Just in case you don't get it:
The moment the information is unencrypted and made available via a userinterface, you've lost all control.
You don't control the iOS rendering loop. You don't control the Android rendering system. (You might think you do though as much of Android is open source).
You don't control the OS core libraries, you don't control the microcode of the CPU. You don't control the blitting to a screen device or the recording of photons on a camera. And I'm not even talking about external manipulation to exfiltrate data.
You might control the content of the IP packages sent. You don't control any other IP packages sent.
Re: So You Want to Build an End-to-End Encrypted Web App
#18E2E is an illusion on anything other than a free Linux running on a free BIOS with no security enclave. You can't have E2E on mobile devices, you can't have E2E on any other OS. (And you'll probably have a hard time finding the right combination of hardware and Linux distro to have it on Linux)
E2E is a property of the software, not the software license.
Yeah, even that is not true.
Do you know what Apple does with text you enter into a text field? Or the letters you type on a virtual keyboard?
It's closed source and even if it were open source, you have no way of checking if the binary has been produced by that source code.
You don't control anything.
Re: So You Want to Build an End-to-End Encrypted Web App
#19E2E is an illusion on anything other than a free Linux running on a free BIOS with no security enclave. You can't have E2E on mobile devices, you can't have E2E on any other OS. (And you'll probably have a hard time finding the right combination of hardware and Linux distro to have it on Linux)
This seems to pick an arbitrary expansion of what “end to end” means, where “end” is “the OS layer on the source/destination computers”.
What if the monitor is backdoored and sends copies of the display buffer to The Secret World Government? What if the keyboard has a hardware keylogger? What if we’re all living in an elaborate computer simulation of a global pandemic?
As an alternate comparison: it’s still end-to-end encrypted communication if I take the securely received message, print out a copy, and tape it to a bulletin board at the town square.
The “end-to-end” refers to the transmission path. It’s a defense against MITM, and can be accomplished by plenty of systems that aren’t Linux.
Re: So You Want to Build an End-to-End Encrypted Web App
#20Earlier quoted context omitted.
E2E is a property of the software, not the software license.
Yeah, even that is not true. Do you know what Apple does with text you enter into a text field? Or the letters you type on a virtual keyboard? It's closed source and even if it were open source, you have no way of checking if the binary has been produced by that source code. You don't control anything.
I agree, I don't control any of that.
But E2E is a technical property of a system. It's not a social property regarding who controls what.