Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Kohler Can Access Pictures from "End-to-End Encrypted" Toilet Camera

varlogsimon.leaflet.pub

Post reply on HN
Print view View original

121–130 of 227 posts

Re: Kohler Can Access Pictures from "End-to-End Encrypted" Toilet Camera

#121

Post by [deleted] »

modeless wrote: post #70
geoduck14 wrote: post #42

Earlier quoted context omitted.

This is exactly what E2EE means. I used to work at a bank, and our data was E2EE, and we had to certify that it was E2EE - from the person paying, through the networks, through the DNS and Load balancers, until it got to the servers. Only at the servers could it be unencrypted and a (authoried) human could look at it. Of course, only authorized users could see the data, but that was a different compliance line item.

No, E2EE doesn't mean it's encrypted until the service provider decrypts it. E2EE means the service provider is unable to decrypt it. What you are describing is encryption in transit (and possibly at rest). Bank data is never E2EE because the bank needs to see it. If banks call it E2EE they are misusing the term. E2EE for financial transactions would look like e.g. ZCash.

[deleted]

Re: Kohler Can Access Pictures from "End-to-End Encrypted" Toilet Camera

#122

Post by calebio »

g-b-r wrote: post #111
calebio wrote: post #60

Earlier quoted context omitted.

It was pretty common to call client-side encryption/SSL "end to end encryption" among network engineers who were analyzing data flowing through their networks[0] as well as those who were implementing SSL/TLS into their applications[1]. The ends were the client and the server and the data was encrypted "end to end". The goal at that time was to prevent MITM snooping/attacks which were highly prevalent at the time. Pa…

I wasn't a network engineer, but to my recollection "end-to-end encryption" was only used occasionally, probably by people not too knowledgeable in cryptography

Well respectfully your recollection is missing lots of references by people that were "knowledgeable in cryptography".

You can easily find these references in the literature, often comparing link encryption with end-to-end encryption. Some of the earliest papers outlining the plans for SSL in the 90s (Analysis of the SSL 3.0 Protocol) are based on this exact foundation from the 80s (End-To-End Arguments in System Design).

Hell, you can even go back to 1978 and see MITRE discussing this exact thing in "Limitations of end-to-end encryption in secure computer networks".

Re: Kohler Can Access Pictures from "End-to-End Encrypted" Toilet Camera

#123

Post by calebio »

g-b-r wrote: post #87
calebio wrote: post #33

It was only a decade or so ago that "End-To-End Encryption" began to mean something other than "encrypted in transit". E2EE now means something wildly different in the context of messaging applications and the like (since like 2014) so this is more of an outdated way of saying "no one is getting your poop pictures between your toilet and us". It also feels like it would never make sense for this to be "E2EE encrypted…

> It was only a decade or so ago that "End-To-End Encryption" began to mean something other than "encrypted in transit". No, before that it was simply not a term, except in some obscure radio protocol (and even there someone competent in cryptography would probably not have chosen that term) > E2EE now means something wildly different in the context of messaging applications and the like (since like 2014) so this is…

> No, before that it was simply not a term, except in some obscure radio protocol

> no one really used the E2EE term before it got the current meaning

It most certainly was a term and no it wasn't simply limited to "some obscure radio protocol".

1994: https://ieeexplore.ieee.org/abstract/document/363791

1984: https://dl.acm.org/doi/pdf/10.1145/357401.357402

1978: https://apps.dtic.mil/sti/tr/pdf/ADA059221.pdf

> Some homemade encryption added on top of TLS is very unlikely to increase the security of the system

"Some homemade encryption" is not what I was suggesting at all. E.g. encrypted-at-the-source (client side) AWS files are still sent over TLS as an encrypted blob within an encrypted blob but remain encrypted past the TLS boundary.

Re: Kohler Can Access Pictures from "End-to-End Encrypted" Toilet Camera

#124

Post by lukeschlather »

calebio wrote: post #65
lukeschlather wrote: post #50

Earlier quoted context omitted.

The two endpoints of the communication with Kohler's app are the client and the server. In WhatsApp's E2EE implementation the endpoints are two client devices. Both are valid meanings of E2EE. You're defining that "end to end" means the server cannot access it but that's simply not what it means.

The modern usage of E2EE definitely means that "the server cannot access it". That's the meat of this entire discussion. While you are technically correct in a network topology sense (where the "ends" are the TCP connection points), that definition has been obsolete in consumer privacy contexts for a decade now due to "true" E2EE encryption. If we use your definition, then Gmail, Facebook, and Amazon are all "End-to-…

> If we use your definition, then Gmail, Facebook, and Amazon are all "End-to-End Encrypted" because the traffic is encrypted between my client and their server.

That may or may not be the case. TLS is always terminated at a load balancer that uses TLS but it's still common to use HTTP within datacenters. So it may not be E2EE and it's a meaningful security feature.

Re: Kohler Can Access Pictures from "End-to-End Encrypted" Toilet Camera

#125

Post by Aeolun »

schmuckonwheels wrote: post #49

Imagine the collective brainpower that could be used to help solve the world's ills, and instead decided, no, what we need is a camera pointed at your asshole which we feed into an AI-powered SaaS we can then sell to you for a subscription. This industry is finished.

It’s pretty impressive that that juicero thing wasn’t the most bizarre thing they could come up with.

Re: Kohler Can Access Pictures from "End-to-End Encrypted" Toilet Camera

#127

Post by IncreasePosts »

karlgkk wrote: post #34
fastball wrote: post #29

Earlier quoted context omitted.

You could have a classifier running on-device that sends summary data (rather than raw images) back to Kohler.

Yeah, it’s kinda like such a reasonable thing too Doing on device compute is probably expensive and would prohibit such a product based on the economics but ITS A GENITAL CAM

Only for the very well endowed since it points down. Though hopefully they're doing something other than let their bits dangle in the toilet water.

Re: Kohler Can Access Pictures from "End-to-End Encrypted" Toilet Camera

#129

Post by hulitu »

fastball wrote: post #30
bmandale wrote: post #18

Earlier quoted context omitted.

This is an incredibly common misuse of the term e2ee. I think at this point we need a new word because you have a coin flip's chance of actually getting what you think when a company describes their product this way.

I have never seen "e2ee" abused this way personally.

Whatsapp, Signal, Telegram, iCloud

Re: Kohler Can Access Pictures from "End-to-End Encrypted" Toilet Camera

#130

Post by hulitu »

koolba wrote: post #41
Terr_ wrote: post #4

So basically their marketing-department is abusing a security term in order to sound good, as opposed to a software flaw. They're claiming "end to end" encryption, which usually implies the service is unable to spy on individual users that are communicating to one-another over an individualized channel. However in this case there are no other users, and their server is one of the "ends" doing the communicating, which…

> However in this case there are no other users, and their server is one of the "ends" doing the communicating, which is... perhaps not a literal contradiction in terms, but certainly breaking the spirit of the phrase. Am I understanding correctly that the other end of this is a rear end?

Every front end needs a rear end. So, yes.
Post reply on HN