161–170 of 235 posts
Only FOSS can deliver verifiable E2EE, and all centralized and proprietary solutions like Zoom, Whatsapp, Instagram, etc should end the security theater.
I applaud Meta for at least being honest about one product.
Earlier quoted context omitted.
Main thing that comes to mind is things like this: - If you lose you phone you lose your messages - If you forget your password you lose your messages - If you switch phone you often lose messages - If you get added to a group you can't see the previous messages
> - If you forget your password you lose your messages This shouldn't be the case right? As password isn't related to the key messages are encrypted with.
Earlier quoted context omitted.
How would the keys get stored in the user's private browsing window? Do they lose all chat history when they log in on a private browsing window and then close it?
I don't know the technical details of that for sure, but I think the answer is that keys and chat history are stored on-device only; for example you lose your WhatsApp history if you don't restore a backup when moving to a new phone. If a messaging app is showing you message history in a private browsing window then perhaps the encryption key for that history is derived from your password or something like that; that…
Earlier quoted context omitted.
Do people expect that Instagram can't read their Instagram private messages? I don't think people expect that. And E2EE is not nearly as cheap as the HN crowd likes to pretend—how do those devices get those keys if not through a central service? Especially if one of them is a web browser?
The answer to most everyone question you’re asking is just, “public key cryptography”. It’s kind of disheartening to me that such basic 1990s tech as implemented by Phil Zimmerman is now obscure enough to merit questions like this. Both parties exchange public keys through the central service. Only the possessor of the respective (on device, Secure Enclave ideally) private keys can decrypt the messages encrypted to t…
Earlier quoted context omitted.
https://en.wikipedia.org/wiki/Diffie%E2%80%93Hellman_key_exc... If Meta are turning it off then I guess it's reasonable to assume that there is something to turn off.
Diffe-Hellman-Merkel key exchange is vulnerable to attacker-in-the-middle attacks. Eave could just do key negotiation with Alice and separately do key negotiation with Bob. You have to use a slightly more complicated cryptographic protocol to avoid this issue.
Earlier quoted context omitted.
And how does one verify that the public key received belongs to the intended party, rather than a mitm? If the answer is blind trust in a third party that runs the messaging service then I suspect that you can guess what the people asking those questions are really asking.
> And how does one verify that the public key received belongs to the intended party, rather than a mitm? Fingerprints. Again, this is like Crypto 101. Not saying that as a personal attack of any kind, I just remain incredulous that what used to be entry level knowledge in “our thing” has evidently become so obscure.
Centralized proprietary software on on proprietary platforms can always be opted into a special update that makes all the private keys deterministic making end to end encryption useless for anyone with knowledge of that targeted backdoor. Only FOSS can deliver verifiable E2EE, and all centralized and proprietary solutions like Zoom, Whatsapp, Instagram, etc should end the security theater. I applaud Meta for at least…
Earlier quoted context omitted.
This is awful. They are doing this so they can literally advertise to kids. I bet their dbs aren't encrypted at rest either. Complete foolishnes
Can you steelman TikTok's argument?
Centralized proprietary software on on proprietary platforms can always be opted into a special update that makes all the private keys deterministic making end to end encryption useless for anyone with knowledge of that targeted backdoor. Only FOSS can deliver verifiable E2EE, and all centralized and proprietary solutions like Zoom, Whatsapp, Instagram, etc should end the security theater. I applaud Meta for at least…
Centralized FOSS software can do the same thing and remove encryption. Open source is not a requirement for security.
https://github.com/signalapp/Signal-Android/blob/main/reprod...
Earlier quoted context omitted.
Centralized FOSS software can do the same thing and remove encryption. Open source is not a requirement for security.
With reproducible builds like Signal does you can be sure the app you've downloaded matches the source code that's been audited: https://github.com/signalapp/Signal-Android/blob/main/reprod...
A solution to this would be independent reproducible builds like F-Droid does, but Moxie rejected this citing it would cause them to lose control of the platform and install metrics Google and Apple provide. Always thought that was a weird position for a privacy tool.