211–220 of 235 posts
People here like it, but end-to-end encryption is an objectively worse user experience for people that don't care about that feature
Earlier quoted context omitted.
Being in a prison cell is a great way to avoid traffic accidents, I agree.
It’s people like you who go in the dark forest because “the prison is tight”, get mugged, then complain that the sheriff doesn’t operate there. Call it a prison cell, or a fortified city. Whatever, dude…
a lot of shady messages go around in Insta DMs - whether it's cheating spouses, athletes getting exposed etc then of course other criminal shit.
if only, only if - you as the platform can sell added insurance (verified) program that screenshots can't be taken without the other party consenting etc.
Earlier quoted context omitted.
I'm asking you about how you want the world to work.
Well then, I think E2EE is a good thing and I'll take the minor inconveniences.
To fix this, you either need to authorize each device (and web browser) from another device that's logged in, or the central authority holds your keys.
Earlier quoted context omitted.
Centralized FOSS software can do the same thing and remove encryption. Open source is not a requirement for security.
FOSS is however a prerequisite to Kerckhoff's principle https://en.wikipedia.org/wiki/Kerckhoffs%27s_principle
Earlier quoted context omitted.
By disabling Apple "Intelligence" you bypass the risk of your prompts going to OpenAI.
What is your concern about prompts to go OpenAI? Apple has a contract with OpenAI that explicitly prevents them from logging, storing, training, or making any use of your prompts other than to satisfy the specific current request. Apple has some good lawyers and I’m sure that the teeth are prominent in that contract.
I send hundreds of prompts to OpenAI's LLM daily. I do not have a concern about it.
Earlier quoted context omitted.
You shouldn't be talking down like this, you're wrong about it. Alice and Bob need to exchange keys beforehand in some trusted out-of-band way. There's no protocol that solves this if Eve can be in the middle. I'm not sure what you mean by fingerprints, but if you describe a protocol, I can describe the mitm attack.
You’re not sure what key fingerprints are? Bob and Alice are setting up their e2e channel, and because they have some extra level of concern about snooping, they telephone each other and read off some form of hash of the public key to each other. A more complex variant would be something like PGP implemented, where Bob and Alice could both sign each others keys after this exchange, ensuring that someone who hadn’t me…
Earlier quoted context omitted.
Well then, I think E2EE is a good thing and I'll take the minor inconveniences.
Not being able to receive messages except on one device isn't a minor inconvenience. To fix this, you either need to authorize each device (and web browser) from another device that's logged in, or the central authority holds your keys.
Earlier quoted context omitted.
No, it's not at all this simple. This is why so many "e2ee" apps like Telegram are bogus, they ended up prioritizing UX over security because there are many places where you can't pick both.
Webs of trust based on OOB key verification and signing, or centralized trust authorities are the two primary models I’m aware of. I’ve always been enamored of the idea of DNS as a back end protocol to enable the former largely decentralized solution. Bob looks up Alice and receives her key from Alice’s namespace within the DNS hierarchy, along with her trust claims. David then looks up Alice’s key within her namespa…
The harder part that Instagram is most likely concerned about is getting low-effort users to keep their private keys safe without losing them.