Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Encrypted web traffic now exceeds 90%

netmarketshare.com

Post reply on HN
Print view View original

241–250 of 311 posts

Re: Encrypted web traffic now exceeds 90%

#241

Post by hcarvalhoalves »

est31 wrote: post #165
hcarvalhoalves wrote: post #159

Earlier quoted context omitted.

If people really listened to Snowden they wouldn't be relying on CA authorities for certificates.

There have been fradulent certificates in the wild in the past but the CAs doing it usually get kicked out pretty quickly. That's what Google's certificate transparency project is for. And they are increasing requirements further and further. Hopefully one day we'll get to a state where the infrastructure of multiple independent companies in different countries needs to be compromised in order for one successful forg…

State actors.

Re: Encrypted web traffic now exceeds 90%

#242

Post by maqp »

dijit wrote: post #162
Andrew_nenakhov wrote: post #129

Earlier quoted context omitted.

Ironically, Telegram markets itself as the most private and secure messenger, but in reality, it's much less private than WhatsApp or Viber: any regular (non-secret) Telegram chats are not end-to-end encrypted - if they were, you wouldn't be able to access them from a new device after authorization with a password.

They don’t claim end to end encryption by default though. You make it sound as if there is a revelation you made here. Telegram has faults, I would even argue it has many, but it’s clear that only “secret” chats and voice/video calls are end to end encrypted. Whatsapp, however, does allow you to download all of your messages from your device using WhatsApp web, and they were recently shown to have an exploit/backdoor…

"They don’t claim end to end encryption by default though."

They don't have to. The amount of my peers (i.e. who also major in CS) who think Telegram is more secure than e.g. WhatsApp, is staggering. People don't really think about the protocol, they only think what they hear on the news, or what their buddies think who have heard it in the news.

And what they hear is "Telegram, the new encrypted messaging app, blah bah..." and then they hear debate "Apple.. Encryption.. LEA can't read messages". So the incorrectly count 1+1=3 and think Telegram is safe against LEA.

When you're online and you try to point out Telegram uses home-brew protocol, EXACTLY the same security architecture as Facebook (TLS), and that both are created by Mark Zuckerbergs of separate nations, you'll very quickly drown in fanboys / sock puppets that come with following arguments

"WELL TELEGRAM'S ENCRYPTION HAS NOT BEEN BROKEN IN THE WILD NOW HAS IT???" (no need when you can hack the server and read practically everything)

or

"NOT TRUE TELEGRAM HAS SECRET CHATS" (which only works between mobile clients, and one-on-one chats, just like Facebook Messenger's opt-in end-to-end encryption. Like this one guy on the internet I talked to so eloquently put it: "I don't use secret chats because when I open my laptop, I want to type with my keyboard and not take out my phone every time I want to reply")

or

"PAVEL DUROV ABANDONED MOTHER RUSSIA TO BRING YOU THIS SECURITY" (which tells you absolutely nothing about the protocol and is no proof of any motivation towards any direction. When you're as rich as Durov you can choose any other country in the world and I suspect Dubai isn't treating him too badly).

or

"DUROV REFUSED BACKDOOR SO THERE IS NO WAY TO GET USER DATA" (which is simply not true, it's not like government agents can't hack servers, if Durov could deliver such systems, he'd be making five figure hourly wage hardening Fortune500 companies' systems)

Re: Encrypted web traffic now exceeds 90%

#243

Post by blotter_paper »

girvo wrote: post #234
blotter_paper wrote: post #188

Earlier quoted context omitted.

I listened to that interview, and purposefully didn't include my take on it above because I didn't want my crazier belief to distract from my crazy belief. Let's dive into the deep end of my personal crazypool: he came off very politicany to me, even down to the purposeful missteps. People trust a speaker more when the speaker says something a little bit offensive, probably because it's a sign that the person will sp…

Wait did he seriously say IMEIs can’t be changed? Surely he knows better: they definitely can. It’s not easy, but it’s doable. Or was, a decade ago at least.

Here's a transcript[0]:

>Edward Snowden: (02:26:27) They’re two globally unique identifiers that only exist anywhere in the world in one place. This makes your phone different than all the other phones. The IMEI is burned into the handset of your phone. No matter what SIM card you change to, it’s always going to be the same and it’s always going to be telling the phone network. It’s this physical handset.

[0]: https://www.rev.com/blog/joe-rogan-edward-snowden-podcast-in...

Re: Encrypted web traffic now exceeds 90%

#244

Post by newscracker »

skizm wrote: post #177
svara wrote: post #73

We often hear the complaint here that nobody cares / cared about Snowden's revelations. But to me it seems he did provide a lot of the impetus for having HTTPS virtually everywhere and a lot of the instant messenging apps being end-to-end encrypted. Most of WhatsApp's users are as non-technical as it gets, and yet they use the kind of encryption that only computer enthusiasts were interested in just a couple years ag…

Maybe a noob question, but are whatsapp's messages secure from Facebook? Would some motivated employee at Facebook be able to read everyone's messages if they wanted? If no, how do we know?

As much as I despise Facebook and its properties, the “how do we know” question can only be answered based on the trust that there would be at least one person in the company/team who would be a whistleblower if the end to end encryption is removed (with their knowledge and not through some state sponsored hacking).

With that background, a motivated employee cannot read WhatsApp messages that they have not sent or received themselves because WhatsApp uses the Signal protocol implementation. Coming to your first question, WhatsApp does share metadata with Facebook. So the fact that content isn’t shared is a moot point because a lot can be inferred from metadata alone to target people for any purpose.

So WhatsApp is not really a secure messenger if Facebook is part of your threat model and is considered an adversary or an adversary who can be easily coerced or compromised.

Re: Encrypted web traffic now exceeds 90%

#245

Post by maqp »

tantalor wrote: post #211
Andrew_nenakhov wrote: post #168

Earlier quoted context omitted.

Oh, come on! If Telegram can decrypt chats for a user, they can decrypt it if they really want. Any other kind of encryption is irrelevant - from third party attackers, tls works good enough.

Yeh "endpoint security" is hard. You need some trusted specialized hardware or network. https://en.wikipedia.org/wiki/End-to-end_encryption#Endpoint...

Dealing with the endpoint security is a really tough problem but I have a pet-project that pushes the price per endpoint just below $500 https://github.com/maqp/tfc

Re: Encrypted web traffic now exceeds 90%

#247

Post by maqp »

est31 wrote: post #165
hcarvalhoalves wrote: post #159

Earlier quoted context omitted.

If people really listened to Snowden they wouldn't be relying on CA authorities for certificates.

There have been fradulent certificates in the wild in the past but the CAs doing it usually get kicked out pretty quickly. That's what Google's certificate transparency project is for. And they are increasing requirements further and further. Hopefully one day we'll get to a state where the infrastructure of multiple independent companies in different countries needs to be compromised in order for one successful forg…

The problems is, companies like VeriSign offer LEA services

Quoting https://papers.ssrn.com/sol3/papers.cfm?abstract_id=1591033

“Verisign also operates a ‘Lawful Intercept’ service called NetDiscovery. This service is provided to ‘... [assist] government agen- cies with lawful interception and subpoena requests for subscriber records.’

If you now try to search for NetDiscovery or LEA services for CAs, you won't find any, but I guarantee you they haven't disappeared anywhere.

Re: Encrypted web traffic now exceeds 90%

#248

Post by maqp »

cfitz wrote: post #181
svara wrote: post #73

We often hear the complaint here that nobody cares / cared about Snowden's revelations. But to me it seems he did provide a lot of the impetus for having HTTPS virtually everywhere and a lot of the instant messenging apps being end-to-end encrypted. Most of WhatsApp's users are as non-technical as it gets, and yet they use the kind of encryption that only computer enthusiasts were interested in just a couple years ag…

We need to promote the use of messaging apps which default to SSL. It shows a user-focused product and perhaps a healthy company.

SSL was THE thing in 1995. End-to-end encrypted email has existed since 1991 (PGP), and for instant messaging you've been able to use OTR since 2004.

End-to-end encryption is what is needed, SSL is the bare minimum for everything. It's the seatbelt + airbag. You can't have a car without those anymore. E2EE is the ACC+AEB+ABS. You should not have a car without those anymore.

Re: Encrypted web traffic now exceeds 90%

#249

Post by NiekvdMaas »

nostrademons wrote: post #179
Andrew_nenakhov wrote: post #129

Earlier quoted context omitted.

Ironically, Telegram markets itself as the most private and secure messenger, but in reality, it's much less private than WhatsApp or Viber: any regular (non-secret) Telegram chats are not end-to-end encrypted - if they were, you wouldn't be able to access them from a new device after authorization with a password.

This marketing message always confused me: my techie understanding was that Telegram is actually one of the least secure messaging choices. If you want security, my understanding is that your preferences should go Signal, Whatsapp, iMessage, Hangouts or whatever Google's flavor-of-the-month messaging app is these days, Telegram, and Facebook.

Telegram does have some unique privacy-related features though that other platforms don't support. Examples are: ability to register without a mobile phone/app, open source library (tdlib), ability to edit messages, ability to delete messages for both sides (including images that are cached on the receiver's side), ability to clear chats for both parties, auto deleting messages.
Post reply on HN