“The hacking campaign [group], nicknamed [ by Microsoft ] Salt Typhoonby Microsoft,
[ this actual campaign of attacks ] is one of the largest intelligence compromises in U.S. history, and not yet fully remediated. Officials in a press call Tuesday [ 2024-12-3 ] refused to set a timetable for declaring the country’s telecommunications systems free of interlopers. Officials had previously told NBC News that China hacked AT&T, Verizon and Lumen Technologies to spy on customers.”
Imgonnatrythis@sh.itjust.works
on 04 Dec 02:29
collapse
Thanks I thought from reading this maybe Salt Typhoon was the codename for the next version of windows.
The third has been systems that telecommunications companies use in compliance with the Commission on Accreditation for Law Enforcement Agencies (CALEA), which allows law enforcement and intelligence agencies with court orders to track individuals’ communications. CALEA systems can include classified court orders from the Foreign Intelligence Surveillance Court, which processes some U.S. intelligence court orders.
Wouldn’t surprise me. “We’re doing this to be helpful to you!” is actually moustached disney villain behavior.
^ similar to the prisoners with cats gimmick. “look how nice we’re being to our prisoners” is actually “stop yelling at your bunkmate or we’ll take away your cat”
When a whole nation’s communications are intercepted by another entity, yes, the bad part is that it’s another nation. Especially an adversarial one.
This is not about individuals’ personal privacy. It’s about things that happen at a much larger scale. For example, leverage for political influence, or leaking of sensitive info that sometimes finds its way into unsecured channels. Mass surveillance is powerful.
I read Molly is forked from Signal. Can I message Signal users from Molly, or do all parties need Molly?
asdfasdfasdf@lemmy.world
on 04 Dec 13:20
nextcollapse
Molly connects to Signal’s servers, so you can chat with your Signal contacts seamlessly.
JackFrostNCola@lemmy.world
on 05 Dec 03:41
collapse
From my experience parties are always better with Molly
zergtoshi@lemmy.world
on 04 Dec 07:37
nextcollapse
Yes, like Signal!
Which does not only use end-to-end encryption for communication, but protects meta data as well:
Signal also uses our metadata encryption technology to protect intimate information about who is communicating with whom—we don’t know who is sending you messages, and we don’t have access to your address book or profile information. We believe that the inability to monetize encrypted data is one of the reasons that strong end-to-end encryption technology has not been widely deployed across the commercial tech industry.
OldManBOMBIN@lemmy.world
on 04 Dec 01:18
nextcollapse
Just stop using your electronic devices. Not like they don’t all have monitors built in already anyway. Every connected device could be sending screenshots home and we’d never know. I mean, I guess you could use something like Wireshark to monitor your home network, but something tells me nowadays there are ways around even that. I’m not a certified network tech or even a script kiddie, but I don’t trust my tech as far as my dog can throw it. I just try to secure through obfuscation as much as possible. Everyone thinks I have carbon monoxide poisoning, but it’s a small price to pay for peace of mind - even a small one.
I’m just saying that, unless you built the device you’re using, and you know what every component does, and you know what it’s doing when, and you know it wasn’t manufactured by a foreign state-owned manufacturer with a penchant for putting spy chips in their devices, then you can’t truly trust anything you do on it, encrypted or not. It doesn’t really matter, if the software is being encrypted by backdoored hardware.
SocialMediaRefugee@lemmy.world
on 04 Dec 16:02
nextcollapse
Do what the Germans did in ww1 when they knew their diplomatic code was broken but couldn’t change it. They put the important stuff in plain sight and treated it like junk mail and encoded the boring stuff.
They knew, they were putting backdoors when they needed them.
Now the new administration will take half of the blame in public opinion (that’s how this works) and also half of the profits, so they won’t investigate too strictly those who’ve done such things.
But also words don’t cost anything. They can afford to say the obvious after the deed has been done.
Hey you guys remember that big AT&T breach recently?
Imgonnatrythis@sh.itjust.works
on 04 Dec 02:28
nextcollapse
The US gov should provide us with their own encryption app to protect us and just have a backdoor only they can access so they can keep an eye on any baddies!
#Igotnothingtohide
#amiright
#muricafuckyeah
PoolloverNathan@programming.dev
on 04 Dec 05:40
collapse
I’m a cryptographer in Florida, and now I’m more confused
sugar_in_your_tea@sh.itjust.works
on 05 Dec 00:07
collapse
Ew.
Think of it like this:
no encryption - sending a postcard
client to sever encryption - dropping off the postcard at the post office instead of the mailbox
end to end encryption - security envelope in the mailbox
read receipts - registered mail
Hopefully you’re less wrong now Mr/Mrs legislator.
Semi_Hemi_Demigod@lemmy.world
on 05 Dec 03:39
collapse
“I didn’t have my pills today. Can you explain that to my staffer? They’ll make a note of it.”
Lost_My_Mind@lemmy.world
on 04 Dec 02:34
nextcollapse
Everybodies aunt at thanksgiving:
“I should be fine. I only trust the facebook with my information. Oh, did I tell you? We have 33 more cousins we didn’t know about. I found out on 23andme.com. All of them want to borrow money.”
Bluetreefrog@lemmy.world
on 04 Dec 02:52
nextcollapse
Interpretation - the NSA can now crack all common encryption methods, so let’s disadvantage our adversaries at no real cost to us.
I vaguely recall Bruce Schneier saying that there is good evidence that the NSA cannot crack certain encryption methods. At the time, RSA was on the list. Maybe common methods mean roll-your-own corporate encryption, but it’s my understanding that GNUpg and similar software are safe.
Well, GPG doesn’t have PFS, but its a good starting point to say hello and then upgrade to some better encrypted messaging app
circuitfarmer@lemmy.sdf.org
on 04 Dec 02:55
nextcollapse
It’s probably also good practice to assume that not all encrypted apps are created equal, too. Google’s RCS messaging, for example, says “end-to-end encrypted”, which sounds like it would be a direct and equal competitor to something like Signal. But Google regularly makes money off of your personal data. It does not behoove a company like Google to protect your data.
Start assuming every corporation is evil. At worst you lose some time getting educated on options.
End to end is end to end. Its either “the devices sign the messages with keys that never leave the the device so no 3rd party can ever compromise them” or it’s not.
Signal is a more trustworthy org, but google isn’t going to fuck around with this service to make money. They make their money off you by keeping you in the google ecosystem and data harvesting elsewhere.
Thats a different tech. End to end is cut and dry how it works. If you do anything to data mine it, it’s not end to end anymore.
Only the users involved in end to end can access the data in that chat. Everyone else sees encrypted data, i.e noise. If there are any backdoors or any methods to pull data out, you can’t bill it as end to end.
micballin@lemmy.world
on 04 Dec 03:51
nextcollapse
They can just claim archived or deleted messages don’t qualify for end to end encryption in their privacy policy or something equally vague. If they invent their own program they can invent the loophole on how the data is processed
cheesemoo@lemmy.world
on 04 Dec 03:53
nextcollapse
Or the content is encrypted, but the metadata isn’t, so they can market to you based on who you talk to and what they buy, etc.
This part is likely, but not what we are talking about. Who you know and how you interact with them is separate from the fact that the content of the messages is not decryptable by anyone but the participants, by design. There is no “quasi” end to end. Its an either/or situation.
sugar_in_your_tea@sh.itjust.works
on 04 Dec 16:31
collapse
It doesn’t matter if the content is encrypted in transit if Google can access the content in the app after decryption. That doesn’t violate E2EE, and they could easily exfiltrate the data though Google Play Services, which is a hard requirement.
I don’t trust them until the app is FOSS, doesn’t rely on Google Play Services, and is independently verified to not send data or metadata to their servers. Until then, I won’t use it.
Provided they have an open API and don’t ban alternative clients, one can make something kinda similar to TOR in this system, taking from the service provider the identities and channels between them.
Meaning messages routed through a few hops over different users.
Sadly for all these services to have open APIs, there needs to be force applied. And you can’t force someone far stronger than you and with the state on their side.
When you use the Google Messages app to send end-to-end encrypted messages, all chats, including their text and any files or media, are encrypted as the data travels between devices. Encryption converts data into scrambled text. The unreadable text can only be decoded with a secret key.
The secret key is a number that’s:
Created on your device and the device you message. It exists only on these two devices.
Not shared with Google, anyone else, or other devices.
Generated again for each message.
Deleted from the sender’s device when the encrypted message is created, and deleted from the receiver’s device when the message is decrypted.
Neither Google or other third parties can read end-to-end encrypted messages because they don’t have the key.
They cant fuck with it, at all, by design. That’s the whole point. Even if they created “archived” messages to datamine, all they would have is the noise.
circuitfarmer@lemmy.sdf.org
on 04 Dec 05:40
collapse
Exactly. We know corporations regularly use marketing and doublespeak to avoid the fact that they operate for their interests and their interests alone. Again, the interests of corporations are not altruistic, regardless of the imahe they may want to support.
Why should we trust them to “innovate” without independent audit?
circuitfarmer@lemmy.sdf.org
on 04 Dec 05:01
nextcollapse
You are suggesting that “end-to-end” is some kind of legally codified phrase. It just isn’t. If Google were to steal data from a system claiming to be end-to-end encrypted, no one would be surprised.
I think your point is: if that were the case, the messages wouldn’t have been end-to-end encrypted, by definition. Which is fine. I’m saying we shouldn’t trust a giant corporation making money off of selling personal data that it actually is end-to-end encrypted.
By the same token, don’t trust Microsoft when they say Windows is secure.
When you use the Google Messages app to send end-to-end encrypted messages, all chats, including their text and any files or media, are encrypted as the data travels between devices. Encryption converts data into scrambled text. The unreadable text can only be decoded with a secret key.
The secret key is a number that’s:
Created on your device and the device you message. It exists only on these two devices.
Not shared with Google, anyone else, or other devices.
Generated again for each message.
Deleted from the sender’s device when the encrypted message is created, and deleted from the receiver’s device when the message is decrypted.
Neither Google or other third parties can read end-to-end encrypted messages because they don’t have the key.
Not that I can find. Can you post Signals most recent independent audit?
Many of these orgs don’t post public audits like this. Its not common, even for the open source players like Signal.
What we do have is a megacorp stating its technical implementation extremely explicitly for a well defined security protocol, for a service meant to directly compete with iMessage. If they are violating that, it opens them up to huge legal liability and reputational harm. Neither of these is worth data mining this specific service.
circuitfarmer@lemmy.sdf.org
on 04 Dec 05:45
nextcollapse
I’m not suggesting that Signal is any better. I’m supporting absolute distrust until such information is available.
I do consider Signal to be a more trustworthy org than Google clearly, but find this quibbling about them “maybe putting a super secret backdoor in the e2ee they use to compete with iMessage” to be pretty clear FUD.
sugar_in_your_tea@sh.itjust.works
on 04 Dec 16:28
collapse
Even if we assume they don’t have a backdoor (which is probably accurate), they can still exfiltrate any data they want through Google Play services after it’s decrypted.
They’re an ad company, so they have a vested interest in doing that. So I don’t trust them. If they make it FOSS and not rely on Google Play services, I might trust them, but I’d probably use a fork instead.
ITGuyLevi@programming.dev
on 05 Dec 16:22
collapse
End to end doesn’t say anything about where keys are stored, it can be end to end encrypted and someone else have access to the keys.
circuitfarmer@lemmy.sdf.org
on 04 Dec 05:01
collapse
This. Distrust in corporations is healthy regardless of what they claim.
Dont trust. Verify. Definitely dont touch it if its closed source
circuitfarmer@lemmy.sdf.org
on 04 Dec 04:57
nextcollapse
You may be right for that particular instance, but I’d still argue caution is safer.
sem@lemmy.blahaj.zone
on 04 Dec 05:15
nextcollapse
It could be end to end encrypted and safe on the network, but if Google is in charge of the device, what’s to say they’re not reading the message after it’s unencrypted? To be fair this would compromise signal or any other app on Android as well
That’s a different threat model that verges on “most astonishing corporate espinoage in human history and greatest threat to corporate personhood” possible for Google. It would require thousands if not tens of thousands of Google employees coordinating in utter secrecy to commit an unheard of crime that would be punishable by death in many circumstances.
If they have backdoored all android phones and are actively exploting them in nefarious ways not explained in their various TOS, then they are exposing themselves to ungodly amounts of legal and regulatory risks.
I expect no board of directors wants a trillion dollars of company worth to evaporate overnight, and would likely not be okay backdooring literally billions of phones from just a fiduciary standpoint.
circuitfarmer@lemmy.sdf.org
on 04 Dec 05:44
nextcollapse
It would require thousands if not tens of thousands of Google semployees coordinating in utter secrecy
This is usually used for things like the Moon Landing, where so many folks worked for NASA to make it entirely impossible that the landing was faked.
But it doesn’t really apply here. We know for example that NSA backdoors exist in Windows. Were those a concerted effort by MS employees? Does everyone working on the project have access to every part of the code?
It just isn’t how development works at this scale.
Ok but no one is arguing Windows is encrypted. Google is specifically stating, in a way that could get them sued for shitloads of money, that their messaging protocol is E2EE. They have explicitly described how it is E2EE. Google can be a bad company while still doing this thing within the bounds we all understand. For example, just because the chat can’t be backdoored doesn’t mean the device can’t be.
How do spyware services used by nation-state customers, like Pegasus, work?
They use backdoors in commonly used platforms on an industrial scale.
Maybe some of them are vulnerabilities due to honest mistakes, the problem is - the majority of vulnerabilities due to honest mistakes also carry denial of service risks in widespread usage. Which means they get found quickly enough.
So your stance is that Google is applying self designed malware to its own services to violate its own policies to harvest data that could bring intense legal, financial and reputational harm to it as an org it was ever discovered?
You think a nearly trillion dollar public company has an internal division that writes malware against flaws in its own software in order to harvest data from its own apps. It does this to gain just a bit more data about people it already has a lot of data on, because why not purposely leave active zero days in your own software, right?
That is wildly conspiratorial thinking, and honestly plain FUD. It undermines serious, actual privacy issues the company has when you make up wild cabals that are running double secret malware attacks against themselves inside Google.
You think a nearly trillion dollar public company has an internal division that writes malware against flaws in its own software in order to harvest data from its own apps. It does this to gain just a bit more data about people it already has a lot of data on, because why not purposely leave active zero days in your own software, right?
You think you are being the smart one here?
No, that’s not what I said. Also cypherpunks and other hobbyists are not that much smarter than corporations and nation-states, to be the only ones to think about plausible deniability.
For example, the whole Windows sources have been given officially for various 3-letter agencies of various countries (Russia included) to study, and of course there are vulnerabilities with the size of such codebase. MS might not have left obvious backdoors and informed FSB of them, but it has given interested parties the ability to find those themselves, which is only a question of work, or maybe make tampered versions of DLLs and what not easier.
Also they are legally obligated to silently comply with a lot of things.
That is wildly conspiratorial thinking, and honestly plain FUD.
WhatsApp and Facebook (before it bought WhatsApp) have both done this, Telegram has done this, MS has done this, even Apple has done this.
when you make up wild cabals that are running double secret malware attacks against themselves inside Google.
You made that up, not me. Should have tried to read what you are being told first.
zergtoshi@lemmy.world
on 04 Dec 07:31
nextcollapse
Signal doesn’t harvest, use, sell meta data, Google may do that.
E2E encryption doesn’t protect from that.
Signal is orders of magnitude more trustworthy than Google in that regard.
There’s also Session, a fork of Signal which claims that their decentralised protocol makes it impossible/very difficult for them to harvest metadata, even if they wanted to.Tho I personally can’t vouch for how accurate their claims are.
Agreed. That still doesnt mean google is not doing E2EE for its RCS service.
Im not arguing Google is trustworthy or better than Signal. I’m arguing that E2EE has a specific meaning that most people in this thread do not appear to understand.
Sure!
I was merely trying to raise awareness for the need to bring privacy protection to a level beyond E2EE, although E2EE is a very important and useful step.
That’s literally what zoom said early in the pandemic.
Then all the business in the world gave them truck loads of money, the industry called them out on it, and they hired teams of cryptographers to build an actual e2ee system
End to end could still - especially with a company like Google - include data collection on the device. They could even “end to end” encrypt sending it to Google in the side channel. If you want to be generous, they would perform the aggregation in-device and don’t track the content verbatim, but the point stands: e2e is no guarantee of privacy. You have to also trust that the app itself isn’t recording metrics, and I absolutely do not trust Google to not do this.
They make so of their big money from profiling and ads. No way they’re not going to collect analytics. Heck, if you use the stock keyboard, that’s collecting analytics about the texts you’re typing into Signal, much less Google’s RCS.
MonkderVierte@lemmy.ml
on 04 Dec 11:41
nextcollapse
End to end matters, who has the key; you or the provider. And Google could still read your messages before they are encrypted.
You have the key, not the provider. They are explicit about this in the implementation.
They can only read the messages before encryption if they are backdooring all android phones in an act of global sabotage. Pretty high consequences for soke low stakes data.
MonkderVierte@lemmy.ml
on 04 Dec 22:53
nextcollapse
I mean, Google does, with Play Services.
ITGuyLevi@programming.dev
on 05 Dec 18:57
collapse
I’m pretty sure the key is stored on the device, which is backed up to Google. I cannot say for sure if they do or don’t backup your keyring, but I feel better not using it.
sugar_in_your_tea@sh.itjust.works
on 04 Dec 16:24
collapse
Yup, they can read anything you can, and send whatever part they want through Google Play services. I don’t trust them, so I don’t use Messenger or Play services on my GrapheneOS device.
CatLikeLemming@lemmy.blahaj.zone
on 04 Dec 13:47
nextcollapse
Note that it doesn’t mean metadata is encrypted. They may not know what you sent, but they may very well know you message your mum twice a day and who your close friends are that you message often, that kinda stuff. There’s a good bit you can do with metadata about messages combined with the data they gather through other services.
jagged_circle@feddit.nl
on 04 Dec 13:52
nextcollapse
They do encrypt it and they likely dont send the messages unencrypted.
Likely what’s happening is they’re extracting keywords to determine what you’re talking about (namely what products you might buy) on the device itself, and then uploading those categories (again, encrypted) up to their servers for storing and selling.
This doesn’t invalidate their claim of e2ee and still lets them profit off of your data. If you want to avoid this, only install apps with open source clients.
2pt_perversion@lemmy.world
on 04 Dec 03:37
nextcollapse
Hear me out, maybe we should update pots and sms to have optional end-to-end encryption for modern implementations as well…Optional as backwards compatible and clearly shown as unencrypted when used that way to be clear.
micballin@lemmy.world
on 04 Dec 03:59
nextcollapse
Att won’t make money off that unless they offer it as a paid service. No reason to give that away for free and the other cell carriers can just pay off (bribe with campaign contributions) legislators to understand encryption is “too costly to implement at such a scale”
sugar_in_your_tea@sh.itjust.works
on 05 Dec 00:09
collapse
You mean RCS?
I’ll raise you one better: use Signal (or simplex.chat if you’re cool). Google and Apple control RCS, and carriers can still sniff metadata. Cut both groups out with a proper messenger.
I laughed so much at that. Encryption is literally just long complicated numbers combined with other long complicated numbers using mathematical formulae. You can’t ban maths.
If I remember correctly, there’s also a law in Australia where they can force tech companies to introduce backdoors in their systems and encryption algorithms, and the company must not tell anyone about it. AFAIK they haven’t tried to actually use that power yet, but it made the (already relatively stagnant) tech market in Australia even worse. Working in tech is the main reason I left Australia for the USA - there’s just so many more opportunities and significantly higher paying jobs for software developers in Silicon Valley.
cupcakezealot@lemmy.blahaj.zone
on 04 Dec 14:06
nextcollapse
You can’t ban maths.
tell me about it; it tried that against my teacher in middle school
rottingleaf@lemmy.world
on 04 Dec 15:06
nextcollapse
I laughed so much at that. Encryption is literally just long complicated numbers combined with other long complicated numbers using mathematical formulae. You can’t ban maths.
Now laugh at banning chemistry and physics (guns and explosives and narcotics). Take a laugh at banning murder too - how do you ban every action leading to someone’s death?
and the company must not tell anyone about it
Any “must not tell” law is crap. Unless you signed some NDA knowing full well what it is about.
Any kind of “national secret disclosure” punishment when you didn’t sign anything to get that national secret is the same.
It’s an order given to a free person, not a voluntarily taken obligation.
That said, you can’t fight force with words.
sugar_in_your_tea@sh.itjust.works
on 04 Dec 16:19
collapse
You can try, and in the US, we have export restrictions on cryptography (ITAR restrictions), so certain products cannot be exported. But you can print out the algorithm and carry it on a plane though, so I’m not sure what the point is…
Different parts of the government. Both existed then and now. There has for a long time been a substantial portion of the government, especially defense and intelligence, that rely on encrypted comms and storage.
I have never understood why electronic communications are not protected as physical mail
Astronauticaldb@lemmy.world
on 04 Dec 14:20
nextcollapse
Lobbying as well as developmental issues I would assume. I’m no real developer just yet but I’d imagine creating robust security protocols is time-consuming and thinking of every possible vulnerability is not entirely worth it.
sugar_in_your_tea@sh.itjust.works
on 04 Dec 16:17
collapse
No, security is pretty easy and has been for decades. PGP has been a thing since 1991, and other encryption schemes were a thing long before. ProtonMail uses PGP and SMTP, the latter of which predates PGP by about a decade (though modern SMPT with extensions wasn’t a thing until 1995).
So at least for email, there’s little technical reason why we couldn’t all use top of the line security. It’s slightly more annoying because you need to trade keys, but email services could totally make it pretty easy (e.g. send the PGP key with the first email, and the email service sends it with an encrypted reply and stores them for later use).
The reason we don’t is because servers wouldn’t be able to read our email. The legitimate use case here is searching (Tuta solves this by searching on the client, ProtonMail stores unencrypted subject lines), and 20 years ago, that would’ve been a hardship with people moving to web services. Today, phones can store emails, so it’s not an issue anymore, so it probably comes down to being able to sell your data.
Many to many encryption is more complicated (e.g. Lemmy or Discord), so I understand why chat took a while to be end to end encrypted (Matrix can do this, for example), but there are plenty of FOSS examples today, and pretty much every device has encryption acceleration in the CPU, so there’s no technical reason why it’s impractical today.
The reason it’s not uniquitous today is because data is really valuable, both to police and advertisers.
JackbyDev@programming.dev
on 04 Dec 15:03
nextcollapse
Because physical mail can be easily opened with a warrant. Encryption can be nigh impossible to break. The idea of a vault that cannot be opened no matter how hard you try is something that scares law makers.
Because the USA has been a broken fascist husk ever since the red scare and has been in slow decline ever since.
sugar_in_your_tea@sh.itjust.works
on 04 Dec 16:05
collapse
More like 23 years ago when the Patriot Act was signed, and every time it has been re-authorized/renamed since. Every President since Bush Jr. is complicit, and I’m getting most of them in the previous 70-ish years (or more) wish they could’ve had that bill as well.
KingThrillgore@lemmy.ml
on 04 Dec 13:58
nextcollapse
On January 20th: The cyberattack is coming from inside the house!
Dumbfuck and his cronies now have access to PRISM and ECHELON. Again.
cupcakezealot@lemmy.blahaj.zone
on 04 Dec 14:05
nextcollapse
until the republicans ban them so they can find queer kids and pregnant people getting healthcare and people reading books
surph_ninja@lemmy.world
on 04 Dec 14:12
nextcollapse
All that happens under Dems, too. Stop giving them a pass.
Y’all keep hitting that downvote button. I’d like to know how many of you are ok with fascism when it’s a Dem at the helm.
Eezyville@sh.itjust.works
on 04 Dec 14:59
nextcollapse
The Snowden leaks came out when Obama was president. Obama was the one who said, “The only people who don’t want to disclose the truth are people with something to hide”. The republicans and democrats are the same fucking people.
Only if you look at it in the most general, limited, pov. Are they the same people on corporate greed? Not all, but mostly yes. Are they the same people on encryption? Yes. Are they the same on human rights? Absolutely fucking not. If the only thing important for you is encryption, voting isn’t going to change the government’s policy decisions. However, if things other than encryption and corporate greed are important, then voting for a Republican is voting against your interests. History is filled with people who can’t see past their own fucking biases and look out for the greater interest… So you have a lot of historical company.
Eezyville@sh.itjust.works
on 04 Dec 16:03
nextcollapse
Dude we’re talking about encryption here. Stay on fuckin topic.
I’m just responding to your comment. If you were only talking about encryption, then maybe word your comment more clearly… Especially if you want to cast aspersions towards other about staying on topic.
Eezyville@sh.itjust.works
on 04 Dec 16:29
collapse
The post is about encrypted apps and cyberattacks not human rights violation. By default the topic of conversation is the post.
stringere@sh.itjust.works
on 04 Dec 17:47
collapse
Isn’t a valid use for encrypted apps to protect from human rights violations?
UnderpantsWeevil@lemmy.world
on 04 Dec 20:09
collapse
The republicans and democrats are the same fucking people.
In many cases, literally. From Michael Bloomberg and Liz Cheney to Donald Trump and Joe Manchin, the number of cross-overs and turn-coats who end up getting into leadership in their opponent’s parties is absolutely crazy. The Nixonian Southern Strategy did one thing brilliantly. It completely crossed the wires of the partisan voter for three generations to the benefit of the corporate oligarchs who get to play both ends against the middle.
Neither party is particularly pro-encryption, because governments in general see encryption by the public a hurdle for their operations (i.e. you don’t need encryption if you have nothing to hide).
Encryption isn’t a partisan issue, and my understanding is that both major parties suck about equally on this issue.
Guess where all that data ends up? The government can just pay retailers to get transaction data, so if the police wants to dig up dirt on you, it’s easier than ever.
That’s pretty messed up IMO, and I’m not happy with this trend given where privacy protections are at these days…
Yep. We need a very strict law to prevent the government from partnering with private companies to get around the fourth amendment. The third party doctrine has obliterated our privacy rights.
sugar_in_your_tea@sh.itjust.works
on 04 Dec 16:55
collapse
Agreed. If there’s anything we should collectively push for, it’s a constitutional recognition to a right to privacy. That’s what Roe v Wade was based on, and it was overturned because it wasn’t constitutionally defensible. The 4th amendment sadly isn’t sufficient, we need to take it a step further.
The Ninth Amendment, if actually followed, would put the burden on the government to prove that something was not a right, rather than just denying it because it wasn’t enumerated in the Constitution. The current Supreme Court has directly contradicted the Ninth by claiming that only enumerated rights are really rights. Except when they make up new ones like corporate personhood.
sugar_in_your_tea@sh.itjust.works
on 05 Dec 03:37
collapse
Yeah, I wish that was the case. But no, we apparently need to be explicit with the Supreme Court.
I’m aware yet I’ve been seeing so many so-called lefties going crazy for the DNC.
I think the desperation and need to defeat Trump has led to a lot of “blind acceptance” of Democrats
UnderpantsWeevil@lemmy.world
on 04 Dec 20:07
collapse
You know that leftists dislike Democrats, right?
They’re classic Frienamies. Every two years, they hold their noses while screaming “I hate this! I hate this! I hate you all!” and pull the lever for the party. Then the party either wins, thanks to all the Michael Bloombergs and Liz Cheneys who guided the party successfully to the right. Or the party loses, thanks to all the civil rights activists and environmentalists and train lovers who made Whitey McDickweasel look like a Communist.
Leftists are the Dems’ most loyal voters and their most bitter enemies.
surph_ninja@lemmy.world
on 04 Dec 18:33
nextcollapse
It’s just treated like team sports for so many people. It doesn’t matter what the team does, it’s offensive to them to criticize it at all.
UnderpantsWeevil@lemmy.world
on 04 Dec 20:04
collapse
Leftists need to stop defending the Democratic party
The joke of it is you’re either with the Democratic Party or you’re a hyper-authoritarian anti-democratic Russia/China loving Tankie. You will eat your police state and you will like it, because otherwise the Bigger Fascists will win.
Of course. Because they pretend they will stop the Republicans, and then they fund and vote for the Republican plans.
Democrats are a right-wing party intended to absorb and dispel leftist energy in order to prevent change and reform. They’re protecting Republicans by design. Absolutely blame them for that.
daniskarma@lemmy.dbzer0.com
on 04 Dec 16:50
collapse
A good advice: start learning how to self host, specially a matrix instance.
UnderpantsWeevil@lemmy.world
on 04 Dec 20:02
collapse
How does that help me hook up on Grindr?
daniskarma@lemmy.dbzer0.com
on 04 Dec 20:35
nextcollapse
It let you send videos to someone over the grindr limit.
Please don’t ask how I know that grindr only let you send 10 short videos per day.
captainlezbian@lemmy.world
on 04 Dec 22:24
nextcollapse
There’s no fediverse replacement for Grindr yet? I’m honestly surprised.
There should at least be an OSS one though right? Like an OpenGrindr? Or a LibreGrindr?
universalfriend@lemmy.blahaj.zone
on 05 Dec 03:25
collapse
We were looking into federated+floss MatchGroup alternatives last week, and didn’t find much of anything.
Most compelling was that some people are using matrix spaces to facilitate dating/hookups, but I imagine those spaces have similar pitfalls to Discord “dating”.
Something akin to OkCupid back when it was owned by Humor Rainbow would be pretty popular, imo.
PagingDoctorLove@lemmy.world
on 04 Dec 14:30
nextcollapse
Question for more tech savvy people: should I be worried about wiping old data, and if so for which apps? Just messaging apps, or also email and social media? Or can I just use the encrypted apps moving forward?
JackbyDev@programming.dev
on 04 Dec 15:01
nextcollapse
Wiping old stuff won’t hurt, but they might not actually delete it.
PagingDoctorLove@lemmy.world
on 05 Dec 15:45
collapse
That’s definitely something I worry about, especially after the recent reddit clusterfuck.
WhyJiffie@sh.itjust.works
on 04 Dec 15:17
nextcollapse
just wanted to add that deleting an app will not result in deletion of your data stored in the cloud (e.g. your emails)
PagingDoctorLove@lemmy.world
on 05 Dec 15:51
collapse
That I do know. I’m not worried about emails, or really anything specific. My online activity is pretty tame, but that’s within the context of a country with a functioning democracy that treats women like free humans. Not a surveillance state that plans to criminalize reproductive healthcare and turn women into sex slaves. I guess the problem I’m having is I don’t know how much I need to change my online habits because I have no idea how bad things are going to get.
WhyJiffie@sh.itjust.works
on 07 Dec 01:53
collapse
that’s great to hear. in your case not wiping emails and social media is not that much of a danger, I would assume, but I would do it anyway, even if I was not a women, just for the sake of it not being used (theoretically) for ads and such anymore. but be sure you have backed up every email and post you will delete, and storing it securely
every single thing you send online is going to be there forever. “the cloud” is someone’s server and constitutes online. even end to end encryption isn’t necessarily going to save you.
for example iCloud backup is encrypted. but Apple in the past has kept a copy of your encryption key on your iCloud. why? because consumers who choose to encrypt and lose their passwords are gonna freak out when all their data is effectively gone forever.
so when FBI comes a’knocking to Apple with a subpoena… once they get access to that encryption key it doesn’t matter if you have the strongest encryption in the world
my advice
never ever ever write something online that you do not want everybody in the world seeing.
to put on my tin foil hat, i believe government probably has access to methods that break modern encryptions. in theory with quantum computers it shouldn’t be difficult
archomrade@midwest.social
on 04 Dec 15:47
nextcollapse
I’d imagine operating a quantum computer for blanket surveillance is cost-prohibitive, but yea, if you’ve given them reason to look at you just assume they have the means to break your encryption.
PagingDoctorLove@lemmy.world
on 05 Dec 15:57
collapse
I agree with you and I don’t put anything that I would consider questionable online, at least not these days. I’m just having a hard time figuring out what adjustments to make in addition to worrying about personal things I’ve already shared, like my gender and race. You know what I mean? I’m a married woman, and I have info in various places about our family planning choices, to give an example. That’s really starting to worry me, but how can I even begin to delete my data? It’s everywhere. Every doctor has their own patient portal, I have multiple email accounts, and I don’t even want to think about the dumb shit I might have posted when YouTube comment sections were new.
yeah i just try not to think about it. I’m glad I was in the myspace generation during my teenage years. so I was actually able to just delete my myspace later on as an adult
i feel worse for the kids growing up today. they don’t fully understand the implications of what they are posting online. anything and everything is being recorded forever. my generation got a chance to be a stupid kid and have it be forgotten. today’s kids don’t get that opportunity
the best you can do, though, is just stop posting potentially damaging things online. you can’t change what you already posted. and 999 times out of a thousand, it’s not gonna hurt you.
i understand the overwhelmed feeling though
PagingDoctorLove@lemmy.world
on 06 Dec 03:18
collapse
Thanks, I appreciate the commiserating, it does make me feel a little better.
sugar_in_your_tea@sh.itjust.works
on 04 Dec 16:02
collapse
That depends on the privacy protections where you live and the policies of each service:
most places in the US - they already have your data and aren’t obligated to delete it
outside the EU - probably the same as the US
the EU or select states (e.g. CA) - you have some protections and a legal obligation to honor delete requests
For the first two, I wouldn’t bother. I personally poisoned my data with Reddit before leaving, because I’ve heard of then reversing deletions. For the third, deleting may make sense.
But in general, I’d keep your other accounts open until you fully transition to the new one.
Below is information when considering a replacement service.
Anything where data is stored on a server you don’t directly control can be leaked or subpoenad from the org that owns that server. Any unencrypted communication can be intercepted, and any regular encryption (HTTPS) can be logged by that server (e.g. under court order without notifying the customer).
Check out your old reddit account. I poisoned my data, too, then deleted it, but they restored it completely like the bastards they are. I deleted my 2F too, so it’s there forever now.
sugar_in_your_tea@sh.itjust.works
on 04 Dec 16:42
collapse
Yup, I figured that would be the case. I “deleted” my account, so I can’t go verify, but I let it sit for a couple weeks and my poisoned posts were still there (even got a couple replies asking WTF is up w/ my comments).
So yeah, not sure if my data is still there or not, but at least I tried.
Thing is, if they have backups, even editing data doesn’t do anything. Or they could even just have it set up to only display the most recent version but still keep each edit on the db. Wouldn’t even be hard to implement. Hell, it wouldn’t even be that hard to implement a historical series of diffs so they don’t have to store the full comments for each edit if the edit is a small one.
Like if I wanted to run a service that made it easier to find interesting data, part of that would be to flag deletes and edits as “whatever was there before has a higher chance of being interesting”.
Once something is posted, IMO just assume that it can’t be unposted and trying to unpost it might work similarly to the Streisand effect.
Even here. Sure, the source is open and I’d bet looking at the delete and edit functions would make it look like everything is fine. But other federated servers don’t have to run the same code and can react to delete and edit directives from other servers however they want. The main difference between this platform and Reddit in regards to control over posted information is the fediverse can’t prevent entities from accessing the data for free (albeit with less user metadata like IP and email).
sugar_in_your_tea@sh.itjust.works
on 04 Dec 20:00
collapse
it wouldn’t even be that hard to implement a historical series of diffs
And external services provide this as well, like those services where you can find deleted comments (or the internet archive).
I just try to disassociate my identity as much as I can from sites like Reddit. I never used my email on Reddit, and I haven’t used mine here. I’m guessing an enterprising individual could triangulate who I am based on my posts (though I do post false information sometimes), but that’s a lot less likely than if I handed over that association (i.e. through Facebook or whatever).
Do what you can, but yeah, assume that everything you post on the internet exists forever.
SocialMediaRefugee@lemmy.world
on 04 Dec 15:59
nextcollapse
I use a one time pad with all of my contacts. I ask them to eat or burn each page when they are used up.
iknowitwheniseeit@lemmynsfw.com
on 04 Dec 19:12
nextcollapse
From RFC 2804:
The IETF believes that adding a requirement for wiretapping will make affected protocol designs considerably more complex. Experience has shown that complexity almost inevitably jeopardizes the security of communications even when it is not being tapped by any legal means; there are also obvious risks raised by having to protect the access to the wiretap. This is in conflict with the goal of freedom from security loopholes.
This was written in 2000 in response to US government requests to add backdoors to voice-over-IP (VoIP) standards.
It was recognized 25 years ago that having tapping capabilities is fundamentally insecure.
rottingleaf@lemmy.world
on 04 Dec 21:22
nextcollapse
It was always recognized.
Every time I go to the Interwebs and read what people have to say on security, it’s always the same high horse absolutism.
I’ve read Attwood’s book on Asperger’s syndrome a couple weeks ago. There such absolutism was mentioned as a natural trait of aspies, but one that, when applied to social power dynamics or any military logic, gets you assroped in jail.
People who want to spy on you or read all your communications understand too that general security suffers, but just not having that power is out of question for them, and also with the power they already have the security effect on them personally won’t be too big.
It’s a social problem of the concept of personal freedom being vilified in the Western world via association with organized crime, terrorism, anarchism, you get the idea.
It’s not hard to see that the pattern here is that these things are chosen because they challenge state’s authority and power, because, well, subsets of what’s called organized crime and terrorism that can be prevented by surveillance are not what people generally consider bad, and anarchism is not something bad in any form.
What’s more important, people called that do not need to challenge the state if the state is functional, as in - representative, not oppressive and not a tool for some groups to hurt other groups.
As we’ve seen in all the world history, what’s called organized crime and what’s called terrorism are necessary sometimes to resolve deadlocks in a society. It has never happened in history that a society could function by its formalized laws for long without breaking consistency of those. And it has never happened that an oppressed group\ideology\movement would be able to make its case in accordance with the laws made by its oppressor.
Why I’m typing all this - it’s not a technical problem. It’s a problem of bad people who should be afraid not being afraid and thus acting, and good people who should be afraid not being afraid and thus not acting.
sugar_in_your_tea@sh.itjust.works
on 04 Dec 23:57
collapse
You don’t need technical knowledge to see the problem.
If you live in an apartment and your landlord has a master key, then all an attacker needs to do is get that master key. In an apartment complex, maybe that’s okay because who’s going to break in to the landlord’s office? But on the internet, tons of people are trying to break in every day, and eventually someone will get the key.
Even for the landlord, I’d rather them have a copy of my key than a master key, because that way they’d need to steal my key specifically.
There’s been a lot of good research done lately on how to achieve trusted communication on untrusted platforms and over untrusted channels. Encryption is a big part of that.
And there are a number of scenarios where the ISP creates a hostile environment without having been compromised by an external actor. A malicious government, for example, or an ISP wanting to exploit customer communications for commercial reasons.
threaded - newest
What i read [and corrected] from the article :
“The hacking
campaign[group], nicknamed [ by Microsoft ] Salt Typhoonby Microsoft,[ this actual campaign of attacks ] is one of the largest intelligence compromises in U.S. history, and not yet fully remediated. Officials in a press call Tuesday [ 2024-12-3 ] refused to set a timetable for declaring the country’s telecommunications systems free of interlopers. Officials had previously told NBC News that China hacked AT&T, Verizon and Lumen Technologies to spy on customers.”
Thanks I thought from reading this maybe Salt Typhoon was the codename for the next version of windows.
No, that’s Salty AI
Sounds bad I guess, but the USA has been spying on us for a long time now. Is the bad part that it’s China?
Bets on this being directly related to back doors that US spy agencies demand be installed?
RTFA
So, bet won?
Wouldn’t surprise me. “We’re doing this to be helpful to you!” is actually moustached disney villain behavior.
^ similar to the prisoners with cats gimmick. “look how nice we’re being to our prisoners” is actually “stop yelling at your bunkmate or we’ll take away your cat”
When a whole nation’s communications are intercepted by another entity, yes, the bad part is that it’s another nation. Especially an adversarial one.
This is not about individuals’ personal privacy. It’s about things that happen at a much larger scale. For example, leverage for political influence, or leaking of sensitive info that sometimes finds its way into unsecured channels. Mass surveillance is powerful.
Yes. Wars happen. Even corrupt politicians are nicer when their control base is inside the country.
Like Signal?
Or alternatively, Molly
I read Molly is forked from Signal. Can I message Signal users from Molly, or do all parties need Molly?
From my experience parties are always better with Molly
Yes, like Signal!
Which does not only use end-to-end encryption for communication, but protects meta data as well:
Source: signal.org/blog/signal-is-expensive/
I haven’t verified that claim investigating the source code, but I’m positive others have.
No, BPs are a risk. Better to avoid apps that require phone numbers
Guess that confirms that E2EE is effective against these backdoors.
We’ve long had NSA slides that showed Tor and e2ee solutions as “disastrous” to their visibility.
.
Just stop using your electronic devices. Not like they don’t all have monitors built in already anyway. Every connected device could be sending screenshots home and we’d never know. I mean, I guess you could use something like Wireshark to monitor your home network, but something tells me nowadays there are ways around even that. I’m not a certified network tech or even a script kiddie, but I don’t trust my tech as far as my dog can throw it. I just try to secure through obfuscation as much as possible. Everyone thinks I have carbon monoxide poisoning, but it’s a small price to pay for peace of mind - even a small one.
.
I’m just saying that, unless you built the device you’re using, and you know what every component does, and you know what it’s doing when, and you know it wasn’t manufactured by a foreign state-owned manufacturer with a penchant for putting spy chips in their devices, then you can’t truly trust anything you do on it, encrypted or not. It doesn’t really matter, if the software is being encrypted by backdoored hardware.
.
Oh yeah for sure. Gang gang.
Do what the Germans did in ww1 when they knew their diplomatic code was broken but couldn’t change it. They put the important stuff in plain sight and treated it like junk mail and encoded the boring stuff.
That’s what I’m sayin. Or if nothing else just fill the airwaves with garbage.
You & others might be interested in this:
…cmu.edu/…/field-stripping-a-weapons-system-build…
and maybe this:
en.wikipedia.org/wiki/Intel_Management_Engine
Thank you!
Oh gee, forcing companies to leave backdoors for the government might compromise security, everyone. Who'd have thunk it? 🤦
They knew, they were putting backdoors when they needed them.
Now the new administration will take half of the blame in public opinion (that’s how this works) and also half of the profits, so they won’t investigate too strictly those who’ve done such things.
But also words don’t cost anything. They can afford to say the obvious after the deed has been done.
Hey you guys remember that big AT&T breach recently?
The US gov should provide us with their own encryption app to protect us and just have a backdoor only they can access so they can keep an eye on any baddies! #Igotnothingtohide #amiright #muricafuckyeah
Poe’s law?
Coles law
End-to-end encryption is indispensable. Our legislators (no matter where we live) need to be made to understand this next time they try to outlaw it.
“So it’s like a filter on the tubes?” - Our legislators
“you wouldn’t put a dump truck full of movies on a snowy road without chains on the tires would you?”
I’m a cryptographer in Florida, and now I’m more confused
Ew.
Think of it like this:
Hopefully you’re less wrong now Mr/Mrs legislator.
“I didn’t have my pills today. Can you explain that to my staffer? They’ll make a note of it.”
Everybodies aunt at thanksgiving:
“I should be fine. I only trust the facebook with my information. Oh, did I tell you? We have 33 more cousins we didn’t know about. I found out on 23andme.com. All of them want to borrow money.”
Interpretation - the NSA can now crack all common encryption methods, so let’s disadvantage our adversaries at no real cost to us.
I vaguely recall Bruce Schneier saying that there is good evidence that the NSA cannot crack certain encryption methods. At the time, RSA was on the list. Maybe common methods mean roll-your-own corporate encryption, but it’s my understanding that GNUpg and similar software are safe.
Well, GPG doesn’t have PFS, but its a good starting point to say hello and then upgrade to some better encrypted messaging app
It’s probably also good practice to assume that not all encrypted apps are created equal, too. Google’s RCS messaging, for example, says “end-to-end encrypted”, which sounds like it would be a direct and equal competitor to something like Signal. But Google regularly makes money off of your personal data. It does not behoove a company like Google to protect your data.
Start assuming every corporation is evil. At worst you lose some time getting educated on options.
End to end is end to end. Its either “the devices sign the messages with keys that never leave the the device so no 3rd party can ever compromise them” or it’s not.
Signal is a more trustworthy org, but google isn’t going to fuck around with this service to make money. They make their money off you by keeping you in the google ecosystem and data harvesting elsewhere.
Your honor, I would like to submit Exhibit A, Google Chrome “Enhanced Privacy”.
eff.org/…/how-turn-googles-privacy-sandbox-ad-tra…
Google will absolutely fuck with anything that makes them money.
Thats a different tech. End to end is cut and dry how it works. If you do anything to data mine it, it’s not end to end anymore.
Only the users involved in end to end can access the data in that chat. Everyone else sees encrypted data, i.e noise. If there are any backdoors or any methods to pull data out, you can’t bill it as end to end.
They can just claim archived or deleted messages don’t qualify for end to end encryption in their privacy policy or something equally vague. If they invent their own program they can invent the loophole on how the data is processed
Or the content is encrypted, but the metadata isn’t, so they can market to you based on who you talk to and what they buy, etc.
This part is likely, but not what we are talking about. Who you know and how you interact with them is separate from the fact that the content of the messages is not decryptable by anyone but the participants, by design. There is no “quasi” end to end. Its an either/or situation.
It doesn’t matter if the content is encrypted in transit if Google can access the content in the app after decryption. That doesn’t violate E2EE, and they could easily exfiltrate the data though Google Play Services, which is a hard requirement.
I don’t trust them until the app is FOSS, doesn’t rely on Google Play Services, and is independently verified to not send data or metadata to their servers. Until then, I won’t use it.
Provided they have an open API and don’t ban alternative clients, one can make something kinda similar to TOR in this system, taking from the service provider the identities and channels between them.
Meaning messages routed through a few hops over different users.
Sadly for all these services to have open APIs, there needs to be force applied. And you can’t force someone far stronger than you and with the state on their side.
The messages are signed by cryptographic keys on the users phones that never leave the device. They are not decryptable in any way by google or anyone else. Thats the very nature of E2EE.
They cant fuck with it, at all, by design. That’s the whole point. Even if they created “archived” messages to datamine, all they would have is the noise.
Exactly. We know corporations regularly use marketing and doublespeak to avoid the fact that they operate for their interests and their interests alone. Again, the interests of corporations are not altruistic, regardless of the imahe they may want to support.
Why should we trust them to “innovate” without independent audit?
You are suggesting that “end-to-end” is some kind of legally codified phrase. It just isn’t. If Google were to steal data from a system claiming to be end-to-end encrypted, no one would be surprised.
I think your point is: if that were the case, the messages wouldn’t have been end-to-end encrypted, by definition. Which is fine. I’m saying we shouldn’t trust a giant corporation making money off of selling personal data that it actually is end-to-end encrypted.
By the same token, don’t trust Microsoft when they say Windows is secure.
Its a specific, technical phrase that means one thing only, and yes, googles RCS meets that standard:
support.google.com/messages/answer/10262381?hl=en
They have more technical information here if you want to deep dive about the literal implementation.
You shouldn’t trust any corporation, but needless FUD detracts from their actual issues.
You are missing my point.
I don’t deny the definition of E2EE. What I question is whether or not RCS does in fact meet the standard.
You provided a link from Google itself as verification. That is… not useful.
Has there been an independent audit on RCS? Why or why not?
Not that I can find. Can you post Signals most recent independent audit?
Many of these orgs don’t post public audits like this. Its not common, even for the open source players like Signal.
What we do have is a megacorp stating its technical implementation extremely explicitly for a well defined security protocol, for a service meant to directly compete with iMessage. If they are violating that, it opens them up to huge legal liability and reputational harm. Neither of these is worth data mining this specific service.
I’m not suggesting that Signal is any better. I’m supporting absolute distrust until such information is available.
Here’s all their independent audits:
community.signalusers.org/t/…/13243
Thank you. I had trouble running down a list.
I do consider Signal to be a more trustworthy org than Google clearly, but find this quibbling about them “maybe putting a super secret backdoor in the e2ee they use to compete with iMessage” to be pretty clear FUD.
Even if we assume they don’t have a backdoor (which is probably accurate), they can still exfiltrate any data they want through Google Play services after it’s decrypted.
They’re an ad company, so they have a vested interest in doing that. So I don’t trust them. If they make it FOSS and not rely on Google Play services, I might trust them, but I’d probably use a fork instead.
End to end doesn’t say anything about where keys are stored, it can be end to end encrypted and someone else have access to the keys.
This. Distrust in corporations is healthy regardless of what they claim.
Dont trust. Verify. Definitely dont touch it if its closed source
You may be right for that particular instance, but I’d still argue caution is safer.
It could be end to end encrypted and safe on the network, but if Google is in charge of the device, what’s to say they’re not reading the message after it’s unencrypted? To be fair this would compromise signal or any other app on Android as well
That’s a different threat model that verges on “most astonishing corporate espinoage in human history and greatest threat to corporate personhood” possible for Google. It would require thousands if not tens of thousands of Google employees coordinating in utter secrecy to commit an unheard of crime that would be punishable by death in many circumstances.
If they have backdoored all android phones and are actively exploting them in nefarious ways not explained in their various TOS, then they are exposing themselves to ungodly amounts of legal and regulatory risks.
I expect no board of directors wants a trillion dollars of company worth to evaporate overnight, and would likely not be okay backdooring literally billions of phones from just a fiduciary standpoint.
This is usually used for things like the Moon Landing, where so many folks worked for NASA to make it entirely impossible that the landing was faked.
But it doesn’t really apply here. We know for example that NSA backdoors exist in Windows. Were those a concerted effort by MS employees? Does everyone working on the project have access to every part of the code?
It just isn’t how development works at this scale.
Ok but no one is arguing Windows is encrypted. Google is specifically stating, in a way that could get them sued for shitloads of money, that their messaging protocol is E2EE. They have explicitly described how it is E2EE. Google can be a bad company while still doing this thing within the bounds we all understand. For example, just because the chat can’t be backdoored doesn’t mean the device can’t be.
Telegram has its supposedly E2EE protocol which isn’t used by most of Telegram users, but also there have been a few questionable traits found in it.
Google is trusted a bit more than Pavel Durov, but it can well do a similar thing.
And yes, Android is a much larger heap of hay where they can hide a needle.
I think it’s also confirmed by radio transmissions from the Moon received in real time right then by USSR and other countries.
How do spyware services used by nation-state customers, like Pegasus, work?
They use backdoors in commonly used platforms on an industrial scale.
Maybe some of them are vulnerabilities due to honest mistakes, the problem is - the majority of vulnerabilities due to honest mistakes also carry denial of service risks in widespread usage. Which means they get found quickly enough.
So your stance is that Google is applying self designed malware to its own services to violate its own policies to harvest data that could bring intense legal, financial and reputational harm to it as an org it was ever discovered?
Seems far fetched.
Legal and financial - doubt it. Reputational - counter-propaganda is a thing.
I think your worldview lags behind our current reality. I mean, even in 30-years old reality it would seem a bit naive.
Also you’ve ignored me mentioning things like Pegasus, from our current, not hypothetical, reality.
So yes.
You think a nearly trillion dollar public company has an internal division that writes malware against flaws in its own software in order to harvest data from its own apps. It does this to gain just a bit more data about people it already has a lot of data on, because why not purposely leave active zero days in your own software, right?
That is wildly conspiratorial thinking, and honestly plain FUD. It undermines serious, actual privacy issues the company has when you make up wild cabals that are running double secret malware attacks against themselves inside Google.
You think you are being the smart one here?
No, that’s not what I said. Also cypherpunks and other hobbyists are not that much smarter than corporations and nation-states, to be the only ones to think about plausible deniability.
For example, the whole Windows sources have been given officially for various 3-letter agencies of various countries (Russia included) to study, and of course there are vulnerabilities with the size of such codebase. MS might not have left obvious backdoors and informed FSB of them, but it has given interested parties the ability to find those themselves, which is only a question of work, or maybe make tampered versions of DLLs and what not easier.
Also they are legally obligated to silently comply with a lot of things.
WhatsApp and Facebook (before it bought WhatsApp) have both done this, Telegram has done this, MS has done this, even Apple has done this.
You made that up, not me. Should have tried to read what you are being told first.
Signal doesn’t harvest, use, sell meta data, Google may do that.
E2E encryption doesn’t protect from that.
Signal is orders of magnitude more trustworthy than Google in that regard.
There’s also Session, a fork of Signal which claims that their decentralised protocol makes it impossible/very difficult for them to harvest metadata, even if they wanted to.Tho I personally can’t vouch for how accurate their claims are.
Agreed. That still doesnt mean google is not doing E2EE for its RCS service.
Im not arguing Google is trustworthy or better than Signal. I’m arguing that E2EE has a specific meaning that most people in this thread do not appear to understand.
Sure!
I was merely trying to raise awareness for the need to bring privacy protection to a level beyond E2EE, although E2EE is a very important and useful step.
Of course our app is end-to-end encrypted! The ends being your device and our server, that is.
It’s end to end to end encrypted!
That’s literally what zoom said early in the pandemic.
Then all the business in the world gave them truck loads of money, the industry called them out on it, and they hired teams of cryptographers to build an actual e2ee system
End to end could still - especially with a company like Google - include data collection on the device. They could even “end to end” encrypt sending it to Google in the side channel. If you want to be generous, they would perform the aggregation in-device and don’t track the content verbatim, but the point stands: e2e is no guarantee of privacy. You have to also trust that the app itself isn’t recording metrics, and I absolutely do not trust Google to not do this.
They make so of their big money from profiling and ads. No way they’re not going to collect analytics. Heck, if you use the stock keyboard, that’s collecting analytics about the texts you’re typing into Signal, much less Google’s RCS.
End to end matters, who has the key; you or the provider. And Google could still read your messages before they are encrypted.
You have the key, not the provider. They are explicit about this in the implementation.
They can only read the messages before encryption if they are backdooring all android phones in an act of global sabotage. Pretty high consequences for soke low stakes data.
I mean, Google does, with Play Services.
I’m pretty sure the key is stored on the device, which is backed up to Google. I cannot say for sure if they do or don’t backup your keyring, but I feel better not using it.
Yup, they can read anything you can, and send whatever part they want through Google Play services. I don’t trust them, so I don’t use Messenger or Play services on my GrapheneOS device.
Note that it doesn’t mean metadata is encrypted. They may not know what you sent, but they may very well know you message your mum twice a day and who your close friends are that you message often, that kinda stuff. There’s a good bit you can do with metadata about messages combined with the data they gather through other services.
They do encrypt it and they likely dont send the messages unencrypted.
Likely what’s happening is they’re extracting keywords to determine what you’re talking about (namely what products you might buy) on the device itself, and then uploading those categories (again, encrypted) up to their servers for storing and selling.
This doesn’t invalidate their claim of e2ee and still lets them profit off of your data. If you want to avoid this, only install apps with open source clients.
E2EE means a 3rd party cant extract anything in the messages at all, by definition.
If they are doing the above, it’s not E2EE, and they are liable for massive legal damages.
Thats not what it means. It means that a third party cannot decrypt it on their servers.
Of course if the “third party” is actually decrypting it on your device, then they can read the messages. I dont know why this is not clear to you.
end to end is meaningless when the app scans your content and does whatever with it
For example, WhatsApp and their almost-mandatory “backup” feature.
Unless you’re Zoom and just blatantly lie lol
arstechnica.com/…/zoom-to-pay-85m-for-lying-about…
End-to-end encryption matters if your device isn’t actively trying to sabotage your privacy.
If you run Android, Google is guilty of that.
If you run Windows in a non-enterprise environment Microsoft is guilty of that.
If you run iOS or MacOS, Apple is (very likely) guilty of that.
Yup, so I run GrapheneOS without Google at services. It probably doesn’t spy on me, which is nice.
If its not Open Source and Audited yearly, its compromised. Your best option for secure comms is Signal and Matrix.
Well yeah, to use RCS on Android, you need to use Google’s Messenger app, so they can absolutely still get your data. Source from GrapheneOS.
I don’t use RCS because I refuse to use Google’s Messenger app. Simple as.
RCS is an industry standard, not a Google thing.
Hear me out, maybe we should update pots and sms to have optional end-to-end encryption for modern implementations as well…Optional as backwards compatible and clearly shown as unencrypted when used that way to be clear.
Att won’t make money off that unless they offer it as a paid service. No reason to give that away for free and the other cell carriers can just pay off (bribe with campaign contributions) legislators to understand encryption is “too costly to implement at such a scale”
You mean RCS?
I’ll raise you one better: use Signal (or simplex.chat if you’re cool). Google and Apple control RCS, and carriers can still sniff metadata. Cut both groups out with a proper messenger.
Real encrypted apps, …or just the ones their own government can use to spy on them?
The reporter mentioned signal, though the gov spokespeople didn’t seem to recommend any specific app
In the voice of Nelson Muntz: “Nobody spies on our citizens but us!”
Use something where the client is open source.
The US Govt 5 years ago: e2e encryption is for terrorists. The govt should have backdoors.
The US Govt now: Oh fuck, our back door got breached, everyone quick use e2e encryption asap!
The Australian government tried to straight up ban encryption some years ago.
I laughed so much at that. Encryption is literally just long complicated numbers combined with other long complicated numbers using mathematical formulae. You can’t ban maths.
If I remember correctly, there’s also a law in Australia where they can force tech companies to introduce backdoors in their systems and encryption algorithms, and the company must not tell anyone about it. AFAIK they haven’t tried to actually use that power yet, but it made the (already relatively stagnant) tech market in Australia even worse. Working in tech is the main reason I left Australia for the USA - there’s just so many more opportunities and significantly higher paying jobs for software developers in Silicon Valley.
tell me about it; it tried that against my teacher in middle school
en.wikipedia.org/wiki/Illegal_number
Now laugh at banning chemistry and physics (guns and explosives and narcotics). Take a laugh at banning murder too - how do you ban every action leading to someone’s death?
Any “must not tell” law is crap. Unless you signed some NDA knowing full well what it is about.
Any kind of “national secret disclosure” punishment when you didn’t sign anything to get that national secret is the same.
It’s an order given to a free person, not a voluntarily taken obligation.
That said, you can’t fight force with words.
You can try, and in the US, we have export restrictions on cryptography (ITAR restrictions), so certain products cannot be exported. But you can print out the algorithm and carry it on a plane though, so I’m not sure what the point is…
Different parts of the government. Both existed then and now. There has for a long time been a substantial portion of the government, especially defense and intelligence, that rely on encrypted comms and storage.
FBI has definitely always been anti-encryption
I have never understood why electronic communications are not protected as physical mail
Lobbying as well as developmental issues I would assume. I’m no real developer just yet but I’d imagine creating robust security protocols is time-consuming and thinking of every possible vulnerability is not entirely worth it.
No, security is pretty easy and has been for decades. PGP has been a thing since 1991, and other encryption schemes were a thing long before. ProtonMail uses PGP and SMTP, the latter of which predates PGP by about a decade (though modern SMPT with extensions wasn’t a thing until 1995).
So at least for email, there’s little technical reason why we couldn’t all use top of the line security. It’s slightly more annoying because you need to trade keys, but email services could totally make it pretty easy (e.g. send the PGP key with the first email, and the email service sends it with an encrypted reply and stores them for later use).
The reason we don’t is because servers wouldn’t be able to read our email. The legitimate use case here is searching (Tuta solves this by searching on the client, ProtonMail stores unencrypted subject lines), and 20 years ago, that would’ve been a hardship with people moving to web services. Today, phones can store emails, so it’s not an issue anymore, so it probably comes down to being able to sell your data.
Many to many encryption is more complicated (e.g. Lemmy or Discord), so I understand why chat took a while to be end to end encrypted (Matrix can do this, for example), but there are plenty of FOSS examples today, and pretty much every device has encryption acceleration in the CPU, so there’s no technical reason why it’s impractical today.
The reason it’s not uniquitous today is because data is really valuable, both to police and advertisers.
Because physical mail can be easily opened with a warrant. Encryption can be nigh impossible to break. The idea of a vault that cannot be opened no matter how hard you try is something that scares law makers.
Because the USA has been a broken fascist husk ever since the red scare and has been in slow decline ever since.
More like 23 years ago when the Patriot Act was signed, and every time it has been re-authorized/renamed since. Every President since Bush Jr. is complicit, and I’m getting most of them in the previous 70-ish years (or more) wish they could’ve had that bill as well.
On January 20th: The cyberattack is coming from inside the house!
Dumbfuck and his cronies now have access to PRISM and ECHELON. Again.
until the republicans ban them so they can find queer kids and pregnant people getting healthcare and people reading books
All that happens under Dems, too. Stop giving them a pass.
Y’all keep hitting that downvote button. I’d like to know how many of you are ok with fascism when it’s a Dem at the helm.
The Snowden leaks came out when Obama was president. Obama was the one who said, “The only people who don’t want to disclose the truth are people with something to hide”. The republicans and democrats are the same fucking people.
Only if you look at it in the most general, limited, pov. Are they the same people on corporate greed? Not all, but mostly yes. Are they the same people on encryption? Yes. Are they the same on human rights? Absolutely fucking not. If the only thing important for you is encryption, voting isn’t going to change the government’s policy decisions. However, if things other than encryption and corporate greed are important, then voting for a Republican is voting against your interests. History is filled with people who can’t see past their own fucking biases and look out for the greater interest… So you have a lot of historical company.
Dude we’re talking about encryption here. Stay on fuckin topic.
I’m just responding to your comment. If you were only talking about encryption, then maybe word your comment more clearly… Especially if you want to cast aspersions towards other about staying on topic.
The post is about encrypted apps and cyberattacks not human rights violation. By default the topic of conversation is the post.
Isn’t a valid use for encrypted apps to protect from human rights violations?
Taking a narrow myopic view leads to single issue voting, and that has caused ridiculous levels of damage to the public.
Technical problems and political problems can be related, and discussing one in the context of the other can be useful.
The outcome of the 2024 election, according to the liberal pundits, was that trans-rights and Palestinian liberties cost Harris the election.
Sounds more like the centrists’ line.
In many cases, literally. From Michael Bloomberg and Liz Cheney to Donald Trump and Joe Manchin, the number of cross-overs and turn-coats who end up getting into leadership in their opponent’s parties is absolutely crazy. The Nixonian Southern Strategy did one thing brilliantly. It completely crossed the wires of the partisan voter for three generations to the benefit of the corporate oligarchs who get to play both ends against the middle.
It goes on long before that. The Dixiecrats were as conservative as the Republicans, and more racist than some Republicans.
As if most of the legal provisions for widespread surveillance were not done under Clinton administration.
Yup. The Apple-FBI encryption dispute started under Obama, as did the Snowden leak.
Neither party is particularly pro-encryption, because governments in general see encryption by the public a hurdle for their operations (i.e. you don’t need encryption if you have nothing to hide).
Encryption isn’t a partisan issue, and my understanding is that both major parties suck about equally on this issue.
It’s a wonder they’re not also trying to outlaw printing presses at this point. They openly believe that we are not entitled to private conversations.
Printing press is okay. One-time-code books are tantamount to treason!
en.m.wikipedia.org/wiki/Solitaire_(cipher)
Or a deck of cards
It seems we’re moving that direction. Physical media in video games is becoming less and less common, more and more stores are digital only (and Google made a deal w/ Mastercard to get that data), and ebooks are likely to overtake physical books in the near-ish future.
Guess where all that data ends up? The government can just pay retailers to get transaction data, so if the police wants to dig up dirt on you, it’s easier than ever.
That’s pretty messed up IMO, and I’m not happy with this trend given where privacy protections are at these days…
Yep. We need a very strict law to prevent the government from partnering with private companies to get around the fourth amendment. The third party doctrine has obliterated our privacy rights.
Agreed. If there’s anything we should collectively push for, it’s a constitutional recognition to a right to privacy. That’s what Roe v Wade was based on, and it was overturned because it wasn’t constitutionally defensible. The 4th amendment sadly isn’t sufficient, we need to take it a step further.
The Ninth Amendment, if actually followed, would put the burden on the government to prove that something was not a right, rather than just denying it because it wasn’t enumerated in the Constitution. The current Supreme Court has directly contradicted the Ninth by claiming that only enumerated rights are really rights. Except when they make up new ones like corporate personhood.
Yeah, I wish that was the case. But no, we apparently need to be explicit with the Supreme Court.
Those downvoting need to learn about the PATRIOT act and FISA “courts”.
Those downvoting aren’t the type of people who enjoy challenging their worldview. They won’t look at shit.
Absolutely right. Their echo chamber is their safe space so don’t threaten it!
Dumb people are down voting you despite the fact that you’re 1000000% correct.
Leftists need to stop defending the Democratic party so hard, it’s making them look like neo liberals
Wait what? You know that leftists dislike Democrats, right?
Are you really not aware they are two different things?
I’m aware yet I’ve been seeing so many so-called lefties going crazy for the DNC.
I think the desperation and need to defeat Trump has led to a lot of “blind acceptance” of Democrats
They’re classic Frienamies. Every two years, they hold their noses while screaming “I hate this! I hate this! I hate you all!” and pull the lever for the party. Then the party either wins, thanks to all the Michael Bloombergs and Liz Cheneys who guided the party successfully to the right. Or the party loses, thanks to all the civil rights activists and environmentalists and train lovers who made Whitey McDickweasel look like a Communist.
Leftists are the Dems’ most loyal voters and their most bitter enemies.
It’s just treated like team sports for so many people. It doesn’t matter what the team does, it’s offensive to them to criticize it at all.
The joke of it is you’re either with the Democratic Party or you’re a hyper-authoritarian anti-democratic Russia/China loving Tankie. You will eat your police state and you will like it, because otherwise the Bigger Fascists will win.
Fucking what? Which democrats are banning books and putting together lists of trans children?
And no, I’m not a fan of the DNC, I’m just not a fucking dishonest piece of shit.
Which Dems are stopping it?
And there it is. Blame the Democrats for not stopping the Republicans from doing their misdeeds.
Of course. Because they pretend they will stop the Republicans, and then they fund and vote for the Republican plans.
Democrats are a right-wing party intended to absorb and dispel leftist energy in order to prevent change and reform. They’re protecting Republicans by design. Absolutely blame them for that.
A good advice: start learning how to self host, specially a matrix instance.
How does that help me hook up on Grindr?
It let you send videos to someone over the grindr limit.
Please don’t ask how I know that grindr only let you send 10 short videos per day.
I’m afraid you’re going to have to cruise irl
There’s no fediverse replacement for Grindr yet? I’m honestly surprised.
There should at least be an OSS one though right? Like an OpenGrindr? Or a LibreGrindr?
We were looking into federated+floss MatchGroup alternatives last week, and didn’t find much of anything.
Most compelling was that some people are using matrix spaces to facilitate dating/hookups, but I imagine those spaces have similar pitfalls to Discord “dating”.
Something akin to OkCupid back when it was owned by Humor Rainbow would be pretty popular, imo.
Question for more tech savvy people: should I be worried about wiping old data, and if so for which apps? Just messaging apps, or also email and social media? Or can I just use the encrypted apps moving forward?
Wiping old stuff won’t hurt, but they might not actually delete it.
That’s definitely something I worry about, especially after the recent reddit clusterfuck.
just wanted to add that deleting an app will not result in deletion of your data stored in the cloud (e.g. your emails)
That I do know. I’m not worried about emails, or really anything specific. My online activity is pretty tame, but that’s within the context of a country with a functioning democracy that treats women like free humans. Not a surveillance state that plans to criminalize reproductive healthcare and turn women into sex slaves. I guess the problem I’m having is I don’t know how much I need to change my online habits because I have no idea how bad things are going to get.
that’s great to hear. in your case not wiping emails and social media is not that much of a danger, I would assume, but I would do it anyway, even if I was not a women, just for the sake of it not being used (theoretically) for ads and such anymore. but be sure you have backed up every email and post you will delete, and storing it securely
the safest perspective to have is this -
every single thing you send online is going to be there forever. “the cloud” is someone’s server and constitutes online. even end to end encryption isn’t necessarily going to save you.
for example iCloud backup is encrypted. but Apple in the past has kept a copy of your encryption key on your iCloud. why? because consumers who choose to encrypt and lose their passwords are gonna freak out when all their data is effectively gone forever.
so when FBI comes a’knocking to Apple with a subpoena… once they get access to that encryption key it doesn’t matter if you have the strongest encryption in the world
my advice
never ever ever write something online that you do not want everybody in the world seeing.
to put on my tin foil hat, i believe government probably has access to methods that break modern encryptions. in theory with quantum computers it shouldn’t be difficult
I’d imagine operating a quantum computer for blanket surveillance is cost-prohibitive, but yea, if you’ve given them reason to look at you just assume they have the means to break your encryption.
I agree with you and I don’t put anything that I would consider questionable online, at least not these days. I’m just having a hard time figuring out what adjustments to make in addition to worrying about personal things I’ve already shared, like my gender and race. You know what I mean? I’m a married woman, and I have info in various places about our family planning choices, to give an example. That’s really starting to worry me, but how can I even begin to delete my data? It’s everywhere. Every doctor has their own patient portal, I have multiple email accounts, and I don’t even want to think about the dumb shit I might have posted when YouTube comment sections were new.
It’s all really overwhelming.
yeah i just try not to think about it. I’m glad I was in the myspace generation during my teenage years. so I was actually able to just delete my myspace later on as an adult
i feel worse for the kids growing up today. they don’t fully understand the implications of what they are posting online. anything and everything is being recorded forever. my generation got a chance to be a stupid kid and have it be forgotten. today’s kids don’t get that opportunity
the best you can do, though, is just stop posting potentially damaging things online. you can’t change what you already posted. and 999 times out of a thousand, it’s not gonna hurt you.
i understand the overwhelmed feeling though
Thanks, I appreciate the commiserating, it does make me feel a little better.
That depends on the privacy protections where you live and the policies of each service:
For the first two, I wouldn’t bother. I personally poisoned my data with Reddit before leaving, because I’ve heard of then reversing deletions. For the third, deleting may make sense.
But in general, I’d keep your other accounts open until you fully transition to the new one.
Below is information when considering a replacement service.
Anything where data is stored on a server you don’t directly control can be leaked or subpoenad from the org that owns that server. Any unencrypted communication can be intercepted, and any regular encryption (HTTPS) can be logged by that server (e.g. under court order without notifying the customer).
Even “secure” services can be ordered to keep logs. Here’s an example from Proton mai, and here’s one involving Tutanota.
So it depends on your threat model, or in other words, who you’re trying to keep away from your data. Just think about how screwed you might be if:
The answers to the above should help you decide which to type of service you’d feel comfortable with, and what tradeoffs you’re willing to make.
Check out your old reddit account. I poisoned my data, too, then deleted it, but they restored it completely like the bastards they are. I deleted my 2F too, so it’s there forever now.
Yup, I figured that would be the case. I “deleted” my account, so I can’t go verify, but I let it sit for a couple weeks and my poisoned posts were still there (even got a couple replies asking WTF is up w/ my comments).
So yeah, not sure if my data is still there or not, but at least I tried.
Thing is, if they have backups, even editing data doesn’t do anything. Or they could even just have it set up to only display the most recent version but still keep each edit on the db. Wouldn’t even be hard to implement. Hell, it wouldn’t even be that hard to implement a historical series of diffs so they don’t have to store the full comments for each edit if the edit is a small one.
Like if I wanted to run a service that made it easier to find interesting data, part of that would be to flag deletes and edits as “whatever was there before has a higher chance of being interesting”.
Once something is posted, IMO just assume that it can’t be unposted and trying to unpost it might work similarly to the Streisand effect.
Even here. Sure, the source is open and I’d bet looking at the delete and edit functions would make it look like everything is fine. But other federated servers don’t have to run the same code and can react to delete and edit directives from other servers however they want. The main difference between this platform and Reddit in regards to control over posted information is the fediverse can’t prevent entities from accessing the data for free (albeit with less user metadata like IP and email).
And external services provide this as well, like those services where you can find deleted comments (or the internet archive).
I just try to disassociate my identity as much as I can from sites like Reddit. I never used my email on Reddit, and I haven’t used mine here. I’m guessing an enterprising individual could triangulate who I am based on my posts (though I do post false information sometimes), but that’s a lot less likely than if I handed over that association (i.e. through Facebook or whatever).
Do what you can, but yeah, assume that everything you post on the internet exists forever.
I use a one time pad with all of my contacts. I ask them to eat or burn each page when they are used up.
I go one further and also use public/private key pairs that my acquaintances must use to decrypt the scrambled letters I mail them.
All my official communications are in a rotating cypher of Navajo, Hungarian, and Korean.
Good luck decrypting my smoke signal cypher!
The Semaphor Version of Wurthering Heights
Plains sign language described in Serbian phonetically from mandarin characters
I just send back and forth plain gibberish. Good luck breaking that!
I use some decoder ring I found in a cereal box, it’s totally secure.
B̷̡̡̢̧̺̩̝̤̜̪̰͖̻̗͇͓͙͍̦̹̹͚̠̲͔͕̫̤͎̳̱̦̜̖̤͙̎͌͑̂̿̋͐͂̉͜͜͜ͅe̸̺̠̰̋̐͑͒͗͑̑͂̿͑͘͠͝ ̴̡̨̢̨̨̡̯̺̤̝͇̠̯͚͇̰͈͙͍͕̖͕͖̜̹̰̗͙̈̍̄͂́͜ṣ̵̡̞̰͎̝͙͚̘̞̓̊̿̂̉͐͐̐̀̍̂́͋̏́̚͘͠͠ư̴̧̧̨̧̝͙̰̗͓͉͚͇̻͇̝͖̞͙̤͙̞͔̯͈̙̗̰̖̺̼͕͇̗̂̎̐̅͊̔͋̄̿̅̎̍͂̏͘̚ͅṛ̶͙͙͚͖̭̆̄̎̔̾͛̏̈̽͌̎͋̿̈̌̃̃͑̑̏̐̽̎̉́̊̿̆̌̕͜͝͠e̵̛̝̱͓̐̂͊̀̓̑̈́̒̓́̂̿̒̒̔͌̆͌̎͆̓͂̂̏͆̑͜͝͝ ̶̧̧̳̮̬̤̱̯͚̜̜͔̞̰̠̼̩̘͖̹͕̥͔̰͎͖̩̠͇̭̭̺̮̔͊͛̉͐͗͛͌̓̂͐̇̔̑̓̐̇̀̅̿̿̃͛̈́̔̏͛̓͂̏̕̚̕͜͠͠ͅͅͅͅţ̵͔͂̋͌̋͊͗̇ơ̷̘̱͙̝͖͍̪̗̮̫͉͖̪͉̯͙͛̋̾̑͛̇́̑̒̓͐̀̇̓͒̾͛͆̾͗̒̕̚͘͜͝ ̶̧̡̢̭̥͚̱̲̮͙̠̼͉͖̞̩̞̰̠͍̭̭͖͖̻̜͖͇̬͎̮͙̦͗͌̈̌̍̔̋̔̈́̈́̃̍̓͌͒̉̓͐̓̏̓̃̇̅́̐̃̂̚̕͜͝͝d̸̢̨̢̧̢͔͚̼̩̮͖̭̥̮͓̭͇͖̞̰̞̰̋̓̊̈́̈̐̄̆͊̈͑̓̉͝͠ͅŗ̵̲͓̠̮͉̹͍̰̟̘̄̈́̈́̂̀̆͗̔̓̔̐̀̍̓̄̾̋͋̆̈́̓͐͊͒͋͂̓̽͌̂̊͂̔͋̓͌͐̈́̓͠͝ĩ̴̛̛̝̹͓͚̦̱̰̫̌̋͌̏̒́̇̂̅̎̄͒̏̎̈͊͊̽͘̕͜͝͝͝͠n̴̨̡̡̛͚͖̼̖̦͔̬̩̝̞͔̥͖̫̮͎̻͔̪͍͖̣̻̯͉̝̜͓̐̏̾̋̂͛́̍̄̿̔͛̉̾̏̆̍͋͒̂́̽̆͐̋̈͆̊̈̈́̽̔̏̏̎̕̚͘̚͠k̴̡̭̙̼̻̟͔̏̂ ̵̨͓̺̲͇͔̪͇͓̥̰͈̲͊́̂́͋̊̀̾̌͋̉͑̍̿̆̊͐͆̏̑̑͛̾̀̀̏͆̽́͝͠ỵ̶̡̝̺̙͇̪̮͚̣̓̍̐̄̉̇̀͋̔̀̂͒̾̋͘ǫ̴͇̝̤͕̮̺̦̼̪̯̟̼̳͙̼̃̈́́͗̓̊͑́̾̈́͘̕͜͝͠ͅͅų̷̢̛̭̟̭̖̟͇̪̦̪̳̯̟̬͉̬͉͎̫͎̮̜̠͔̝̜̭̪̤͆̆͋̉̆̓̽̋̀̆̌͝r̵̨̡̳͈̝͈̖͈̻̺̮͖̻͓͓͇̩͖̬̣̪͙̗̥̯̍̍͂͂́̑ͅ ̷̢̧̢̧̛̛̖̹͉̳͚̞̟̻̮̟͙̥̥͓͙̻̩̙̈̓͆͌̈́͊́̈́̎̑͗̑̆̀̈́͆̏ͅƠ̴̛̛̱̰̬̲̼̹̬̰̮͓̜̐̔̈́̾̓͆̔͂̂͂̂̓̏̾͐͌͘̕͘͝͝͝v̴̛̤̝̹͙̩͌̾̾̒͋͐͂̍̽̈́͛̎̆̋̓̔̀́̍͑͌͌͂͆̈̚̚̚͘͜͝͝ͅå̶̡̢̹̻͙͗͒̌̓̑̋̂̉̿̌̋͋̆͋͋̈́̋̎̀͝͝ĺ̶̡̨̨̨̛̻͙̘̖͍̥̝̺͔͙̱̼͙̱̀͌̃̍́͊̉͑̐ͅt̶̡̛͎͕̥͉̙̰̫̲̺̩̘̜̖͔̝̜̤̮͙̳̻̮̠̦́̌͌̍̑̃̿̔͒͗̑̏̎̿̉̀̀͊̽̃̽͌͆̏͗͗̋̈́̔̉́̒͗̑̊͜͝ͅį̴̡̢̡̪̥͉̩̯͎̩̤̺̙̩̳̘͓̣̮̰͔̯̘̰̖̪̻͉̣̖̬̩͉̦̃̂̍͜ͅͅņ̵̡̢̧̢̯̠͍͖͔̬̜̥̗̜͈̮͖̗̺̳̱̣̟̦̗͉̮̥̏̿͒̏͆̔̀͐̉̀͗͋͐͌͒̀́̿́͗͂́̏̂͊̑̅͝͝͝͝ȩ̶̨̡̨̫͉̱͉̦̫͇̪̼̰̺̩̘̼̬̝̘̥͖͎̬̺̀̓͋̄̂̉͝͝
From RFC 2804:
datatracker.ietf.org/doc/rfc2804/
This was written in 2000 in response to US government requests to add backdoors to voice-over-IP (VoIP) standards.
It was recognized 25 years ago that having tapping capabilities is fundamentally insecure.
It was always recognized.
Every time I go to the Interwebs and read what people have to say on security, it’s always the same high horse absolutism.
I’ve read Attwood’s book on Asperger’s syndrome a couple weeks ago. There such absolutism was mentioned as a natural trait of aspies, but one that, when applied to social power dynamics or any military logic, gets you assroped in jail.
People who want to spy on you or read all your communications understand too that general security suffers, but just not having that power is out of question for them, and also with the power they already have the security effect on them personally won’t be too big.
It’s a social problem of the concept of personal freedom being vilified in the Western world via association with organized crime, terrorism, anarchism, you get the idea.
It’s not hard to see that the pattern here is that these things are chosen because they challenge state’s authority and power, because, well, subsets of what’s called organized crime and terrorism that can be prevented by surveillance are not what people generally consider bad, and anarchism is not something bad in any form.
What’s more important, people called that do not need to challenge the state if the state is functional, as in - representative, not oppressive and not a tool for some groups to hurt other groups.
As we’ve seen in all the world history, what’s called organized crime and what’s called terrorism are necessary sometimes to resolve deadlocks in a society. It has never happened in history that a society could function by its formalized laws for long without breaking consistency of those. And it has never happened that an oppressed group\ideology\movement would be able to make its case in accordance with the laws made by its oppressor.
Why I’m typing all this - it’s not a technical problem. It’s a problem of bad people who should be afraid not being afraid and thus acting, and good people who should be afraid not being afraid and thus not acting.
You don’t need technical knowledge to see the problem.
If you live in an apartment and your landlord has a master key, then all an attacker needs to do is get that master key. In an apartment complex, maybe that’s okay because who’s going to break in to the landlord’s office? But on the internet, tons of people are trying to break in every day, and eventually someone will get the key.
Even for the landlord, I’d rather them have a copy of my key than a master key, because that way they’d need to steal my key specifically.
And I had one experience where our landlords attempted to rob us.
There’s been a lot of good research done lately on how to achieve trusted communication on untrusted platforms and over untrusted channels. Encryption is a big part of that.
And there are a number of scenarios where the ISP creates a hostile environment without having been compromised by an external actor. A malicious government, for example, or an ISP wanting to exploit customer communications for commercial reasons.
The same people who want to get rid of encryption
I mean, clearly not the SAME people.