This is a most excellent place for technology news and articles.
The US Govt 5 years ago: e2e encryption is for terrorists. The govt should have backdoors.
The US Govt now: Oh fuck, our back door got breached, everyone quick use e2e encryption asap!
The Australian government tried to straight up ban encryption some years ago.
I laughed so much at that. Encryption is literally just long complicated numbers combined with other long complicated numbers using mathematical formulae. You can't ban maths.
If I remember correctly, there's also a law in Australia where they can force tech companies to introduce backdoors in their systems and encryption algorithms, and the company must not tell anyone about it. AFAIK they haven't tried to actually use that power yet, but it made the (already relatively stagnant) tech market in Australia even worse. Working in tech is the main reason I left Australia for the USA - there's just so many more opportunities and significantly higher paying jobs for software developers in Silicon Valley.
You can’t ban maths.
tell me about it; it tried that against my teacher in middle school
Different parts of the government. Both existed then and now. There has for a long time been a substantial portion of the government, especially defense and intelligence, that rely on encrypted comms and storage.
FBI has definitely always been anti-encryption
I have never understood why electronic communications are not protected as physical mail
More like 23 years ago when the Patriot Act was signed, and every time it has been re-authorized/renamed since. Every President since Bush Jr. is complicit, and I'm getting most of them in the previous 70-ish years (or more) wish they could've had that bill as well.
Oh gee, forcing companies to leave backdoors for the government might compromise security, everyone. Who'd have thunk it? 🤦
It's probably also good practice to assume that not all encrypted apps are created equal, too. Google's RCS messaging, for example, says "end-to-end encrypted", which sounds like it would be a direct and equal competitor to something like Signal. But Google regularly makes money off of your personal data. It does not behoove a company like Google to protect your data.
Start assuming every corporation is evil. At worst you lose some time getting educated on options.
End to end is end to end. Its either "the devices sign the messages with keys that never leave the the device so no 3rd party can ever compromise them" or it's not.
Signal is a more trustworthy org, but google isn't going to fuck around with this service to make money. They make their money off you by keeping you in the google ecosystem and data harvesting elsewhere.
google isn't going to fuck around with this service to make money
Your honor, I would like to submit Exhibit A, Google Chrome “Enhanced Privacy”.
Google will absolutely fuck with anything that makes them money.
This. Distrust in corporations is healthy regardless of what they claim.
Signal doesn't harvest, use, sell meta data, Google may do that.
E2E encryption doesn't protect from that.
Signal is orders of magnitude more trustworthy than Google in that regard.
It could be end to end encrypted and safe on the network, but if Google is in charge of the device, what's to say they're not reading the message after it's unencrypted? To be fair this would compromise signal or any other app on Android as well
Like Signal?
Yes, like Signal!
Which does not only use end-to-end encryption for communication, but protects meta data as well:
Signal also uses our metadata encryption technology to protect intimate information about who is communicating with whom—we don’t know who is sending you messages, and we don’t have access to your address book or profile information. We believe that the inability to monetize encrypted data is one of the reasons that strong end-to-end encryption technology has not been widely deployed across the commercial tech industry.
Source: https://signal.org/blog/signal-is-expensive/
I haven't verified that claim investigating the source code, but I'm positive others have.
until the republicans ban them so they can find queer kids and pregnant people getting healthcare and people reading books
A good advice: start learning how to self host, specially a matrix instance.
Everybodies aunt at thanksgiving:
"I should be fine. I only trust the facebook with my information. Oh, did I tell you? We have 33 more cousins we didn't know about. I found out on 23andme.com. All of them want to borrow money."
Real encrypted apps, ...or just the ones their own government can use to spy on them?
In the voice of Nelson Muntz: "Nobody spies on our citizens but us!"
Sounds bad I guess, but the USA has been spying on us for a long time now. Is the bad part that it's China?
Bets on this being directly related to back doors that US spy agencies demand be installed?
RTFA
The third has been systems that telecommunications companies use in compliance with the Commission on Accreditation for Law Enforcement Agencies (CALEA), which allows law enforcement and intelligence agencies with court orders to track individuals’ communications. CALEA systems can include classified court orders from the Foreign Intelligence Surveillance Court, which processes some U.S. intelligence court orders.
So, bet won?
When a whole nation's communications are intercepted by another entity, yes, the bad part is that it's another nation. Especially an adversarial one.
This is not about individuals' personal privacy. It's about things that happen at a much larger scale. For example, leverage for political influence, or leaking of sensitive info that sometimes finds its way into unsecured channels. Mass surveillance is powerful.
From RFC 2804:
- The IETF believes that adding a requirement for wiretapping will make affected protocol designs considerably more complex. Experience has shown that complexity almost inevitably jeopardizes the security of communications even when it is not being tapped by any legal means; there are also obvious risks raised by having to protect the access to the wiretap. This is in conflict with the goal of freedom from security loopholes.
https://datatracker.ietf.org/doc/rfc2804/
This was written in 2000 in response to US government requests to add backdoors to voice-over-IP (VoIP) standards.
It was recognized 25 years ago that having tapping capabilities is fundamentally insecure.
You don't need technical knowledge to see the problem.
If you live in an apartment and your landlord has a master key, then all an attacker needs to do is get that master key. In an apartment complex, maybe that's okay because who's going to break in to the landlord's office? But on the internet, tons of people are trying to break in every day, and eventually someone will get the key.
Even for the landlord, I'd rather them have a copy of my key than a master key, because that way they'd need to steal my key specifically.
End-to-end encryption is indispensable. Our legislators (no matter where we live) need to be made to understand this next time they try to outlaw it.
“So it’s like a filter on the tubes?” - Our legislators
"you wouldn't put a dump truck full of movies on a snowy road without chains on the tires would you?"
On January 20th: The cyberattack is coming from inside the house!
Dumbfuck and his cronies now have access to PRISM and ECHELON. Again.
I use a one time pad with all of my contacts. I ask them to eat or burn each page when they are used up.
I go one further and also use public/private key pairs that my acquaintances must use to decrypt the scrambled letters I mail them.
What i read [and corrected] from the article :
"The hacking ~~campaign~~ [group], nicknamed [ by Microsoft ] Salt Typhoon ~~by Microsoft~~,
[ this actual campaign of attacks ] is one of the largest intelligence compromises in U.S. history, and not yet fully remediated. Officials in a press call Tuesday [ 2024-12-3 ] refused to set a timetable for declaring the country’s telecommunications systems free of interlopers. Officials had previously told NBC News that China hacked AT&T, Verizon and Lumen Technologies to spy on customers."
Hear me out, maybe we should update pots and sms to have optional end-to-end encryption for modern implementations as well...Optional as backwards compatible and clearly shown as unencrypted when used that way to be clear.
Guess that confirms that E2EE is effective against these backdoors.
There's been a lot of good research done lately on how to achieve trusted communication on untrusted platforms and over untrusted channels. Encryption is a big part of that.
And there are a number of scenarios where the ISP creates a hostile environment without having been compromised by an external actor. A malicious government, for example, or an ISP wanting to exploit customer communications for commercial reasons.
