4 ms·
> Facebook, Microsoft, Twitter, and YouTube (Google/Alphabet, Inc) have formed the Global Internet Forum to Counter Terrorism and Amber Rudd is asking them to q
by sspiff 9y ago
> Facebook, Microsoft, Twitter, and YouTube (Google/Alphabet, Inc) have formed the Global Internet Forum to Counter Terrorism and Amber Rudd is asking them to quietly drop end-to-end encryption from their products. You should not believe a single word any of those companies tells you about end-to-end encryption or privacy on their platforms ever again.
and
> she reveals that she has created the Global Internet Forum to Counter Terrorism with Facebook, Microsoft, Twitter and YouTube (Google/Alphabet, Inc.) and asked them to remove end-to-end encryption from their products (remember that Facebook makes WhatsApp) without telling anyone.
This wording implies that these big tech companies would silently, without anyone noticing, drop or compromise their E2E encryption. Is this something they could do? I'd expect such a change to be noticeable in both the clients they distribute and the network traffic they generate by people in the infosec industry.
Can anyone with a deeper understanding of the matter chime in?
- lmm 9y ago> This wording implies that these big tech companies would silently, without anyone noticing, drop or compromise their E2E encryption. Is this something they could do? I'd expect such a change to be noticeable in both the clients they distribute and the network traffic they generate by people in the infosec industry. The apps are closed-source, and cryptographic libraries already generate keystreams that look like random data. All they'd have to do is replace the random nonces etc. with data generated deterministically from their own key and some suitable factors (device ID, time), similar to how stateless password managers work; that would be virtually undetectable.
- JohnStrange 9y agoYes, they could do that, and in order to detect it security professionals would need access to their servers and/or reverse engineer their binary software distributions where this is applicable. Whether they do it, I don't know, but I'd like to point out that Google used RC4 for SSL for a suspiciously long time after it was considered broken (all in the name of compatibility, of course). A change in public policy only occurred after the Snowden revelations. However, to make this clear, this is all speculation, they could do it but whether they do it I can't tell and no one else can without insider knowledge.
- FungalRaincloud 9y agoIt's plausible that they could just compromise the security, intentionally, without telling anyone (and without anyone being able to easily tell). I think what's more likely, at least in the case of WhatsApp, is that they would just not make an announcement when they remove E2E encryption entirely. The security community would certainly complain, and long-term, the traffic they are currently getting from parties of any interest would move somewhere else. But in the short term, it would compromise the security of a substantial number of their target users. It's plausible that, without a public announcement, many 'nefarious' users would continue to use it for a few months.
- rocqua 9y agoI'm more worried about a trigger-able mode of whatsapp that silently disables E2E encryption on a specific phone. The only way to figure this out is to catch the app in the act. It seems possible that WhatsApp could be persuaded by the government to implement such technology.
- rapsey 9y agoOr already has and is under a gag order.
- FungalRaincloud 9y agoSomething that does concern me about WhatsApp is that backups of messages (by default, it seems, put on Google Drive on Android) are not encrypted. I'm not really sure why. There's not a compelling reason that I can think of.