4 ms·
You don't understand. Encryption is necessary because on the internet, there is no distance. Any web service today must be built with the knowledge that everyon
by ripdog 7y ago
You don't understand. Encryption is necessary because on the internet, there is no distance. Any web service today must be built with the knowledge that everyone, everywhere is attacking it all the time. The only defense against that kind of attack is an encryption that nobody can break.
When a weakness is introduced into that defense, even if it's a secret key held only by trusted governments and only (they promise) to be used in emergencies, that key is a method of attack that anyone, anywhere can use against everyone. The only defense is that the secret key remain secret, and there are an endless number of ways it could be comprimised, ranging from human error, phishing, or plain old brute forcing. A single key for all Whatsapp conversations is a valuable enough prize for criminals all over the world to invest serious money in custom hardware to crack it.
Currently, encryption schemes like Whatsapp's rely on generation of new keys for every message, making the value of attacking any one message limited. Without this defense, Whatsapp will be cracked, sooner or later. And once someone publicly reveals that key, every single message sent before that point becomes compromised. Maybe even publicly exposed. Would you be okay with that? Exposing your private message history to the internet because governments wanted to snoop?
- mytailorisrich 7y agoI do understand. This is an issue with Whatsapp's architecture, not with my comment or governments' concerns.
- ripdog 7y agoNo, you don't. This is a fundamental rule of how encryption works. You can't design around it. If there is a key which decrypts everything, then there is a risk it can be stolen or guessed and used to decrypt anyone's messages. This risk does not exist in current, properly designed systems. Any government which wishes to add a backdoor to an E2E encrypted messaging system must understand that they will be HEAVILY undermining the security and privacy rights for all users of the service which has the backdoor.
- mytailorisrich 7y agoI think you are the one not understanding at this point. This has nothing to do with "how encryption works". Whatsapp decided to go for E2E encryption for commercial and marketing purposes following all those privacy scandals. They did not have to. They could have gone with P2P encryption, i.e. that their databases could have stored messages in cleartext. That way authorities would not have needed to ask for any backdoor. As already mentioned, this is how cellular operators work (that's obviously something governments wanted). I think we might see legislation brought in in the future in order to force this.
- ripdog 7y agoOh. I didn't realise you were arguing against encryption in its entirety. Okay. Let's just get rid of E2E entirely and let Facebook mine not only our metadata but also the content of our messages. Nice plan.
- mytailorisrich 7y agoI am not arguing against encryption in its entirety... > let Facebook mine not only our metadata... Don't use Facebook, then.