6 ms·

I work on cryptography at AWS, and long before that I worked on Skype a bit, so I can't resist commenting! Wickr features end to end cryptography, https://wick

I work on cryptography at AWS, and long before that I worked on Skype a bit, so I can't resist commenting! Wickr features end to end cryptography, https://wickr.com/wp-content/uploads/2019/12/WhitePaper_WickrMessagingProtocol.pdf https://wickr.com/wp-content/uploads/2019/12/WhitePaper_Wick..., and I can't see why we'd change that (and even that framing is a bit weird, I'm sure Wickr will continue to be autonomous but maybe with access to more resources from the rest of Amazon). Increasingly, end-to-end cryptography is what customers expect. We also use end-to-end cryptography in other Amazon systems, most recently including Ring doorbells - https://support.ring.com/hc/en-us/articles/360054941511-Understanding-Video-End-to-End-Encryption-E2EE- https://support.ring.com/hc/en-us/articles/360054941511-Unde...

rapsey 5y ago
As an american company, customers should absolutely be distrustful of any claims of security. There is very little in the way of the feds giving you a gag order and ordering you to provide a backdoor. Amazon has zero recourse in this situation, neither would they risk their gov contracts fighting it.
- strictnein 5y ago
  Yeah, they definitely just invested $xxx millions in a product that they know they won't be able to keep alive. Amazon has plenty of recourse, and they've been fighting gag orders for years now. Ex: https://arstechnica.com/tech-policy/2016/09/microsoft-amazon-google-apple-fox-news-us-gagging-orders/ https://arstechnica.com/tech-policy/2016/09/microsoft-amazon... The company leading that charge: Microsoft. The company that got the huge JEDI DoD cloud contract: Microsoft. Weird, huh?
  - rapsey 5y ago
    Nonesense. When they get a gag order they have zero choice and recourse. Their options are shutting down the company or comply. They can join a legal fight to stop this practice, they however must comply with every order they get.
    - dang 5y ago
      "When disagreeing, please reply to the argument instead of calling names. 'That is idiotic; 1 + 1 is 2, not 3' can be shortened to '1 + 1 is 2, not 3." https://news.ycombinator.com/newsguidelines.html https://news.ycombinator.com/newsguidelines.html
  - dang 5y ago
    "Don't be snarky." https://news.ycombinator.com/newsguidelines.html https://news.ycombinator.com/newsguidelines.html
INTPenis 5y ago
End 2 end cryptography, to what end does Ring need e2ee? To Amazon? Who is on the other end? Also, metadata.
- drenvuk 5y ago
  other enrolled devices. please check the provided links.
- rapsey 5y ago
  I have actually seen "secure" messengers claim e2e encryption because they use https to their servers. The ends are clients and their servers.
Bigpet 5y ago
> I'm sure Wickr will continue to be autonomous but maybe with access to more resources from the rest of Amazon To be fair, this is the fairy-tale that's told on every acquisition. I'm pretty certain this same narrative was spun even when facebook acquired occulus. Not saying this will be similar, but just hearing those words is not assuring by itself.
- bydo 5y ago
  Amazon's proven a much better steward than Facebook, though. Twitch seems pretty independent other than some Prime perks, Eero doesn't seem to have changed much, I'm pretty sure they forgot that they even bought IMDB and DPReview, etc.
  - askafriend 5y ago
    I didn't even realize they had bought DPReview...
realce 5y ago
That's an odd glossy advertisement... Everyone here knows what end-to-end encryption is. Regardless of any promise, professed dismay, warranty, or other statement by Amazon, this product is no longer a trustworthy interface for private communications. The mere presence of the company brings such high probability of capitulation to government or corporate eavesdroppers that it's basically a useless asset to own IMPO.
tiagod 5y ago
>Wickr features end to end cryptography You can make it weaker without getting rid of it. Whatsapp also has E2EE on the message contents, does it stop Facebook from sharing all your contacts, call metadata, message times etc with the authorities? Very unlikely.
motohagiography 5y ago
Appreciating the irony that we've gone to all this trouble to create e2e crypto protocols so that now we can finally trust products like Ring and Alexa to spy on us. The beauty of Wickr is it provided disposable identities and relatively strong anonymity, and fended off bulk interception using an end to end security protocol. The market for it was smaller because while everyone says they want security, I found that the risk/reward of anonymity is too risky for most people. The people I knew who did use Wickr were political staffers and operatives/activists on campaigns, law enforcement, and other fields where they had official recourse to protection. The reason for AMZN to buy Wickr is that it is a trustworthy secure messenger product with a valuable and influential user base, and an evolution of the product without anonymity is probably the case for growth. I don't see it being backdoored so much as just adapted to leverage its existing user base to fill out a feature need in a suite of AWS collaboration tools that will compete against Teams/Github, Zoom, Atlassian, etc.
- Terretta 5y ago
  > The reason for AMZN to buy Wickr is that it is a trustworthy secure messenger product… Or, rather, the reason is they turned all that into a platform: https://wickr.com/pro/ https://wickr.com/pro/
arpinum 5y ago
AWS hired the architect behind the NSA's attempt at breaking commercial crypto, according the Matthew Green [0]. I can't trust AWS will be truthful about their crypto systems and lack of backdoors. [0] - https://twitter.com/matthew_d_green/status/1357143560005509122 https://twitter.com/matthew_d_green/status/13571435600055091...
- LordDragonfang 5y ago
  To be fair, if you were interested in hardening your system and evaluating attack surfaces, that is also what you would do.
  - arpinum 5y ago
    Great! invite someone into the building who has lied to the entire crypto community to undermine global security. They will surely know how to spot bad actors! Invite a bad actor into the building in order to keep bad actors out. Invite bad actor into the building? Hmm, maybe not.
    - staticassertion 5y ago
      You've just described a decades-long strategy of the strongest information security teams, which has turned into the industry of red teaming.
- rainonmoon 5y ago
  Green's conviction about this is tantalizing but it's also melodramatic in a way that makes it easy to believe something not quite true (or provable, anyway.) In fact if you look down the thread, you'll see Green admitting that correlating Salter is basically speculation and other people providing plausible alternatives to Green's claims for Salter's motives at AWS. tptacek has a more measured history of what actually happened and it is very different than what you'd glean from Green's tweets.[0] Personally in this case I'd be more worried about touting Ring's end-to-end encryption with one hand while the other hand points one of those ends to your police department[1]. [0] https://sockpuppet.org/blog/2015/08/04/is-extended-random-malicious/ https://sockpuppet.org/blog/2015/08/04/is-extended-random-ma... [1] https://www.theguardian.com/commentisfree/2021/may/18/amazon-ring-largest-civilian-surveillance-network-us https://www.theguardian.com/commentisfree/2021/may/18/amazon...

rapsey 5y ago

As an american company, customers should absolutely be distrustful of any claims of security. There is very little in the way of the feds giving you a gag order and ordering you to provide a backdoor. Amazon has zero recourse in this situation, neither would they risk their gov contracts fighting it.

strictnein 5y ago
Yeah, they definitely just invested $xxx millions in a product that they know they won't be able to keep alive. Amazon has plenty of recourse, and they've been fighting gag orders for years now. Ex: https://arstechnica.com/tech-policy/2016/09/microsoft-amazon-google-apple-fox-news-us-gagging-orders/ https://arstechnica.com/tech-policy/2016/09/microsoft-amazon... The company leading that charge: Microsoft. The company that got the huge JEDI DoD cloud contract: Microsoft. Weird, huh?
- rapsey 5y ago
  Nonesense. When they get a gag order they have zero choice and recourse. Their options are shutting down the company or comply. They can join a legal fight to stop this practice, they however must comply with every order they get.
  - dang 5y ago
    "When disagreeing, please reply to the argument instead of calling names. 'That is idiotic; 1 + 1 is 2, not 3' can be shortened to '1 + 1 is 2, not 3." https://news.ycombinator.com/newsguidelines.html https://news.ycombinator.com/newsguidelines.html
- dang 5y ago
  "Don't be snarky." https://news.ycombinator.com/newsguidelines.html https://news.ycombinator.com/newsguidelines.html

INTPenis 5y ago

End 2 end cryptography, to what end does Ring need e2ee? To Amazon? Who is on the other end? Also, metadata.

drenvuk 5y ago
other enrolled devices. please check the provided links.
rapsey 5y ago
I have actually seen "secure" messengers claim e2e encryption because they use https to their servers. The ends are clients and their servers.

Bigpet 5y ago

> I'm sure Wickr will continue to be autonomous but maybe with access to more resources from the rest of Amazon To be fair, this is the fairy-tale that's told on every acquisition. I'm pretty certain this same narrative was spun even when facebook acquired occulus. Not saying this will be similar, but just hearing those words is not assuring by itself.

bydo 5y ago
Amazon's proven a much better steward than Facebook, though. Twitch seems pretty independent other than some Prime perks, Eero doesn't seem to have changed much, I'm pretty sure they forgot that they even bought IMDB and DPReview, etc.
- askafriend 5y ago
  I didn't even realize they had bought DPReview...

realce 5y ago

That's an odd glossy advertisement... Everyone here knows what end-to-end encryption is. Regardless of any promise, professed dismay, warranty, or other statement by Amazon, this product is no longer a trustworthy interface for private communications. The mere presence of the company brings such high probability of capitulation to government or corporate eavesdroppers that it's basically a useless asset to own IMPO.

tiagod 5y ago

>Wickr features end to end cryptography You can make it weaker without getting rid of it. Whatsapp also has E2EE on the message contents, does it stop Facebook from sharing all your contacts, call metadata, message times etc with the authorities? Very unlikely.

motohagiography 5y ago

Appreciating the irony that we've gone to all this trouble to create e2e crypto protocols so that now we can finally trust products like Ring and Alexa to spy on us. The beauty of Wickr is it provided disposable identities and relatively strong anonymity, and fended off bulk interception using an end to end security protocol. The market for it was smaller because while everyone says they want security, I found that the risk/reward of anonymity is too risky for most people. The people I knew who did use Wickr were political staffers and operatives/activists on campaigns, law enforcement, and other fields where they had official recourse to protection. The reason for AMZN to buy Wickr is that it is a trustworthy secure messenger product with a valuable and influential user base, and an evolution of the product without anonymity is probably the case for growth. I don't see it being backdoored so much as just adapted to leverage its existing user base to fill out a feature need in a suite of AWS collaboration tools that will compete against Teams/Github, Zoom, Atlassian, etc.

Terretta 5y ago
> The reason for AMZN to buy Wickr is that it is a trustworthy secure messenger product… Or, rather, the reason is they turned all that into a platform: https://wickr.com/pro/ https://wickr.com/pro/

arpinum 5y ago

AWS hired the architect behind the NSA's attempt at breaking commercial crypto, according the Matthew Green [0]. I can't trust AWS will be truthful about their crypto systems and lack of backdoors. [0] - https://twitter.com/matthew_d_green/status/1357143560005509122 https://twitter.com/matthew_d_green/status/13571435600055091...

LordDragonfang 5y ago
To be fair, if you were interested in hardening your system and evaluating attack surfaces, that is also what you would do.
- arpinum 5y ago
  Great! invite someone into the building who has lied to the entire crypto community to undermine global security. They will surely know how to spot bad actors! Invite a bad actor into the building in order to keep bad actors out. Invite bad actor into the building? Hmm, maybe not.
  - staticassertion 5y ago
    You've just described a decades-long strategy of the strongest information security teams, which has turned into the industry of red teaming.
rainonmoon 5y ago
Green's conviction about this is tantalizing but it's also melodramatic in a way that makes it easy to believe something not quite true (or provable, anyway.) In fact if you look down the thread, you'll see Green admitting that correlating Salter is basically speculation and other people providing plausible alternatives to Green's claims for Salter's motives at AWS. tptacek has a more measured history of what actually happened and it is very different than what you'd glean from Green's tweets.[0] Personally in this case I'd be more worried about touting Ring's end-to-end encryption with one hand while the other hand points one of those ends to your police department[1]. [0] https://sockpuppet.org/blog/2015/08/04/is-extended-random-malicious/ https://sockpuppet.org/blog/2015/08/04/is-extended-random-ma... [1] https://www.theguardian.com/commentisfree/2021/may/18/amazon-ring-largest-civilian-surveillance-network-us https://www.theguardian.com/commentisfree/2021/may/18/amazon...