5 ms·

I very much doubt it. Law enforcement doesn’t seem too concerned about regular old HTTPS. I wonder why?

by pyuser583 5y ago

wmf 5y ago
HTTPS is not end-to-end encrypted (it kinda would be if we used P2P but we don't) so you can subpoena the server.
- CogitoCogito 5y ago
  > HTTPS is not end-to-end encrypted (it kinda would be if we used P2P but we don't) so you can subpoena the server. How is https communication not end to end encrypted? And what’s the difference between subpoenaing a server vs an end user? The server is just another person/organization. Edit: Re-reading this I guess you mean that having a centra server acting as a middle man would probably not be end to end which I agree with. I thought you meant user <—-> server wasn’t end to end.
  - xeromal 5y ago
    I think they just mean they can just tell the company who owns the server to give them the data.
  - woodruffw 5y ago
    A typical example is a chat application served over HTTPS: your communication with the server is encrypted, but the messages sent between you and your friends are passed through the server in the clear (through databases, logging, caching layers, etc.).
- Andrew_nenakhov 5y ago
  It is absolutely end-to-end encrypted. However, one of the ends is usually a server.
  - pyuser583 5y ago
    I guess it depends on which end we are talking about. Generally, “end to end encryption” refers to client to client encryption, where the sever routes data but can’t read it.
- judge2020 5y ago
  Your comment is only confusing because E2EE is a term about encryption where no data between two devices can be read by eavesdroppers. HTTPS is indeed end-to-end encrypted between the server and the device. A better way to put it is that HTTPS does not promote E2EE between end-users, which it doesn't intend/pretend to do anyways.
  - upofadown 5y ago
    >E2EE is a term about encryption where no data between two devices can be read by eavesdroppers. That would cover any use of encryption. E2EE is a term used where there is a distinction to be made between access by users at the ends of the system and some other part of the system. Originally used to cover the encrypted email case where there is a lot of "middle" in the form of email servers and a small amount of "end". The term is often used incorrectly these days for marketing purposes. TLS could be used in an E2EE system, but it is normally not.
fitblipper 5y ago
Because, it's a massive centralized decrypted data repository, law enforcement can simply ask for the data and the company will hand it over. It's not their data so they don't care to defend it but because of the third party doctrine it's legally their data to hand off w/o your permission. Peer to peer or end to end encryption removes this trivially easy access, which is why they don't like it.
aaomidi 5y ago
Companies like Cloudflare exist.
Jerry2 5y ago
> I wonder why? NSLs: https://www.eff.org/issues/national-security-letters/faq https://www.eff.org/issues/national-security-letters/faq Dragnet/Geofence warrants: https://www.nbcnews.com/news/us-news/google-tracked-his-bike-ride-past-burglarized-home-made-him-n1151761 https://www.nbcnews.com/news/us-news/google-tracked-his-bike... and https://www.logically.ai/articles/geofence-warrants-on-the-rise https://www.logically.ai/articles/geofence-warrants-on-the-r... Dragnet/Mass-surveillance keyword warrants: https://www.forbes.com/sites/thomasbrewster/2021/10/04/google-keyword-warrants-give-us-government-data-on-search-users/?sh=643c31f97c97 https://www.forbes.com/sites/thomasbrewster/2021/10/04/googl... Dragnet/mass-scanning of online storage: https://www.forbes.com/sites/thomasbrewster/2021/12/20/google-scans-gmail-and-drive-for-cartoons-of-child-sexual-abuse/ https://www.forbes.com/sites/thomasbrewster/2021/12/20/googl... PRISM: https://en.wikipedia.org/wiki/PRISM_(surveillance_program) https://en.wikipedia.org/wiki/PRISM_(surveillance_program) RAMPART-A: https://en.wikipedia.org/wiki/RAMPART-A https://en.wikipedia.org/wiki/RAMPART-A Forced backdoors into "encrypted" email: https://www.theregister.com/2020/12/08/tutanota_backdoor_court_order/ https://www.theregister.com/2020/12/08/tutanota_backdoor_cou... And who knows what else is still secret. A good rule of thumb is that if something's in the "cloud" or hosted on someone's computer that you don't directly control, you should assume that LEOs have access to it. When all the data is centralized, you don't care about the end-point encryption. All you care about is having access to all the databases.
- GreenWatermelon 5y ago
  LEOs? Can only think if Low Earth Orbits.
  - woodruffw 5y ago
    "Law Enforcement Organization." Edit: "Officer."
    - judge2020 5y ago
      My understanding was that it stood for Law Enforcement Officer.
paxys 5y ago
Law enforcement is mostly concerned about corporate servers rather than home ones. E2E encryption puts those servers out of their control, hence the pushback.
brimble 5y ago
Most or all of the major trust chains that underpin it are compromised, would be my guess.

I very much doubt it. Law enforcement doesn’t seem too concerned about regular old HTTPS. I wonder why?

wmf 5y ago

HTTPS is not end-to-end encrypted (it kinda would be if we used P2P but we don't) so you can subpoena the server.

CogitoCogito 5y ago
> HTTPS is not end-to-end encrypted (it kinda would be if we used P2P but we don't) so you can subpoena the server. How is https communication not end to end encrypted? And what’s the difference between subpoenaing a server vs an end user? The server is just another person/organization. Edit: Re-reading this I guess you mean that having a centra server acting as a middle man would probably not be end to end which I agree with. I thought you meant user <—-> server wasn’t end to end.
- xeromal 5y ago
  I think they just mean they can just tell the company who owns the server to give them the data.
- woodruffw 5y ago
  A typical example is a chat application served over HTTPS: your communication with the server is encrypted, but the messages sent between you and your friends are passed through the server in the clear (through databases, logging, caching layers, etc.).
Andrew_nenakhov 5y ago
It is absolutely end-to-end encrypted. However, one of the ends is usually a server.
- pyuser583 5y ago
  I guess it depends on which end we are talking about. Generally, “end to end encryption” refers to client to client encryption, where the sever routes data but can’t read it.
judge2020 5y ago
Your comment is only confusing because E2EE is a term about encryption where no data between two devices can be read by eavesdroppers. HTTPS is indeed end-to-end encrypted between the server and the device. A better way to put it is that HTTPS does not promote E2EE between end-users, which it doesn't intend/pretend to do anyways.
- upofadown 5y ago
  >E2EE is a term about encryption where no data between two devices can be read by eavesdroppers. That would cover any use of encryption. E2EE is a term used where there is a distinction to be made between access by users at the ends of the system and some other part of the system. Originally used to cover the encrypted email case where there is a lot of "middle" in the form of email servers and a small amount of "end". The term is often used incorrectly these days for marketing purposes. TLS could be used in an E2EE system, but it is normally not.

fitblipper 5y ago

Because, it's a massive centralized decrypted data repository, law enforcement can simply ask for the data and the company will hand it over. It's not their data so they don't care to defend it but because of the third party doctrine it's legally their data to hand off w/o your permission. Peer to peer or end to end encryption removes this trivially easy access, which is why they don't like it.

aaomidi 5y ago

Companies like Cloudflare exist.

Jerry2 5y ago

> I wonder why? NSLs: https://www.eff.org/issues/national-security-letters/faq https://www.eff.org/issues/national-security-letters/faq Dragnet/Geofence warrants: https://www.nbcnews.com/news/us-news/google-tracked-his-bike-ride-past-burglarized-home-made-him-n1151761 https://www.nbcnews.com/news/us-news/google-tracked-his-bike... and https://www.logically.ai/articles/geofence-warrants-on-the-rise https://www.logically.ai/articles/geofence-warrants-on-the-r... Dragnet/Mass-surveillance keyword warrants: https://www.forbes.com/sites/thomasbrewster/2021/10/04/google-keyword-warrants-give-us-government-data-on-search-users/?sh=643c31f97c97 https://www.forbes.com/sites/thomasbrewster/2021/10/04/googl... Dragnet/mass-scanning of online storage: https://www.forbes.com/sites/thomasbrewster/2021/12/20/google-scans-gmail-and-drive-for-cartoons-of-child-sexual-abuse/ https://www.forbes.com/sites/thomasbrewster/2021/12/20/googl... PRISM: https://en.wikipedia.org/wiki/PRISM_(surveillance_program) https://en.wikipedia.org/wiki/PRISM_(surveillance_program) RAMPART-A: https://en.wikipedia.org/wiki/RAMPART-A https://en.wikipedia.org/wiki/RAMPART-A Forced backdoors into "encrypted" email: https://www.theregister.com/2020/12/08/tutanota_backdoor_court_order/ https://www.theregister.com/2020/12/08/tutanota_backdoor_cou... And who knows what else is still secret. A good rule of thumb is that if something's in the "cloud" or hosted on someone's computer that you don't directly control, you should assume that LEOs have access to it. When all the data is centralized, you don't care about the end-point encryption. All you care about is having access to all the databases.

GreenWatermelon 5y ago
LEOs? Can only think if Low Earth Orbits.
- woodruffw 5y ago
  "Law Enforcement Organization." Edit: "Officer."
  - judge2020 5y ago
    My understanding was that it stood for Law Enforcement Officer.

paxys 5y ago

Law enforcement is mostly concerned about corporate servers rather than home ones. E2E encryption puts those servers out of their control, hence the pushback.

brimble 5y ago

Most or all of the major trust chains that underpin it are compromised, would be my guess.