4 ms·

I don't see how this is possible if you also have E2EE. Great example is email encryption via PGP. It exists, it's used (rarely) in some cases, but it's so poor

I don't see how this is possible if you also have E2EE. Great example is email encryption via PGP. It exists, it's used (rarely) in some cases, but it's so poorly implemented to the point of being useless unless

AndersSandvik 4y ago
It will be possible because the user will have the encryption key
dingleberry420 4y ago
Why should this be an issue at all? It's my account, I should know the encryption key & algorithm. Any open source app can then implement this.
- endisneigh 4y ago
  How exactly would you implement an interoperable E2EE group chat app where you can arbitrarily add and remove people like with iMessage? The EU law linked does not actually recommend anything specifically, just vaguely states interoperability being a goal. Certain apps will have certain functionality. Unless you're willing to constrain the functionality it's not really possible. Right now everyone could already use email which supports encryption. They don't, though.
  - deleted 4y ago
    [deleted]
  - vageli 4y ago
    > How exactly would you implement an interoperable E2EE group chat app where you can arbitrarily add and remove people like with iMessage? Doesn't the matrix chat app allow for this? Might be useful to learn how they do it if this is of interest. https://matrix.org/docs/guides/end-to-end-encryption-implementation-guide https://matrix.org/docs/guides/end-to-end-encryption-impleme...
  - OJFord 4y ago
    How is the problem you're imagining solved by having just a single company in charge of the app?
    - endisneigh 4y ago
      It’s not - the company usually also has the keys, so you have to trust them.
      - OJFord 4y ago
        If you call that E2EE then all E is.
        endisneigh 4y ago
        If you want interoperability you would need true e2ee, I never claimed single company regular encryption was e2ee
  - dingleberry420 4y ago
    The same way as they're doing it right now, just well-documented and open. Let the bigcrops create working groups to hammer out the details.
chrismorgan 4y ago
On the contrary, genuine end-to-end encryption is only possible this way. First-party end-to-end encryption is broken by design. (I’ve explained somewhat more with particular examples in a few comments: https://hn.algolia.com/?query=chrismorgan+end-to-end+encryption&type=comment https://hn.algolia.com/?query=chrismorgan+end-to-end+encrypt....) To be sure, interoperability requires a suitable spec for other clients to implement, but there’s absolutely nothing special about end-to-end encryption in this picture—it’s just a feature to implement like any other.
- endisneigh 4y ago
  tell me then, how exactly would this work as new features are developed - do all apps have to be static in functionality indefinitely? how would it work with group chats where you can add and remove people arbitrarily?
  - karpierz 4y ago
    > tell me then, how exactly would this work as new features are developed - do all apps have to be static in functionality indefinitely? Can you give an example of a "new feature" that you think would be stymied by this? > how would it work with group chats where you can add and remove people arbitrarily? I don't quite understand what issue you're pointing to. I'm not sure if you're unsure of how e2e encryption works or something else. Can you ask your question again with more specificity?
    - endisneigh 4y ago
      Sending money for example. Haven’t kept up to date with matrix - does it even allow e2ee with group chats using a bridge?
      - karpierz 4y ago
        Why would requiring interoperability of messages or video calls prevent an app from implementing a "send money" feature? Also, if you want to make a "send money" feature, why would it being interoperable preclude you from doing it? Bank transfers are already interoperable, why can't a send money feature be? > e2ee with group chats See: https://interoperability.news/2022/03/end-to-end-encrypted-group-chats-and-interoperability/ https://interoperability.news/2022/03/end-to-end-encrypted-g...

AndersSandvik 4y ago

It will be possible because the user will have the encryption key

dingleberry420 4y ago

Why should this be an issue at all? It's my account, I should know the encryption key & algorithm. Any open source app can then implement this.

endisneigh 4y ago
How exactly would you implement an interoperable E2EE group chat app where you can arbitrarily add and remove people like with iMessage? The EU law linked does not actually recommend anything specifically, just vaguely states interoperability being a goal. Certain apps will have certain functionality. Unless you're willing to constrain the functionality it's not really possible. Right now everyone could already use email which supports encryption. They don't, though.
- deleted 4y ago
  [deleted]
- vageli 4y ago
  > How exactly would you implement an interoperable E2EE group chat app where you can arbitrarily add and remove people like with iMessage? Doesn't the matrix chat app allow for this? Might be useful to learn how they do it if this is of interest. https://matrix.org/docs/guides/end-to-end-encryption-implementation-guide https://matrix.org/docs/guides/end-to-end-encryption-impleme...
- OJFord 4y ago
  How is the problem you're imagining solved by having just a single company in charge of the app?
  - endisneigh 4y ago
    It’s not - the company usually also has the keys, so you have to trust them.
    - OJFord 4y ago
      If you call that E2EE then all E is.
      - endisneigh 4y ago
        If you want interoperability you would need true e2ee, I never claimed single company regular encryption was e2ee
- dingleberry420 4y ago
  The same way as they're doing it right now, just well-documented and open. Let the bigcrops create working groups to hammer out the details.

chrismorgan 4y ago

On the contrary, genuine end-to-end encryption is only possible this way. First-party end-to-end encryption is broken by design. (I’ve explained somewhat more with particular examples in a few comments: https://hn.algolia.com/?query=chrismorgan+end-to-end+encryption&type=comment https://hn.algolia.com/?query=chrismorgan+end-to-end+encrypt....) To be sure, interoperability requires a suitable spec for other clients to implement, but there’s absolutely nothing special about end-to-end encryption in this picture—it’s just a feature to implement like any other.

endisneigh 4y ago
tell me then, how exactly would this work as new features are developed - do all apps have to be static in functionality indefinitely? how would it work with group chats where you can add and remove people arbitrarily?
- karpierz 4y ago
  > tell me then, how exactly would this work as new features are developed - do all apps have to be static in functionality indefinitely? Can you give an example of a "new feature" that you think would be stymied by this? > how would it work with group chats where you can add and remove people arbitrarily? I don't quite understand what issue you're pointing to. I'm not sure if you're unsure of how e2e encryption works or something else. Can you ask your question again with more specificity?
  - endisneigh 4y ago
    Sending money for example. Haven’t kept up to date with matrix - does it even allow e2ee with group chats using a bridge?
    - karpierz 4y ago
      Why would requiring interoperability of messages or video calls prevent an app from implementing a "send money" feature? Also, if you want to make a "send money" feature, why would it being interoperable preclude you from doing it? Bank transfers are already interoperable, why can't a send money feature be? > e2ee with group chats See: https://interoperability.news/2022/03/end-to-end-encrypted-group-chats-and-interoperability/ https://interoperability.news/2022/03/end-to-end-encrypted-g...