3 ms·

As I understand it, if we had true end-to-end encryption, I would have to make sure I kept a set of keys, copied them between every computer and phone I used fo

As I understand it, if we had true end-to-end encryption, I would have to make sure I kept a set of keys, copied them between every computer and phone I used for chatting, and if I lost those keys I'd lose all my messages? Honestly, for most people I don't think that's functionality they would want, at least without us getting much better at interfaces and usability. Standard ways of storing keys, for example in a password manager, would be a good start (does this already exist and I've missed it?)

mr_mitm 4y ago
> As I understand it, if we had true end-to-end encryption, I would have to make sure I kept a set of keys, copied them between every computer and phone I used for chatting, and if I lost those keys I'd lose all my messages? Unless you made an unencrypted backup, then yes, that's true and that is the reason why Telegram decided against E2EE by default. According to them their users prefer easy cloud access to their messages over security.
- iggldiggl 4y ago
  > According to them their users prefer easy cloud access to their messages over security. And likewise with e-mail, PGP et al. break some features that rely on your mail server having access to the full message contents, like content-based message filtering (spam or otherwise) and server-side search.
rmnclmnt 4y ago
Using a password manager in a sensible manner already goes a long way! Most synchronized E2EE services only ask for a master passphrase to encrypt your keys before storing them server side (e.g Bitwarden, Keybase, ProtonMail). Then you only need your password manager to recall the passphrase when synchronizing a new device! People need to learn again how the devices in their pocket work and the risks for not doing things properly!
sigwinch28 4y ago
> and if I lost those keys I'd lose all my messages? Only if the developers of the software insist on encryption at rest in addition to transit encryption. For example, you don’t lose the ability to open files you have already downloaded via HTTPS just because the client or server certificate later expires.
jcynix 4y ago
IMHO, for most people the best interface would be a physical key (with software keys on it). That is something like a smartcard or ubikey, and even a way of obtaining multiple copies, like with physical keys. My employer rolled out a smartcard based PKI about 15 years ago, where you may own more than one card (optionally in sim card size for usb tokens) so, for example, you can have one in the office and have another one in your home office. Works quite well (modulo mobile) for now abour 30K employees. And, combined with RFID on the cards, you can call elevators, open doors, pay for food, etc. Now if hardware manufacturers had standardized on appropriate hardware (chassis, keyboards, smart devices…) some 20 years ago, instead of trying (and failing) all kinds of software "solutions" … and thinner and thinner hardware, so no such cards or sticks would fit anymore …
- mr_mitm 4y ago
  The difference is: If you lose your smartcard, it's pretty straight forward for your employer to verify your identity and issue a new one. How do I do that with WhatsApp? We all know how well these tech giants react if you got permanently locked you out of accounts, no matter whose fault it was. And even if I could get a new key, I would have to explain to all my contacts why my key changed and they would have to re-verify it over a secure channel. It doesn't scale. Now you might say: just keep multiple copies, but there will be cases where people lose all copies, and depending on how much of our digital lives will be tied to these keys, we will need a secure recovery plan for that.
jcynix 4y ago
> if I lost those keys I'd lose all my messages? Not neccessarily, that just happens with bad implementations (i.e. most of them, sigh). If you get a confidential letter in the physicsl world, you open it, read it, and then store it in a safe,.or a locked drawer, correct? The software world chose to "re-seal" the letter in its envelope again instead. So if you loose your key, you loose access to the letter. The proper way to implement this would be to store the decrypted contents in the software equivalent of a lockable drawer, e.g. an encryped disk, folder or whatever. Which could (and should) have sensible fallbacks to retrieve its content.
- mort96 4y ago
  Most people don't have encrypted drives with fallbacks to retrieve its contents (whatever that means).
  - jcynix 4y ago
    Not having encrypted drives is some kind of misfeature nowadays, especially for mobile devices. Fallbacks can be key escrow (i.e. put a printout or a physical key into a sealed envelope and deposit it at a family member, friend, or notary), and backups, encrypted with a different (or more than one) key. https://en.wikipedia.org/wiki/Linux_Unified_Key_Setup https://en.wikipedia.org/wiki/Linux_Unified_Key_Setup for example allows the use of multiple keys, so a backup could use the same (primary) key as your drive and some secondary key(s) to access the backup if the primary key is lost somehow. As I mentioned in another comment here, keys should have been physical features for a long time, but hardware vendors would had to standardize on a general implementation and as we know, they all like to "standardize" on exactly their way of doing things.
upofadown 4y ago
The secret bits can be protected by a strong passprase (which you can print out) or kept in a hardware device that also does enough of the cryptography to allow the secrets to stay on the hardware device. After that the problem becomes one of backup. You can scatter your encrypted keys all over the internet if you want (or just on a reliable server somewhere). You can have a bunch of hardware devices stored in various safe places and protected in various ways. You often hear advice that comes down to keeping, say, your PGP keys in one secure place, but that is a terrible idea... E2EE encryption needs a good backup approach. If your system does not provide that in a easy to use way for the user then you have a bad system. E2EE encryption is hard but it doesn't help to leave all the hardness for the user.

mr_mitm 4y ago

> As I understand it, if we had true end-to-end encryption, I would have to make sure I kept a set of keys, copied them between every computer and phone I used for chatting, and if I lost those keys I'd lose all my messages? Unless you made an unencrypted backup, then yes, that's true and that is the reason why Telegram decided against E2EE by default. According to them their users prefer easy cloud access to their messages over security.

iggldiggl 4y ago
> According to them their users prefer easy cloud access to their messages over security. And likewise with e-mail, PGP et al. break some features that rely on your mail server having access to the full message contents, like content-based message filtering (spam or otherwise) and server-side search.

rmnclmnt 4y ago

Using a password manager in a sensible manner already goes a long way! Most synchronized E2EE services only ask for a master passphrase to encrypt your keys before storing them server side (e.g Bitwarden, Keybase, ProtonMail). Then you only need your password manager to recall the passphrase when synchronizing a new device! People need to learn again how the devices in their pocket work and the risks for not doing things properly!

sigwinch28 4y ago

> and if I lost those keys I'd lose all my messages? Only if the developers of the software insist on encryption at rest in addition to transit encryption. For example, you don’t lose the ability to open files you have already downloaded via HTTPS just because the client or server certificate later expires.

jcynix 4y ago

IMHO, for most people the best interface would be a physical key (with software keys on it). That is something like a smartcard or ubikey, and even a way of obtaining multiple copies, like with physical keys. My employer rolled out a smartcard based PKI about 15 years ago, where you may own more than one card (optionally in sim card size for usb tokens) so, for example, you can have one in the office and have another one in your home office. Works quite well (modulo mobile) for now abour 30K employees. And, combined with RFID on the cards, you can call elevators, open doors, pay for food, etc. Now if hardware manufacturers had standardized on appropriate hardware (chassis, keyboards, smart devices…) some 20 years ago, instead of trying (and failing) all kinds of software "solutions" … and thinner and thinner hardware, so no such cards or sticks would fit anymore …

mr_mitm 4y ago
The difference is: If you lose your smartcard, it's pretty straight forward for your employer to verify your identity and issue a new one. How do I do that with WhatsApp? We all know how well these tech giants react if you got permanently locked you out of accounts, no matter whose fault it was. And even if I could get a new key, I would have to explain to all my contacts why my key changed and they would have to re-verify it over a secure channel. It doesn't scale. Now you might say: just keep multiple copies, but there will be cases where people lose all copies, and depending on how much of our digital lives will be tied to these keys, we will need a secure recovery plan for that.

jcynix 4y ago

> if I lost those keys I'd lose all my messages? Not neccessarily, that just happens with bad implementations (i.e. most of them, sigh). If you get a confidential letter in the physicsl world, you open it, read it, and then store it in a safe,.or a locked drawer, correct? The software world chose to "re-seal" the letter in its envelope again instead. So if you loose your key, you loose access to the letter. The proper way to implement this would be to store the decrypted contents in the software equivalent of a lockable drawer, e.g. an encryped disk, folder or whatever. Which could (and should) have sensible fallbacks to retrieve its content.

mort96 4y ago
Most people don't have encrypted drives with fallbacks to retrieve its contents (whatever that means).
- jcynix 4y ago
  Not having encrypted drives is some kind of misfeature nowadays, especially for mobile devices. Fallbacks can be key escrow (i.e. put a printout or a physical key into a sealed envelope and deposit it at a family member, friend, or notary), and backups, encrypted with a different (or more than one) key. https://en.wikipedia.org/wiki/Linux_Unified_Key_Setup https://en.wikipedia.org/wiki/Linux_Unified_Key_Setup for example allows the use of multiple keys, so a backup could use the same (primary) key as your drive and some secondary key(s) to access the backup if the primary key is lost somehow. As I mentioned in another comment here, keys should have been physical features for a long time, but hardware vendors would had to standardize on a general implementation and as we know, they all like to "standardize" on exactly their way of doing things.

upofadown 4y ago

The secret bits can be protected by a strong passprase (which you can print out) or kept in a hardware device that also does enough of the cryptography to allow the secrets to stay on the hardware device. After that the problem becomes one of backup. You can scatter your encrypted keys all over the internet if you want (or just on a reliable server somewhere). You can have a bunch of hardware devices stored in various safe places and protected in various ways. You often hear advice that comes down to keeping, say, your PGP keys in one secure place, but that is a terrible idea... E2EE encryption needs a good backup approach. If your system does not provide that in a easy to use way for the user then you have a bad system. E2EE encryption is hard but it doesn't help to leave all the hardness for the user.