3 ms·

What I find intriguing is that E2EE was significantly more common long ago than it is today. Multi-protocol chat clients would utilize the OTR libraries meanin

What I find intriguing is that E2EE was significantly more common long ago than it is today. Multi-protocol chat clients would utilize the OTR libraries meaning 'off the record' and even auto-negotiate with folks over AIM, MSN, ICQ, IRC and others to assist in showing fingerprints and sharing public keys which could be done over the platform or out of band if one so wished. I would have expected that by today that not only would this be more common but that the technology would have significantly advanced by now. Instead the opposite appears to be true. People are instead using apps that pinky promise to E2EE things and depend on the chat service to handle the trust mechanism for them which in my view entirely defeats the intent and purpose of E2EE. I assume the motivation is the desire to capture and monetize every conversation, especially the private conversations and/or to comply with national security letters. I've heard people try to rationalize this with because non technical people but non technical people were utilizing OTR just fine. What could realistically be done to reverse this in a way that puts the control back into the individuals hands? i.e. Even if all the kings horses and all the kings men wanted your messages they could only pound sand again and again.

jll29 4y ago
This may be due to policy activism on the side of governments. I think asking service providers to use more E2EE is not the right approach. Governments' intelligence agencies do not shy away from infiltrating commercial vendors (from Yahoo! to the infamous Crypto AG - https://en.wikipedia.org/wiki/Crypto_AG https://en.wikipedia.org/wiki/Crypto_AG). 1. People should diversify across many, in particular smaller platform, so that surveillance cannot be done as it becomes a scale & long tail problem. 2. People should use P2P E2EE protocols and GPG-encrypted emails. The single biggest step forward would be easier ways to set up public key encrypted email part of e.g. Mozilla Thunderbird and other clients. But in parallel an attitude change is needed, for the receiving end needs to know how to open an encrypted email.
georgyo 4y ago
I used OTR, but I would not say that it was _more_ common, as that was just a layer over a non E2EE platform like the ones you listed. Using OTR meant using a non-standard client, installing the plugins for it, and configuring it. Worse, all parties you wanted to chat with had to do it as well. Which means it was almost always a novelty feature among nerdy friends and no one else. Because most people did not have it installed, having it auto negotiate always was a non-starter. It meant people who didn't have it would recieve cryptic messages from you at the start of each session and then complain to you. So most of the time it was completely manual process of enabling it for _some_ chats, and this leaks a massive amount of data. It basically declares that for this particular chat sometime might have been interesting. Often the chat log would include a plain text message like "Let's switch to OTR". Unlike you I could not get any non-technical friends to care about OTR enough to install it. I have difficulty even today getting people interested in Signal. I still hear arguments like "I'm not that interesting, they can look" and "I've got nothing to hide"
- LinuxBender 4y ago
  Because most people did not have it installed In my circle of friends, everyone used a non standard client so they could customize the skin of the client. Most of these people were either not technical or at least just technical enough to follow simple instructions. I personally knew many people that used the multi-protocol chat clients. Their primary interest was for the customization capabilities of the client and having all their messages in one place rather than encryption plugins. The vendor clients did not have a dark mode and were nowhere near as customizable. The E2EE aspect was just a nice to have for some. I suspect this will never be a thing again as vendors might decide to ban accounts that use a client other than their own and people would fear losing their social circles in the vendor locked in services. That is, outside of IRC. One can still use E2EE in IRC.
saddlerustle 4y ago
> What I find intriguing is that E2EE was significantly more common long ago than it is today. This is absurd. Today a large fraction of the world's population is using E2EE via WhatsApp.
- LinuxBender 4y ago
  Today a large fraction of the world's population is using E2EE via WhatsApp. That is good example of the problem I am describing. People are using E2EE created, deployed and maintained by WhatsApp in WhatsApp. That is a problem. The E2EE in WhatsApp is not truly E2EE if it is maintained by the very people providing the service in my unwavering opinion. True E2EE is entirely outside of the service transport that messages are traversing meaning that FB could not possibly intercept the messages even if their livelihood depended on it. Today people have to just trust that FB are not targeting people with custom intercept code or code that otherwise preclude E2EE for specific messages or recipients. That is what I call a pinky promise sometimes also referred to as a Pinky Swear [1]. I follow the logic of, people will do what people can do. If the application can be monkeyed with, it will be. Message encryption must be entirely outside of the purview of the application. Even OTR was somewhat at risk of interception. That is why I would have expected that by today this would have been a solved problem and highly evolved. [1] - https://en.wikipedia.org/wiki/Pinky_swear https://en.wikipedia.org/wiki/Pinky_swear
  - georgyo 4y ago
    There are a few reasons why I think it has to be at the app itself. In order to be actually secure, all conversions must be encrypted, without exception. OTR is one channel method of encrypting text, but it isn't the only method. For example using PGP over text messages is also a plugin for pidgin. Competing standards means your ven diagram of people and chat protocols now gets an entire new axis of encrption method. Metadata is data. Without seeing the message content, it is still valuable to see who is talking to who and when. There are always tradeoffs. While OTR may be more verifiable secure, it's difficultly hiders adoption. A balance has to be reached with ease of use and security. If it is easy to get it wrong then people will have a false sense of security. That is strictly worse than no actual security.
Asmod4n 4y ago
ICQ and the like threatened to close your account when you used OTR.
pabs3 4y ago
None of what you lament has been lost. OTR still exists and is used by some folks. There are still OTR supporting clients that also support the current proprietary messaging systems like Facebook. The only thing that was lost is that most people moved away from using Free Software for communication and most new people were born into and grew up within proprietary communication ecosystems. Please note that OTRv3 uses significantly outdated encryption. There is OTRv4 but it isn't finished yet. https://bugs.otr.im/otrv4/otrv4 https://bugs.otr.im/otrv4/otrv4 https://github.com/otrv4/otrv4/ https://github.com/otrv4/otrv4/

jll29 4y ago

This may be due to policy activism on the side of governments. I think asking service providers to use more E2EE is not the right approach. Governments' intelligence agencies do not shy away from infiltrating commercial vendors (from Yahoo! to the infamous Crypto AG - https://en.wikipedia.org/wiki/Crypto_AG https://en.wikipedia.org/wiki/Crypto_AG). 1. People should diversify across many, in particular smaller platform, so that surveillance cannot be done as it becomes a scale & long tail problem. 2. People should use P2P E2EE protocols and GPG-encrypted emails. The single biggest step forward would be easier ways to set up public key encrypted email part of e.g. Mozilla Thunderbird and other clients. But in parallel an attitude change is needed, for the receiving end needs to know how to open an encrypted email.

georgyo 4y ago

I used OTR, but I would not say that it was _more_ common, as that was just a layer over a non E2EE platform like the ones you listed. Using OTR meant using a non-standard client, installing the plugins for it, and configuring it. Worse, all parties you wanted to chat with had to do it as well. Which means it was almost always a novelty feature among nerdy friends and no one else. Because most people did not have it installed, having it auto negotiate always was a non-starter. It meant people who didn't have it would recieve cryptic messages from you at the start of each session and then complain to you. So most of the time it was completely manual process of enabling it for _some_ chats, and this leaks a massive amount of data. It basically declares that for this particular chat sometime might have been interesting. Often the chat log would include a plain text message like "Let's switch to OTR". Unlike you I could not get any non-technical friends to care about OTR enough to install it. I have difficulty even today getting people interested in Signal. I still hear arguments like "I'm not that interesting, they can look" and "I've got nothing to hide"

LinuxBender 4y ago
Because most people did not have it installed In my circle of friends, everyone used a non standard client so they could customize the skin of the client. Most of these people were either not technical or at least just technical enough to follow simple instructions. I personally knew many people that used the multi-protocol chat clients. Their primary interest was for the customization capabilities of the client and having all their messages in one place rather than encryption plugins. The vendor clients did not have a dark mode and were nowhere near as customizable. The E2EE aspect was just a nice to have for some. I suspect this will never be a thing again as vendors might decide to ban accounts that use a client other than their own and people would fear losing their social circles in the vendor locked in services. That is, outside of IRC. One can still use E2EE in IRC.

saddlerustle 4y ago

> What I find intriguing is that E2EE was significantly more common long ago than it is today. This is absurd. Today a large fraction of the world's population is using E2EE via WhatsApp.

LinuxBender 4y ago
Today a large fraction of the world's population is using E2EE via WhatsApp. That is good example of the problem I am describing. People are using E2EE created, deployed and maintained by WhatsApp in WhatsApp. That is a problem. The E2EE in WhatsApp is not truly E2EE if it is maintained by the very people providing the service in my unwavering opinion. True E2EE is entirely outside of the service transport that messages are traversing meaning that FB could not possibly intercept the messages even if their livelihood depended on it. Today people have to just trust that FB are not targeting people with custom intercept code or code that otherwise preclude E2EE for specific messages or recipients. That is what I call a pinky promise sometimes also referred to as a Pinky Swear [1]. I follow the logic of, people will do what people can do. If the application can be monkeyed with, it will be. Message encryption must be entirely outside of the purview of the application. Even OTR was somewhat at risk of interception. That is why I would have expected that by today this would have been a solved problem and highly evolved. [1] - https://en.wikipedia.org/wiki/Pinky_swear https://en.wikipedia.org/wiki/Pinky_swear
- georgyo 4y ago
  There are a few reasons why I think it has to be at the app itself. In order to be actually secure, all conversions must be encrypted, without exception. OTR is one channel method of encrypting text, but it isn't the only method. For example using PGP over text messages is also a plugin for pidgin. Competing standards means your ven diagram of people and chat protocols now gets an entire new axis of encrption method. Metadata is data. Without seeing the message content, it is still valuable to see who is talking to who and when. There are always tradeoffs. While OTR may be more verifiable secure, it's difficultly hiders adoption. A balance has to be reached with ease of use and security. If it is easy to get it wrong then people will have a false sense of security. That is strictly worse than no actual security.

Asmod4n 4y ago

ICQ and the like threatened to close your account when you used OTR.

pabs3 4y ago

None of what you lament has been lost. OTR still exists and is used by some folks. There are still OTR supporting clients that also support the current proprietary messaging systems like Facebook. The only thing that was lost is that most people moved away from using Free Software for communication and most new people were born into and grew up within proprietary communication ecosystems. Please note that OTRv3 uses significantly outdated encryption. There is OTRv4 but it isn't finished yet. https://bugs.otr.im/otrv4/otrv4 https://bugs.otr.im/otrv4/otrv4 https://github.com/otrv4/otrv4/ https://github.com/otrv4/otrv4/