5 ms·

> new places to move the goalposts "moving the goalposts"? Since when has closed source unverifiable crypto been a good idea? Since when has it been a good id

> new places to move the goalposts "moving the goalposts"? Since when has closed source unverifiable crypto been a good idea? Since when has it been a good idea to trust a provider that fully controls the encryption algorithm to also be the only possible store for your supposedly encrypted data? This is no better than Facebook claiming that Whatsapp is now "E2EE" encrypted. It's a useless PR tactic. If you mistrust Facebook, why would you suddenly trust their unverifiable claim that the data is now E2EE? You could have an argument if at least 3rd party clients were allowed, so that you could detect when they silently change the protocol. But not even that. There's absolutely no _technical_ thing they could do to gain any trust. The goalpost has never been there.

brookst 4y ago
> why would you suddenly trust their unverifiable claim that the data is now E2EE > It's a useless PR tactic. Maybe because a single whistleblower would bring down the mother of all class action lawsuits? Hardcore anti-corporate types like to imagine that these companies are evil geniuses, where all 100,000 employees are operating in perfect alignment, with no mistakes or disagreements, and all secrets are kept perfectly. It just doesn't work like that. Threat model it for a second: how many more phones is Apple going to sell with this? Maybe a 1% increase, to wildly overestimate it? And what would be the financial harm from a single engineer popping on HN and saying "it's all BS, phones send the keys to the cloud, I worked on the system to store them."? > There's absolutely no _technical_ thing they could do to gain any trust. Well, that's true. But there's also no non-technical thing they could do. It is literally impossible to prove perfect technical compliance on an ongoing basis using any combination of technical and non-technical means. That goes for open source too. Evil compilers, etc, can turn perfectly solid source into malicious binaries. The compiler's source can even be perfectly secure. At some point you have to think about probabilities and motivations, and move away from this "anything not 100% perfect, which BTW is not possible, is 100% useless" world view.
- AshamedCaptain 4y ago
  > Maybe because a single whistleblower would bring down the mother of all class action lawsuits? Sure, like that is going to happen. I mean, "Facebook can read your supposedly-encrypted Whatsapp messages" will raise how many eyebrows exactly? > But there's also no non-technical thing they could do No, that's untrue. For starters, release the source. Allow me to run my own backup software on their servers. Allow me to transparently run my own encryption before I upload stuff to their servers. And a very long etc. > anything not 100% perfect, which BTW is not possible, is 100% useless This is 100% useless not because it is not 100% perfect (it very well could be), but because it is 100% useless by conception. What threat model does this protect against exactly? The scenario where Apple servers get compromised? I'm quite sure this risk does not even enter the mind of the target audience here, and if it did, the hacker could very well push the silent update anyway. The scenario where Apple itself has access to the data? This does absolutely nothing to prevent it. The scenario where someone can social engineer an Apple employee to give your iCloud key to someone else? It was already not possible.
  - brookst 4y ago
    > What threat model does this protect against exactly? Two big threats: 1) insider attacks like the Saudi Twitter infiltration[0], and 2) Overreach by legitimate government process like subpoena[1]. > release the source Useless. How do you know it's the exact source running on-device? > Allow me to run my own backup software on their servers Useless. How do you know your own backup software isn't compromised via a secret deal with Apple? > Allow me to transparently run my own encryption before I upload stuff to their servers. Useless. How do you know the OS isn't grabbing the raw files? How do you know your own encryption isn't compromised? How do you know that Xcode isn't inserting backdoors in the encryption you compiled from source? > And a very long etc. All useless. Tell me your perfect solution and I promise I can show it's useless (by your standards). [0] https://en.wikipedia.org/wiki/Saudi_infiltration_of_Twitter https://en.wikipedia.org/wiki/Saudi_infiltration_of_Twitter [1] https://ijunkie.com/your-icloud-data-phenomenal-law-enforcement-agencies/ https://ijunkie.com/your-icloud-data-phenomenal-law-enforcem...
    - AshamedCaptain 4y ago
bdominy 4y ago
In an ideal world, E2EE would be in high demand and used anytime sensitive info is exchanged between parties, but the reality is that most people don't know about it or the protections it provides. If FB and Apple can educate people about E2EE, even as a PR tactic, it helps grow that awareness.
jdiez17 4y ago
Closed source applications like WhatsApp can be and in fact are reverse engineered by researchers who want to verify the end-to-end encryption claim. For example, see this BlackHat talk: https://i.blackhat.com/USA-19/Wednesday/us-19-Zaikin-Reverse-Engineering-WhatsApp-Encryption-For-Chat-Manipulation-And-More.pdf https://i.blackhat.com/USA-19/Wednesday/us-19-Zaikin-Reverse...
judge2020 4y ago
The goalposts have been moved because the leading argument for the past few years has been "it's not actually encrypted because you or the person you're talking to could be using iCloud Backup". Now all you have to do is make sure you and the people you talk to have this simple option enabled in settings (with the only risk being that you lose all your data if you need Apple Support to give you access to your iCloud again after losing all backup codes and encryption keys). As for your actual argument, there are always tradeoffs when we implement "good" but not "perfect" encryption solutions. Here, your trust is indeed in Apple to not perform an evil maid attack, but for many of us, we trust that Apple doing this to a regular person (or journalist, or government official) would be absolutely devastating to their entire brand. Even if most people wouldn't care if Apple cooperated with the CIA to perform a coup in $x country via sending out targeted malware to the leader's phone, they still stand to lose hundreds of billions of, if not a trillion, dollars over the following decade in lost iOS product sales, due to them purposefully hacking their own product to steal user data.

brookst 4y ago

> why would you suddenly trust their unverifiable claim that the data is now E2EE > It's a useless PR tactic. Maybe because a single whistleblower would bring down the mother of all class action lawsuits? Hardcore anti-corporate types like to imagine that these companies are evil geniuses, where all 100,000 employees are operating in perfect alignment, with no mistakes or disagreements, and all secrets are kept perfectly. It just doesn't work like that. Threat model it for a second: how many more phones is Apple going to sell with this? Maybe a 1% increase, to wildly overestimate it? And what would be the financial harm from a single engineer popping on HN and saying "it's all BS, phones send the keys to the cloud, I worked on the system to store them."? > There's absolutely no _technical_ thing they could do to gain any trust. Well, that's true. But there's also no non-technical thing they could do. It is literally impossible to prove perfect technical compliance on an ongoing basis using any combination of technical and non-technical means. That goes for open source too. Evil compilers, etc, can turn perfectly solid source into malicious binaries. The compiler's source can even be perfectly secure. At some point you have to think about probabilities and motivations, and move away from this "anything not 100% perfect, which BTW is not possible, is 100% useless" world view.

AshamedCaptain 4y ago
> Maybe because a single whistleblower would bring down the mother of all class action lawsuits? Sure, like that is going to happen. I mean, "Facebook can read your supposedly-encrypted Whatsapp messages" will raise how many eyebrows exactly? > But there's also no non-technical thing they could do No, that's untrue. For starters, release the source. Allow me to run my own backup software on their servers. Allow me to transparently run my own encryption before I upload stuff to their servers. And a very long etc. > anything not 100% perfect, which BTW is not possible, is 100% useless This is 100% useless not because it is not 100% perfect (it very well could be), but because it is 100% useless by conception. What threat model does this protect against exactly? The scenario where Apple servers get compromised? I'm quite sure this risk does not even enter the mind of the target audience here, and if it did, the hacker could very well push the silent update anyway. The scenario where Apple itself has access to the data? This does absolutely nothing to prevent it. The scenario where someone can social engineer an Apple employee to give your iCloud key to someone else? It was already not possible.
- brookst 4y ago
  > What threat model does this protect against exactly? Two big threats: 1) insider attacks like the Saudi Twitter infiltration[0], and 2) Overreach by legitimate government process like subpoena[1]. > release the source Useless. How do you know it's the exact source running on-device? > Allow me to run my own backup software on their servers Useless. How do you know your own backup software isn't compromised via a secret deal with Apple? > Allow me to transparently run my own encryption before I upload stuff to their servers. Useless. How do you know the OS isn't grabbing the raw files? How do you know your own encryption isn't compromised? How do you know that Xcode isn't inserting backdoors in the encryption you compiled from source? > And a very long etc. All useless. Tell me your perfect solution and I promise I can show it's useless (by your standards). [0] https://en.wikipedia.org/wiki/Saudi_infiltration_of_Twitter https://en.wikipedia.org/wiki/Saudi_infiltration_of_Twitter [1] https://ijunkie.com/your-icloud-data-phenomenal-law-enforcement-agencies/ https://ijunkie.com/your-icloud-data-phenomenal-law-enforcem...
  - AshamedCaptain 4y ago

bdominy 4y ago

In an ideal world, E2EE would be in high demand and used anytime sensitive info is exchanged between parties, but the reality is that most people don't know about it or the protections it provides. If FB and Apple can educate people about E2EE, even as a PR tactic, it helps grow that awareness.

jdiez17 4y ago

Closed source applications like WhatsApp can be and in fact are reverse engineered by researchers who want to verify the end-to-end encryption claim. For example, see this BlackHat talk: https://i.blackhat.com/USA-19/Wednesday/us-19-Zaikin-Reverse-Engineering-WhatsApp-Encryption-For-Chat-Manipulation-And-More.pdf https://i.blackhat.com/USA-19/Wednesday/us-19-Zaikin-Reverse...

judge2020 4y ago

The goalposts have been moved because the leading argument for the past few years has been "it's not actually encrypted because you or the person you're talking to could be using iCloud Backup". Now all you have to do is make sure you and the people you talk to have this simple option enabled in settings (with the only risk being that you lose all your data if you need Apple Support to give you access to your iCloud again after losing all backup codes and encryption keys). As for your actual argument, there are always tradeoffs when we implement "good" but not "perfect" encryption solutions. Here, your trust is indeed in Apple to not perform an evil maid attack, but for many of us, we trust that Apple doing this to a regular person (or journalist, or government official) would be absolutely devastating to their entire brand. Even if most people wouldn't care if Apple cooperated with the CIA to perform a coup in $x country via sending out targeted malware to the leader's phone, they still stand to lose hundreds of billions of, if not a trillion, dollars over the following decade in lost iOS product sales, due to them purposefully hacking their own product to steal user data.