3 ms·
An important aspect of mutually authenticated encryption is that while your conversations are private they’re also verifiably yours. When law enforcement gets a
by fnordpiglet 4y ago
An important aspect of mutually authenticated encryption is that while your conversations are private they’re also verifiably yours. When law enforcement gets access to bad guys devices (or good guys and neutral guys, see US customs dragnet cloning of devices at the border) they know for a very high certainty you did in fact have those conversations and can verify cryptographically who you had them with. Layer on pervasive biometric authentication the story of chain of custody for a communication is even tighter. Again as you point out the math doesn’t care if this is good or bad, it just is. It’s a tool that works in your favor, you know with a very high degree of certainty that the other party is in fact who you think it is. But so does everyone who has access to your conversation know for a high degree of certainty you said those things.
I used to work for a company who advised you always apply the Wall Street journal test to what you write down in a communication - as you can never be certain it won’t be on the front page attributed to you. With mutually authenticated E2E encryption that’s doubly true.
- hiq 4y agoAccording to https://en.wikipedia.org/wiki/Signal_Protocol#Properties https://en.wikipedia.org/wiki/Signal_Protocol#Properties, the Signal protocol provides message repudiation, so what you described doesn't apply to Signal, and probably not to WhatsApp either.
- fnordpiglet 4y agoExcept I specified the original devices are accessed, not that a third party intercepts.
- groby_b 4y agoThat still only proves your side of the communication. (Which has nothing to do with the encryption scheme, just with posession) The other side is identified by a phone number. "Don't use your own phone number" is fairly good advice if you engage in interactions that are high-value enough that anybody would both physically obtain a device and deidentify a phone number. It certainly doesn't make you magically more identifiable than other message exchange mechanisms.
- uconnectlol 4y ago[dead]
- novok 4y agoOnly if you have both devices? Otherwise a random phone number that someone may or may not have anymore is not much evidence at all. And if / when signal gets away from phone numbers, it's even less evidence.
- uconnectlol 4y ago[dead]
- vlmutolo 4y agoSignal provides both deniability and authenticated encryption. This article has some good info on how this is possible: https://www.praetorian.com/blog/an-opinionated-series-on-why-signal-protocol-is-well-designed-deniability/ https://www.praetorian.com/blog/an-opinionated-series-on-why...