4 ms·

Privacy and "there are people you don't know in the group" seem in tension. I sort of get it since that's how a company works, but it doesn't seem like "real" p

Privacy and "there are people you don't know in the group" seem in tension. I sort of get it since that's how a company works, but it doesn't seem like "real" privacy when you don't know who will read what you wrote. Similarly, if someone new can join and they can read what you wrote, it doesn't seem very private. Your audience is not only the people in the group, but a person to be named later. (Screenshots are always a possibility, but this is normalizing it.) This goes double for having AI in the chat. The AI needs to read all the messages, so doesn't that mean the Wavelength needs a private key? At that point, I'm not sure that end-to-end encryption matters. The chat might as well be stored on Wavelength's servers.

rylz 4y ago
We're very transparent in the UI about the fact that messages that mention @AI are not covered by e2ee. See https://imgur.com/a/5kPEdQP https://imgur.com/a/5kPEdQP Only messages that actually mention @AI are sent in plaintext to us, and then to OpenAI's API. All content shared between people without invoking the AI is fully end-to-end encrypted. Our servers don't have access to any users' private keys -- those are generated on each client and never transmitted, except in the case when a user logs in on secondary device and uses our QR-code transfer flow (in which case the sensitive information is communicated peer-to-per in that QR code). We'll share much more on this when we publish our tech blog in the coming weeks. Regarding privacy around strangers joining a group -- Wavelength supports locking down groups to the degree the group creator chooses. You can disable history syncing, so that new members don't get a copy of prior history (which, when enabled, is reencrypted and sent by prior members of the group) when they join. And groups only grow to a size where there would be people you don't know in them, if someone chose to share an invite link semi-publicly, or allow all members to invite new members (which is also a setting the creator can toggle). Personally, I'm in a number of quite large groups including people I don't know in real life, as well as plenty of groups with 2-10 friends I know in real life, where I obviously trust everybody not to screenshot/share what I'm writing, and I appreciate having strong e2ee.

rylz 4y ago

We're very transparent in the UI about the fact that messages that mention @AI are not covered by e2ee. See https://imgur.com/a/5kPEdQP https://imgur.com/a/5kPEdQP Only messages that actually mention @AI are sent in plaintext to us, and then to OpenAI's API. All content shared between people without invoking the AI is fully end-to-end encrypted. Our servers don't have access to any users' private keys -- those are generated on each client and never transmitted, except in the case when a user logs in on secondary device and uses our QR-code transfer flow (in which case the sensitive information is communicated peer-to-per in that QR code). We'll share much more on this when we publish our tech blog in the coming weeks. Regarding privacy around strangers joining a group -- Wavelength supports locking down groups to the degree the group creator chooses. You can disable history syncing, so that new members don't get a copy of prior history (which, when enabled, is reencrypted and sent by prior members of the group) when they join. And groups only grow to a size where there would be people you don't know in them, if someone chose to share an invite link semi-publicly, or allow all members to invite new members (which is also a setting the creator can toggle). Personally, I'm in a number of quite large groups including people I don't know in real life, as well as plenty of groups with 2-10 friends I know in real life, where I obviously trust everybody not to screenshot/share what I'm writing, and I appreciate having strong e2ee.