3 ms·

So, what's going to happen with secure banking? Will local govt officials (councillors) get to spy on all my credit card transactions and sneak a peak at my acc

• dannyw 4y ago
  All credit card transactions and financial transactions are basically open book.
  • josefx 4y ago
    And how do you sign the transactions to confirm that they where send by someone authorized?
• beardyw 4y ago
  End-to-end implies traffic between individuals. So for instance WhatsApp can't read your messages but the end recipient can. That said, my bank did try to reassure me they had end-to-end encryption for my web access. It's not the same thing.
  • ndsipa_pomu 4y ago
    > End-to-end implies traffic between individuals That's certainly one interpretation, but I'd counter that an HTTPS connection to an online shop is also end-to-end as the contents are encrypted such that any intermediate ISP cannot sniff the contents, but only myself and the online shop are able to.
    • jeroenhd 4y ago
      That's not what cryptographers or even most people dealing with messengers would consider end-to-end encryption.
      • ndsipa_pomu 4y ago
        So what would be the correct term to use if one of the "ends" is not a human?
        • upofadown 4y ago
          The humanity of the individuals at the ends is not relevant. The point is that each individual only has to trust the other individual. Not, say a TLS certificate authority.
  • xoa 4y ago
    >End-to-end implies traffic between individuals I strongly disagree, this makes zero sense, and I'd never heard of it in decades up until on HN just the other day. End-to-end means exactly what it says on the tin: END to END, with no middleman. The specific identity of what each "end" is, whether human, organization, or even a machine and not a human at all, is irrelevant. The point is that Alice and Bob can communicate information and nobody except "them" (noting that "Bob" here could be Future Alice too as in an E2EE storage service like a password manager) has access to plain text, only the ciphertext. This in contrast to things like email, where your goal is to communicate to Bob, but the relays it travels through also have access to the plain text even if the transmission between each hop is encrypted. So if I'm talking to my bank through a link where only my bank and I have access to the info, that's absolutely E2EE. Same as if I'm logging into or commenting HN. HN is my "final destination" for the communication of information, and only myself and HN can see the plain text text during said communication (though of course in the case of comments HN then takes it and publishes it at my directive). In contrast other sites may be both E2EE and not. If I'm accessing Migadu or MXroute or Google in order to find out something specifically from them, the HTTPS connection is sufficient for E2EE, since they're the other party. If I use webmail to send an email to someone else, the fact that I connect to their service via HTTPS doesn't make for an E2EE communication, because they're not the intended recipient, but a middleman, yet can read the plain text anyway.
    • upofadown 4y ago
      >So if I'm talking to my bank through a link where only my bank and I have access to the info, that's absolutely E2EE. Through TLS? That is certainly not E2EE. That is because a trusted third party (certificate authority) is involved to insure that you are actually communicating with the bank. End to end means exactly that. You are able to communicate securely with only the trust of the entity you are communicating with. You definition pretty much covers any effective use of cryptography for privacy. That would make the distinction meaningless.
      • xoa 4y ago
        >Through TLS? That is certainly not E2EE. It certainly is. Encryption is a separate problem from authentication. >That is because a trusted third party (certificate authority) is involved to insure that you are actually communicating with the bank The CA that helps with mutual authentication does not have access to the plain text, and it's perfectly possible to have other checks on top. >You definition pretty much covers any effective use of cryptography for privacy. That would make the distinction meaningless. Wrong. In fact, it's your definition that excludes nearly every single existing use of cryptography, also making the distinction meaningless. For most people even Signal involves a central party and trust for establishing authentication. iMessage? WhatsApp? None of this is E2EE according to you, which is ridiculous. MitM attacks and endpoint security are the core modern challenge for E2EE systems, but E2EE is still notably distinct from all the many kinds of communication that existed and still exist that aren't E2EE, and where neither of those are even required because the plaintext itself is available. Edit to add: I don't tend to use wikipedia as much anymore, but regardless of objective objections to its definitions, I do think it's certainly worth considering for a view on what subjective consensus is. Ie, whether or not the articles are all correct, if you're trying to answer a more meta question of "what do people think it is" then that's always helpful. Which of course is a big question when it comes to language definitions. So fwiw, its entry on E2EE [0] agrees: >End-to-end encryption ensures that data is transferred securely between endpoints. But, rather than try to break the encryption, an eavesdropper may impersonate a message recipient (during key exchange or by substituting their public key for the recipient's), so that messages are encrypted with a key known to the attacker. Which is how I've always understood it. Authentication is a major second level challenge to encryption, but without any encryption at all it just doesn't generally come up when it comes to privacy. There is no particular authentication for HTTP or telnet. E2EE is one of those "necessary, but not sufficient" items. ---- 0: https://en.wikipedia.org/wiki/End-to-end_encryption https://en.wikipedia.org/wiki/End-to-end_encryption