5 ms·

You know it’s really frustrating? Acting like end to end encryption mean some thing when Apple and Google won’t give us root. Literally everything about e2e en

You know it’s really frustrating? Acting like end to end encryption mean some thing when Apple and Google won’t give us root. Literally everything about e2e encryption right now is a fantasy without low level access.

Semaphor 3y ago
But root on android is almost effortless.
- lrvick 3y ago
  You can get root, but you cannot take root away from Qualcomm and Google, so they are in every conversation.
  - cpach 3y ago
    This is just not true. If you use sound E2EE, Qualcomm and Google are not in your conversations. (FWIW: Regular text messages are not E2EE. Use something better.)
    - palata 3y ago
      Hmm maybe you're not talking about the same thing. I think the parent means that if your phone shows you the message in cleartext on the screen, then someone who has access to the phone can read it. You can read the message by looking at the screen, and Google can technically read it because they "own" the OS that prints it to the screen. Whether they do it or not is another question, but they can.
LinuxBender 3y ago
Apple and Google won’t give us root An open and flexible boot loader would also be nifty. The ability to dynamically boot into any of several operating systems on the same phone could be useful for testing new OS versions without fear of bricking the device. This should make vendors less apprehensive about updating devices by removing the risk of bricking them. Get rid of internal storage and have a slot for an OS card with multiple boot partitions and a slot for multimedia. Add to this every phone OS must have a proper file manager and terminal shell by default. Adding to this the lack of open source hardware and firmware is problematic for e2ee. I believe there is a lack of transparency around attestation and chain of custody in the entire build process and not just for the SoC but also the modular baseband modems. I would personally like to see entirely modular, upgradable and serviceable phones similar to FairPhone but even more open and easier to swap parts. 6G deprecates 5G? No problem, pop out the 5G module and pop in the 6G in its external slot. Rijndael+E2EE found weak? Pop in the Twofish+Serpent+E2EE Custom encryption module. Or the AI-CoProcessor. Or the MIDI module. Or the Hack-RF module!
nonrepeating 3y ago
Do you mean that Google and Apple could revoke e2ee at any time? And/or, that their implementation of it might be include a backdoor for them?
- submeta 3y ago
  not having root access means that the user doesn't have complete control over the device's operating system and its underlying features. This limitation can potentially compromise the security of end-to-end encryption because the companies controlling the device could theoretically have the ability to intercept or alter the data before it's encrypted or after it's decrypted. So, the parent is probably suggesting that without root access, and thus full control over the device, the promise of end-to-end encryption is somewhat of a "fantasy" because the user can't guarantee that the device itself isn't compromising the encryption in some way.
  - lrvick 3y ago
    Honestly having root on a phone or any OS is generally a bad idea. You can do anything as an unprivileged user. Better to not have root accessible at all. The problem is when someone else has root.
- berbec 3y ago
  Apple can do anything they want with "your" phone. As it's an entirely closed-source ecosystem with obfuscated hardware, trusting Apple is the only reason to believe anything isn't decrypted and sent straight to <insert-TLA-here>. Google is marginally better, as AOSP exists, but once you deal with an actual Android phone, everything is locked down and Google services have total control. e2ee only exists if you can verify their isn't a third end.
  - kornhole 3y ago
    And we have proof of it happening. A few weeks back, Kaspersky labs and the FSB found thousands of Iphones had been taken over by the NSA or another ABC agency. Russia subsequently banned all Iphones for any government usage. https://www.zerohedge.com/geopolitical/russia-says-us-hacked-thousands-iphones-espionage-operation https://www.zerohedge.com/geopolitical/russia-says-us-hacked... You might say well I am not on their list to target. That could change at any time if you speak up and start becoming a problem. They did it to Tucker Carlson.
croes 3y ago
You know there are OS beside Android and iOS?
- blitzar 3y ago
  Without looking it up ... name one.
Georgelemental 3y ago
E2EE reduces the number of potential third parties, even if not to zero. That's better than nothing.
__MatrixMan__ 3y ago
Root, and a community of people that you trust who are incentivized to audit the contents of whatever updates you install, and the infrastructure to bind that trust to those updates in a scalable and trustworthy way. And tools for catching apps being shady so you can revoke trust in auditors that blessed a bad one. Root is kind of like the wooden sword in Zelda, it's where the journey begins. Which dungeon is next is an open question but I'd propose something that installs packages by cryptographic hash so that whatever community we build for trusted packages can publish signed predicates referring to the trustworthiness of their referents without having to also host the packages themselves (given that servers which resolve names to packages become high-value targets and probably shouldn't be trusted). nix-on-droid seems like it could be modified to do this.
- lrvick 3y ago
  I wish that community effort actually worked, but the truth is almost no one reviews 99% of the open source libraries linked into every app, let alone the binary blob drivers and OMA-DM toolkits with root access to your phone controlled by Apple/Google and Qualcomm. Truly no e2ee chat is safe if even one person accesses it from a smartphone with code the community cannot review, or is not actively reviewing. Until we have 100% open code on endpoints with auditable hardware (like the Precursor) and have crowd sourced signed code reviews... we are vulnerable to any company, state actor, or teen that phishes the credentials to an NPM repo. The state of software supply chain integrity today is about as good as hospital sanitation practices in the 1800s.
  - __MatrixMan__ 3y ago
    Communities coming together to protect themselves against a common enemy is something that we've been doing for perhaps a million years. We're actually quite good at it. But there hasn't yet been a market for tooling that brings those instincts into the realm of software. So far it has been "trust us, we're the vendor," and not "let's use this to trust each other but not our enemy". I agree that our software supply chains are in their infancy. Regrettably, so is our ability to use software to inflict harm (if you haven't played Cyberpunk 2077, it has a pretty good take on this--you spend a lot of time killing people by hacking into their implants). I hate to be gloomy, but I think that as the threats become more real, more deadly, the supply chain integrity piece will have to level up as well.
lrvick 3y ago
E2EE is only truly reliable if you control the endpoints fully, and verify keys. Short of that is is mostly security theater and marketing. I have an e2ee chat where everyone in it is a security researcher that exclusively accesses it from a dedicated QubesOS VM, and everyone has cross verified each others keys. I have other e2ee chats where almost everyone but me is using iPhones, Android phones, windows, macos and no one verify keys, and thus I just operate as though anything said in those chat will be made public at any moment.
- palata 3y ago
  > Short of that is is mostly security theater and marketing. There is a difference between "security theater and marketing" and "threat model". A random ISP in a random country does not necessarily have the power to take over control on your iPhone, so with e2ee they just can't read your messages. It's not completely useless, it just depends on the threat model.
- throw0101a 3y ago
  > E2EE is only truly reliable if you control the endpoints fully […] And with all the zero-days being regularly found, even in open source software, you cannot be sure of that 100% of the time. How long did Debian's OpenSSL patch/bug exist before it was noticed?
hedora 3y ago
Without E2E, the cloud providers are legally required to hand over your private data, often without a warrant. They often also sell your data to law enforcement. With E2E, they cannot be legally compelled to do those things, and doing so voluntarily without disclosing it would likely be illegal. So, E2E has legal benefits for the end user, in addition to some technical benefits.
- 111111IIIIIII 3y ago
  According to ChatGPT 4, US-based cloud providers are not necessarily legally required to inform or disclose sharing your data with or selling your data to the US government.
- akira2501 3y ago
  e2e, without root, leaves me completely exposed to key escrows or just straight up key exfiltration. It feels like a paper victory.
  - fragmede 3y ago
    Run a second device with the cell modem disabled or without one, and have it access the Internet via WiFi or bluetooth, to reduce the attack surface.
- blitzar 3y ago
  With E2E, the cloud providers are legally required to hand over your private data, often without a warrant. What they have to hand over is scrambled nonsense, but they still have to hand it over.
charcircuit 3y ago
Because these operating systems evolved to the point where root is not needed. Switching to root is dangerous and violates the principle of least privilege. Now privileged actions like getting your location is managed by the operating system and the operating system can ask the user to permit permissions to apps.
cpach 3y ago
What’s your point? Just because you don’t know how to analyze an iOS application doesn’t mean it’s not possible. I understand that some people want to fully control their smartphone. But lack of root isn’t something that prevents E2EE communication. And if you don’t trust neither Google nor Apple, fine. You can still run Signal on Linux. (Or Matrix, OMEMO, etc.)
- kortilla 3y ago
  The point is that both Apple and Google can just read your messages out of memory. It’s no different than having a private conversation in a room with a microphone.
  - bborud 3y ago
    The you owe us homework: show that other hardware is meaningfully more secure. If you can't or won't, your point crumbles to nothing.
    - fragmede 3y ago
      I don't see that as the case. There doesn't need to be a provably secure device for another device to be shown to be fundamentally insecure. What is secure, is leaving all phones, hell, all electronics, out of the windowless room to have the sensitive conversation in. It's a lot of friction but if your thread model includes APTs, you have to give up a lot of convenience.
      - cpach 3y ago
        If Five Eyes are targeting you, then you will need to think very hard about OPSEC indeed. Luckily, most of us are not targeted by the Five Eyes. And when it comes to dragnet surveillance, applications like Signal has raised the bar significantly.
        fragmede 3y ago
        You're right but there are APTs other than Five Eyes if you're elsewhere in the world though. Like say the Middle East.
rainsford 3y ago
What's more frustrating is the security absolutist mindset that seems too common in these sorts of discussions, where meaningful improvements in security are derided as useless because they don't solve every single problem in every scenario. Or worse, because they don't satisfy a particular ideological view of how computing should work, whether or not that truly impacts security. Is running Signal on an iPhone going to stop the Mossad from Mossading your chats if they want to? Probably not, but then neither will exclusively communicating using some fully open source cellphone with full root access that doesn't actually exist. The benefit of Signal on an iPhone is that people will actually use that and it will help against a lot of things that aren't the Mossad pulling out all the stops coming after you personally. Honestly a lot of security discourse feels like calling airbags and seat belts useless because they won't help if you drive head on into a bullet train. Let's have a discussion about limitations and paths to improvement, absolutely. But ignoring "better" because it's not "perfect" is rarely a good strategy.
- hulitu 3y ago
  > But ignoring "better" because it's not "perfect" is rarely a good strategy. But "better" it is not. When the attacker controls the CA and your OS there is nothing "better". Those days the Web Browser and the apps hapilly sending telemetry over the internet are the main entry point for an attacker. And yet we see statements like "if you use E2EE you are secure.
  - palata 3y ago
    > But "better" it is not. It is better against many attackers. Just not the ones you choose to consider. There is no such thing as "if you do this you are secure", it depends on your threat model.
ilyt 3y ago
And near-every single "security" tech being used to take rights from user to decide what their device is doing. So we have tech allowing app to be secure from risks outside of its box mostly used to push DRM...

Semaphor 3y ago

But root on android is almost effortless.

lrvick 3y ago
You can get root, but you cannot take root away from Qualcomm and Google, so they are in every conversation.
- cpach 3y ago
  This is just not true. If you use sound E2EE, Qualcomm and Google are not in your conversations. (FWIW: Regular text messages are not E2EE. Use something better.)
  - palata 3y ago
    Hmm maybe you're not talking about the same thing. I think the parent means that if your phone shows you the message in cleartext on the screen, then someone who has access to the phone can read it. You can read the message by looking at the screen, and Google can technically read it because they "own" the OS that prints it to the screen. Whether they do it or not is another question, but they can.

LinuxBender 3y ago

Apple and Google won’t give us root An open and flexible boot loader would also be nifty. The ability to dynamically boot into any of several operating systems on the same phone could be useful for testing new OS versions without fear of bricking the device. This should make vendors less apprehensive about updating devices by removing the risk of bricking them. Get rid of internal storage and have a slot for an OS card with multiple boot partitions and a slot for multimedia. Add to this every phone OS must have a proper file manager and terminal shell by default. Adding to this the lack of open source hardware and firmware is problematic for e2ee. I believe there is a lack of transparency around attestation and chain of custody in the entire build process and not just for the SoC but also the modular baseband modems. I would personally like to see entirely modular, upgradable and serviceable phones similar to FairPhone but even more open and easier to swap parts. 6G deprecates 5G? No problem, pop out the 5G module and pop in the 6G in its external slot. Rijndael+E2EE found weak? Pop in the Twofish+Serpent+E2EE Custom encryption module. Or the AI-CoProcessor. Or the MIDI module. Or the Hack-RF module!

nonrepeating 3y ago

Do you mean that Google and Apple could revoke e2ee at any time? And/or, that their implementation of it might be include a backdoor for them?

submeta 3y ago
not having root access means that the user doesn't have complete control over the device's operating system and its underlying features. This limitation can potentially compromise the security of end-to-end encryption because the companies controlling the device could theoretically have the ability to intercept or alter the data before it's encrypted or after it's decrypted. So, the parent is probably suggesting that without root access, and thus full control over the device, the promise of end-to-end encryption is somewhat of a "fantasy" because the user can't guarantee that the device itself isn't compromising the encryption in some way.
- lrvick 3y ago
  Honestly having root on a phone or any OS is generally a bad idea. You can do anything as an unprivileged user. Better to not have root accessible at all. The problem is when someone else has root.
berbec 3y ago
Apple can do anything they want with "your" phone. As it's an entirely closed-source ecosystem with obfuscated hardware, trusting Apple is the only reason to believe anything isn't decrypted and sent straight to <insert-TLA-here>. Google is marginally better, as AOSP exists, but once you deal with an actual Android phone, everything is locked down and Google services have total control. e2ee only exists if you can verify their isn't a third end.
- kornhole 3y ago
  And we have proof of it happening. A few weeks back, Kaspersky labs and the FSB found thousands of Iphones had been taken over by the NSA or another ABC agency. Russia subsequently banned all Iphones for any government usage. https://www.zerohedge.com/geopolitical/russia-says-us-hacked-thousands-iphones-espionage-operation https://www.zerohedge.com/geopolitical/russia-says-us-hacked... You might say well I am not on their list to target. That could change at any time if you speak up and start becoming a problem. They did it to Tucker Carlson.

croes 3y ago

You know there are OS beside Android and iOS?

blitzar 3y ago
Without looking it up ... name one.

Georgelemental 3y ago

E2EE reduces the number of potential third parties, even if not to zero. That's better than nothing.

__MatrixMan__ 3y ago

Root, and a community of people that you trust who are incentivized to audit the contents of whatever updates you install, and the infrastructure to bind that trust to those updates in a scalable and trustworthy way. And tools for catching apps being shady so you can revoke trust in auditors that blessed a bad one. Root is kind of like the wooden sword in Zelda, it's where the journey begins. Which dungeon is next is an open question but I'd propose something that installs packages by cryptographic hash so that whatever community we build for trusted packages can publish signed predicates referring to the trustworthiness of their referents without having to also host the packages themselves (given that servers which resolve names to packages become high-value targets and probably shouldn't be trusted). nix-on-droid seems like it could be modified to do this.

lrvick 3y ago
I wish that community effort actually worked, but the truth is almost no one reviews 99% of the open source libraries linked into every app, let alone the binary blob drivers and OMA-DM toolkits with root access to your phone controlled by Apple/Google and Qualcomm. Truly no e2ee chat is safe if even one person accesses it from a smartphone with code the community cannot review, or is not actively reviewing. Until we have 100% open code on endpoints with auditable hardware (like the Precursor) and have crowd sourced signed code reviews... we are vulnerable to any company, state actor, or teen that phishes the credentials to an NPM repo. The state of software supply chain integrity today is about as good as hospital sanitation practices in the 1800s.
- __MatrixMan__ 3y ago
  Communities coming together to protect themselves against a common enemy is something that we've been doing for perhaps a million years. We're actually quite good at it. But there hasn't yet been a market for tooling that brings those instincts into the realm of software. So far it has been "trust us, we're the vendor," and not "let's use this to trust each other but not our enemy". I agree that our software supply chains are in their infancy. Regrettably, so is our ability to use software to inflict harm (if you haven't played Cyberpunk 2077, it has a pretty good take on this--you spend a lot of time killing people by hacking into their implants). I hate to be gloomy, but I think that as the threats become more real, more deadly, the supply chain integrity piece will have to level up as well.

lrvick 3y ago

E2EE is only truly reliable if you control the endpoints fully, and verify keys. Short of that is is mostly security theater and marketing. I have an e2ee chat where everyone in it is a security researcher that exclusively accesses it from a dedicated QubesOS VM, and everyone has cross verified each others keys. I have other e2ee chats where almost everyone but me is using iPhones, Android phones, windows, macos and no one verify keys, and thus I just operate as though anything said in those chat will be made public at any moment.

palata 3y ago
> Short of that is is mostly security theater and marketing. There is a difference between "security theater and marketing" and "threat model". A random ISP in a random country does not necessarily have the power to take over control on your iPhone, so with e2ee they just can't read your messages. It's not completely useless, it just depends on the threat model.
throw0101a 3y ago
> E2EE is only truly reliable if you control the endpoints fully […] And with all the zero-days being regularly found, even in open source software, you cannot be sure of that 100% of the time. How long did Debian's OpenSSL patch/bug exist before it was noticed?

hedora 3y ago

Without E2E, the cloud providers are legally required to hand over your private data, often without a warrant. They often also sell your data to law enforcement. With E2E, they cannot be legally compelled to do those things, and doing so voluntarily without disclosing it would likely be illegal. So, E2E has legal benefits for the end user, in addition to some technical benefits.

111111IIIIIII 3y ago
According to ChatGPT 4, US-based cloud providers are not necessarily legally required to inform or disclose sharing your data with or selling your data to the US government.
akira2501 3y ago
e2e, without root, leaves me completely exposed to key escrows or just straight up key exfiltration. It feels like a paper victory.
- fragmede 3y ago
  Run a second device with the cell modem disabled or without one, and have it access the Internet via WiFi or bluetooth, to reduce the attack surface.
blitzar 3y ago
With E2E, the cloud providers are legally required to hand over your private data, often without a warrant. What they have to hand over is scrambled nonsense, but they still have to hand it over.

charcircuit 3y ago

Because these operating systems evolved to the point where root is not needed. Switching to root is dangerous and violates the principle of least privilege. Now privileged actions like getting your location is managed by the operating system and the operating system can ask the user to permit permissions to apps.

cpach 3y ago

What’s your point? Just because you don’t know how to analyze an iOS application doesn’t mean it’s not possible. I understand that some people want to fully control their smartphone. But lack of root isn’t something that prevents E2EE communication. And if you don’t trust neither Google nor Apple, fine. You can still run Signal on Linux. (Or Matrix, OMEMO, etc.)

kortilla 3y ago
The point is that both Apple and Google can just read your messages out of memory. It’s no different than having a private conversation in a room with a microphone.
- bborud 3y ago
  The you owe us homework: show that other hardware is meaningfully more secure. If you can't or won't, your point crumbles to nothing.
  - fragmede 3y ago
    I don't see that as the case. There doesn't need to be a provably secure device for another device to be shown to be fundamentally insecure. What is secure, is leaving all phones, hell, all electronics, out of the windowless room to have the sensitive conversation in. It's a lot of friction but if your thread model includes APTs, you have to give up a lot of convenience.
    - cpach 3y ago
      If Five Eyes are targeting you, then you will need to think very hard about OPSEC indeed. Luckily, most of us are not targeted by the Five Eyes. And when it comes to dragnet surveillance, applications like Signal has raised the bar significantly.
      - fragmede 3y ago
        You're right but there are APTs other than Five Eyes if you're elsewhere in the world though. Like say the Middle East.

rainsford 3y ago

What's more frustrating is the security absolutist mindset that seems too common in these sorts of discussions, where meaningful improvements in security are derided as useless because they don't solve every single problem in every scenario. Or worse, because they don't satisfy a particular ideological view of how computing should work, whether or not that truly impacts security. Is running Signal on an iPhone going to stop the Mossad from Mossading your chats if they want to? Probably not, but then neither will exclusively communicating using some fully open source cellphone with full root access that doesn't actually exist. The benefit of Signal on an iPhone is that people will actually use that and it will help against a lot of things that aren't the Mossad pulling out all the stops coming after you personally. Honestly a lot of security discourse feels like calling airbags and seat belts useless because they won't help if you drive head on into a bullet train. Let's have a discussion about limitations and paths to improvement, absolutely. But ignoring "better" because it's not "perfect" is rarely a good strategy.

hulitu 3y ago
> But ignoring "better" because it's not "perfect" is rarely a good strategy. But "better" it is not. When the attacker controls the CA and your OS there is nothing "better". Those days the Web Browser and the apps hapilly sending telemetry over the internet are the main entry point for an attacker. And yet we see statements like "if you use E2EE you are secure.
- palata 3y ago
  > But "better" it is not. It is better against many attackers. Just not the ones you choose to consider. There is no such thing as "if you do this you are secure", it depends on your threat model.

ilyt 3y ago

And near-every single "security" tech being used to take rights from user to decide what their device is doing. So we have tech allowing app to be secure from risks outside of its box mostly used to push DRM...