5 ms·

I don't like this change. What's going to be their proposal on multi device data sync, especially including web browsers? During my trip, I just let my phone lo

I don't like this change. What's going to be their proposal on multi device data sync, especially including web browsers? During my trip, I just let my phone log the path. Then I edit/browse it on my desktop since it's very inefficient to do so on my phone. With this change, this flow becomes almost infeasible or at least very tedious.

modeless 3y ago
I agree, but I think the headline is misleading. The data can still be backed up in the cloud. However, it will be end-to-end encrypted. It seems to me like the real issue is the inability of web apps to process end-to-end encrypted data. Are there any web standards efforts to solve this?
- nl 3y ago
  > the real issue is the inability of web apps to process end-to-end encrypted data We do this at verida.io Yes, the key management is the issue.
- _factor 3y ago
  https://en.wikipedia.org/wiki/Homomorphic_encryption https://en.wikipedia.org/wiki/Homomorphic_encryption
  - iggldiggl 3y ago
    Which is probably rather pointless for that usecase, because you don't want to blindly batchprocess the geodata, you want to interactively display it to the user.
    - _factor 3y ago
      Google can store the data, compile a list of suggestions from it, and never see it.
- dns_snek 3y ago
  Google's messaging is misleading, too. The data is likely encrypted, but it's impossible for it to be encrypted "end to end" like they claim. > You can encrypt and upload a copy of your Timeline from this device to your Google Account, in case you lose your device or need to switch devices. You can recover the data after losing your device (which would be the only "end" in end to end encryption), which means that the data isn't actually E2EE, and thus Google or anyone with access to your Google account can still access it.
  - modeless 3y ago
    You are wrong. It can still be end-to-end encrypted using a password. Android backups are end-to-end encrypted (iPhone backups too but only if you enable the optional "Advanced Data Protection" feature) using your phone unlock code as a password. The phone unlock code is never sent to Google/Apple, it is only processed locally on your phone. Your phone unlock code is typically not complex enough to withstand brute force attacks, so brute force attack resistance is added using an HSM in the datacenter (just as brute forcing the code locally is prevented using an HSM in the phone). A similar technique is also used by Signal, you can read about it here: https://blog.cryptographyengineering.com/2020/07/10/a-few-thoughts-about-signals-secure-value-recovery/ https://blog.cryptographyengineering.com/2020/07/10/a-few-th...
    - dns_snek 3y ago
      Today I learned, I'll have to read more about that.

modeless 3y ago

I agree, but I think the headline is misleading. The data can still be backed up in the cloud. However, it will be end-to-end encrypted. It seems to me like the real issue is the inability of web apps to process end-to-end encrypted data. Are there any web standards efforts to solve this?

nl 3y ago
> the real issue is the inability of web apps to process end-to-end encrypted data We do this at verida.io Yes, the key management is the issue.
_factor 3y ago
https://en.wikipedia.org/wiki/Homomorphic_encryption https://en.wikipedia.org/wiki/Homomorphic_encryption
- iggldiggl 3y ago
  Which is probably rather pointless for that usecase, because you don't want to blindly batchprocess the geodata, you want to interactively display it to the user.
  - _factor 3y ago
    Google can store the data, compile a list of suggestions from it, and never see it.
dns_snek 3y ago
Google's messaging is misleading, too. The data is likely encrypted, but it's impossible for it to be encrypted "end to end" like they claim. > You can encrypt and upload a copy of your Timeline from this device to your Google Account, in case you lose your device or need to switch devices. You can recover the data after losing your device (which would be the only "end" in end to end encryption), which means that the data isn't actually E2EE, and thus Google or anyone with access to your Google account can still access it.
- modeless 3y ago
  You are wrong. It can still be end-to-end encrypted using a password. Android backups are end-to-end encrypted (iPhone backups too but only if you enable the optional "Advanced Data Protection" feature) using your phone unlock code as a password. The phone unlock code is never sent to Google/Apple, it is only processed locally on your phone. Your phone unlock code is typically not complex enough to withstand brute force attacks, so brute force attack resistance is added using an HSM in the datacenter (just as brute forcing the code locally is prevented using an HSM in the phone). A similar technique is also used by Signal, you can read about it here: https://blog.cryptographyengineering.com/2020/07/10/a-few-thoughts-about-signals-secure-value-recovery/ https://blog.cryptographyengineering.com/2020/07/10/a-few-th...
  - dns_snek 3y ago
    Today I learned, I'll have to read more about that.