6 ms·
> When asked by The Post whether any government had requested a backdoor, Google spokesman Ed Fernandez did not provide a direct answer but suggested none exist
by latexr 2y ago
> When asked by The Post whether any government had requested a backdoor, Google spokesman Ed Fernandez did not provide a direct answer but suggested none exist: "Google cannot access Android end-to-end encrypted backup data, even with a legal order," he stated.
No, that does not suggest none exists, it only says they don’t have access to it. They could have chosen or have been ordered to give the keys to the government agency but not keep one themselves. I’m not saying that’s likely, just that it’s important to not take these statements as saying more than they do. They wouldn’t hesitate to use “technically correct” as a defence and you have to take that into account.
- JW_00000 2y agoBut if they could give a key to the government agency, it wouldn't be end-to-end encrypted, right? Or are you thinking they would have a copy of users' keys that they gave out? (Which I guess is technically possible.)
- aqme28 2y agoThey could also cripple user key-generation. E.g. they choose random primes from a known subset. It would make communication crackable while also being difficult to detect.
- jonhohle 2y agoIt would be no different from how multiple devices and users access the same content (chat, shared data, etc.). The government’s keys would always be included in set which encrypts the real key. They don’t need the users’ key, Apple doesn’t need their private keys. So technically still end to end encrypted, just with a hidden party involved. Users have no way of knowing this doesn’t already happen. And when their key leaks, it’s as good as no encryption, but still end-to-end encrypted.
- deleted 2y ago[deleted]
- theshrike79 2y agoIf the other end is the government, then it's kinda valid? =)
- marcosdumay 2y agoYou can not use a DH key exchange, and create the symmetric key by some procedure that is predictable, or encode the symmetric key with the government's public key and send it to them. It doesn't stop being end-to-end when you add another end. We often do group chats that way. Or you can create a side-channel and send al the data there. That would stop it from being end-to-end.
- em500 2y agoBefore people immediately think the worst of Google or other corporate representatives, be aware that people working in these companies need to weight their words carefully. From The Verge's article on the issue: The UK has reportedly served Apple a document called a technical capability notice. It’s a criminal offense to even reveal that the government has made a demand. Similarly, if Apple did cede to the UK’s demands then it apparently would not be allowed to warn users that its encrypted service is no longer fully secure.
- highcountess 2y ago[dead]
- free_bip 2y agoHow does this work wrt false advertising laws? If I relied upon their end to end encryption and it turns out to be false advertising because there's a secret backdoor, who do I sue?
- grayhatter 2y agono one, you'll be in secret prison before you somehow gain standing
- chgs 2y agoIf the back door was used the a three letter agency sure. If the backdoor was exploited by a criminal though?
- grayhatter 2y agoso in this hypothetical, some blackhat is able to download data in mass from apple servers? And you're worried that the only thing stopping that, or creating a duty to protect the data is encryption?
- latexr 2y agoWhich is exactly why I’m making this point. If no government had requested a backdoor, they could’ve simply answered “no”. When you have to weight your words, it means you’re not at liberty to say whatever you want. That is itself a signal, and why warrant canaries are a thing. https://en.wikipedia.org/wiki/Warrant_canary https://en.wikipedia.org/wiki/Warrant_canary
- arccy 2y agoif google were to transfer the keys elsewhere, they would have (temporary) custody of the keys, granting them access, and invalidating the statement.
- jonhohle 2y agoMy layman’s understanding is that a user’s private key is used to decrypt a random key, which is then used to protect data. Shared files then only require adding key access to that small secret by someone who knows the original key. If one of the original public keys is always one held by authorities, Google never needs to have custody of the private key and can’t access the data themselves making the statement true, but misleading.
- latexr 2y ago> they would have (temporary) custody of the keys No, they would have had custody of the keys. Meaning it would still be true they cannot (now) access the data.
- deleted 2y ago[deleted]
- cesarb 2y ago> No, that does not suggest none exists, it only says they don’t have access to it. They could have chosen or have been ordered to give the keys to the government agency but not keep one themselves. The whole definition of "end-to-end encrypted" is that only the two ends have the keys. If anyone or anything other than the two ends (the one sending and the one receiving) has access to the keys, it's not end-to-end encrypted.
- deleted 2y ago[deleted]
- bux93 2y agoWhatsapp has had end-to-end encryption since 2016. But it only added encryption to cloud backups in 2021. They didn't share any key material with Google, just backed up the messages and media without any encryption to begin with.
- kccqzy 2y agoYes exactly. Google is very careful to say that "Google cannot access Android end-to-end encrypted backup data" and notice it doesn't say that all Android backups are end-to-end encrypted. For what we know, Google could have decided to use non-end-to-end backups in the UK and end-to-end backups everywhere else.
- chrisjj 2y agoI think that's the implication, not the definition. Data remains encrypted even when a third party gets access a key.