5 ms·

> My assumption is that Google has keys to everything in its kingdom If that were true, then their claims to support E2E encrypted backups are simply false, an

> My assumption is that Google has keys to everything in its kingdom If that were true, then their claims to support E2E encrypted backups are simply false, and they would have been subject to warrants to unlock backups, just like Apple had been until they implemented their "Advanced Data Protection" in 2022. Wouldn't there have been be some evidence of that in the past 7 years, either through security research, or through convictions that hinged on information that was gotten from a supposedly E2E-protected backup?

ajb 2y ago
It's worth noting that what the security services don't have access to is as secret as what they do have access to. According to the late Ross Anderson, for many years the police were unable to trace calls (or was it internet access?) on one of the major UK mobile networks, because it had been designed without that and in such a way that it was hard to retrofit. This was considered highly confidential, lest all the drug dealers etc switch to that network.
dietr1ch 2y ago
They are so used to bend reality that could easily call it e2e encryption even if the key was generated by Google or had a skew that made it vulnerable with some extra knowledge that they have or will have in the next sync.
scripturial 2y ago
It is possible to set up end to end encryption where two different keys unlock your data. Your key, and a government key. I assume google does this. 1. encrypt data with special key 2. encrypt special key with users key, and 3. encrypt special key with government key Anyone with the special key can read the data.the user key or the government key can be used to get special key. This two step process can be done for good or bad purposes. A user can have their key on their device, and a second backup key could be in a usb stick locked in a safe, so if you loose your phone you can get your data back using the second key.
- echoangle 2y ago
  Would that still count as E2E-encrypted if another party has access? That would still count as lying to me.
  - lttlrck 2y ago
    That depends on the definition of "end".
    - QuarterReptile 2y ago
      To say nothing of the definition of "definition", or at least a common understanding. https://m.youtube.com/watch?v=gRelVFm7iJE https://m.youtube.com/watch?v=gRelVFm7iJE
      - blitzar 2y ago
        It depends on what the meaning of the word 'is' is
  - dtpro20 2y ago
    To call it lying is just arguing about the meanings of words. This is literally what lawyers are paid to do. The data payload can be called end to end encrypted. You can easily say to the user that "your emails are encrypted from end to end, they are encrypted before it leaves your computer and decrypted on the receivers computer" without talking about how your key server works. Systems that incorporate a method to allow unlocking using multiple keys don't usually advertise the fact that this is happening. People may even be legally obligated to not tell you.
    - mirekrusin 2y ago
      TIL man in the middle = e2e encryption.
      - scripturial 2y ago
menacingly 2y ago
I don't know the particulars, but in general, silence around a massive tech company on warrants does not mean "they said no and the feds decided to leave them alone"
reshlo 2y ago
Is the source code for every binary blob present on an Android device available for inspection, and is the code running on every Android device verifiable as having been built from that source? > or through convictions If they wanted to use this evidence for a normal criminal case, they would just do parallel construction.
dylan604 2y ago
Would it be possible that they feel that the revelation of this backdoor would be too big of a loss so that any of these theoretical cases of the past 7 years have used parallel construction to avoid revealing the encrypted data was viewed?
- catlifeonmars 2y ago
  That’s a big and brittle conspiracy. You have to have little to no defectors. It’s not a stable equilibrium
jiggawatts 2y ago
A trivial method for circumventing code review is to simply push a targeted update of the firmware to devices subject to a government search order. There are no practical end-user protections against this vector. PS: I strongly suspect that at least a few public package distribution services are run by security agencies to enable this kind of attack. They can distribute clean packages 99.999% of the time, except for a handful of targeted servers in countries being spied upon. A good example is Chocolatey, which popped up out of nowhere, had no visible source of funding, no mention of their ownership structure anywhere, and was incorporated along with hundreds of other companies in a small building in the middle of nowhere. It just screams of being a CIA front, but obviously that's hard to prove.
- nomel 2y ago
  Telegram author claims this is the case [1]: > They were curious to learn which open source libraries are integrated to the Telegram app. You know, on the client side," Durov said. "And they were trying to persuade him to use certain open source tools that he would then integrate into the Telegram code [1] https://www.newsweek.com/telegram-tucker-carlson-government-spying-1891398 https://www.newsweek.com/telegram-tucker-carlson-government-...
- jen20 2y ago
  > Chocolatey, which popped up out of nowhere Chocolatey assuredly did not "pop up out of nowhere" - it was a labour of love from Rob Reynolds to make Windows even barely usable. It likely existed for years before you ever heard of it. > had no visible source of funding Rob was employed by Puppet Labs to develop it until he started the commercial entity which now backs it. > a small building in the middle of nowhere. As I recall, Rob lives in Topeka, Kansas. It follows that his business would be incorporated there, no?
  - jiggawatts 2y ago
    There was no evidence of any of this on the website until recently (maybe 2 or 3 years ago?), and I did look at every page on there. Similarly, I searched on Google for a while and raised the question in more than a few forums. I dug through the business registration records, etc... and found none of the above. Sure, now, they have staff photos and the actual names of people on their about page, but just a few years ago it was almost completely devoid of information: https://web.archive.org/web/20190906125729/https://chocolatey.org/about https://web.archive.org/web/20190906125729/https://chocolate... Look at it from the perspective of a paranoid sysadmin half way around the world raising a quizzical eyebrow when random Reddit posts mention how convenient it is, but it's distributing binaries to servers with absolutely no obvious links back to any organisations, people, or even a legitimate looking business building.
samstave 2y ago
They might have keys to everything in their kingdom, but only if you look through the right len$$ -- as one who helped build the total awareness apparatus, I dont care about my privacy, only as a defeatist. The only weapon again is trancperency of the Entanglements (recall that term, about AI entanglements?) -- What is unclear, is, WRT to these current revealings /confirmations(DOGE, etc) -- Are these institutions being untangled and removed, or squeezed out of their territory?
deleted 2y ago
[deleted]
autoexec 2y ago
> Wouldn't there have been be some evidence of that in the past 7 years, either through security research, or through convictions that hinged on information that was gotten from a supposedly E2E-protected backup? I wouldn't count on it. The main way we'd know about it would be a whistleblower at Google, and whistleblowers are extremely rare. Evidence and court records that might expose a secret backdoor or that the government was getting data from Google that was supposed to be private could easily be kept hidden from the public by sealing it all away for "national security reasons" or by obscuring it though parallel construction.
- catlifeonmars 2y ago
  People are incredibly bad at keeping secrets. And there are a LOT of people at Google. I don’t buy it.
  - autoexec 2y ago
    There were a lot of people working for the NSA besides snowden, but none of them blew the whistle even though some of the programs he exposed had been around for 12 years. There were a whole lot of people working at AT&T but employees weren't lining up to tell us about Room 641A (https://en.wikipedia.org/wiki/Room_641A https://en.wikipedia.org/wiki/Room_641A) before Mark Klein. How did everyone else manage to be kept quiet? The details about MKUltra and the Manhattan Project were successfully kept a secret for decades before eventually being declassified. It'd be a huge mistake to look at the instances where somebody did come forward and spill a secret and assume that it means secrets aren't possible to keep or that there are no secrets being kept right now. It's may not be easy to keep a secret, but governments and corporations are extremely well practiced and have many documented successes.
    - catlifeonmars 2y ago
      You have a point, but a major reason that the examples you cited above were kept secret was because knowledge about them was compartmentalized. As knowledge leaks, so does the possibility of whistleblowers. It’s an unstable equilibrium. My argument (which admittedly is based on an anecdata about how undisciplined large tech corporations are) is that it’s uniquely hard to keep secrets in modern tech companies because by design, knowledge is not compartmentalized. Modern large tech companies have replaced fiefdoms of knowledge with fiefdoms of operational expertise, if that makes sense. Anyway, there have been hundreds, perhaps thousands of whistleblowers in the past and the examples you picked I think are representative of the upper bound, rather than the lower bound of the secret keeping capacity of organizations.
szundi 2y ago
[dead]

ajb 2y ago

It's worth noting that what the security services don't have access to is as secret as what they do have access to. According to the late Ross Anderson, for many years the police were unable to trace calls (or was it internet access?) on one of the major UK mobile networks, because it had been designed without that and in such a way that it was hard to retrofit. This was considered highly confidential, lest all the drug dealers etc switch to that network.

dietr1ch 2y ago

They are so used to bend reality that could easily call it e2e encryption even if the key was generated by Google or had a skew that made it vulnerable with some extra knowledge that they have or will have in the next sync.

scripturial 2y ago

It is possible to set up end to end encryption where two different keys unlock your data. Your key, and a government key. I assume google does this. 1. encrypt data with special key 2. encrypt special key with users key, and 3. encrypt special key with government key Anyone with the special key can read the data.the user key or the government key can be used to get special key. This two step process can be done for good or bad purposes. A user can have their key on their device, and a second backup key could be in a usb stick locked in a safe, so if you loose your phone you can get your data back using the second key.

echoangle 2y ago
Would that still count as E2E-encrypted if another party has access? That would still count as lying to me.
- lttlrck 2y ago
  That depends on the definition of "end".
  - QuarterReptile 2y ago
    To say nothing of the definition of "definition", or at least a common understanding. https://m.youtube.com/watch?v=gRelVFm7iJE https://m.youtube.com/watch?v=gRelVFm7iJE
    - blitzar 2y ago
      It depends on what the meaning of the word 'is' is
- dtpro20 2y ago
  To call it lying is just arguing about the meanings of words. This is literally what lawyers are paid to do. The data payload can be called end to end encrypted. You can easily say to the user that "your emails are encrypted from end to end, they are encrypted before it leaves your computer and decrypted on the receivers computer" without talking about how your key server works. Systems that incorporate a method to allow unlocking using multiple keys don't usually advertise the fact that this is happening. People may even be legally obligated to not tell you.
  - mirekrusin 2y ago
    TIL man in the middle = e2e encryption.
    - scripturial 2y ago

menacingly 2y ago

I don't know the particulars, but in general, silence around a massive tech company on warrants does not mean "they said no and the feds decided to leave them alone"

reshlo 2y ago

Is the source code for every binary blob present on an Android device available for inspection, and is the code running on every Android device verifiable as having been built from that source? > or through convictions If they wanted to use this evidence for a normal criminal case, they would just do parallel construction.

dylan604 2y ago

Would it be possible that they feel that the revelation of this backdoor would be too big of a loss so that any of these theoretical cases of the past 7 years have used parallel construction to avoid revealing the encrypted data was viewed?

catlifeonmars 2y ago
That’s a big and brittle conspiracy. You have to have little to no defectors. It’s not a stable equilibrium

jiggawatts 2y ago

A trivial method for circumventing code review is to simply push a targeted update of the firmware to devices subject to a government search order. There are no practical end-user protections against this vector. PS: I strongly suspect that at least a few public package distribution services are run by security agencies to enable this kind of attack. They can distribute clean packages 99.999% of the time, except for a handful of targeted servers in countries being spied upon. A good example is Chocolatey, which popped up out of nowhere, had no visible source of funding, no mention of their ownership structure anywhere, and was incorporated along with hundreds of other companies in a small building in the middle of nowhere. It just screams of being a CIA front, but obviously that's hard to prove.

nomel 2y ago
Telegram author claims this is the case [1]: > They were curious to learn which open source libraries are integrated to the Telegram app. You know, on the client side," Durov said. "And they were trying to persuade him to use certain open source tools that he would then integrate into the Telegram code [1] https://www.newsweek.com/telegram-tucker-carlson-government-spying-1891398 https://www.newsweek.com/telegram-tucker-carlson-government-...
jen20 2y ago
> Chocolatey, which popped up out of nowhere Chocolatey assuredly did not "pop up out of nowhere" - it was a labour of love from Rob Reynolds to make Windows even barely usable. It likely existed for years before you ever heard of it. > had no visible source of funding Rob was employed by Puppet Labs to develop it until he started the commercial entity which now backs it. > a small building in the middle of nowhere. As I recall, Rob lives in Topeka, Kansas. It follows that his business would be incorporated there, no?
- jiggawatts 2y ago
  There was no evidence of any of this on the website until recently (maybe 2 or 3 years ago?), and I did look at every page on there. Similarly, I searched on Google for a while and raised the question in more than a few forums. I dug through the business registration records, etc... and found none of the above. Sure, now, they have staff photos and the actual names of people on their about page, but just a few years ago it was almost completely devoid of information: https://web.archive.org/web/20190906125729/https://chocolatey.org/about https://web.archive.org/web/20190906125729/https://chocolate... Look at it from the perspective of a paranoid sysadmin half way around the world raising a quizzical eyebrow when random Reddit posts mention how convenient it is, but it's distributing binaries to servers with absolutely no obvious links back to any organisations, people, or even a legitimate looking business building.

samstave 2y ago

They might have keys to everything in their kingdom, but only if you look through the right len$$ -- as one who helped build the total awareness apparatus, I dont care about my privacy, only as a defeatist. The only weapon again is trancperency of the Entanglements (recall that term, about AI entanglements?) -- What is unclear, is, WRT to these current revealings /confirmations(DOGE, etc) -- Are these institutions being untangled and removed, or squeezed out of their territory?

deleted 2y ago

[deleted]

autoexec 2y ago

> Wouldn't there have been be some evidence of that in the past 7 years, either through security research, or through convictions that hinged on information that was gotten from a supposedly E2E-protected backup? I wouldn't count on it. The main way we'd know about it would be a whistleblower at Google, and whistleblowers are extremely rare. Evidence and court records that might expose a secret backdoor or that the government was getting data from Google that was supposed to be private could easily be kept hidden from the public by sealing it all away for "national security reasons" or by obscuring it though parallel construction.

catlifeonmars 2y ago
People are incredibly bad at keeping secrets. And there are a LOT of people at Google. I don’t buy it.
- autoexec 2y ago
  There were a lot of people working for the NSA besides snowden, but none of them blew the whistle even though some of the programs he exposed had been around for 12 years. There were a whole lot of people working at AT&T but employees weren't lining up to tell us about Room 641A (https://en.wikipedia.org/wiki/Room_641A https://en.wikipedia.org/wiki/Room_641A) before Mark Klein. How did everyone else manage to be kept quiet? The details about MKUltra and the Manhattan Project were successfully kept a secret for decades before eventually being declassified. It'd be a huge mistake to look at the instances where somebody did come forward and spill a secret and assume that it means secrets aren't possible to keep or that there are no secrets being kept right now. It's may not be easy to keep a secret, but governments and corporations are extremely well practiced and have many documented successes.
  - catlifeonmars 2y ago
    You have a point, but a major reason that the examples you cited above were kept secret was because knowledge about them was compartmentalized. As knowledge leaks, so does the possibility of whistleblowers. It’s an unstable equilibrium. My argument (which admittedly is based on an anecdata about how undisciplined large tech corporations are) is that it’s uniquely hard to keep secrets in modern tech companies because by design, knowledge is not compartmentalized. Modern large tech companies have replaced fiefdoms of knowledge with fiefdoms of operational expertise, if that makes sense. Anyway, there have been hundreds, perhaps thousands of whistleblowers in the past and the examples you picked I think are representative of the upper bound, rather than the lower bound of the secret keeping capacity of organizations.

szundi 2y ago

[dead]