5 ms·
So basically their marketing-department is abusing a security term in order to sound good, as opposed to a software flaw. They're claiming "end to end" encrypt
by Terr_ 11mo ago
So basically their marketing-department is abusing a security term in order to sound good, as opposed to a software flaw.
They're claiming "end to end" encryption, which usually implies the service is unable to spy on individual users that are communicating to one-another over an individualized channel.
However in this case there are no other users, and their server is one of the "ends" doing the communicating, which is... perhaps not a literal contradiction in terms, but certainly breaking the spirit of the phrase.
- bmandale 11mo agoThis is an incredibly common misuse of the term e2ee. I think at this point we need a new word because you have a coin flip's chance of actually getting what you think when a company describes their product this way.
- tacitusarc 11mo ago“In transit encryption”
- boomboomsubban 11mo agoCreating a new term for the less secure definition doesn't work, as they'll just continue to call it E2EE encrypted.
- calebio 11mo agoI think part of the problem is that prior to WhatsApp's E2EE implementation in like 2014, TLS was very often called "End to End Encryption" as the ends were Client and Server/Service Provider. It got redefined and now the new usage is way more popular than the old one. I can't blame most people for calling TLS "E2EE", even some folks in industry, but it's not great for a company to advertise that you offer X if the meaning of X has shifted so drastically in the last decade.
- kstrauser 11mo agoI’m pushing back on that one. I’ve been running websites since the ‘90s, and I’ve never heard E2EE used that way until very recently by vendors who, bluntly, want to lie about it.
- calebio 11mo agoIt was pretty common to call client-side encryption/SSL "end to end encryption" among network engineers who were analyzing data flowing through their networks[0] as well as those who were implementing SSL/TLS into their applications[1]. The ends were the client and the server and the data was encrypted "end to end". The goal at that time was to prevent MITM snooping/attacks which were highly prevalent at the time. Papers in academia and the greater industry[2] also referred to it in this way at the time. Stack Overflow has plenty of examples of folks calling it "end to end encryption" and you can start to see the time period after the Signal protocol and WhatsApp implemented it that the term started to take on a much wider meaning[4] This also came up a lot in the context of games that rolled out client side encryption for packets on the way to the server. Folks would run MITM applications on their computer to intercept game packets coming out of the client and back from the server. Clever mechanisms were setup for key management and key exchange[3]. [0] as SSL became more common lots of tooling broke at the network level around packet inspection, routing, caching, etc. As well as engineers "having fun" on Friday nights looking at what folks were looking at. [1] Stack Overflow's security section has references from that era [2] "Encrypting the internet" (2010) - https://dl.acm.org/doi/10.1145/1851275.1851200 https://dl.acm.org/doi/10.1145/1851275.1851200 [3] Habbo Hotel's prime and generator being hidden in one of the dynamic images fetched from the server as well as their DH mechanism comes to mind. [4] Jabber/XMPP however used E2EE in the more modern sense around that time as they were exploring going beyond TLS and having true E2EE.
- g-b-r 11mo agoI wasn't a network engineer, but to my recollection "end-to-end encryption" was only used occasionally, probably by people not too knowledgeable in cryptography
- SchemaLoad 11mo agoNo term will stop marketers from lying. If users see one as being the more secure one, marketers will use it. Unless they get sued for false advertising.
- kstrauser 11mo agoI despise how often that’s used. “Do you have end to end encryption?” “Sure! We use TLS for everything, and KMS for at-rest.” “So… no?”
- fastball 11mo agoI have never seen "e2ee" abused this way personally.
- ljlolel 11mo agoZoom also did this once
- internetter 11mo agoThey also paid me something around 100 dollars in settlement for this
- bayindirh 11mo agoI believe they now have a proper e2ee mode which disables all the cloud powered features, no?
- computerfriend 11mo agoThey aquihired (and gutted) keybase for this, but I have a doubt that their "reimplementation" is actually E2EE.
- wkat4242 11mo agoThey don't care about security at all. They once shipped a backdoor in their macOS app. It was noticed and called out and they refused to remove it. It took Apple blacklisting it for Zoom to finally take action.
- hulitu 11mo agoWhatsapp, Signal, Telegram, iCloud
- junon 11mo agoPlease cite where Signal is not e2ee.
- WatchDog 11mo agoAny new term you come up with, will end up being misused by marketers.
- spwa4 11mo agoEnd-to-end encryption doesn't mean anything where it is semi-validly used. It's used on phones, where you as a user (or company) don't control what code executes. For example, WhatsApp was end-to-end encrypted. Well, it doesn't actually provide security because with either physical access to the phone or if you have if you can use the app store to "upgrade" the app, you can upload code to the phone. You can upload an apk that replaces the WhatsApp app. It even still uploads the messages to a central server so you can get those messages from Meta, then get the key from the phone some time later or earlier and use the key to decrypt it when the message is already erased from the phone. (aside from the fact that people don't seem to know/remember WhatsApp backs up to google drive) Code that then gets access to the end-to-end encryption keys ... so you're not safe from state actors, you're not safe from police, you're not safe from the authors of the code and you're not safe from anyone who has physical access to your phone.
- d1sxeyes 11mo agoYes, the government can also just implant tiny cameras in your eyeballs and just record everything you see anyway, so you’re not safe.
- deleted 11mo ago[deleted]
- evanjrowley 11mo agoFWIW that's the initial plot for the Ghost In The Shell: Stand Alone Complex (2002) animated series.
- g-b-r 11mo agoIt's not incredibly common, there's sure a lot of companies that try to misuse it, but the average person (even non technical) still interprets it in the correct way
- addaon 11mo agoWhile they’re taking one “end” much less literally than usual, they are taking the other “end” much more literally…
- koolba 11mo ago> However in this case there are no other users, and their server is one of the "ends" doing the communicating, which is... perhaps not a literal contradiction in terms, but certainly breaking the spirit of the phrase. Am I understanding correctly that the other end of this is a rear end?
- hulitu 11mo agoEvery front end needs a rear end. So, yes.
- geoduck14 11mo agoThis is exactly what E2EE means. I used to work at a bank, and our data was E2EE, and we had to certify that it was E2EE - from the person paying, through the networks, through the DNS and Load balancers, until it got to the servers. Only at the servers could it be unencrypted and a (authoried) human could look at it. Of course, only authorized users could see the data, but that was a different compliance line item.
- kstrauser 11mo agoNah. You have no reasonable expectation that the bank itself can’t access your financial records. Anyone reading Kohler’s lies would have every expectation that the Internet of Poopcam screenshots are theirs and theirs alone.
- lukeschlather 11mo agoAnyone reading that is misunderstanding what E2EE means. As the article says, that's client-side encryption. Kohler isn't lying, people are confusing two different security features.
- hahn-kev 11mo agoDoesn't that just mean HTTPS then?
- modeless 11mo ago
- lmm 11mo ago> They're claiming "end to end" encryption, which usually implies the service is unable to spy on individual users that are communicating to one-another over an individualized channel. It doesn't "imply", it outright states that. Their server isn't the end, it's the middle. They're not "breaking the spirit" or something, what they are doing is called lying.
- d1sxeyes 11mo agoWhat is the other “end”?