5 ms·

I have never seen "e2ee" abused this way personally.

by fastball 11mo ago

ljlolel 11mo ago
Zoom also did this once
- internetter 11mo ago
  They also paid me something around 100 dollars in settlement for this
- bayindirh 11mo ago
  I believe they now have a proper e2ee mode which disables all the cloud powered features, no?
  - computerfriend 11mo ago
    They aquihired (and gutted) keybase for this, but I have a doubt that their "reimplementation" is actually E2EE.
- wkat4242 11mo ago
  They don't care about security at all. They once shipped a backdoor in their macOS app. It was noticed and called out and they refused to remove it. It took Apple blacklisting it for Zoom to finally take action.
hulitu 11mo ago
Whatsapp, Signal, Telegram, iCloud
- junon 11mo ago
  Please cite where Signal is not e2ee.
  - bigfishrunning 11mo ago
    The problem is that you have to trust that they'll stay that way, and we have no way of proving that the app that runs on your phone comes from the same source that they publish.
    - jfindper 11mo ago
      That's a completely different problem than marketers co-opting the term "end-to-end encryption".
- baumschubser 11mo ago
  I would say Telegram is communicating their level of encryption pretty good ("client-to-client" and "client-to-server" is a good way to avoid the ambiguity of e2e). https://telegram.org/faq?setln=en#q-so-how-do-you-encrypt-data https://telegram.org/faq?setln=en#q-so-how-do-you-encrypt-da...
N-Krause 11mo ago
There was a discussion here on hn about OpenAI and it's privacy. Same confusion about e2ee. Users thinking e2ee is possible when you chat with an ai agent. https://news.ycombinator.com/item?id=45908891 https://news.ycombinator.com/item?id=45908891
- charcircuit 11mo ago
  >Users thinking e2ee is possible when you chat with an ai agent. It shouldn't be any harder than e2ee chatting with any other user. It's just instead of the other end chatting using a keyboard as an input they chat using a language model to type the messages. Of course like any other e2ee solution, the person you are talking to also has access to your messages as that's the whole point, being able to talk to them.
  - swiftcoder 11mo ago
    I do not think this matches anyones' mental model of what "end-to-end encrypted" for a conversation between me and what is ostensibly my own computer should look like. If you promise end-to-end encryption, and later it turns out your employees have been reading my chat transcripts...
    - butvacuum 11mo ago
      I'm not sure how you can call chatgpt "ostensibly my own computer" when it's primarily a website. And honestly, E2EE's strict definition (messages between user 1 and user 2 cannot be decrypted by message platform)... Is unambiguously possible for chatGPT. It's just utterly pointless when user2 happens to also be the message platform. If you message support for $chat_platform (if there is such a thing) do you expect them to be unable to read the messages? It's still a disingenuous use of the term. And, if TFA is anything like multiple other providers, it's going to be "oh, the video is E2EE. But the 5fps ,non-sensitive' 512*512px preview isn't."
      - therealpygon 11mo ago
        > it's primarily a website … unambiguously possible[sic] for chatGPT … happens to also be the message platform I assume you mean impossible, and in either case that’s not quite accurate. The “end” is a specific AI model you wished to communicate with, not the platform. You’re suggesting they are one and the same, but they are not and Google proves that with their own secure LLM offering. But I’m 100% with you on it being a disingenuous use.

I have never seen "e2ee" abused this way personally.

ljlolel 11mo ago

Zoom also did this once

internetter 11mo ago
They also paid me something around 100 dollars in settlement for this
bayindirh 11mo ago
I believe they now have a proper e2ee mode which disables all the cloud powered features, no?
- computerfriend 11mo ago
  They aquihired (and gutted) keybase for this, but I have a doubt that their "reimplementation" is actually E2EE.
wkat4242 11mo ago
They don't care about security at all. They once shipped a backdoor in their macOS app. It was noticed and called out and they refused to remove it. It took Apple blacklisting it for Zoom to finally take action.

hulitu 11mo ago

Whatsapp, Signal, Telegram, iCloud

junon 11mo ago
Please cite where Signal is not e2ee.
- bigfishrunning 11mo ago
  The problem is that you have to trust that they'll stay that way, and we have no way of proving that the app that runs on your phone comes from the same source that they publish.
  - jfindper 11mo ago
    That's a completely different problem than marketers co-opting the term "end-to-end encryption".
baumschubser 11mo ago
I would say Telegram is communicating their level of encryption pretty good ("client-to-client" and "client-to-server" is a good way to avoid the ambiguity of e2e). https://telegram.org/faq?setln=en#q-so-how-do-you-encrypt-data https://telegram.org/faq?setln=en#q-so-how-do-you-encrypt-da...

N-Krause 11mo ago

There was a discussion here on hn about OpenAI and it's privacy. Same confusion about e2ee. Users thinking e2ee is possible when you chat with an ai agent. https://news.ycombinator.com/item?id=45908891 https://news.ycombinator.com/item?id=45908891

charcircuit 11mo ago
>Users thinking e2ee is possible when you chat with an ai agent. It shouldn't be any harder than e2ee chatting with any other user. It's just instead of the other end chatting using a keyboard as an input they chat using a language model to type the messages. Of course like any other e2ee solution, the person you are talking to also has access to your messages as that's the whole point, being able to talk to them.
- swiftcoder 11mo ago
  I do not think this matches anyones' mental model of what "end-to-end encrypted" for a conversation between me and what is ostensibly my own computer should look like. If you promise end-to-end encryption, and later it turns out your employees have been reading my chat transcripts...
  - butvacuum 11mo ago
    I'm not sure how you can call chatgpt "ostensibly my own computer" when it's primarily a website. And honestly, E2EE's strict definition (messages between user 1 and user 2 cannot be decrypted by message platform)... Is unambiguously possible for chatGPT. It's just utterly pointless when user2 happens to also be the message platform. If you message support for $chat_platform (if there is such a thing) do you expect them to be unable to read the messages? It's still a disingenuous use of the term. And, if TFA is anything like multiple other providers, it's going to be "oh, the video is E2EE. But the 5fps ,non-sensitive' 512*512px preview isn't."
    - therealpygon 11mo ago
      > it's primarily a website … unambiguously possible[sic] for chatGPT … happens to also be the message platform I assume you mean impossible, and in either case that’s not quite accurate. The “end” is a specific AI model you wished to communicate with, not the platform. You’re suggesting they are one and the same, but they are not and Google proves that with their own secure LLM offering. But I’m 100% with you on it being a disingenuous use.