4 ms·

I know Ring is getting a bad rap for enabling state level surveillance, but the Ring app offers an option to enable end-to-end encryption between the camera and

I know Ring is getting a bad rap for enabling state level surveillance, but the Ring app offers an option to enable end-to-end encryption between the camera and your phone. The stored video is encrypted with key generated on your phone. You have to be physically close to the camera in order to share the key and complete the set-up. Once encrypted, the video can't be analyzed by AI or used in a broad surveillance effort. It's entirely possible that the encryption keys have a backdoor, but I doubt it. Although there is no way to verify.

sillywabbit 8mo ago
End-to-end encryption only means something if you trust the endpoints.
- rvnx 8mo ago
  They often also tend to call HTTPS end-to-end encryption https://aws.amazon.com/blogs/media/securing-your-origin-for-media-and-entertainment-workflows/ https://aws.amazon.com/blogs/media/securing-your-origin-for-... even Amazon Web Services: Benefits of using HTTPS connections: HTTPS provides end-to-end encryption
  - sillywabbit 8mo ago
    I wonder if that's why it's called Transport Layer Security.
ivan_gammel 8mo ago
When national interests require that, it can get a firmware update which sends a copy of data to comrades in U.S. Ministerium für Staatssicherheit even before that e2e encrypted copy reaches your phone.
- deleted 8mo ago
  [deleted]
SV_BubbleTime 8mo ago
>enable end-to-end encryption between the camera and your phone. So… exactly not the part I care about? Cool, it’s encrypted on transit to me… now what about at rest with them? Is it encrypted and they absolutely can not view or hand that footage to police/gov? No.
- m348e912 8mo ago
  > Cool, it’s encrypted on transit to me… now what about at rest with them? Is it encrypted and they absolutely can not view or hand that footage to police/gov? No. Technically yes, e2e encryption means video hosted on their servers is only viewable by devices with decryption keys. So if the police/gov brought a subpoena to request the video, Ring could only offer them the encrypted video. They would have to take possession of your phone and gain access in order to decrypt and view the video. In this case the "ends" in the e2e encryption is the camera and your phone.
  - Galanwe 8mo ago
    I used to work for a well known communication app, the kind everyone here used. Couple things I learnt about "end to end encryption": - You can call your service e2e encrypted even if every client has the same key bundled into the binary, and rotate it from time to time when it's reversed. - You can call your service e2e encrypted even if you have a server that stores and pushes client keys. That is how you could access your message history on multiple devices. - You can call your service e2e encrypted and just retrieve or push client keys at will whenever you get a government request.
    - m348e912 8mo ago
      I just set it up e2e on Ring last week. It generates the a key and a word list (for backup) on your phone. You have to physically be in vicinity of the Ring camera to activate encryption on the camera. My impression is that Ring is truly offering a version of video collection which they can't access. But I think your third point is valid, there is nothing stopping Ring from telling the app to share a user's keys and then give them to whoever is asking.
drnick1 8mo ago
Who has the keys of the encryption algorithm?
- m348e912 8mo ago
  For a Ring user, the keys are generated on your phone via the Ring app. So technically just the user/owner. However there is no certainty that Ring can't obtain access to the keys, just like crypto wallet maker Exodus could decide one day to retrieve private keys from their user's wallets with a software update.

sillywabbit 8mo ago

End-to-end encryption only means something if you trust the endpoints.

rvnx 8mo ago
They often also tend to call HTTPS end-to-end encryption https://aws.amazon.com/blogs/media/securing-your-origin-for-media-and-entertainment-workflows/ https://aws.amazon.com/blogs/media/securing-your-origin-for-... even Amazon Web Services: Benefits of using HTTPS connections: HTTPS provides end-to-end encryption
- sillywabbit 8mo ago
  I wonder if that's why it's called Transport Layer Security.

ivan_gammel 8mo ago

When national interests require that, it can get a firmware update which sends a copy of data to comrades in U.S. Ministerium für Staatssicherheit even before that e2e encrypted copy reaches your phone.

deleted 8mo ago
[deleted]

SV_BubbleTime 8mo ago

>enable end-to-end encryption between the camera and your phone. So… exactly not the part I care about? Cool, it’s encrypted on transit to me… now what about at rest with them? Is it encrypted and they absolutely can not view or hand that footage to police/gov? No.

m348e912 8mo ago
> Cool, it’s encrypted on transit to me… now what about at rest with them? Is it encrypted and they absolutely can not view or hand that footage to police/gov? No. Technically yes, e2e encryption means video hosted on their servers is only viewable by devices with decryption keys. So if the police/gov brought a subpoena to request the video, Ring could only offer them the encrypted video. They would have to take possession of your phone and gain access in order to decrypt and view the video. In this case the "ends" in the e2e encryption is the camera and your phone.
- Galanwe 8mo ago
  I used to work for a well known communication app, the kind everyone here used. Couple things I learnt about "end to end encryption": - You can call your service e2e encrypted even if every client has the same key bundled into the binary, and rotate it from time to time when it's reversed. - You can call your service e2e encrypted even if you have a server that stores and pushes client keys. That is how you could access your message history on multiple devices. - You can call your service e2e encrypted and just retrieve or push client keys at will whenever you get a government request.
  - m348e912 8mo ago
    I just set it up e2e on Ring last week. It generates the a key and a word list (for backup) on your phone. You have to physically be in vicinity of the Ring camera to activate encryption on the camera. My impression is that Ring is truly offering a version of video collection which they can't access. But I think your third point is valid, there is nothing stopping Ring from telling the app to share a user's keys and then give them to whoever is asking.

drnick1 8mo ago

Who has the keys of the encryption algorithm?

m348e912 8mo ago
For a Ring user, the keys are generated on your phone via the Ring app. So technically just the user/owner. However there is no certainty that Ring can't obtain access to the keys, just like crypto wallet maker Exodus could decide one day to retrieve private keys from their user's wallets with a software update.