6 ms·

Tiktok has private messaging, and it is used by hundreds of millions of people. IMO no consumer service should have private 1:1 messaging without e2e. Eithe

Tiktok has private messaging, and it is used by hundreds of millions of people. IMO no consumer service should have private 1:1 messaging without e2e. Either only do public messaging (ie. Like a forum), or implement e2e.

trashb 8mo ago
In my experience most forums have private messaging. Additionally I think it is fine to say "we don't support e2ee". I prefer honesty to a bad (leaky) e2ee implementation, at least the user can make an informed choice.
- Ekaros 8mo ago
  I agree. At least take of "Yes messages are stored on our servers" is honest. And if they are accessed by anything else than limited subpoena is policy or legal issue.
- cucumber3732842 8mo ago
  >In my experience most forums have private messaging. Yeah but it's kind of accepted that the forum owner could read it all if they so chose. Maybe this is a hold over from back in the old days when encryption was nowhere near default during which forums arose.
RobotToaster 8mo ago
Tiktok has direct messages, they don't even call them private. It's better that they're honest about this, nobody should believe for a second that WhatsApp or FB messages are truly E2EE. DM on social media shouldn't be used for anything remotely private. It's a convenience feature, nothing more.
- throw0101c 8mo ago
  > Tiktok has direct messages, they don't even call them private. It may not be called that, but what are users expecting? Some folks may later be surprised when a warrant gets issued (e.g., from a divorce judge).
  - giancarlostoro 8mo ago
    If you are a grown adult and dont do research on “messaging apps” (which Tik Tok is not) then thats really on you.
    - oarsinsync 8mo ago
      If you are a grown adult and don't do research on "<insert any topic that could have a material negative impact on your life, but that is not currently on your radar as being a topic that could have a material negative impact on your life>" then that's really on you. Unfortunately, this doesn't scale.
      - wizardforhire 8mo ago
        Well it does scale… just not in the way that is good for democracy.
      - hogwasher 8mo ago
        It definitely ignores that many people don't have time. If someone is working over 40 hours per week, plus maybe doing unpaid labor taking care of kids or elders, where are people supposed to find the time and energy to brush up on a million different topics they don't even know they might not know enough about? Especially if they might also have medical issues, or hobbies, or want to have any time at all to relax. Obviously, one way to improve the situation would be to make sure people are paid fairly and not overworked and have access to good and affordable or free childcare and elder-care and medical care, but corporations don't want that either. If anything, they're incentivised to disempower workers and keep them uninformed, and to get as much time out of them as they can for as little money as possible.
    - foobarchu 8mo ago
      This viewpoint isn't a slippery slope, it's a runaway train. "You moved into a neighborhood with lead pipes? That's on you, should have done more research" "Your vitamins contained undisclosed allergens? You're an adult, and it didn't say it DIDN'T contain those" "Passwords stolen because your provider stored them in plaintext? They never claimed to store them securely, so it's really on you"
- throwaway290 8mo ago
  > nobody should believe for a second that WhatsApp or FB messages are truly E2EE That's interesting. You think all firms that audited WhatsApp and Signal protocol used by WhatsApp and all programmers who worked there for decades and can see a lie and leak if it was true are all crooks? valid opinion I guess, but I won't call it "no one should believe for a second (curious you didn't mention Telegram, it is actually marketed as secure and e2e and it has completely gimped "secret chats" that are off by default and used by like almost nobody.)
  - giancarlostoro 8mo ago
    I forget if its WhatsApp that technically lets you sync chats in unencrypted form to iCloud which is the “loophole” around this, though you can lockdown your iCloud even tighter, not sure it Apple can do much if you fully lock down your iCloud, not sure if this has been legally tested? Its not a very advertised feature its just a setting.
    - throwaway290 8mo ago
      Right now it got a switch to enable e2e for backups, but yeah I think default backup is probably a workaround...
    - gzread 8mo ago
      The Android version syncs all your chat logs to Google Drive without encryption by default. That's the backdoor.
    - oarsinsync 8mo ago
      WhatsApp iPhone syncs to iCloud unencrypted by default[1]. iMessage also syncs to iCloud unencrypted by default[2]. [1] Depends on you paying for iCloud storage, so that you have space for a full phone backup to occur. [2] Might be "free" with "iMessage in iCloud", an option to enable separately.
      - throwaway290 8mo ago
        > WhatsApp iPhone syncs to iCloud unencrypted by default[1]. Not true. You must choose to enable it or not when you set up new phone. On mine it does not back up
- eloisant 8mo ago
  Honestly I'm tired with every app trying to become the everything app. Now TikTok wants to be a messaging app. Snapchat has a short video feed just like TikTok. WhatsApp only has a text feed, how long until they also add a video feed?
  - vedaba 8mo ago
    Meta already has video feeds in facebook and instagram though, I imagine they wouldn’t want to detract users from those
- dvngnt_ 8mo ago
  > nobody should believe for a second that WhatsApp or FB messages are truly E2EE. Meta still tracks analytics which isn't good for privacy, but I'm not aware of any news of them or 3rd parties reading messages without consent of one of the 1st parties? Signal is probably much better though
  - pixl97 8mo ago
    >I'm not aware of any news of them Yet. Until they say "We delete these messages after X time and they are gone gone, and we're not reading them" Assume they are reading them, or will read them and the information just hasn't got out yet. I mean we keep finding more and more cases where companies like FB and Google were reading messages years ago and it wasn't till now we found out.
    - nindalf 8mo ago
      > We delete these messages after X time They never had the plaintext of the messages in the first place, so they don't need to delete them. That's what end-to-end encrypted means.
      - hogwasher 8mo ago
        Whether Facebook/Meta can read the plain text of the messages or not depends on whether that encryption is "zero knowledge" or not, aka: does Facebook generate and retain the private encryption key, or does it stay on the users' devices only, never visible to Facebook or stored on Facebook servers? In the former case, Facebook can decrypt the messages at will, and the e2ee only protects against hackers, not Facebook itself, nor against law enforcement, since if Facebook has the decryption key they can be legally compelled to hand it over (and probably would voluntarily, going by their history).
        Rubberducky1324 8mo ago
        They use the Signal protocol. The keys are not generated by Facebook, and are never on their servers. They are generated on the devices themselves.
- s3p 8mo ago
  Way to dunk on OP I guess but nobody is playing semantics here, it's just whether people think this is a messaging channel with one intended recipient
tuwtuwtuwtuw 8mo ago
The email protocols would like to have a chat with you.
- kgwxd 8mo ago
  You can bring your own encryption to that, and bring your own client to automate it.
  - em-bee 8mo ago
    you can encrypt the content but not the metadata, not even the subject unless you use a customized client that encodes it (like deltachat which doesn't use a subject at all), but then you still have your email address exposed. for all intents and purposes email is not e2ee.
    - Bender 8mo ago
      Email encryption for most people is sufficient even if the metadata is exposed. One can simply state in their email encryption "Bing Bing Bong" or "Why did you not put the trash out?" which might mean to the recipient :: "check the second SFTP server" or "let the cat outside" or "Jump on my private Mumble chat server" or "Get on my private self hosted IRC server". The email message need not be encrypted for that matter. The intended payload can be in an header-less encrypted file on a throw-away SFTP server in the tmpfs ram disk.
      - tuwtuwtuwtuw 8mo ago
        So it's end to end encrypted except that third parties can see who you communicated with and when? Sure.
        unethical_ban 8mo ago
        I have never considered metadata a part of the term E2EE. It has always been about the message contents. I understand that metadata is valuable information for spies/governments and that encrypting or hiding it is valuable for privacy. But if you use that definition, there are almost no E2EE protocols on the planet in use. First and foremost, any protocol that uses Apple or Google push notifications is giving metadata to those organizations. Even Whatsapp, iMessage, Signal, Telegram private messages, all of that leaks metadata but the contents of messages are hidden from the provider.
DoneWithAllThat 8mo ago
And yet virtually all consumer services with 1:1 messaging lacks e2e. This is a bit of a quixotic position to take.
Bender 8mo ago
Adding that private self hosted forums can permit uploads of encrypted files, encrypted with a pre-shared secret or a secret shared over a private self hosted Mumble voice chat server.
nradov 8mo ago
Lots of other consumer services such as Strava have direct messaging without e2e encryption. No privacy is guaranteed. This is fine, they're not deceiving anyone about how it works.
DeusExMachina 8mo ago
I don't disagree with providing people with more privacy, but what you present is a false dichotomy. For a long time we lived with private messages over SMS that were easily readable by third parties.

trashb 8mo ago

In my experience most forums have private messaging. Additionally I think it is fine to say "we don't support e2ee". I prefer honesty to a bad (leaky) e2ee implementation, at least the user can make an informed choice.

Ekaros 8mo ago
I agree. At least take of "Yes messages are stored on our servers" is honest. And if they are accessed by anything else than limited subpoena is policy or legal issue.
cucumber3732842 8mo ago
>In my experience most forums have private messaging. Yeah but it's kind of accepted that the forum owner could read it all if they so chose. Maybe this is a hold over from back in the old days when encryption was nowhere near default during which forums arose.

RobotToaster 8mo ago

Tiktok has direct messages, they don't even call them private. It's better that they're honest about this, nobody should believe for a second that WhatsApp or FB messages are truly E2EE. DM on social media shouldn't be used for anything remotely private. It's a convenience feature, nothing more.

throw0101c 8mo ago
> Tiktok has direct messages, they don't even call them private. It may not be called that, but what are users expecting? Some folks may later be surprised when a warrant gets issued (e.g., from a divorce judge).
- giancarlostoro 8mo ago
  If you are a grown adult and dont do research on “messaging apps” (which Tik Tok is not) then thats really on you.
  - oarsinsync 8mo ago
    If you are a grown adult and don't do research on "<insert any topic that could have a material negative impact on your life, but that is not currently on your radar as being a topic that could have a material negative impact on your life>" then that's really on you. Unfortunately, this doesn't scale.
    - wizardforhire 8mo ago
      Well it does scale… just not in the way that is good for democracy.
    - hogwasher 8mo ago
      It definitely ignores that many people don't have time. If someone is working over 40 hours per week, plus maybe doing unpaid labor taking care of kids or elders, where are people supposed to find the time and energy to brush up on a million different topics they don't even know they might not know enough about? Especially if they might also have medical issues, or hobbies, or want to have any time at all to relax. Obviously, one way to improve the situation would be to make sure people are paid fairly and not overworked and have access to good and affordable or free childcare and elder-care and medical care, but corporations don't want that either. If anything, they're incentivised to disempower workers and keep them uninformed, and to get as much time out of them as they can for as little money as possible.
  - foobarchu 8mo ago
    This viewpoint isn't a slippery slope, it's a runaway train. "You moved into a neighborhood with lead pipes? That's on you, should have done more research" "Your vitamins contained undisclosed allergens? You're an adult, and it didn't say it DIDN'T contain those" "Passwords stolen because your provider stored them in plaintext? They never claimed to store them securely, so it's really on you"
throwaway290 8mo ago
> nobody should believe for a second that WhatsApp or FB messages are truly E2EE That's interesting. You think all firms that audited WhatsApp and Signal protocol used by WhatsApp and all programmers who worked there for decades and can see a lie and leak if it was true are all crooks? valid opinion I guess, but I won't call it "no one should believe for a second (curious you didn't mention Telegram, it is actually marketed as secure and e2e and it has completely gimped "secret chats" that are off by default and used by like almost nobody.)
- giancarlostoro 8mo ago
  I forget if its WhatsApp that technically lets you sync chats in unencrypted form to iCloud which is the “loophole” around this, though you can lockdown your iCloud even tighter, not sure it Apple can do much if you fully lock down your iCloud, not sure if this has been legally tested? Its not a very advertised feature its just a setting.
  - throwaway290 8mo ago
    Right now it got a switch to enable e2e for backups, but yeah I think default backup is probably a workaround...
  - gzread 8mo ago
    The Android version syncs all your chat logs to Google Drive without encryption by default. That's the backdoor.
  - oarsinsync 8mo ago
    WhatsApp iPhone syncs to iCloud unencrypted by default[1]. iMessage also syncs to iCloud unencrypted by default[2]. [1] Depends on you paying for iCloud storage, so that you have space for a full phone backup to occur. [2] Might be "free" with "iMessage in iCloud", an option to enable separately.
    - throwaway290 8mo ago
      > WhatsApp iPhone syncs to iCloud unencrypted by default[1]. Not true. You must choose to enable it or not when you set up new phone. On mine it does not back up
eloisant 8mo ago
Honestly I'm tired with every app trying to become the everything app. Now TikTok wants to be a messaging app. Snapchat has a short video feed just like TikTok. WhatsApp only has a text feed, how long until they also add a video feed?
- vedaba 8mo ago
  Meta already has video feeds in facebook and instagram though, I imagine they wouldn’t want to detract users from those
dvngnt_ 8mo ago
> nobody should believe for a second that WhatsApp or FB messages are truly E2EE. Meta still tracks analytics which isn't good for privacy, but I'm not aware of any news of them or 3rd parties reading messages without consent of one of the 1st parties? Signal is probably much better though
- pixl97 8mo ago
  >I'm not aware of any news of them Yet. Until they say "We delete these messages after X time and they are gone gone, and we're not reading them" Assume they are reading them, or will read them and the information just hasn't got out yet. I mean we keep finding more and more cases where companies like FB and Google were reading messages years ago and it wasn't till now we found out.
  - nindalf 8mo ago
    > We delete these messages after X time They never had the plaintext of the messages in the first place, so they don't need to delete them. That's what end-to-end encrypted means.
    - hogwasher 8mo ago
      Whether Facebook/Meta can read the plain text of the messages or not depends on whether that encryption is "zero knowledge" or not, aka: does Facebook generate and retain the private encryption key, or does it stay on the users' devices only, never visible to Facebook or stored on Facebook servers? In the former case, Facebook can decrypt the messages at will, and the e2ee only protects against hackers, not Facebook itself, nor against law enforcement, since if Facebook has the decryption key they can be legally compelled to hand it over (and probably would voluntarily, going by their history).
      - Rubberducky1324 8mo ago
        They use the Signal protocol. The keys are not generated by Facebook, and are never on their servers. They are generated on the devices themselves.
s3p 8mo ago
Way to dunk on OP I guess but nobody is playing semantics here, it's just whether people think this is a messaging channel with one intended recipient

tuwtuwtuwtuw 8mo ago

The email protocols would like to have a chat with you.

kgwxd 8mo ago
You can bring your own encryption to that, and bring your own client to automate it.
- em-bee 8mo ago
  you can encrypt the content but not the metadata, not even the subject unless you use a customized client that encodes it (like deltachat which doesn't use a subject at all), but then you still have your email address exposed. for all intents and purposes email is not e2ee.
  - Bender 8mo ago
    Email encryption for most people is sufficient even if the metadata is exposed. One can simply state in their email encryption "Bing Bing Bong" or "Why did you not put the trash out?" which might mean to the recipient :: "check the second SFTP server" or "let the cat outside" or "Jump on my private Mumble chat server" or "Get on my private self hosted IRC server". The email message need not be encrypted for that matter. The intended payload can be in an header-less encrypted file on a throw-away SFTP server in the tmpfs ram disk.
    - tuwtuwtuwtuw 8mo ago
      So it's end to end encrypted except that third parties can see who you communicated with and when? Sure.
      - unethical_ban 8mo ago
        I have never considered metadata a part of the term E2EE. It has always been about the message contents. I understand that metadata is valuable information for spies/governments and that encrypting or hiding it is valuable for privacy. But if you use that definition, there are almost no E2EE protocols on the planet in use. First and foremost, any protocol that uses Apple or Google push notifications is giving metadata to those organizations. Even Whatsapp, iMessage, Signal, Telegram private messages, all of that leaks metadata but the contents of messages are hidden from the provider.

DoneWithAllThat 8mo ago

And yet virtually all consumer services with 1:1 messaging lacks e2e. This is a bit of a quixotic position to take.

Bender 8mo ago

Adding that private self hosted forums can permit uploads of encrypted files, encrypted with a pre-shared secret or a secret shared over a private self hosted Mumble voice chat server.

nradov 8mo ago

Lots of other consumer services such as Strava have direct messaging without e2e encryption. No privacy is guaranteed. This is fine, they're not deceiving anyone about how it works.

DeusExMachina 8mo ago

I don't disagree with providing people with more privacy, but what you present is a false dichotomy. For a long time we lived with private messages over SMS that were easily readable by third parties.