3 ms·
https://en.wikipedia.org/wiki/Diffie%E2%80%93Hellman_key_exchange https://en.wikipedia.org/wiki/Diffie%E2%80%93Hellman_key_exc... If Meta are turning it off th
by danparsonson 5mo ago
https://en.wikipedia.org/wiki/Diffie%E2%80%93Hellman_key_exchange https://en.wikipedia.org/wiki/Diffie%E2%80%93Hellman_key_exc...
If Meta are turning it off then I guess it's reasonable to assume that there is something to turn off.
- tardedmeme 5mo agoHow would the keys get stored in the user's private browsing window? Do they lose all chat history when they log in on a private browsing window and then close it?
- danparsonson 5mo agoI don't know the technical details of that for sure, but I think the answer is that keys and chat history are stored on-device only; for example you lose your WhatsApp history if you don't restore a backup when moving to a new phone. If a messaging app is showing you message history in a private browsing window then perhaps the encryption key for that history is derived from your password or something like that; that can be done locally so that all the server ever sees is encrypted data.
- tardedmeme 5mo agoIf you log in to the app on one phone and then in a web browser should you still be able to see your messages in the web browser?
- danparsonson 5mo agoSorry do you mean, that's how it works now, or, that's how you think it should work? Are you talking about Instagram or WA or something else? edit: misread your message; if you have two sessions active at the same time, then yes I would expect both sessions to receive the same messages.
- tardedmeme 5mo agoWhat if you log into the app and then log out of the app and then log into the app again? Should you be able to see your messages? E2EE is a fail-secure design. In case of any doubt it deletes your private messages. When applied to this case I don't think the downside of constantly losing all your messages outweighs the upside of Facebook pretending they don't have a copy of all of them.
- danparsonson 5mo agoAre you asking for technical details about E2EE in messaging apps, or simply making the point that you don't like it? If you don't like it, then fine, you do you, however I would point out that we all accept some inconvenience in our lives as a trade off for improved security; the lock on my front door is inconvenient but I'd rather have it than not. As to whether or not Meta have been lying about it, then that would be on-brand for them, but then what are they turning off if so? Or maybe the whole thing is theatre, and I should better disconnect from the internet altogether? I don't see the value in speculating about that.
- tardedmeme 5mo agoI'm asking you about how you want the world to work.
- danparsonson 5mo agoWell then, I think E2EE is a good thing and I'll take the minor inconveniences.
- tardedmeme 5mo agoNot being able to receive messages except on one device isn't a minor inconvenience. To fix this, you either need to authorize each device (and web browser) from another device that's logged in, or the central authority holds your keys.
- deleted 5mo ago[deleted]
- LPisGood 5mo agoDiffe-Hellman-Merkel key exchange is vulnerable to attacker-in-the-middle attacks. Eave could just do key negotiation with Alice and separately do key negotiation with Bob. You have to use a slightly more complicated cryptographic protocol to avoid this issue.