News for hackers. Stuff that matters.

A comment on Reddit DMs will not reach their destination if they contain certain text. Parent comment

Re:Reddit DMs will not reach their destination if they conta... by beefhash on Sunday June 10, 2018 @12:19AM (#17276487)
I think that's backwards. You cannot assume that a "private" message is actually private unless end-to-end encryption is advertised. You still cannot safely assume so unless you've checked the code yourself. Privacy is never the default.

Hence the move to call things "direct" messages, rather than "private" as it used to be.

[ Parent | on HN ]
Re:Reddit DMs will not reach their destination if they conta... by Ninn on Sunday June 10, 2018 @05:54AM (#17277389)
You cant even be sure when you have checked the source code of the project -- whos to say that is actually what is deployed?
[ Parent | on HN ]
Re:Reddit DMs will not reach their destination if they conta... by Boulth on Sunday June 10, 2018 @06:55AM (#17277545)
Reproducible builds.
[ Parent | on HN ]
Re:Reddit DMs will not reach their destination if they conta... by aserafini on Sunday June 10, 2018 @07:35AM (#17277641)
But how do you know that the build you verified yourself is the one that is running on their server? It would be amazing to solve this problem - are there any solutions?
[ Parent | on HN ]
Re:Reddit DMs will not reach their destination if they conta... by megous on Sunday June 10, 2018 @07:44AM (#17277658)
End-to-end yousually means client to client. So all you need to verify is client code.
[ Parent | on HN ]
Re:Reddit DMs will not reach their destination if they conta... by Boulth on Sunday June 10, 2018 @08:30AM (#17277805)
Intel SGX, if you trust Intel. But the amount of code that runs on SGX is limited so usually you'd run only critical parts there.

A practical example: https://signal.org/blog/private-contact-discovery/

[ Parent | on HN ]
Re:Reddit DMs will not reach their destination if they conta... by spinsser on Monday June 11, 2018 @07:30AM (#17283396)
Wow! That is an interesting issue.

I was thinking of having a third-party trusted services that compares the hash of the deployed application to the one they independently compiled themselves.

But the complexity is nontrivial and there is enough variations between the output of the same source code across different build environments that would make hashes useless.

Another possibility is having trusted compilers that would send link the source code to the build in a trusted repository.

[ Parent | on HN ]
Re:Reddit DMs will not reach their destination if they conta... by cryptonector on Sunday June 10, 2018 @02:07AM (#17276834)
You also need an agreement from the recipient to keep it private.
[ Parent | on HN ]
Re:Reddit DMs will not reach their destination if they conta... by rando444 on Sunday June 10, 2018 @03:39PM (#17279823)
End-to-end encryption is for client-client communication.

When the sender and recipient are connected directly to the same system, there are no endpoints.

[ Parent | on HN ]