News for hackers. Stuff that matters.

A comment on Attorney General will ask Zuckerberg to halt plans for end-to-end encryption. Parent comment

Re:Attorney General will ask Zuckerberg to halt plans for en... by dheera on Thursday October 03, 2019 @02:48PM (#21150592)
> Facebook can read the messages at both ends

This is why I believe that end-to-end encryption is not truly useful unless the source code of the clients is public, or the protocol is open.

Any closed source client can read messages at the ends, or be forced to do so by an evil government.

At the very least, they could open up XMPP compatibility again so that people could write their own open source clients for it. Australia wouldn't be able to do anything about the propagation of such open source software.

I was able to have end-to-end encryption running on top of MSN, AOL, ICQ, QQ, Facebook, Gtalk, Yahoo, and several others about 10 years ago with Pidgin and simple plugins that encrypted/decrypted messages on the fly. It's too bad they all moved selfishly to closed source walled-garden mobile apps -- it's a big step back in privacy.

[ Parent | on HN ]
Re:Attorney General will ask Zuckerberg to halt plans for en... by greyfade on Thursday October 03, 2019 @05:08PM (#21152234)
I've been bouncing around the idea of a fully decentralized end-to-end encrypted chat protocol for exactly this reason, but I've been afraid to work on it for precisely the reason this thread is being discussed. I know that if my name were attached to the project, I'd be facing all kinds of unwelcome scrutiny from the government and news agencies. I'd lose the very privacy I want to maintain by designing privacy-protecting software.
[ Parent | on HN ]
Re:Attorney General will ask Zuckerberg to halt plans for en... by Unklejoe on Thursday October 03, 2019 @08:26PM (#21153722)
Check out Matrix. Sounds like what you’re describing.
[ Parent | on HN ]
Re:Attorney General will ask Zuckerberg to halt plans for en... by greyfade on Saturday October 05, 2019 @01:55AM (#21164043)
There's a lot I'm not explaining, in part because I don't (yet) understand crypto well enough to know if my idea even makes sense, let alone is feasible.

Matrix is close, but not what I'm describing. It's far more centralized than I'd like to see.

[ Parent | on HN ]
Re:Attorney General will ask Zuckerberg to halt plans for en... by questionasked on Thursday October 03, 2019 @07:39PM (#21153413)
What's the advantage of decentralisation? Is it really a problem to have centralised servers if they're just storing dumb encrypted blobs?
[ Parent | on HN ]
Re:Attorney General will ask Zuckerberg to halt plans for en... by dheera on Thursday October 03, 2019 @07:54PM (#21153513)
Governments can force the people who own the servers to stop.
[ Parent | on HN ]
Re:Attorney General will ask Zuckerberg to halt plans for en... by dualboot on Thursday October 03, 2019 @06:03PM (#21152735)
Signal is pretty solid.

https://signal.org/

[ Parent | on HN ]
Re:Attorney General will ask Zuckerberg to halt plans for en... by greyfade on Thursday October 03, 2019 @06:24PM (#21152909)
Maybe it is, but it's not the decentralized replacement for Discord and Teams that I envision.
[ Parent | on HN ]
Re:Attorney General will ask Zuckerberg to halt plans for en... by cyphar on Friday October 04, 2019 @04:51AM (#21155934)
I would take a look at Matrix[1], which is basically what you're describing (it's a federated replacement from group chats that has Signal-like E2EE and has an open protocol) and it's already implemented.

[1]: https://matrix.org/

[ Parent | on HN ]
Re:Attorney General will ask Zuckerberg to halt plans for en... by lxjm on Friday October 04, 2019 @07:24AM (#21156558)
XMPP with OTR is exactly this. Facebook messager used to be compatible with XMPP.
[ Parent | on HN ]
Re:Attorney General will ask Zuckerberg to halt plans for en... by greyfade on Saturday October 05, 2019 @01:53AM (#21164040)
Not exactly. I rather dislike XMPP's design, and what I'd like to see is something not only decentralized (relying at most on a DHT seed), but supporting group chats with trivially-expirable keys. My limited exposure to OTR suggests it only reliably supports one-on-one exchanges.
[ Parent | on HN ]
Re:Attorney General will ask Zuckerberg to halt plans for en... by kd3 on Friday October 04, 2019 @09:24AM (#21157383)
Open source doesn't guarantee that the compiled source running on your device is the same as what you can view on, for example, GitHub. That is also a trust problem.
[ Parent | on HN ]
Re:Attorney General will ask Zuckerberg to halt plans for en... by sjy on Friday October 04, 2019 @11:27AM (#21158588)
It is much easier to trust that `apt-get install pidgin` will run the published Pidgin source code, than it is to trust that Messenger or WhatsApp will only do the (undocumented) things that I expect them to do.
[ Parent | on HN ]
Re:Attorney General will ask Zuckerberg to halt plans for en... by nearbuy on Thursday October 03, 2019 @10:38PM (#21154353)
It should be easier to detect if they're reading it at the ends because they'd then have to retransmit the data to Facebook with a different key.
[ Parent | on HN ]
Re:Attorney General will ask Zuckerberg to halt plans for en... by lxjm on Friday October 04, 2019 @07:27AM (#21156571)
I tried to read data transmitted between the facebook messenger app (on iOS) and facebook server but it's encrypted and if you set up a mitm proxy it refuses to transmit. Even if you trust the mitm proxy certificate in the OS settings.
[ Parent | on HN ]
Re:Attorney General will ask Zuckerberg to halt plans for en... by lonelappde on Thursday October 03, 2019 @03:24PM (#21151004)
The only chance at security is if you can tap your network connection at the dumb wire layer, and verify that it's encrypted with your own private key.
[ Parent | on HN ]