News for hackers. Stuff that matters.

A comment on Zoom to bring end-to-end encryption to all users, including non-paying. Parent comment

Re:Zoom to bring end-to-end encryption to all users, includi... by just-ok on Wednesday June 17, 2020 @02:09PM (#23554647)
This could be the case for literally any E2EE service that controls key distribution (including WhatsApp, Signal, etc.), especially when there's no way to verify key fingerprints (here Signal differs because it does have a way, and it's open source so you can be more confident that it's not BSing you).

It's shocking to me how often this is glossed over when discussing E2EE services: you still must trust the platform.

[ Parent | on HN ]
Re:Zoom to bring end-to-end encryption to all users, includi... by vonquant on Wednesday June 17, 2020 @02:29PM (#23554909)
E2EE and open source: the two things people assume automatically makes things super-crazy-secure.

The implementation of E2EE must be robust and there must be somebody who is actually checking the source code (plus verifiable builds)

[ Parent | on HN ]
Re:Zoom to bring end-to-end encryption to all users, includi... by just-ok on Wednesday June 17, 2020 @03:04PM (#23555365)
Don't forget the human element: users still have actually do the verifying (e.g. checking public key fingerprints of recipients) that the source code enables!
[ Parent | on HN ]
Re:Zoom to bring end-to-end encryption to all users, includi... by antris on Wednesday June 17, 2020 @06:02PM (#23557311)
If you go down that road, you can make this argument infinitely. Even if you verify your builds, you cannot know if the software you are using to check the build isn't compromised. Or if you check the software you use to check the build, you have to check the software doing that check and so on.

Nothing makes software automatically super-crazy-secure. Absolute security doesn't exist.

[ Parent | on HN ]
Re:Zoom to bring end-to-end encryption to all users, includi... by okamiueru on Thursday June 18, 2020 @01:36AM (#23560088)
You'd get close by doing all you mentioned, but also compiling and hosting the code and infrastructure yourself. Not often this is feasible.
[ Parent | on HN ]
Re:Zoom to bring end-to-end encryption to all users, includi... by antris on Friday June 19, 2020 @07:55AM (#23573425)
You'd be still trusting the compiler. However many layers of checks you do, there's always something you need to trust.
[ Parent | on HN ]
Re:Zoom to bring end-to-end encryption to all users, includi... by dkersten on Wednesday June 17, 2020 @03:59PM (#23556013)
It doesn’t automatically make everything secure, but it’s still a prerequisite for a trusted secure thing.
[ Parent | on HN ]
Re:Zoom to bring end-to-end encryption to all users, includi... by g-b-r on Wednesday June 17, 2020 @06:40PM (#23557665)
and safe OS, computer, room...
[ Parent | on HN ]
Re:Zoom to bring end-to-end encryption to all users, includi... by g-b-r on Wednesday June 17, 2020 @05:11PM (#23556805)
"E2EE" is kinda antonymous with "key distribution" (unless, maybe, if you mean authentication keys)
[ Parent | on HN ]
Re:Zoom to bring end-to-end encryption to all users, includi... by just-ok on Wednesday June 17, 2020 @09:41PM (#23558894)
Well the crux of E2EE is authenticity, so yes. Key distribution is a fundamental problem of public-key cryptography: you can’t get my public, authentic identity key without trusting someone to not tamper with it along the way. We implicitly trust [Zoom|iMessage|Telegram|...] to do this.
[ Parent | on HN ]
Re:Zoom to bring end-to-end encryption to all users, includi... by nickik on Wednesday June 17, 2020 @06:22PM (#23557510)
You can check the finger print on WhatsApp
[ Parent | on HN ]
Re:Zoom to bring end-to-end encryption to all users, includi... by just-ok on Wednesday June 17, 2020 @09:45PM (#23558920)
You absolutely can, but this leads directly to vonquant’s point (and antris’ follow-up)[1]: without the source, how far do you trust Facebook to not just pull a UI trick? It’s paranoia all the way down ;)

[1]: https://news.ycombinator.com/item?id=23554909

[ Parent | on HN ]