News for hackers. Stuff that matters.

A comment on Google Is Testing End-to-End Encryption in Android Messages. Parent comment

Re:Google Is Testing End-to-End Encryption in Android Messages by est31 on Monday November 23, 2020 @04:50AM (#25185122)
These end to end encrypted systems are subverted through backups that devices put into the cloud in the clear. Officially they are "encrypted" in Android [0], but typically the key is extremely weak so it's easy to brute force. iCloud is officially "encrypted" as well but Apple holds the keys.

[0]: https://security.googleblog.com/2018/10/google-and-android-h...

[ Parent | on HN ]
Re:Google Is Testing End-to-End Encryption in Android Messages by dragonelite on Monday November 23, 2020 @05:29AM (#25185327)
Yeah whatsapp kept asking me do you want to backup your chat history so we can easily recover it. To the point it became so annoying i almost deleted whatsapp. I just assume there is no privacy on the internet. If i wanna keep a secret i will keep it in my mind.
[ Parent | on HN ]
Re:Google Is Testing End-to-End Encryption in Android Messages by sneak on Monday November 23, 2020 @07:05AM (#25185835)
I believe that that blog post indicates that Google uses custom HSMs to do the backup pin check to access the actual backup encryption key, ruling out the likelihood (but not possibility) that Google is able to casually decrypt the data.

Google writes and signs the firmware for the Titan HSMs in question, though. I would be surprised if it is actually 100% technically impossible for Google to decrypt backups.

[ Parent | on HN ]
Re:Google Is Testing End-to-End Encryption in Android Messages by est31 on Monday November 23, 2020 @07:18AM (#25185928)
Yeah the HSM idea is good, and it likely helps preventing malicious insiders from hacking user's backups, but I wouldn't trust it as it's not verifiable from the outside.
[ Parent | on HN ]
Re:Google Is Testing End-to-End Encryption in Android Messages by blackrock on Monday November 23, 2020 @08:37AM (#25186591)
The other problem, if you try your best to avoid backing your stuff up to the cloud, is that other people will back up their stuff to the cloud.

So, your messages with them, will get sucked up also, and forever saved on the cloud.

[ Parent | on HN ]
Re:Google Is Testing End-to-End Encryption in Android Messages by bergstromm466 on Monday November 23, 2020 @05:00AM (#25185167)
It’s scary how few people know and understand all this, and, proportional to the amount of tech we use in our daily lives, how little we learn to use and program our own technology.

I think we’ve got nothing to blame but the digital enclosure of knowledge through patents and copyrights. People aren’t ‘stupid’ at all, they’re disinherited and disempowered, starting at ‘school‘.

[ Parent | on HN ]