Re:WhatsApp – Security of End-to-End Encrypted Backups [pdf]
by godelski on Saturday September 11, 2021 @02:30AM
(#28489839)
Well if Facebook is encrypting I'm hoping Apple/Google can't decrypt on their datacenters. That would be really weird. Just with the key that I hold (aka my app account). I've always understood E2EE as an in transit thing or public/private key where it is encrypted till the other end. I definitely want my backups sitting at rest on some server where I have no ends and it is just a loop.
[ Parent
| on HN ]
Re:WhatsApp – Security of End-to-End Encrypted Backups [pdf]
by Thorrez on Sunday September 12, 2021 @03:39AM
(#28499305)
>Well if Facebook is encrypting I'm hoping Apple/Google can't decrypt on their datacenters.
I was referring to the prior backup scheme where Facebook wasn't encrypting. It could accurately be described as encrypted at rest I think, but yet Google and Apple could read the contents I think.
>no ends and it is just a loop.
The terminology is getting pretty confusing at this point. I usually think of the ends as the intended parties to look at the data. If there are no ends, then no one will look at the data, meaning the data is useless. Actually if there's no beginning end, there's no one to create the data, so thus the data doesn't even exist.
Re:WhatsApp – Security of End-to-End Encrypted Backups [pdf]
by blackoil on Saturday September 11, 2021 @02:55AM
(#28489927)
Next step is who owns the key, if it is FB that kills E2E story. If it is user, they'll forget/lose it, so it doesn't scale to 2B users. Currently Apple/Google are set as the custodians of the key.