Re:When Tech Says ‘No’
by johnbellone on Tuesday September 05, 2023 @09:11AM
(#37391139)
The point the parent was making is that if Apple decided tomorrow they wanted to implement a backdoor for law enforcement there's no way we'd know until the evidence starts to show up in court cases (or someone at Apple/LEO leaks the knowledge). The system is a closed loop and proprietary. We're taking their word for it.
Re:When Tech Says ‘No’
by didntcheck on Tuesday September 05, 2023 @09:15AM
(#37391192)
But nothing stops the clients lying and putting fake mundane plaintext in the government "copy"
Not the government's problem to solve, and tech firms can easily solve that by changing how their encryption works (e.g. using secure enclaves, or remote attestation).
That does not change anything, asymmetric or symmetric, the same principles apply. E2E means that only the recipients has the ability to decrypt the messages, so far we seem to agree. As I said, and you verified, for your scheme to work, then messages should be encrypted with a known government PK, but that is not privacy. Now the government has the ability to decrypt everything, and can store messages indefinitely and use it for whatever they decide now and in the future. That is a surveillance state by definition.
Remember that the encryption is being done client side by apps these networks control. E2E is therefore sort of fake to begin with because WhatsApp is not only the servers but also the client. You can't mix and match, so you have to encrypt messages using software provided to you by the "adversary". E2E encryption is therefore more of a tool to control bad insiders and negotiate with governments than encryption as conventionally understood.
Also remember that tech firms run the public key directory. Almost nobody verifies public keys, and even if they did, they're doing so with apps controlled by the tech firms so you can't know the verification is done properly anyway. And the keys can change at any moment, with your own way to know it's happened being UI controlled by the tech firms.
Still, even if clients and servers were separate, nothing stops clients from encrypting messages using a well known government public key and attaching that along with the e2e encrypted version.