You know it’s really frustrating? Acting like end to end encryption mean some thing when Apple and Google won’t give us root.
Literally everything about e2e encryption right now is a fantasy without low level access.
Literally everything about e2e encryption right now is a fantasy without low level access.
Is running Signal on an iPhone going to stop the Mossad from Mossading your chats if they want to? Probably not, but then neither will exclusively communicating using some fully open source cellphone with full root access that doesn't actually exist. The benefit of Signal on an iPhone is that people will actually use that and it will help against a lot of things that aren't the Mossad pulling out all the stops coming after you personally.
Honestly a lot of security discourse feels like calling airbags and seat belts useless because they won't help if you drive head on into a bullet train. Let's have a discussion about limitations and paths to improvement, absolutely. But ignoring "better" because it's not "perfect" is rarely a good strategy.
But "better" it is not. When the attacker controls the CA and your OS there is nothing "better".
Those days the Web Browser and the apps hapilly sending telemetry over the internet are the main entry point for an attacker. And yet we see statements like "if you use E2EE you are secure.
It is better against many attackers. Just not the ones you choose to consider.
There is no such thing as "if you do this you are secure", it depends on your threat model.
Just because you don’t know how to analyze an iOS application doesn’t mean it’s not possible.
I understand that some people want to fully control their smartphone. But lack of root isn’t something that prevents E2EE communication.
And if you don’t trust neither Google nor Apple, fine. You can still run Signal on Linux. (Or Matrix, OMEMO, etc.)
I'd assume Apple and Google would seriously consider relocating if they were so ordered, even if they ultimately decided not to; but let's say for the sake of argument that they decide they have to supply the unencrypted content of messages of apps they didn't write running on operating systems they did write.
If I was an engineer tasked with doing that, I would refuse, even if it meant leaving.
But if I wasn't that kind of person, I'd have the OS take screenshots whenever a certain app was in the foreground.
Under what law/statute?
If you can't or won't, your point crumbles to nothing.
And when it comes to dragnet surveillance, applications like Signal has raised the bar significantly.
I have an e2ee chat where everyone in it is a security researcher that exclusively accesses it from a dedicated QubesOS VM, and everyone has cross verified each others keys.
I have other e2ee chats where almost everyone but me is using iPhones, Android phones, windows, macos and no one verify keys, and thus I just operate as though anything said in those chat will be made public at any moment.
There is a difference between "security theater and marketing" and "threat model".
A random ISP in a random country does not necessarily have the power to take over control on your iPhone, so with e2ee they just can't read your messages. It's not completely useless, it just depends on the threat model.
And with all the zero-days being regularly found, even in open source software, you cannot be sure of that 100% of the time.
How long did Debian's OpenSSL patch/bug exist before it was noticed?
Root is kind of like the wooden sword in Zelda, it's where the journey begins.
Which dungeon is next is an open question but I'd propose something that installs packages by cryptographic hash so that whatever community we build for trusted packages can publish signed predicates referring to the trustworthiness of their referents without having to also host the packages themselves (given that servers which resolve names to packages become high-value targets and probably shouldn't be trusted). nix-on-droid seems like it could be modified to do this.
Truly no e2ee chat is safe if even one person accesses it from a smartphone with code the community cannot review, or is not actively reviewing.
Until we have 100% open code on endpoints with auditable hardware (like the Precursor) and have crowd sourced signed code reviews... we are vulnerable to any company, state actor, or teen that phishes the credentials to an NPM repo.
The state of software supply chain integrity today is about as good as hospital sanitation practices in the 1800s.
I agree that our software supply chains are in their infancy. Regrettably, so is our ability to use software to inflict harm (if you haven't played Cyberpunk 2077, it has a pretty good take on this--you spend a lot of time killing people by hacking into their implants). I hate to be gloomy, but I think that as the threats become more real, more deadly, the supply chain integrity piece will have to level up as well.
They often also sell your data to law enforcement.
With E2E, they cannot be legally compelled to do those things, and doing so voluntarily without disclosing it would likely be illegal.
So, E2E has legal benefits for the end user, in addition to some technical benefits.
What they have to hand over is scrambled nonsense, but they still have to hand it over.
An open and flexible boot loader would also be nifty. The ability to dynamically boot into any of several operating systems on the same phone could be useful for testing new OS versions without fear of bricking the device. This should make vendors less apprehensive about updating devices by removing the risk of bricking them. Get rid of internal storage and have a slot for an OS card with multiple boot partitions and a slot for multimedia. Add to this every phone OS must have a proper file manager and terminal shell by default.
Adding to this the lack of open source hardware and firmware is problematic for e2ee. I believe there is a lack of transparency around attestation and chain of custody in the entire build process and not just for the SoC but also the modular baseband modems.
I would personally like to see entirely modular, upgradable and serviceable phones similar to FairPhone but even more open and easier to swap parts. 6G deprecates 5G? No problem, pop out the 5G module and pop in the 6G in its external slot. Rijndael+E2EE found weak? Pop in the Twofish+Serpent+E2EE Custom encryption module. Or the AI-CoProcessor. Or the MIDI module. Or the Hack-RF module!
So, the parent is probably suggesting that without root access, and thus full control over the device, the promise of end-to-end encryption is somewhat of a "fantasy" because the user can't guarantee that the device itself isn't compromising the encryption in some way.
Google is marginally better, as AOSP exists, but once you deal with an actual Android phone, everything is locked down and Google services have total control.
e2ee only exists if you can verify their isn't a third end.
You might say well I am not on their list to target. That could change at any time if you speak up and start becoming a problem. They did it to Tucker Carlson.
"They" did what? Are you referring to the texts with other hosts that were exposed in the dominion lawsuit?
He's been repeatedly caught lying through his teeth and he's on record admitting that he lies if he's "cornered or something." but that he tries to never lie on TV, but of course that was before we got all that evidence of the lies he spewed for ages on TV too, so I guess he was "cornered" when he said that. The man lies for a living. You may want to adjust your understanding of "honest".
That the encryption on Signal has been cracked and/or the corporation has been compromised is a bold claim and I am going to need more than someones uncle on facebook saying it is true to believe it.
“When you eliminate the impossible, whatever remains, however improbable, must be the truth.”
You can read the message by looking at the screen, and Google can technically read it because they "own" the OS that prints it to the screen. Whether they do it or not is another question, but they can.