Comment by microtonal | Hacker News Reader

Comment by microtonal | Hacker News Reader

Parent Full thread

I think one of the main issues is that end-to-end message encryption is a sham as long as backups are not encrypted. I could have good device security, but if the person I'm talking to does not use ADP, iMessage and WhatsApp messages get backed up with only at-rest encryption (I think Signal opts out of standard iOS backups) and possibly the same for backups of the iPhone notification database (which the article suggests as a possibility).

Similarly on Android, WhatsApp suggests unencrypted backups to Google Drive by default.

Putting on my tinfoil hat, I am pretty sure that Google/Apple/Meta have some deal (successor to PRISM) where end-to-end encrypted messaging is tolerated as long as they have defaults that make it possible to access chats anyway. Apple not enabling ADP by default and WhatsApp doing Google Drive backups that are not end-to-end encrypted is the implementation. Since most people just use the defaults, it undermines security of people who care.

It's a 'win-win', the tech companies can wash their hands in innocence, the agencies get access to data, and phone users believe that they are chatting in a secure/private manner.

"end-to-end message encryption is a sham as long as" -- I agree with that but would add even more caveats. If someone can't list those caveats off the top of their head they shouldn't be pretending they aren't able to communicate securely.

Just look at Salt Typhoon, every single person should be way more paranoid than they are, including government & agency officials. The attach surface and potential damage - financial and reputation - will only get worse with AI automation and impersonation, and that's for people who are doing nothing interesting and are law abiding citizens.

I mean the Hungarian minister of Foreign Affairs briefed Lavrov on internal EU matters and there are recordings of one or more calls. It seems that opsec is bad at pretty much every level.

We’re already forgetting when the Secretary of War invited a journalist to the secret SIGNAL group chat

Given the shoddy state of network security at large, especially on infrastructure projects (power plants, hospitals, dams, etc.) I always feel like major governments sit on so destructive potential to disrupt communications and anything connected to the Internet of its adversaries to have mutual assured destruction potential of a nuclear bomb.

No one’s crazy enough to push that button, because once you do there is no turning back.

I have often wondered about this exact situation. Like there are many instances of companies who depend on keeping their network secure and are actively taking preventative measures to keep their network safe that end up getting hacked. So surely there has to have been infiltration to some of the critical infrastructure keeping cities running. Why don't we hear more about it?

Only semi-conscientious companies will even KNOW they were compromised.

Suspect the rest are either not even looking and/or the attackers removed all their traces before anyone could possibly see.

When was the last time YOU inspected the authorization logs in systemd or the event log in Windows on your personal computer…

In Windows Defender we trust…

Signal data is not backed up, they have a local backup solution and an in-app e2e cloud backup for $2/month.

The backup is free for text and something like 60 days of media. You only have to pay to backup all media.

This is what I’ve always hated with Apple Time Machine, which I think MUST have been deliberate:

    - create an encrypted disk
    - install Mac OS on the encrypted disk
    - use Time Machine to back it up with encrypt turned on

All good so far. Ok, time to restore:

    - Restore from Time Machine
    - enjoy your PLAIN TEXT install :poo:

This isn't really an issue anymore. All M series Macs (and T2?) are always encrypted by default.

> the tech companies can wash their hands in innocence

Hostile defaults, not just in tech, is how Western liberal soft power often works. They can always claim "hey, you have the choice", but they know very well most people won't even know they have the choice, or is it so cumbersome or costly to move away from the hostile defaults - and stay that way - that in practice, the effect is the same as if you lived in a totalitarian regime. The difference is that you can keep believing in the deception of "freedom" in a Western liberal society; in a totalitarian regime, you are much more likely to know you've got a jackboot on your throat, because there is one.

What is needed isn't radical liberal atomistic individualism which rationalizes the antisocial war of all against all that rewards raw might. You won't find freedom there. You need a culture of respect of and sense of duty toward the authentic common good, backed by moral authority, where authority is power + justice.

Reply on news.ycombinator.com