557
U.S. officials urge Americans to use encrypted apps amid unprecedented cyberattack
(www.nbcnews.com)
this post was submitted on 04 Dec 2024
557 points (99.5% liked)
Technology
59772 readers
3115 users here now
This is a most excellent place for technology news and articles.
Our Rules
- Follow the lemmy.world rules.
- Only tech related content.
- Be excellent to each another!
- Mod approved content bots can post up to 10 articles per day.
- Threads asking for personal tech support may be deleted.
- Politics threads may be removed.
- No memes allowed as posts, OK to post as comments.
- Only approved bots from the list below, to ask if your bot can be added please contact us.
- Check for duplicates before posting, duplicates may be removed
Approved Bots
founded 2 years ago
MODERATORS
you are viewing a single comment's thread
view the rest of the comments
view the rest of the comments
It's probably also good practice to assume that not all encrypted apps are created equal, too. Google's RCS messaging, for example, says "end-to-end encrypted", which sounds like it would be a direct and equal competitor to something like Signal. But Google regularly makes money off of your personal data. It does not behoove a company like Google to protect your data.
Start assuming every corporation is evil. At worst you lose some time getting educated on options.
Well yeah, to use RCS on Android, you need to use Google's Messenger app, so they can absolutely still get your data. Source from GrapheneOS.
I don't use RCS because I refuse to use Google's Messenger app. Simple as.
If its not Open Source and Audited yearly, its compromised. Your best option for secure comms is Signal and Matrix.
RCS is an industry standard, not a Google thing.
End to end is end to end. Its either "the devices sign the messages with keys that never leave the the device so no 3rd party can ever compromise them" or it's not.
Signal is a more trustworthy org, but google isn't going to fuck around with this service to make money. They make their money off you by keeping you in the google ecosystem and data harvesting elsewhere.
end to end is meaningless when the app scans your content and does whatever with it
For example, WhatsApp and their almost-mandatory “backup” feature.
Unless you’re Zoom and just blatantly lie lol
https://arstechnica.com/tech-policy/2021/08/zoom-to-pay-85m-for-lying-about-encryption-and-sending-data-to-facebook-and-google/
Note that it doesn't mean metadata is encrypted. They may not know what you sent, but they may very well know you message your mum twice a day and who your close friends are that you message often, that kinda stuff. There's a good bit you can do with metadata about messages combined with the data they gather through other services.
Signal doesn't harvest, use, sell meta data, Google may do that.
E2E encryption doesn't protect from that.
Signal is orders of magnitude more trustworthy than Google in that regard.
Agreed. That still doesnt mean google is not doing E2EE for its RCS service.
Im not arguing Google is trustworthy or better than Signal. I'm arguing that E2EE has a specific meaning that most people in this thread do not appear to understand.
Sure!
I was merely trying to raise awareness for the need to bring privacy protection to a level beyond E2EE, although E2EE is a very important and useful step.
There's also Session, a fork of Signal which claims that their decentralised protocol makes it impossible/very difficult for them to harvest metadata, even if they wanted to.Tho I personally can't vouch for how accurate their claims are.
Your honor, I would like to submit Exhibit A, Google Chrome “Enhanced Privacy”.
https://www.eff.org/deeplinks/2023/09/how-turn-googles-privacy-sandbox-ad-tracking-and-why-you-should
Google will absolutely fuck with anything that makes them money.
This. Distrust in corporations is healthy regardless of what they claim.
Dont trust. Verify. Definitely dont touch it if its closed source
End to end could still - especially with a company like Google - include data collection on the device. They could even "end to end" encrypt sending it to Google in the side channel. If you want to be generous, they would perform the aggregation in-device and don't track the content verbatim, but the point stands: e2e is no guarantee of privacy. You have to also trust that the app itself isn't recording metrics, and I absolutely do not trust Google to not do this.
They make so of their big money from profiling and ads. No way they're not going to collect analytics. Heck, if you use the stock keyboard, that's collecting analytics about the texts you're typing into Signal, much less Google's RCS.
It could be end to end encrypted and safe on the network, but if Google is in charge of the device, what's to say they're not reading the message after it's unencrypted? To be fair this would compromise signal or any other app on Android as well
End to end matters, who has the key; you or the provider. And Google could still read your messages before they are encrypted.
Yup, they can read anything you can, and send whatever part they want through Google Play services. I don't trust them, so I don't use Messenger or Play services on my GrapheneOS device.
You have the key, not the provider. They are explicit about this in the implementation.
They can only read the messages before encryption if they are backdooring all android phones in an act of global sabotage. Pretty high consequences for soke low stakes data.
I mean, Google does, with Play Services.
They do encrypt it and they likely dont send the messages unencrypted.
Likely what's happening is they're extracting keywords to determine what you're talking about (namely what products you might buy) on the device itself, and then uploading those categories (again, encrypted) up to their servers for storing and selling.
This doesn't invalidate their claim of e2ee and still lets them profit off of your data. If you want to avoid this, only install apps with open source clients.
E2EE means a 3rd party cant extract anything in the messages at all, by definition.
If they are doing the above, it's not E2EE, and they are liable for massive legal damages.
Thats not what it means. It means that a third party cannot decrypt it on their servers.
Of course if the "third party" is actually decrypting it on your device, then they can read the messages. I dont know why this is not clear to you.
You may be right for that particular instance, but I'd still argue caution is safer.
Of course our app is end-to-end encrypted! The ends being your device and our server, that is.
That's literally what zoom said early in the pandemic.
Then all the business in the world gave them truck loads of money, the industry called them out on it, and they hired teams of cryptographers to build an actual e2ee system
It’s end to end to end encrypted!
End-to-end encryption matters if your device isn't actively trying to sabotage your privacy.
If you run Android, Google is guilty of that.
If you run Windows in a non-enterprise environment Microsoft is guilty of that.
If you run iOS or MacOS, Apple is (very likely) guilty of that.
Yup, so I run GrapheneOS without Google at services. It probably doesn't spy on me, which is nice.